Systems and methods are provided for mitigating denial of service attacks in a communications network. Based on a determination that requests to access an E11 resource exceeds a threshold, it may be determined that a denial of service attack attempt is occurring. One or more mitigation protocols can be used to block, filter, or re-route attempts that are associated with the denial of service attack. Association with the denial of service attack can be identified based on a distance between the user devices associated with the requests and a time period for which the requests were originated.