WO2021234796A1 - Mobile communication system - Google Patents

Abstract

[Problem] To provide a mobile communication system which detects and blocks malicious wireless communication as abnormal wireless communication, so as to avoid unauthorized occupation of a wireless channel and secure the communication security and quality. [Solution] A mobile communication system in which: a frame transmitter-receiver unit 112 of a communication device 1 outputs control information of a received frame to a frame information output unit 114; the frame information output unit 114 outputs received frame information for extracting the feature amount of the frame to a control terminal 4; the control terminal 4 determines whether the received frame information is normal or abnormal on the basis of a white list or a black list; to the frame transmitter-receiver unit 112 of the communication device 1 and a relay device 3, access control information for prohibiting reception is output upon the abnormality determination and access control information for cancelling prohibition of reception is output upon the normality determination, so as to block or unblock the reception.

Description

Mobile communication system

The present invention relates to a mobile communication system applied to a mobile network, and more particularly to a mobile communication system capable of discriminating abnormal communication and unauthorized communication to ensure the security and quality of communication.

[Conventional technology]
In a conventional mobile communication system, in a mobile network, terminals are autonomously detected between mobile communication stations, routes are optimized autonomously, an ad hoc wireless network is constructed, and the amount of delay is reduced. It realizes communication that suppresses the load on the line while reducing the amount.

[Conventional mobile communication system: Fig. 9]
A conventional mobile communication system will be described with reference to FIG. FIG. 9 is a block diagram of a conventional mobile communication system.
As shown in FIG. 9, the conventional mobile communication system includes a communication device 10, a communication terminal 2, and a control terminal 40.

The conventional communication device 10 includes a network unit 110, a wireless access control unit 12, a wireless signal processing unit 13, a high frequency unit 14, and an antenna 15.
The network unit 110 has a QoS (Quality of Service) function unit 1101, a frame transmission / reception unit 1102, and a communication method function unit 1103.
The wireless access control unit 12 includes a transmission / reception counter 12a.
Further, the control terminal 40 has a statistical display unit 45.

The network unit 110 mainly serves as an interface with a communication terminal 2 such as an IP (Internet Protocol) telephone terminal or a PC (Personal Computer) or a control terminal 40, and exchanges IP (Internet Protocol) packets with the wireless access control unit 12. Set the communication method, etc.

When the communication method from the control terminal 40 is set, the communication method function unit 1103 notifies the QoS function unit 1101, the wireless access control unit 12, the radio signal processing unit 13, and the high frequency unit 14 of the communication method. , Switch the settings, and input and acquire the status from each part.
When the communication method is set from the communication method function unit 1101, the QoS function unit 1101 selects an IP packet to be preferentially transmitted according to the communication method and outputs the IP packet to the frame transmission / reception unit 1102.
Further, the QoS function unit 1101 outputs an IP packet from the frame transmission / reception unit 1102 to the communication terminal 2.

The frame transmission / reception unit 1102 incorporates the IP packet input from the QoS function unit 1101 into the communication frame to generate a transmission frame, and outputs the transmission frame to the wireless access control unit 12. Here, if the IP packets have the same destination, a plurality of IP packets can be passed to the wireless access control unit 12 as transmission frames.
Further, the frame transmission / reception unit 1102 takes out an IP packet using the communication data from the wireless access control unit 12 as a reception frame and outputs the IP packet to the QoS function unit 1101.

The wireless access control unit 12 determines whether or not the wireless line is in use, and outputs the transmission frame input from the network unit 110 to the wireless signal processing unit 13 when the line is not in use.
Further, the wireless access control unit 12 outputs the error-corrected and decoded communication data (received frame) from the wireless signal processing unit 13 to the network unit 110.
Further, the wireless access control unit 12 determines whether or not the data has reliably reached the other party during the wireless communication, and performs retransmission control or the like as necessary.

The transmission / reception counter 12a in the wireless access control unit 12 counts the transmission / reception of IP packets, and outputs the transmission / reception count value to the communication method function unit 1103 of the network unit 110. The communication method function unit 1103 grasps the transmission / reception status based on the count value from the transmission / reception counter 12a.

The wireless signal processing unit 13 errors-corrects and encodes the communication data from the wireless access control unit 12 and outputs it to the high-frequency unit 14.
Further, the radio signal processing unit 13 error-corrects and decodes the demodulated signal from the high-frequency unit 14, and outputs the demodulated signal to the radio access control unit 12.

