A method for execution in a mobility management entity, MME, of a telecommunication network comprising: storing on the mobility management entity, MME, a UE blacklist of identifiers of user equipment, UE (12, 12') and a success rate metric; receiving, by the MME from an eNodeB, an attach request that originated from a UE, the request including a UE identifier associated with a subscriber of the UE; upon receiving the attach request, checking, by the MME, the UE blacklist to determine whether the identifier is on the UE blacklist; in response to the UE identifier being on the UE blacklist, performing the following steps by the MME: rejecting the attach request without notifying a home subscriber server, HSS, after the receiving of the attach request from the eNodeB; updating the success rate metric to reflect the failed attach request; comparing the success rate metric to a threshold; and in response to a decrease in the success rate metric below the threshold, recognizing a malicious attack and taking mitigating steps; and in response to the UE identifier being absent from the UE blacklist, performing the following steps by the MME: requesting for further authentication of the UE identifier at the HSS; in response to a failed authentication response from the HSS, rejecting the attach request and updating the success rate metric on a per eNodeB basis to reflect the failed request; comparing the success rate metric to a threshold; and in response to a decrease in the success rate metric below the threshold, recognizing a malicious attack and taking mitigating steps comprising: adding the UE identifier to the UE blacklist; and sending a message to the eNodeB to block one of all or selected future attach requests. storing on the mobility management entity, MME, a UE blacklist of identifiers of user equipment, UE (12, 12') and a success rate metric; receiving, by the MME from an eNodeB, an attach request that originated from a UE, the request including a UE identifier associated with a subscriber of the UE; upon receiving the attach request, checking, by the MME, the UE blacklist to determine whether the identifier is on the UE blacklist; in response to the UE identifier being on the UE blacklist, performing the following steps by the MME: rejecting the attach request without notifying a home subscriber server, HSS, after the receiving of the attach request from the eNodeB; updating the success rate metric to reflect the failed attach request; comparing the success rate metric to a threshold; and in response to a decrease in the success rate metric below the threshold, recognizing a malicious attack and taking mitigating steps; and rejecting the attach request without notifying a home subscriber server, HSS, after the receiving of the attach request from the eNodeB; updating the success rate metric to reflect the failed attach request; comparing the success rate metric to a threshold; and in response to a decrease in the success rate metric below the threshold, recognizing a malicious attack and taking mitigating steps; and in response to the UE identifier being absent from the UE blacklist, performing the following steps by the MME: requesting for further authentication of the UE identifier at the HSS; in response to a failed authentication response from the HSS, rejecting the attach requesting for further authentication of the UE identifier at the HSS; in response to a failed authentication response from the HSS, rejecting the attach request and updating the success rate metric on a per eNodeB basis to reflect the failed request; comparing the success rate metric to a threshold; and in response to a decrease in the success rate metric below the threshold, recognizing a malicious attack and taking mitigating steps comprising: adding the UE identifier to the UE blacklist; and sending a message to the eNodeB to block one of all or selected future attach requests. comparing the success rate metric to a threshold; and in response to a decrease in the success rate metric below the threshold, recognizing a malicious attack and taking mitigating steps comprising: adding the UE identifier to the UE blacklist; and sending a message to the eNodeB to block one of all or selected future attach requests. adding the UE identifier to the UE blacklist; and sending a message to the eNodeB to block one of all or selected future attach requests.