Diameter edge agent attack detection

In accordance with the example embodiments of the Invention there is at least a method and apparatus to detect that at least one message received from another network device of a communication network is in response to a prior message using a spoofed source address; based on the detecting, mirror the at least one message; and send to the another network device the mirrored at least one message to cause the another network device to filter out the at least one message in response to the prior message using the spoofed address. Further, there is at least a method and apparatus to receive from a network node signaling associated with at least one message; based on the signaling, detect that the at least one message is in response to a prior message using a spoofed source address; and based on the detecting, filter out the at least one message in response to the prior message using the spoofed source address.

TECHNICAL FIELD

The teachings in accordance with the example embodiments of this invention relate generally to deflecting attacks coming over the Interconnection between operator networks and, more specifically, relate to deflecting attacks coming over the Interconnection between operator networks such as GRX/IPX or SS7 based networks.

BACKGROUND

Certain abbreviations that may be found in the description and/or in the Figures are herewith defined as follows:3GPP 3rdGeneration Partnership ProjectACK AcknowledgementAVP Attribute Value PairBGP Border Gateway ProtocolDEA Diameter Edge AgentDRA Diameter Routing AgentDPA Diameter Proxy AgentDoS Denial of Service AttackGPRS general packet radio serviceGRX GPRS Roaming ExchangeGSM Global System for Mobile CommunicationGSMA GSM AssociationGT Global TitleHLR Home Location RegisterHSS Home Subscriber ServerIP Internet protocolIMSI International Mobile Subscriber IdentityIPX Interconnectivity Provider ExchangeISD Insert Subscriber Data MessageIDR Insert Subscriber Data RequestMAP Mobile Application PartMME Mobility Management EntityMSC Mobile Switching CentreRIFS Roaming and Interconnect Fraud and SecurityPCRF Policy and Charging Rules FunctionPRN Provide Roaming NumberSS7 signaling system 7STP Signal Transfer PointTCAP Transaction Capabilities Application PartUL uplinkVLR Visitor Location Register

Typical attacks are those that modify user profile for fraud or those are causing a Denial of Service against a network node or a user. Those attacks have been observed in the wild e.g. by well-known tier1network operators diameter purge/reset command usage/faulty load balancing messages etc.

Due to the large amount of attacks (e.g. for one command a large Asian tier1operator got more than 9 million attacks in 3 month). Operators evaluate legal and technical approaches to identify and punish misbehaving interconnection partners. Those misbehaving partners cause large scale load (and potential outage of no des), loss and leak of subscriber data (e.g. cryptographic keys, location), fraud and service unavailability for users. There is the major stumbling block in those discussion is that the attack message might misuse the identity of a well behaving partner and that partner is blamed (and wrongly punished).

There is a need a solution for this problem at least for the reason that if this problem is not solved then there can be no interconnection without at least operator liabilities. One can not introduce any punishments or liabilities, if one cannot be reasonable sure, to punish accidentally the wrong party. On the other hand, if there are no consequences to misusing the interconnection, then why should attackers or misbehaving operators stop their activities.

SUMMARY

In an example aspect of the invention, there is a method comprising: detecting, by a network node, that at least one message received from another network device of a communication network is in response to a prior message using a spoofed source address; based on the detecting, mirroring the at least one message; and sending to the another network device the mirrored at least one message to cause the another network device to filter out the at least one message in response to the prior message using the spoofed address.

In an example aspect of the invention, there is an apparatus comprising: at least one processor; and at least one memory including computer program code, where the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to at least: detect that at least one message received from another network device of a communication network is in response to a prior message using a spoofed source address; based on the detecting, mirror the at least one message; and send to the another network device the mirrored at least one message to cause the another network device to filter out the at least one message in response to the prior message using the spoofed address.