The high frequency unit 14 modulates the error correction coded communication data from the radio signal processing unit 13 for transmission and outputs it to the antenna 15.
Further, the high frequency unit 14 demodulates the signal input from the antenna 15 for reception and outputs the signal to the radio signal processing unit 13.
The antenna 15 emits a transmission signal from the high frequency unit 14 into the air, and outputs the signal from the air to the high frequency unit 14.

[Processing in conventional mobile communication systems]
[Send processing]
In the conventional mobile communication system, as a transmission process, the network unit 110 exchanges packets between the communication terminal 2 and the wireless access control unit 12, and the frame transmission / reception unit 1102 assigns control information to the IP packet. Is generated, and the wireless access control unit 12 determines, based on the transmission frame received from the network unit 110, whether the frequency resource, that is, the so-called wireless line, is not in use, or whether it is the transmittable time of its own station, and can transmit. If it is determined that the packet is determined to be, the packet is encrypted and transferred to the wireless signal processing unit 13.

After the radio signal processing unit 13 encodes and interleaves to correct a communication error, it performs modulation to make it a carrier wave, adds a synchronization signal, a control signal, and the like, and transfers the signal to the high frequency unit 14.
The high frequency unit 14 converts the input carrier wave into a high frequency with a high frequency, amplifies it to a specified power, and transmits it from the antenna 15.

[Reception processing]
Next, as reception processing, radio waves are input from the antenna 15, high-frequency signals are converted into carrier waves by the high-frequency unit 14, and output to the radio signal processing unit 13.
The wireless signal processing unit 13 demodulates the carrier wave, detects a synchronization signal, a control signal, and the like, and restores the digital information. Then, the wireless signal processing unit 13 corrects the erroneous information and outputs it to the wireless access control unit 12.

The wireless access control unit 12 decodes the encrypted digital information, determines whether or not the received digital information is a frame, and if the digital information is determined to be a frame, according to the control information stored in the frame. Perform response processing and adjust the transmittable time.
When the IP packet is stored in the received frame (received frame), the wireless access control unit 12 outputs the received frame to the network unit 110.

The network unit 110 extracts an IP packet from the received frame input from the wireless access control unit 12 by the frame transmission / reception unit 1102, determines whether or not the packet is for the communication terminal 2 to be connected, and uses the packet for the communication terminal 2. If so, the packet is forwarded to the communication terminal 2.
Further, the control terminal 40 sets the communication device 10, monitors the communication status and the device status, and displays the communication status and the device status on the statistical display unit 45.

Conventional mobile communication systems are in an environment vulnerable to cyber attacks related to networks because of their characteristics of realizing autonomous distributed access and facilitating network connection from wireless.
In wireless networks, there are many methods in which one frequency resource is shared among a plurality of mobile communication stations. Specifically, time division (TDMA: Time Division Multiple Access), which is multiple access, and conflict avoidance by carrier sense (CSMA / CA: Carrier Sense Multiple Access / Collision Avoidance: carrier sense multiple access / Collision avoidance method) is used.

In these sharing methods, when malicious communication occurs, unless there is an error in the content of the control information used for communication, it is often determined that the communication is normal, so malicious communication is detected. It was not easy to shut off.

[Related technology]
As a related prior art, there is Japanese Patent No. 5848956 "Communication Device" (Patent Document 1).
Patent Document 1 discloses a communication device that determines the number of connected IP packets according to the usage rate of a subcarrier when transmitting using any one of a plurality of communication methods in a mobile communication system. ing.

Japanese Patent No. 5848956

However, in the conventional mobile communication system, when the control information is incorrect, it is determined that the communication is abnormal, and the information related to the wireless communication or the network connection is discarded, but the wireless line is intentionally occupied. Regarding communication and communication that reproduces and misuses received signals, if the content of the control information is normal, it is difficult to judge that it is abnormal communication, delay in network connection occurs, and communication security There was a problem that quality could not be ensured.

Note that Patent Document 1 does not describe a technique for detecting malicious communication or unauthorized communication and blocking those communications.

The present invention has been made in view of the above circumstances, and detects malicious wireless communication as abnormal wireless communication to block the communication, avoids unauthorized occupation of the wireless line, and improves the security and quality of the communication. The purpose is to provide a mobile communication system to be secured.

