a dynamic learning and screening module implemented by the at least one processor for operating in a learn mode in which traffic from foreign mobility management nodes is received and identities of the foreign mobility management nodes are learned and used to populate the security database, operating in a test mode to dynamically learn foreign mobility management node security status and maintaining the security status for the foreign mobility management nodes in the security database, and operating in an active mode to filter traffic from the foreign mobility management nodes using the dynamically learned node identities and security statuses. The system of claim 11 wherein operating in the learn mode includes querying a home location register (HLR) or home subscriber server (HSS) to identify an old mobility management node and an age of location parameter and populating the security database with an entry corresponding to the old mobility management node and the age of location parameter. The system of any one of claims 11 to 12 wherein operating in the learn mode includes performing validation testing for mobility management node identities extracted from received messages, updating validation pass and fail counts in the security database based on results of the validation testing, and updating the security statuses based on the validation pass and fail counts. The system of any one of claims 11 to 13 wherein operating in the learn mode includes dynamically learning time parameters usable for velocity checks between old and new foreign mobility management nodes. The system of any one of claims 11 to 14 wherein operating in the active mode includes receiving messages from foreign mobility management nodes, performing lookups in the security database using mobility management node identities extracted from the messages, and blocking or passing the messages based on the dynamically learned security status for the node identities stored in the security database.