In another example aspect of the invention, there is a method comprising: receiving, by a network device of a communication network, from a network node signaling associated with at least one message; based on the signaling, detecting that the at least one message is in response to a prior message using a spoofed source address; and based on the detecting, filtering out the at least one message in response to the prior message using the spoofed source address.

In still another example aspect of the invention, there an apparatus comprising at least one processor; and at least one memory including computer program code, where the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to at least: receive from a network node signaling associated with at least one message; based on the signaling, detect that the at least one message is in response to a prior message using a spoofed source address; and based on the detecting, filter out the at least one message in response to the prior message using the spoofed source address.

DETAILED DESCRIPTION

In this invention, we propose at least a method and apparatus to deflect attacks coming over the Interconnection between operator networks.

The example embodiments of the invention work to deflect attacks coming over the Interconnection between operator networks i.e. GRX/IPX or SS7. The example embodiments described are focused on LTE and 5G interconnect scenarios, but this is none limiting to those and also apply to 4G, 3G and 2G. The same security solution in accordance with the example embodiments could also be applied to legacy approaches like SS7 and is compatible with such.

The example embodiments of the invention work to deflect attacks coming over an interconnection between operator networks, such as when:The Attacker uses the identity of a partner operator and performs an attack that does not require an answer to be routed correctly (e.g. interconnect fraud that modifies a subscriber accounts, DoS attacks);The attacked operator complains then to his partner operator, but that partner operator is not aware of anything, since he has not send any message;The partner operator may then only find some strange “ack” messages, where he did not send the requests. This kind of messages are usually considered configuration error by some other network and discarded silently.

The example embodiments of the invention provide a mechanism and protocol usage, how the partner operator can automatically inform the attacked operator, that an attack is ongoing and thereby by raising awareness indicating that he is not the REAL source of the attack messages. The operations in accordance with the example embodiments also describe how to filter and process messages so as to allow fast attack detection and mitigation of financial damage or preventing a DoS against the user and also DoS against network nodes. In addition, we describe how the mechanism work, when you have intermediate parties (interconnectivity providers) are part of the transport path.

Before describing the exemplary embodiments of the invention in further detail reference is now made toFIG. 1. As illustrated inFIG. 1, the Edge Node24includes its own processing means such as at least one data processor (DP)24A, storing means such as at least one computer-readable memory (MEM)24B storing at least one computer program (PROG)24C, and communicating means such as a transmitter TX24D and a receiver RX24E for bidirectional wireless communications with devices Internal Node20, and/or Operator Node21or any other network device via its antenna24F. The Edge Node24stores in its MEM24B processing code for use by the Message Processor block24G to perform a method enabling deflecting attacks, such as attacks coming over the Interconnection between the operator networks of Internal node20and the Operator Node21. Edge nodes are typically STP, DEA, DRA or DPA. But it might also be that some core network nodes are directly connected to the interconnection network.

The Operator Node21similarly includes processing means such as at least one data processor (DP)21A, storing means such as at least one computer-readable memory (MEM)21B storing at least one computer program (PROG)21C, and communicating means such as a transmitter TX21D and a receiver RX21E for bidirectional wireless communications with the Edge Node24and Internal Node20ofFIG. 1as well as the other apparatus or other network device via one or more antennas21F. The Operator Node21stores in its local MEM21B and/or its Message Processor block21G, computer program code for signal processing. Such signal processing, for example, to perform as described herein attack detection and potential reaction operations based on data packets it receives, and to utilise such processing for detecting and stopping such carrier communications attacks.

The Internal Node20includes processing means such as at least one data processor (DP)20A, storing means such as at least one computer-readable memory (MEM)20B storing at least one computer program (PROG)20C, and also communicating means such as a transmitter TX20D and a receiver RX20E for bidirectional wireless communications with the Edge Node24and the Operator Node21, or any other communication device, via one or more antennas20F. The RX20E and the TX20D are each shown as being embodied in a radio-frequency front end chip, which is one non-limiting embodiment. The Internal Node20also has stored in the MEM20B at Message Processor block20G computer program code to perform some example operations for attack detection and elimination as discussed herein.