The present invention for solving the problems of the above-mentioned conventional example is a mobile communication system used for a mobile network, and outputs received frame information for extracting the feature amount of the frame from the control information of the received frame. At the same time, the communication device that blocks reception by the access control information of reception prohibition and cancels reception by the access control information of reception prohibition is input, and the reception frame information is input, and the reception frame information is normal or not. Whether it is abnormal is determined based on the normal or abnormal list of received frame information stored in advance, and when it is determined to be abnormal, the access control information for which reception is prohibited is output to the communication device, and when it is determined to be normal. It has a control terminal that outputs access control information for canceling reception prohibition to a communication device.

INDUSTRIAL APPLICABILITY In the above mobile communication system, a relay device is provided between a communication device and a communication terminal, and the control terminal outputs access control information for prohibiting reception or access control information for canceling reception prohibition to the relay device and relays the information. The device blocks reception by the access control information of reception prohibition, and cancels reception by the access control information of cancellation of reception prohibition.

According to the present invention, in the mobile communication system, the control terminal extracts feature amount data from received frame information, learns it as normal feature amount data if the received frame information is normal, and learns it as normal feature amount data if the received frame information is abnormal. It is trained as anomalous feature data, and the list of normal or abnormal is updated using the learning result.

According to the present invention, in the mobile communication system, the control terminal uses a self-encoder for learning, inputs feature quantity data about received frames to the self-encoder as input data, and outputs data from the self-encoder. The normality or abnormality of the frame is determined based on the difference between the input data and the input data.

INDUSTRIAL APPLICABILITY In the above mobile communication system, when the control terminal determines whether the received frame is normal or abnormal, the present invention updates the list of normal or abnormal with the received frame information of the determined frame.

In the present invention, in the mobile communication system, the control terminal calculates the correlation of a plurality of parameters related to reception by a statistical method to obtain feature data.

According to the present invention, in the mobile communication system, the control terminal clusters feature data from a plurality of parameters related to reception and obtains feature data for each cluster.

According to the present invention, the received frame information for extracting the feature amount of the frame is output from the control information of the received frame, and the reception is blocked by the access control information for prohibiting reception, and the access control information for releasing the reception prohibition is released. The communication device that cancels the reception interruption and the received frame information are input, and whether the received frame information is or is abnormal is determined based on the normal or abnormal list of the received frame information stored in advance. However, it is a mobile communication system that has a control terminal that outputs reception prohibition access control information to the communication device when it is determined to be abnormal, and outputs access control information to the communication device when it is determined to be normal. Therefore, even if there is no error in the control information used for communication, it has the effect of detecting malicious wireless communication as abnormal wireless communication, preventing unauthorized occupation of the wireless line, and ensuring the security and quality of communication. ..

According to the present invention, a relay device is provided between a communication device and a communication terminal, the control terminal outputs access control information for which reception is prohibited or access control information for canceling reception prohibition to the relay device, and the relay device receives. Since the above mobile communication system uses the access control information for prohibiting access to block reception and the access control information for canceling reception prohibition to cancel reception, the feature amount data is learned and the normal or abnormal list is updated for reception. It has the effect of improving the accuracy of determining whether the frame information is normal or abnormal.

It is a block diagram of the structure of this system. It is a schematic diagram which shows the transmission / reception frame and the upper layer protocol data. It is a schematic diagram which shows the target parameter of a single time incremental statistic. It is a schematic diagram which shows the parameter of a clustering classification. It is a schematic diagram which shows the content of application of an analysis method. It is a block diagram of the feature quantity extraction part. It is a partial block diagram of a control terminal. It is a block diagram which shows the normal learning part / abnormal learning part. It is a block diagram of the structure of the conventional mobile communication system.

An embodiment of the present invention will be described with reference to the drawings.
[Outline of Embodiment]
The mobile communication system (this system) according to the embodiment of the present invention is used for a mobile network, and a communication device controls received frame information for extracting a feature amount of the frame from the control information of the received frame. It is output to the terminal, and the control terminal determines whether the received frame information is normal or abnormal based on the list of normal information (white) or abnormal information (black), and if it is determined to be abnormal, the communication device and the relay device. The access control information for which reception is prohibited is output to, and when it is determined to be normal, the access control information for canceling reception prohibition is output to the communication device and the relay device, and reception is blocked or reception is canceled. Even if there is no error in the control information used, malicious wireless communication can be detected as abnormal wireless communication, unauthorized occupation of the wireless line can be prevented, and communication security and quality can be ensured.

