Abstract: Systems and methods for detecting a subscriber permanent identifier (SUPI) from a subscriber concealed identifier (SUCI) include steps of receiving the SUCI that is a representative of user equipment (UE) of interest and that is encrypted; checking association data with the received SUCI to determine a corresponding SUPI, wherein the association data includes a mapping of a plurality of SUCIs to a plurality of SUPIs and is maintained over time based on monitoring messages in a 5G core network; and providing the corresponding SUPI. The steps can further include updating the association data based on monitoring exchanges on both sides of an access and mobility management function (AMF) associated with the 5G core network.