In addition, for example purposes there is shown a cloud200inFIG. 1which an Attacker10may use to launch attack commands22against network elements, such as the Internal Node20, the Edge Node24, and/or the Operator Node21as shown inFIG. 1, or their networks. It is noted that the cloud200can include other nodes, such as nodes of other network operators or even a same network operator as is experiencing an attack. Further, it is noted that the source of the attack may be from any location, outside or inside any network which may or may not be subject to the attack. Attacks can be launched from any node that is connected to the interconnection network. An attack can be launched via a compromised node that has access to the interconnection network. In addition, it is noted that the attack could be over communication path that are connecting networks or interconnection providers including a undersea cable connection, a wired land-line connection, or both e.g. through BGP routing attacks. It is noted that a node that the attacker may launch an attack from can be located in any type of electronic device with communication capability. Such a node can be, but is not limited to, a cellular phone, a computer (e.g., laptop, desktop computer, or server), and/or a personal data assistant to mention only a few. In addition, it is noted that the dashed arrows indicating Attack command(s)22can be using any type of wired and/or hardwired connection.

In accordance with some embodiments of the invention, there can be information communications over connections as indicated by arrows25and26, which may be used by the Edge Node24, Internal Node20, and/or Operator Node21, to perform the message processing operations in accordance with some embodiments. Further, this information can include signaling, message and communication checks as in accordance with the example embodiments of the invention. It is noted that arrows25and26are non-limiting representations of connectivity between the Internal Node20, the Operator Node21, and/or the Edge Node24. In accordance with the example embodiments these connections such as indicated by arrows25and26can include any type of hardwired, wireless, satellite, and/or electronic circuitry connections (e.g., circuitry connections internal and/or external to these devices). Further, although the Internal Node20, Operator Node21, and/or Edge Node24are shown as separate entities, any of these devices may be in the same network or be in different networks.

Further, in some embodiments of the invention, each of the steps as disclosed herein, including the interconnection attack detection and elimination, may be based on information detected and/or shared by the Internal Node20, Operator Node21, and/or Edge Node24or information received via the antenna20F,21F, and/or24F as well as associated receivers RX20E,21E, and24E. Such information from any one or more of the Internal Node20, Operator Node21, and/or the Edge Node24can be processed and implemented by at least one of the PROGs20C,21C, and/or24C in the respective device Internal Node20, Operator Node21, and/or Edge Node24. Each of the PROGs20C,21C, and/or24C is assumed to include program instructions that, when executed by the associated DP20A,21A, and/or24A enable the device to operate in accordance with some embodiments of this invention to perform the operations as detailed herein. Message Processor blocks20G,21G, and24G may summarize different results from executing different tangibly stored software to implement certain aspects of these teachings. In these regards some embodiments of this invention may be implemented at least in part by computer software stored on the MEM20B,21B, and/or24B which is respectively executable by DP20A,21A, and/or24A, or by hardware, or by a combination of tangibly stored software and hardware (and tangibly stored firmware). In a typical embodiment, the countering software would be installed in the edge node. But some operators may want to install this mechanism also in core network e.g. HSS, HLR, MME directly, if they have them connected directly to the interconnection network, or if they want to detect potential security breaches inside their own network.

In addition, although the dashed lines20DL,21DL, and24DL ofFIG. 1indicate that the message parts of the Internal Node20, Operator Node21, and/or Edge Node24, these components and their operations may be separate from at least a processor and/or memory of the Edge Node24, Internal Node20, and/or Operator Node21ofFIG. 1. Each of the RX24E, TX24D, and antenna24F; the RX20E, TX20D and antenna20F; the RX21E, TX21D and antenna21F of the Edge Node24, Internal Node20, and/or Operator Node2, respectively, are not essential to the operations in accordance with some embodiments of the invention. In accordance with non-limiting embodiments of the invention the Edge Node24, Internal Node20, and/or Operator Node21may be connected to other nodes which provide the actual user services and external radio parts for sending or receiving signaling via circuitry such as integrated circuitry.