In addition, in this system, the control terminal extracts feature amount data from the received frame information, and if the received frame information is normal, it is trained as normal feature amount data, and if the received frame information is abnormal, the feature amount is abnormal. It is trained as data and the list of normal or abnormal is updated using the learning result. The feature quantity data is trained and the list of normal or abnormal is updated to determine the normal or abnormal determination accuracy of the received frame information. It can be improved.

[This system: Fig. 1]
This system will be described with reference to FIG. FIG. 1 is a block diagram of the configuration of this system.
As shown in FIG. 1, this system includes a communication device 1, a communication terminal 2, a relay device 3, and a control terminal 4.
Since the communication terminal 2 is the same as the conventional communication terminal shown in FIG. 9, a specific description thereof will be omitted.

[Each part of this system]
Each part of this system will be described in detail.
[Communication device 1]
As shown in FIG. 1, the communication device 1 includes a network unit 11, a wireless access control unit 12, a wireless signal processing unit 13, a high frequency unit 14, and an antenna 15. Since the wireless access control unit 12, the wireless signal processing unit 13, the high frequency unit 14, and the antenna 15 have the same configuration as the conventional configuration shown in FIG. 9, description thereof will be omitted.

The network unit 11 in the communication device 1 of this system includes a QoS function unit 111, a frame transmission / reception unit 112, a communication method function unit 113, and a frame information output unit 114.
The QoS function unit 111, the frame transmission / reception unit 112, and the communication method function unit 113 execute the same processing as the QoS function unit 1101, the frame transmission / reception unit 1102, and the communication method function unit 1103 of the conventional network unit 110 of FIG. be.
However, the frame transmission / reception unit 112 outputs information (control information in the frame format) of the transmission frame and the reception frame (transmission / reception frame) to the frame information output unit 114. The details of the control information will be described later.

The newly provided frame information output unit 114 is necessary for inputting transmission / reception frame information from the frame transmission / reception unit 112, acquiring related control information (control information) from the frame format, and extracting feature quantities. The received frame information is output to the feature extraction unit 42 of the control terminal 4.
In this system, it is mainly described that normal / abnormal is determined for received frame information and access control is performed. However, if normal / abnormal is also determined for transmitted frame information and access control is performed, this system can be used. It is possible to prevent the communication device from becoming a transmitter for attacks.
The transmission / reception frame format and reception frame information will be described later.

[Relay device 3]
The relay device 3 is a device such as a router that relays, and relays an IP packet between the communication device 1, particularly the QoS function unit 111 of the network unit 11 and the communication terminal 2.
Further, the relay device 3 inputs control information (access control information) for prohibiting or canceling communication from the control terminal 4, controls access such as communication interruption, and outputs normal or abnormal access control information to the host device. Output to the communication terminal 2 to detect an abnormality.
The details of the access control information will be described later, but the relay device 3 prohibits (blocks) reception according to the access control information, and cancels the prohibition.

[Control terminal 4]
As shown in FIG. 1, the control terminal 4 includes a statistical display / control unit 41, a feature extraction unit 42, a normal learning unit 43, and an abnormal learning unit 44.
Unlike the control terminal 40 of FIG. 9, the control terminal 4 has an additional configuration, and the statistical display / control unit 41 also has an additional function. Hereinafter, a specific description will be given.

[Statistical display / control unit 41]
The statistical display / control unit 41 sets a communication method in the communication method function unit 113 of the network unit 11 of the communication device 1, monitors the communication status and the device status, and displays the communication status and the device status.
Further, the statistical display / control unit 41 determines whether the received frame is a normal received frame or an abnormal received frame based on the detection results input from the normal learning unit 43 and the abnormal learning unit 44, and determines whether the received frame is a normal receiving frame or an abnormal receiving frame. If it is a normal reception frame, reception is prohibited, and if it is a normal reception frame, access control information for canceling reception is output to the relay device 3 and the frame transmission / reception unit 112.

Here, even if there is no error in the control information of the received frame, the statistical display / control unit 41 of this system determines that the received frame is malicious and abnormal from the reception interval, the received data size, the number of received numbers, the transmission waiting time, and the like. Then, the control for limiting the reception is performed.

Further, the statistical display / control unit 41 stores a list of normal received frame information (white list) and a list of abnormal received frame information (black list).
Then, the statistical display / control unit 41 inputs the received frame information from the frame information output unit 114, refers to the white list or the black list, and the received frame information is white (normal) or black. Determine if it is (abnormal).

