Patent ID: 11882158
Assignee: AT&T INTELLECTUAL PROPERTY I, L.P.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 13:
14. A non-transitory, machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising:
receiving, over a communication network an authentication request from a user device for performing a function utilizing a first authentication method, wherein the authentication request identifies the function and the first authentication method;
obtaining network intelligence data, the network intelligence data including: historical data of other network devices accessing services via a wide-area network of the communication network, an identification of events occurring in a mobile communication network of the communication network, time of day data associated with a plurality of user devices accessing the services, and trending data associated with the plurality of user devices accessing the services on the mobile communication network;
analyzing a security behavior of the processing system;
identifying a risk level each of a plurality of authentication methods resulting in a plurality of risk levels using a machine learning application, wherein the first authentication method is one of the plurality of authentication methods;
identifying a first risk level that is associated with the first authentication method and identifying a second risk level that is associated with the function, based on the security behavior of the processing system and the network intelligence data, wherein the identifying of the first risk level is based on an analysis of network element security behaviors for the other network devices, the network element security behaviors being identified based on user plane messages and control plane messages in the mobile communication network that indicate a security breach;
identifying a second authentication method from the plurality of authentication methods that is associated with the second risk level;
identifying a risk threshold; and
determining the first risk level associated with the first authentication method is above the risk threshold and the second risk level associated with the function is below the risk threshold and in response thereto:
determining an amount of risk between the first risk level and the risk threshold;
terminating an access point device associated with a first service based on the amount of risk;
notifying the user device of the second risk level for the function; and
providing a recommendation to the user device to utilize the second authentication method to perform the function.