METHOD AND APPARATUS FOR DETECTING DIAMETER PROTOCOL IDR MESSAGE SPOOFING ATTACK ON MOBILE COMMUNICATION NETWORK

摘要

A method and system for detecting a diameter spoofing attack based on an IDR message are provided. The method according to an embodiment includes the steps of obtaining a normal International Mobile Subscriber Identity (IMSI) from a packet of the Diameter S6a protocol transmitted from a Mobile Management Entity (MME) to a Home Subscriber Server (HSS) of a home network, and the normal IMSI Adding a record including a to the session table, obtaining an IDR (Insert Subscriber Data Request) message of the Diameter S6a protocol, and if the IMSI included in the IDR message is not retrieved from the session table, the IDR And determining the message as an abnormal IDR message.