When the statistical display / control unit 41 determines that the received frame information is white, the statistical display / control unit 41 outputs the access control information for canceling reception prohibition to the relay device 3 and the frame transmission / reception unit 112, and outputs the feature data from the feature extraction unit 42. A learning instruction to be learned by the normal learning unit 43 is output.
Further, when the statistical display / control unit 41 determines that the received frame information is black, the access control information for which reception is prohibited is output to the relay device 3 and the frame transmission / reception unit 112, and the feature data from the feature extraction unit 42 is output. Is output to the abnormality learning unit 44 to learn.
A more specific configuration and processing of the statistical display / control unit 41 will be described later.

[Feature extraction unit 42]
The feature extraction unit 42 extracts parameters (target parameters of single time incremental statistics) from the received frame information from the frame information output unit 114, performs incremental statistical processing, and performs clustering processing using the parameters of the clustering classification. The feature amount data corresponding to the cluster is output to the normal learning unit 43 or the abnormal learning unit 44.
The specific configuration, processing, parameters, etc. of the feature extraction unit 42 will be described later.

[Normal learning unit 43, Abnormal learning unit 44]
The normal learning unit 43 and the abnormal learning unit 44 input feature data from the feature extraction unit 42, extract an error through a learned self-encoder, and output the error to the statistical display / control unit 41 as a detection result. .. The self-encoder is learning to encode the input data and decode it into the same data as the input data. The self-encoder in the normal learning unit 43 is learning the normal data, and the abnormal learning unit 44 is learning the abnormal data. Then, the difference between the input data and the decoded data is extracted as an error.

Therefore, when the feature data is input to the normal learning unit 43 and the error in the self-encoder is extracted, it can be determined whether the data is normal or not depending on the magnitude of the error.
Further, when the feature data is input to the abnormality learning unit 44 and the error in the self-encoder is extracted, it can be determined whether or not the feature data is abnormal data depending on the magnitude of the error.

That is, the error from the normal learning unit 43 and the abnormal learning unit 44 is output to the statistical display / control unit 41 as a detection result, and the statistical display / control unit 41 determines whether the feature data is normal or abnormal based on the detection result. And update the white list or blacklist.

Further, the normal learning unit 43 and the abnormal learning unit 44 learn the feature data from the feature extraction unit 42 according to the learning instruction from the statistical display / control unit 41. Learning of feature data will also be described later.

[Transmission / reception frame, upper layer protocol data: Fig. 2]
Next, an example of the transmission / reception frame and the upper layer protocol data used in this system will be described with reference to FIG. FIG. 2 is a schematic diagram showing transmission / reception frames and upper layer protocol data.
As shown in FIG. 2, the transmission / reception frame format includes a frame (WLAN Frame [QoS Frame]) such as a wireless LAN (WLAN: Wireless Local Aera Network), and IP Packet (IP Packet) and TCP (Transmission) as higher-level protocol data. There are Control Protocol) segments (TCP Segments), UDP (User Datagram Protocol) segments (UDP Segments), and control messages (Adhoc Routing Message [OLSR]) used in adhoc routing.

Information for control is attached to each of these frame formats and upper layer protocol data, and the concept of time, the communication order, and the concept of logical connection are shown in them. For example, the "Duration" field of the WLAN frame of FIG. 2 contains the time required for transmission, and the time specified in this field must wait for transmission.

[Received frame information: Figures 3 and 4]
The received frame information output from the frame information output unit 114 to the feature extraction unit 42 of the control terminal 4 will be described with reference to FIGS. 3 and 4. FIG. 3 is a schematic diagram showing the target parameters of the single time incremental statistics, and FIG. 4 is a schematic diagram showing the parameters of the clustering classification.
In order to extract the feature amount by the feature extraction unit 42, the control information shown in FIG. 2 is subjected to incremental statistics in a fixed time interval, that is, in a single time, and communication information is performed using the classification parameters shown in FIG. Need to be categorized by cluster as a unit of logical connection.

[Parameters subject to single time increment: Fig. 3]
Here, an example of a target parameter for performing incremental statistics of communication information in a transmission / reception frame will be described with reference to FIG. These parameters were selected to detect malicious and anomalous communications.
To perform incremental statistics in a single time, we define the parameters that are the subject of the single time incremental statistics, as shown in FIG.
In FIG. 3, a WLAN frame "WLAN Frame" and an ad hoc routing control message "Ad hoc Routing Message" are adopted as data, and two fields in the data are used as usage parameters 1 and 2, and the usage parameters 1 and 2 are combined. Correspondingly, the feature parameter name is defined.
There are five feature parameter names, "FCBySrc", "DurBySrc", "SeqBySrc", "AdcSseqByOrg", and "AdcMTByOrg".

