A method, comprising: an interworking function network element receiving a monitoring request regarding a user equipment or a category of devices from at least one of a services capability server and an application server; the interworking function network element responding to the monitoring request indicating whether monitoring will be performed for the user equipment or the category of devices; and the interworking function network element registering the user equipment or the category of devices for monitoring service with a home subscriber server to enable the home subscriber server to authenticate the monitoring request and to identify a serving node to perform a monitoring activity regarding the user equipment or the category of devices with respect to at least one suspicious event and to send to the serving node a registering message for monitoring; the method further comprising: the interworking function network element receiving from the home subscriber server a registration status response in response to the registering; and the interworking function network element forwarding the registration status toward the at least one of the services capability server and the application server while responding to the monitoring request; wherein the suspicious event comprises at least one event of the following: a tracking update occurs from a location outside an area allowed for the user equipment or from a certain device category; the user equipment or the device category accesses a network outside an allowed time interval or at a forbidden time interval; the user equipment or the device category is subscribed for packet switched services only but is performing a location update to obtain voice service; or the user equipment or the device category has exceeded an allowed data usage limit. an interworking function network element receiving a monitoring request regarding a user equipment or a category of devices from at least one of a services capability server and an application server; the interworking function network element responding to the monitoring request indicating whether monitoring will be performed for the user equipment or the category of devices; and the interworking function network element registering the user equipment or the category of devices for monitoring service with a home subscriber server to enable the home subscriber server to authenticate the monitoring request and to identify a serving node to perform a monitoring activity regarding the user equipment or the category of devices with respect to at least one suspicious event and to send to the serving node a registering message for monitoring; the method further comprising: the interworking function network element receiving from the home subscriber server a registration status response in response to the registering; and the interworking function network element forwarding the registration status toward the at least one of the services capability server and the application server while responding to the monitoring request; wherein the suspicious event comprises at least one event of the following: a tracking update occurs from a location outside an area allowed for the user equipment or from a certain device category; the user equipment or the device category accesses a network outside an allowed time interval or at a forbidden time interval; the user equipment or the device category is subscribed for packet switched services only but is performing a location update to obtain voice service; or the user equipment or the device category has exceeded an allowed data usage limit. the interworking function network element receiving from the home subscriber server a registration status response in response to the registering; and the interworking function network element forwarding the registration status toward the at least one of the services capability server and the application server while responding to the monitoring request; wherein the suspicious event comprises at least one event of the following: a tracking update occurs from a location outside an area allowed for the user equipment or from a certain device category; the user equipment or the device category accesses a network outside an allowed time interval or at a forbidden time interval; the user equipment or the device category is subscribed for packet switched services only but is performing a location update to obtain voice service; or the user equipment or the device category has exceeded an allowed data usage limit.