telecommunications network routing node. The method further includes operating the telecommunications network routing node in a test mode to dynamically learn foreign mobility management node security status and maintaining the security status for the foreign mobility management nodes in the security database. The method further includes operating the telecommunications network routing node in an active mode to filter traffic from the foreign mobility management nodes using the dynamically learned node identities and security statuses. According to another aspect of the subject matter described herein, operating the telecommunications network routing node in a learn mode includes querying a home location register (HLR) or home subscriber server (HSS) to identify an old mobility management node and an age of location parameter and populating the security database with an entry corresponding to the old mobility management node and the age of location parameter. According to yet another aspect of the subject matter described herein, operating the telecommunications network node in the learn mode includes performing validation testing for mobility management node identities extracted from received messages, updating validation pass and fail counts in the security database based on results of the validation testing, and updating the security statuses based on the validation pass and fail counts. According to yet another aspect of the subject matter described herein, operating the telecommunications network node in the learn mode includes performing validation testing for mobility management node identities extracted from received messages, updating validation pass and fail counts in the security database based on results of the validation testing, and updating the security statuses based on the validation pass and fail counts. According to yet another aspect of the subject matter described herein, operating the telecommunications network node in the learn mode includes performing validation testing for mobility management node identities extracted from received messages, updating validation pass and fail counts in the security database based on results of the validation testing, and updating the security statuses based on the validation pass and fail counts.