Abstract: A method for providing call intelligence to a signaling firewall in a communications network includes collecting, by a network security service component, call session data from incoming and outgoing calls involving a mobile device and providing, by the network security service component, the call session data to a signaling firewall via an application programming interface (API). The method further includes receiving, by the signaling firewall, an update location request message associated with the mobile device, extracting signaling message information that includes current location data and timestamp data from the received update location request message, and utilizing the current location data and the timestamp data to identify a correlated portion of the call session data.

Abstract: A method for historical 5G user equipment (UE) mobility tracking and security screening includes receiving, at a network data aggregation node including at least one processor, UE registration data from 5G network functions (NFs) as UEs connect to different network locations. The method further includes aggregating, at the network node, registration data for individual UEs from the 5G NFs to produce mobility patterns for the UEs. The method further includes receiving, at the network node and from a 5G NF located in a home network of a UE, a request for a mobility pattern of the UE in response to receiving a message for effecting a new registration for the UE. The method further includes responding to the request by transmitting the mobility pattern to the 5G NF located in the home network of the UE.

Abstract: A method for providing call intelligence to a signaling firewall in a communications network includes collecting, by a network security service component, call session data from incoming and outgoing calls involving a mobile device and providing, by the network security service component, the call session data to a signaling firewall via an application programming interface (API). The method further includes receiving, by the signaling firewall, an update location request message associated with the mobile device, extracting signaling message information that includes current location data and timestamp data from the received update location request message, and utilizing the current location data and the timestamp data to identify a correlated portion of the call session data.

Abstract: A method for historical 5G user equipment (UE) mobility tracking and security screening includes receiving, at a network data aggregation node including at least one processor, UE registration data from 5G network functions (NFs) as UEs connect to different network locations. The method further includes aggregating, at the network node, registration data for individual UEs from the 5G NFs to produce mobility patterns for the UEs. The method further includes receiving, at the network node and from a 5G NF located in a home network of a UE, a request for a mobility pattern of the UE in response to receiving a message for effecting a new registration for the UE. The method further includes responding to the request by transmitting the mobility pattern to the 5G NF located in the home network of the UE.

Abstract: A method for validating UE location includes receiving, at a network gateway, a signaling message for updating a location of a UE with a mobile communications network. A first indication of user equipment location is extracted from the signaling message. One of: a cloud-based UE location database containing UE location information obtained from a UE location reporting application resident on the UE, a cloud-based loyalty card transaction database containing loyalty card transaction records indexed by UE identifiers, and a mobile location center (MLC) that obtains UE location information by requesting or receiving the UE location information from a mobility management entity (MME) is queried to obtain a second indication of location of the UE. It is determined from a relationship between the first and second indications of location of the UE that the signaling message is suspicious.

Abstract: A method for validating UE location includes receiving, at a network gateway, a signaling message for updating a location of a UE with a mobile communications network. A first indication of user equipment location is extracted from the signaling message. One of: a cloud-based UE location database containing UE location information obtained from a UE location reporting application resident on the UE, a cloud-based loyalty card transaction database containing loyalty card transaction records indexed by UE identifiers, and a mobile location center (MLC) that obtains UE location information by requesting or receiving the UE location information from a mobility management entity (MME) is queried to obtain a second indication of location of the UE. It is determined from a relationship between the first and second indications of location of the UE that the signaling message is suspicious.

Abstract: A method for validating UE location includes receiving, at a network gateway, a signaling message for updating a location of a UE with a mobile communications network. A first indication of user equipment location is extracted from the signaling message. One of: a cloud-based UE location database containing UE location information obtained from a UE location reporting application resident on the UE, a cloud-based loyalty card transaction database containing loyalty card transaction records indexed by UE identifiers, and a mobile location center (MLC) that obtains UE location information by requesting or receiving the UE location information from a mobility management entity (MME) is queried to obtain a second indication of location of the UE. It is determined from a relationship between the first and second indications of location of the UE that the signaling message is suspicious.

Abstract: Methods, systems, and computer readable media for nuisance call management. In one example, a method includes receiving, at a telecommunications signaling computer system for routing telecommunications signaling messages in a core network of a telecommunications signaling network, a message from a subscriber's user equipment (UE) indicating that the subscriber has flagged a first call as a nuisance call. The method includes storing, in a subscriber-level nuisance call database, an association between a calling party identifier for the calling party and a subscriber identifier for the subscriber. The method includes, in response to a second call from the calling party to the subscriber, blocking, at the telecommunications signaling computer system, the second call using the association between the calling party identifier and the subscriber identifier in the subscriber-level nuisance call database.