Electronic nodes implementing some aspects of the invention need not be the entire nodes as depicted atFIG. 1, but some embodiments may be implemented by one or more components of same such as the above described tangibly stored software, hardware, firmware and data processors e.g. part of the functionality can be implemented in an edge node and part in another core network node e.g. HSS.

FIG. 2shows a direct attack scenario which may be stopped by the operations in accordance with the example embodiments. As shown inFIG. 2there is a Network wherein an Operator1is located. As shown inFIG. 2there is an Attacker10, an Operator21and an Internal Node20. As shown inFIG. 2the Internal Node20is connected to an Operator Node21via an Edge Node24.

A first non-limiting direct attack scenario, in which the example embodiments can work to an advantage, includes:1. An attacker has access to the interconnect network (roaming interconnect) and sends an attack command to the operator1(attacked operator, lower cloud in the figure below) that does not require an answer to work e.g. Diameter purge message (DoS against user), diameter UL (DoS against user), diameter ISD (fraud, DoS against user, eavesdropping), MAP deleteSubscriber (DoS against user), reset message (DoS network), PRN (DoS network). The attacker can spoof his sender identity by using the identity e.g. origin-realm of an partner operator2(for SIGTRAN that is IP address spoofing, for SS7 the Global Title). Those identities and needed information an attacker can be found via press releases on roaming agreement and IP address scan for static IP addresses, documents on IR.21roaming that are accidentally on the internet. The identity can be: IP address, realm identity, host identity, Global Title (depending on underlying protocol) or a combination of thereof;2. The edge node of the operator1(attacked operator) that receives the message is under the impression that the message is coming from a partner because the identity in the message indicates that the source of the message is a partner e.g. the origin-realm AVP used in the message is that of the partner, and the operators don't use a reliable source authentication on their interconnections (e.g. IPSec). Therefore the edge node or the attacked operator1forwards the message to the internal node e.g. MME, HSS, SGSN, PCRF. It is assumed that by posing as a partner the attacker can bypass realm check etc of the edge node. Edge Node24includes are DEA, DRA, DPA or STP, but in principle it can already be an HLR, HSS, MSC, VLR or MME (security wise it is not recommended to plug core network nodes directly to the interconnection networks, but some operators plug their core network nodes directly into the interconnection for performance reason or because of their international network set-up where they share network nodes for several networks of theirs);3. The internal node e.g. MME, HSS or whichever was targeted responds to the request as required (e.g. deletes subscriber info) and confirms the message (ACK acknowledgement message) as required by the 3GPP specifications; and4. The confirmation message is then going to the partner operator2(due to the spoofed sender identity in step 1). The partner then gets a strange message where he did not send any request for. Usually this message would be silently discarded and considered misconfiguration of partner networks. There is where this invention intends to provide a substantial change and improvement.

Operators exchange e.g. in GSMA RIFS group information on how attacks are performed and how to counter those. The above mentioned example, is a quite typical attack scenario as it allows an attacker to shift the “blame” to another operator. The other partner operator would be then suspected, but this partner then did not have any idea what was going on (of course they did not send any messages and only got “ack” messages which was discarded). By the current approach it takes quite a while to discover the fraud for the first operator. The example embodiments of the invention target and detect this kind of fraud or attack very fast without breaking the interconnect system. The detection approach introduced in this document can be added easily to the existing global system in a gradual manner and does not require large investments or infrastructure.

