also created. VLR validation includes comparing the calling party address (CgPA) of a Category 3.1 message received by routing node 100 with the location of the subscriber stored in the HLR. If the location is the same, it can be concluded that the message is coming from the current VLR and the message is valid. If the location is different than the CgPA of the message, then the VLR validation fails. IMEI validation may be performed as described in commonly-assigned, co-pending U.S. Patent Application No. 16/024,422, filed June 29, 201 8, the disclosure of which is incorporated herein by reference in its entirety. Briefly, IMEI validation may include having routing node 100 query the MSC or HLR (that in turn queries the MSC using the provide subscriber information (PSI) operation) to provide the IMEI of the subscriber. If the MSC is whitelisted, routing node 100 may store the IMEI- IMSI pair for future use. If the MSC is graylisted, routing node 100 may use the earlier stored IMEI-IMSI pair for validation of the graylisted MSC. 

Even though the learn and test modes are described herein as separate modes, the subject matter described herein is not limited to such an implementation. Routing node may operate in the test and learn modes simultaneously to learn new node identities and perform validation testing for the newly learned node identities without departing from the scope of the subject matter described herein. In addition, the routing node could also operate in the test, learn, and active modes simultaneously to dynamically learn new node identities, perform validation testing of the newly learned node identities, and filter traffic using the dynamically learned security status. 

In step 604, routing node 100 operates in active mode to filter traffic from foreign mobility management nodes using the dynamically learned node identities in statuses. As stated above with regard to Figure 4 , operating in the active mode includes filtering received traffic from foreign mobility management nodes based on the status of the entries in the static and dynamic profile tables. Validation counts are updated, and velocity learning is also performed. 

In the examples described above, dynamically learning the status of a mobility management node is performed by updating validation pass and fail counts as well as time thresholds for foreign mobility management nodes. 