Abstract: Methods, systems, and computer readable media for nuisance call management. In one example, a method includes receiving, at a telecommunications signaling computer system for routing telecommunications signaling messages in a core network of a telecommunications signaling network, a message from a subscriber's user equipment (UE) indicating that the subscriber has flagged a first call as a nuisance call. The method includes storing, in a subscriber-level nuisance call database, an association between a calling party identifier for the calling party and a subscriber identifier for the subscriber. The method includes, in response to a second call from the calling party to the subscriber, blocking, at the telecommunications signaling computer system, the second call using the association between the calling party identifier and the subscriber identifier in the subscriber-level nuisance call database.

Abstract: The subject matter described herein includes methods, systems, and computer readable media for providing a Diameter traffic estimator. According to one exemplary system, a user interface is configured to receive user input regarding a number of subscribers and subscriber network activity types. A Diameter traffic estimator is configured to estimate an indication of Diameter traffic volume based on the number of subscribers and the subscriber network activity type.

Abstract: Methods, systems, and computer readable media for providing targeted services to telecommunications network subscribers based on information extracted from network signaling and data traffic are disclosed. According to one aspect, the subject matter described herein includes a method for providing targeted services to telecommunications network subscribers based on information extracted from network signaling and data traffic. The method includes collecting subscriber and network related information from nodes in a telecommunications network, storing the subscriber and network related information in a repository for storing and maintaining that data, analyzing the information stored in the repository to determine subscriber interests, behaviors, and/or preferences, creating policy rules based on determined subscriber interests, behaviors, and/or preferences, and implementing the created policy rules in response to network events.

Abstract: Methods, systems, and computer readable media for determining policy information associated with an emergency call are disclosed. According to one method, the method occurs at a policy and charging rules function (PCRF) separate from an emergency services routing proxy (ESRP). The method includes receiving, from the ESRP, a request for one or more policy rules regarding an emergency call, wherein the request includes an intended destination of the emergency call and determining, using the intended destination, one or more policy rules.

Abstract: Methods, systems, and computer readable media for determining policy information associated with an emergency call are disclosed. According to one method, the method occurs at a policy and charging rules function (PCRF) separate from an emergency services routing proxy (ESRP). The method includes receiving, from the ESRP, a request for one or more policy rules regarding an emergency call, wherein the request includes an intended destination of the emergency call and determining, using the intended destination, one or more policy rules.

Abstract: Methods, systems, and computer readable media for providing targeted services to telecommunications network subscribers based on information extracted from network signaling and data traffic are disclosed. According to one aspect, the subject matter described herein includes a method for providing targeted services to telecommunications network subscribers based on information extracted from network signaling and data traffic. The method includes collecting subscriber and network related information from nodes in a telecommunications network, storing the subscriber and network related information in a repository for storing and maintaining that data, analyzing the information stored in the repository to determine subscriber interests, behaviors, and/or preferences, creating policy rules based on determined subscriber interests, behaviors, and/or preferences, and implementing the created policy rules in response to network events.

Abstract: The subject matter described herein includes methods, systems, and computer readable media for providing a Diameter traffic estimator. According to one exemplary system, a user interface is configured to receive user input regarding a number of subscribers and subscriber network activity types. A Diameter traffic estimator is configured to estimate an indication of Diameter traffic volume based on the number of subscribers and the subscriber network activity type.

Abstract: Methods, systems, and computer program products for surveillance of messaging service messages in a communications network are disclosed. According to one aspect, a system is provided for intercepting a messaging service message in a communications network. The system can include a communication module for receiving and sending messaging service messages from a communications network. Further, the system can include a subscriber surveillance database for maintaining a listing of subscribers that have been placed under surveillance. The system can also include a surveillance function for receiving a messaging service message, extracting a subscriber identifier from the messaging service message, performing a lookup in the surveillance database using the subscriber identifier, and performing a surveillance action in response to locating a matching entry in the database.

Abstract: Methods, systems, and computer program products for automatically populating a signaling-based access control database based on output from a fraud detection application are disclosed. According to one method, a fraud detection application detects fraud based on call information received from monitoring points in a network. The fraud detection application produces output for identifying a calling party making a fraudulent call. The output is used to automatically populate a signaling-based access control database. A signaling-based access control application screens call signaling messages and performs a screening action, such as rerouting a call, using the information received from the fraud detection application.

Abstract: Methods and systems for detecting intrusion events, such as war dialing events are disclosed. According to one method, signaling messages associated with calls being made or attempted in a telecommunications network are analyzed. Based on the signaling messages, it is determined whether a war dialing event has occurred or is in progress. In response to determining that a war dialing event has occurred or is in progress, a war dialing event mitigating action is performed.