In accordance with an example embodiment of the invention the processing steps for a solution in accordance with the example embodiments can include the partner node at Operator2that receives the ack or confirmation message then performs the following steps:1. Check if there was an outgoing message relating to that ack message (e.g. searching by correlation id, TCAP identifier, IMSI, ICC_ID, MSISDN, sending identity, and/or other identifier);2. If no outgoing message was found, then the partner operator takes the Acknowledgement message and sends it back to the operator1edge node. But the following changes are applied (which allow the attacked operator to identify that he has been attacked):The sending identity (e.g. GT/realm) address in the upper layers (e.g., not lower layer identity, for example IP address, TCAP ID) would be the operator1(the attacked operator)The receiving identity address in the upper layer would be the operator2(the innocent partner operator that just got the ack message);3. The receiving node at operator1(the attacked operator) would now see a message, where the IP realm and the sending identity would not match and it would look like the message was coming from themselves. So he immediately knows, that something is strange. The edge node filtering rules in a firewall or filtering software can be tuned to detect this kind of “mismatch” and raise an alarm. Today, the configuration is that those messages are discarded. If a layer matching software is deployed it would need to be extended (e.g. SS7 firewall product, DEA filtering engine) to recognize, that this “mirror message” needs to be flagged and not just discarded. This approach allows to identify already the first attack message, while the current system today requires manual interaction (e-mail, calling etc) to identify what is going on, which often gives attackers the opportunity to get away with their attack. The message that are received by operator1are then analysed further for at least one or more of the following:a. Who sends it (upper layer identity gives real sender i.e. operator2).b. What message is inside (ack)c. What is the corresponding message that was there before (attackers messages are found) in operator1own edge node e.g. DEA node. And potentially the routing records or other information is retrieved, analysed and stored for potential prosecution.d. System discovers an ongoing attack and can stop the attack (e.g. blacklisting IMSI or blacklisting IPs deducted from routing tables).

Further, in accordance with the example embodiments of the invention there may be variants which may be applied. The possible Variants include:1. Delay for some actions, and only release of command after a safety period is applied (and no such message as above was received);2. Caching of data for some command and reinstall, after this kind of message above is received;3. The receiving operator would NOT send or mirror this message back again to avoid race conditions (ping-pong of error messages); and/or4. The message may have an additional field that confirms the integrity of the message and is signed by the partner operator or an interconnection provider (see below).

FIG. 3illustrates an indirect interconnection scenario and solution in accordance with the example embodiments for another attack scenario. In this scenario the incoming attack message was sent via an interconnection provider. As shown inFIG. 3there is there is an Operator1network wherein the Internal Node20is located, and which is communicating with the Partner Node210of an Operator21network. The Internal Node20is connected to the Partner Node21via the Edge Node24and IPX providers30. In addition, shown inFIG. 3is the Attacker10which is connected via the IPX providers30(IPX30). Even ifFIG. 3only illustrates one interconnection provider and routers (e.g. DRA), there might be several involved in the message communication.

As shown inFIG. 3the attack steps may include:1. The Attacker10poses as a partner and send messages to the operator1via the IPX30;2. & 3. The messages are forwarded to the Internal Node20via the Edge Node24, where the messages would be processed in accordance with the example embodiments. It is noted that the Edge Node24can include any of an edge node DEA and/or STP; and the Internal Node can include an MME, HSS, and/or HLR or other core network node;4. At this step the Internal Node20or the Edge Node24of the Operator1processes the messages, and an ack or confirmation to the messages is sent to the Partner Node210. As similarly stated above the confirmation message are then going to the Partner Node210due to the spoofed partner identity in step 1.

