Oracle Corporation
Methods, systems, and computer readable media for conducting a time distance security countermeasure for outbound roaming subscribers using diameter edge agent

Abstract:

A method includes receiving an ingress Diameter message related to a mobile subscriber from a MME located in a non-home network, sending a RIR message containing a mobile subscriber identifier to a HSS in a home network of the mobile subscriber, receiving identification information identifying a MME in the home network that conducted a most recent attachment of the mobile subscriber, utilizing the identification information to send an IDR message containing the mobile subscriber identifier to the identified MME, receiving an IDA message containing attachment timestamp data corresponding to the most recent attachment of the mobile subscriber in the home network, determining a transit time using the UE attachment timestamp data and timestamp information corresponding to the ingress Diameter message, and analyzing the transit time to determine if the ingress Diameter message is to be designated as a suspicious ingress message.