A system for detecting and mitigating a 5G signaling storm generated by one or more 5G-capable devices (401, 402, 403), the system comprising: a Control Plane signal probe, connected in-line at a first network node located between a Radio Access Network and a 5G Core Network, to monitor Control Plane control messages originating from the 5G-capable devices (401, 402, 403) and passing through the first network node; a User Plane signal probe, connected in-line at a second network node located between the 5G Core Network and one or more remote entities to which the 5G-capable devices are sending messages, to monitor User Plane control messages passing through the second network node; an Inventory Management sub-system, to store data correlating between a particular 5G-capable device (401, 402, 403) and an International Mobile Subscriber Identity (IMSI) number allocated to it; a Protector Unit configured to receive (i) data collected by the CP signal probe, and (ii) data collected by the UP signal probe, and (iii) a subset of IMSI numbers from the IM sub-system, and to generate a list of particular 5G-capable devices (401, 402, 403) that are detected to be compromised or malfunctioning, and to trigger quarantining of control messages outgoing from said particular 5G-capable devices (401, 402, 403) that are in said list; characterized in that the Protector Unit is configured to perform Machine Learning analysis of (i) data collected by the Control Plane signal probe and (ii) data collected by the User Plane signal probe, and to generate, based on said Machine Learning analysis, a determination that a particular 5G-capable device (401, 402, 403) is compromised or malfunctioning; said Machine Learning analysis comprising at least a Random Forest analysis of (i) data collected by the Control Plane signal probe and (ii) data collected by the User Plane signal probe; wherein in said Random Forest analysis, each point is a feature of deviation of counters from corresponding pre-defined normal-operation range-of-values represented as a pair of minimum value and maximum value, and each point is allocated a value that corresponds to either (i) an indicator of regular communications by the 5G-capable device (401, 402, 403), or (ii) an indicator of minor abnormality that is below a pre-defined threshold value of abnormal communications, or (iii) an indicator of major abnormality that is equal to or greater than said pre-defined threshold value of abnormal communications. a Control Plane signal probe, connected in-line at a first network node located between a Radio Access Network and a 5G Core Network, to monitor Control Plane control messages originating from the 5G-capable devices (401, 402, 403) and passing through the first network node; a User Plane signal probe, connected in-line at a second network node located between the 5G Core Network and one or more remote entities to which the 5G-capable devices are sending messages, to monitor User Plane control messages passing through the second network node; an Inventory Management sub-system, to store data correlating between a particular 5G-capable device (401, 402, 403) and an International Mobile Subscriber Identity (IMSI) number allocated to it; a Protector Unit configured to receive (i) data collected by the CP signal probe, and (ii) data collected by the UP signal probe, and (iii) a subset of IMSI numbers from the IM sub-system, and to generate a list of particular 5G-capable devices (401, 402, 403) that are detected to be compromised or malfunctioning, and to trigger quarantining of control messages outgoing from said particular 5G-capable devices (401, 402, 403) that are in said list; characterized in that the Protector Unit is configured to perform Machine Learning analysis of (i) data collected by the Control Plane signal probe and (ii) data collected by the User Plane signal probe, and to generate, based on said Machine Learning analysis, a determination that a particular 5G-capable device (401, 402, 403) is compromised or malfunctioning; said Machine Learning analysis comprising at least a Random Forest analysis of (i) data collected by the Control Plane signal probe and (ii) data collected by the User Plane signal probe; wherein in said Random Forest analysis, each point is a feature of deviation of counters from corresponding pre-defined normal-operation range-of-values represented as a pair of minimum value and maximum value, and each point is allocated a value that corresponds to either (i) an indicator of regular communications by the 5G-capable device (401, 402, 403), or (ii) an indicator of minor abnormality that is below a pre-defined threshold value of abnormal communications, or (iii) an indicator of major abnormality that is equal to or greater than said pre-defined threshold value of abnormal communications.