In accordance with an example embodiment of the invention the processing steps for a solution in accordance with the example embodiments include that the partner node at operator2that receives the Ack message then performs the following steps:1. Check if there was an outgoing message relating to that ack message (e.g. searching by correlation id, TCAP identifier, IMSI, ICC_ID, MSISDN, sending identity, and/or other identifier);2. If no outgoing message was found, then the partner operator takes the Acknowledgement message and sends it back to the operator1edge node. But the following changes are applied:The sending identity (e.g. GT/realm) address in the upper layers (e.g., not lower layer identity, for example IP address, TCAP ID) would be the operator1(for the case this is replaced by the IPX, there might be several sending identities inserted and only the first will be replaced); andThe receiving identity address in the upper layer would be the operator2;3. The receiving node at operator1would now see a message, where the IP realm and the sending identity would not match and it would look like the message was coming from themselves. Today, the configuration is that those messages are discarded. If a layer matching software is deployed it would need to be extended (e.g. SS7 firewall product, DEA filtering rule engine) to recognize, that this “mirror message” needs to be flagged and not just discarded. This message is then analysed further for at least one or more of the following:a. Who sends it (upper layer identity gives real sender i.e. operator2);b. What message is inside (ack);c. What is the corresponding message that was there before (attackers messages are found) in operator1own DEA node. And potentially the routing records or other information is retrieved, analysed and stored for potential prosecution; andd. System discovers an ongoing attack and can stop the attack (e.g. blacklisting IMSI or blacklisting IPs deducted from routing tables).

In addition, in accordance with the example embodiments of the invention there may be variants which may be applied to improve the system further. The possible Variants include:Delay for some actions, and only release of command after a safety period is applied (and no such message as above was received);Caching of data for some command and reinstall, after this kind of message above is received;The receiving operator1would NOT send or mirror this message back again to avoid race conditions (ping-pong of error messages); andThe message may have an additional field that confirms the integrity of the message and is signed by the partner operator

The embodiments of this invention may be implemented by computer software executable by a data processor of a network device such as the Operator Node21, the Edge Node24, and/or the Internal Node20as inFIG. 2and/orFIG. 3. The data processor such as the message processor20G,21G, and/or24G as shown inFIGS. 2 and/or 3, or by hardware, or by a combination of software and hardware. It is noted that any of these devices may have multiple processors (e.g. RF, baseband, imaging, user interface) which operate in a slave relation to a master processor. The teachings may be implemented in any single one or combination of those multiple processors.

The memory20B,21B, and/or24B, as in devices ofFIGS. 2 and/or 3, may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory node, magnetic memory nodes and systems, optical memory devices and systems, fixed memory and removable memory. The data processors20A,21A, and/or24A, as inFIGS. 2 and/or 3, may be of any type suitable to the local technical environment, and may include one or more of general purpose computers, special purpose computers, microprocessors, digital signal processors (DSFs) and processors based on a multi-core processor architecture, as non-limiting examples.

FIG. 4aillustrates operations which may be performed by a network device such as, but not limited to, an Operator Node21and Edge Node2412as inFIG. 1, e.g., an eNB. As shown in step410there is detecting, by a network node, that at least one message received from another network device of a communication network is in response to a prior message using a spoofed source address. As shown in step420ofFIG. 4athere is, based on the detecting, mirroring the at least one message. Then as Shown in step430ofFIG. 4athere is sending to the another network device the mirrored at least one message to cause the another network device to filter out the at least one message in response to the prior message using the spoofed address.

In accordance with the example embodiments as disclosed in the paragraph above, the at least one message comprises an acknowledgement message addressed to the spoofed source address.

In accordance with the example embodiments as disclosed in the paragraphs above, the spoofed address is an address of the network node.

In accordance with the example embodiments as disclosed in the paragraphs above, the detecting comprises determining that the acknowledgment message is not associated with a prior outgoing message from the network node.

In accordance with the example embodiments as disclosed in the paragraphs above, the determining comprises: being unable to locate in the acknowledgment message at least one of a correlation identification, a Transaction Capabilities Application Part identifier, International Mobile Subscriber Identity, integrated circuit card identifier, and a Mobile Station International Subscriber Directory Number that is associated with a prior outgoing message from the network node.

In accordance with the example embodiments as disclosed in the paragraphs above, the sending comprises sending to the another network device higher layer signaling indicating a sending identity and an Internet Protocol realm associated with the at least one message.

