Abstract: The invention concerns a method and system for determining a mobile network operator identifier in relation to a mobile device subscriber number and a telecommunications network event, the telecommunications network event comprising a call set-up initiated by a first mobile device having an associated first mobile device subscriber number to connect to a second mobile device having a second mobile device subscriber number, the call set-up comprising sending a request to a portability server, the portability server sending a response formatted according to a predetermined format depending on a type of cellular technology. The determination comprises analyzing the response and extracting an identifier of the mobile network operator associated to the second mobile device subscriber number, and storing, in a dedicated storing structure, an association between the mobile network operator identifier and the second mobile device subscriber number of the second mobile device.

Abstract: Systems and methods for call direction detection on Session Initiation Protocol (SIP) Internet Protocol (IP) Multimedia Subsystem (IMS) include monitoring SIP register messages, such as “401 UNAUTHORIZED” messages inside the IMS core to detect and log the IP addresses of the Proxy-Call Session Control Function (P-CSCF). The systems and methods include monitoring SIP registration messages; determining and storing addresses of P-CSCFs based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein; monitoring SIP INVITE messages; and, for a specific call associated with a SIP INVITE message, determining a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs.

Abstract: Systems and methods include obtaining monitored traffic from an S1 interface; detecting a Secondary Radio Access Technology (RAT) Data Usage Report (DUR) in the monitored traffic; determining whether the Secondary RAT DUR relates to a 5G Non-Standard Architecture (NSA), and, if so, determining an address of a gNodeB in the Secondary RAT DUR; and storing the address of the gNodeB in a database. The systems and methods can include, for a call, updating a Call Detail Record (CDR) to reflect one of 5G NSA and 4G based on whether an address in the CDR is in the database.

Abstract: Subscriber identity module (SIM) swap scam detection include receiving wireless network data based on passive monitoring of a wireless network; identifying a subscriber identity module, SIM, card change in user equipment, UE, based on changes in identifiers in the wireless network data; identifying a commercial user communication with the UE after the SIM card change; and detecting potentially fraudulent activity for the UE based on a combination of the SIM card change, the commercial user communication, and a time period therebetween. The steps can further include providing an alert of the potentially fraudulent activity identifying the commercial user communication as a possible SIM swap scam.

Abstract: Systems and methods include obtaining monitored traffic from an S1 interface; detecting a Secondary Radio Access Technology (RAT) Data Usage Report (DUR) in the monitored traffic; determining whether the Secondary RAT DUR relates to a 5G Non-Standard Architecture (NSA), and, if so, determining an address of a gNodeB in the Secondary RAT DUR; and storing the address of the gNodeB in a database. The systems and methods can include, for a call, updating a Call Detail Record (CDR) to reflect one of 5G NSA and 4G based on whether an address in the CDR is in the database.

Abstract: Systems and methods for call direction detection on Session Initiation Protocol (SIP) Internet Protocol (IP) Multimedia Subsystem (IMS) include monitoring SIP register messages, such as “401 UNAUTHORIZED” messages inside the IMS core to detect and log the IP addresses of the Proxy-Call Session Control Function (P-CSCF). The systems and methods include monitoring SIP registration messages; determining and storing addresses of P-CSCFs based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein; monitoring SIP INVITE messages; and, for a specific call associated with a SIP INVITE message, determining a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs.