METHOD AND APPARATUS FOR DETECTING DIAMETER PROTOCOL IDR MESSAGE SPOOFING ATTACK ON MOBILE COMMUNICATION NETWORK

摘要

A method and system for detecting a diameter spoofing attack based on an IDR message are provided. A method according to an embodiment includes: obtaining a normal International Mobile Subscriber Identity (IMSI) from a packet of Diameter S6a protocol transmitted from a Mobile Management Entity (MME) to a Home Subscriber Server (HSS) of a home network; adding a record including to the session table; obtaining an Insert Subscriber Data Request (IDR) message of the Diameter S6a protocol; and when the IMSI included in the IDR message is not queried in the session table, the IDR determining the message as an abnormal IDR message.