In accordance with the example embodiments as disclosed in the paragraphs above, the filtering is caused based on a mismatch of the Internet Protocol Realm and the sending identity in the higher layer signaling of the at least one message.

A non-transitory computer-readable medium (MEM21B and/or24B ofFIG. 1) storing program code (PROG21C and/or24C; and MEM21B and/or24B ofFIG. 1), the program code executed by at least one processor (Processors21A,21G,24A, and/or24G ofFIG. 1) to perform the operations as at least described in the paragraphs above.

In accordance with an example embodiment of the invention as described above there is an apparatus comprising: means for detecting (Antenna21F and/or24F; RX24E and/or RX21E; PROG21C and/or24C; and Processors21A,21G,24A, and/or24G ofFIG. 1) by a network node (Operator Node21and/or Edge Node24as inFIG. 1), that at least one message received from another network device of a communication network is in response to a prior message using a spoofed source address. Means, based on the detecting, for mirroring (RX24E and/or RX21E; PROG21C and/or24C; and Processors21A,21G,24A, and/or24G ofFIG. 1) the at least one message. And means for sending (TX21D and/or TX24D; PROG21C and/or24C and Processors21A,21G,24A, and/or24G ofFIG. 1) to the another network device the mirrored at least one message to cause the another network device to filter out the at least one message in response to the prior message using the spoofed address of the network node.

FIG. 4billustrates operations which may be performed by a network device such as, but not limited to, an Internal Node20as inFIG. 1, e.g., a user equipment (UE). As shown in step450there is receiving from a network node signaling associated with at least one message. As shown in step460ofFIG. 4bthere is based on the signaling, detecting that the at least one message is in response to a prior message using a spoofed source address. Then as shown in step470ofFIG. 4bthere is, based on the detecting, filtering out the at least one message in response to the prior message using the spoofed source address.

In accordance with the example embodiments as disclosed in the paragraph above, the detecting the at least one message is using a spoofed source address comprises determining there is a mismatch of an Internet Protocol Realm and a sending identity indicated in higher layer signaling of the received signaling.

In accordance with the example embodiments as disclosed in the paragraphs above, the detecting comprises determining that the spoofed source address is an address of the network node.

In accordance with the example embodiments as disclosed in the paragraphs above, the at least one message comprises an acknowledgement message addressed to the spoofed source address.

In accordance with the example embodiments as disclosed in the paragraphs above, the detecting comprises identifying that the acknowledgment message is not associated with a prior outgoing message from the network node.

In accordance with the example embodiments as disclosed in the paragraphs above, the identifying comprises: being unable to locate in the acknowledgment message at least one of a correlation identification, a Transaction Capabilities Application Part identifier, International Mobile Subscriber Identity, integrated circuit card identifier, and a Mobile Station International Subscriber Directory Number associated with a prior outgoing message from the network node.

A non-transitory computer-readable medium (MEM2ofFIG. 1) storing program code (PROG20C and MEM20B ofFIG. 1), the program code executed by at least one processor (Processors20A and/or20G ofFIG. 1) to perform the operations as at least described in the paragraphs above.

In accordance with an example embodiment of the invention as described above there is an apparatus comprising: means for receiving (Antenna20F; RX20E; PROG20C; MEM20B; and Processors20A and/or20G ofFIG. 1) by a network device (e.g., Internal Node20as inFIG. 1) of a communication network, from a network node signaling associated with at least one message. Means, based on the signaling, for detecting (Antenna20F; RX20E; PROG20C; MEM20B; and Processors20A and/or20G ofFIG. 1) that the at least one message is in response to a prior message using a spoofed source address. And means, based on the detecting, for filtering (RX20E; PROG20C; MEM20B; and Processors20A and/or20G ofFIG. 1) out the at least one message in response to the prior message using the spoofed source address.