[Parameters for clustering classification: Fig. 4]
Next, an example of the parameters used for the classification of clustering will be described with reference to FIG.
Since there are several categorized patterns for received frames in the classification by clustering, it is better to extract the features according to the cluster within the group (cluster) of those categorized classifications. This is done to obtain an appropriate amount of features.
In particular, malicious anomalous received frames have a typified pattern, and an attempt is made to extract features within the cluster in comparison with other malicious anomalous received frames.

As shown in FIG. 4, the parameters of the clustering classification adopt the WLAN frame "WLAN Frame", the upper layer protocol data "IP Protocol""TCP / UDP Protocol", and the adhoc routing control message "Adhoc Routing Message". The feature parameter names are defined corresponding to the combination of the usage parameters 1 and 2 with the two fields in the data as the usage parameters 1 and 2. In some cases, the feature parameter name is defined only by the parameter 1 used.
There are six feature parameter names: "MacSrc", "MacSrcDst", "SeqBySrc", "NetSrcDst", "TLSrcDst", and "AdcOrg".

[Analysis method application content: Fig. 5]
Next, an example of application contents of the analysis method for analyzing the feature amount will be described with reference to FIG. FIG. 5 is a schematic diagram showing the contents of application of the analysis method.
As shown in FIG. 5, the analysis method is applied to the four statistical parameters of "reception interval", "reception data size", "number of receptions", and "transmission waiting time", and the statistical methods are "average" and "standard deviation". The feature parameters are associated with four types of "covariance" and "product-moment correlation coefficient".
As the feature parameter, the feature parameter name of the target parameter in FIG. 3 is used. The last two feature parameters omit the letters "Adc".
The relationship of FIGS. 3 to 5 will be specifically described with reference to FIG.

In this system, statistical parameters that show characteristic values in the case of malicious communication are selected. For example, in the case of communication that intentionally occupies a wireless line, it is considered that there are features such as a short reception interval, a large reception data size, a large number of receptions, and a short transmission standby time.

The analysis method calculates the correlation using the feature parameters by the available statistical method for the four statistical parameters "reception interval", "reception data size", "number of receptions", and "transmission waiting time", and the calculated correlation. The value is the feature amount data for each cluster.
For example, the "reception interval" is calculated for the feature parameters "FCBySrc", "SseqByOrg", and "MTByOrg" by the available statistical method "mean" or "standard deviation", and the features of the clustering classification. Classification is performed by calculating using the usage parameters 1 and 2 corresponding to the parameter name, the correlation with the value of the feature parameter already stored in the classified cluster is calculated, and the feature amount data in the cluster is calculated based on the correlation. Output.
Although the feature parameters corresponding to the received data size are not shown in FIG. 5, the calculation of the statistical method is performed by other parameters and the like.

[Feature quantity extraction unit 42: FIG. 6]
Next, a specific configuration of the feature amount extraction unit 42 in the control terminal 4 will be described with reference to FIG. FIG. 6 is a block diagram of the feature amount extraction unit.
As shown in FIG. 6, the feature amount extraction unit 42 includes a parameter extraction unit 422, an incremental statistical processing unit 423, and a clustering processing unit 424.

[Parameter extraction unit 422]
The parameter extraction unit 422 extracts the target parameter of the single time incremental statistics in the frame shown in FIG. 3 from the received frame information input from the frame information output unit 114, and outputs the target parameter to the incremental statistics processing unit 423. The target parameters in FIG. 3 are suitable for measuring the increment of received frames.

[Incremental statistical processing unit 423]
The incremental statistic processing unit 423 calculates the increment of the target parameter in a certain period and performs a process of calculating the statistic of the incremental tendency.
As the statistical method, as shown in FIG. 5, a method applicable to each statistical parameter among the mean, standard deviation, covariance, and product moment correlation coefficient is used for the four statistical parameters.

For example, when the incremental statistical processing unit 423 performs statistical processing for the statistical parameter "reception interval" in FIG. 5 in a fixed time using the statistical method "mean" or "standard deviation", the feature parameters "FCBySrc" and "SseqByOrg" are used. Using "MT by Org", statistical processing is performed according to the usage parameters 1 and 2 corresponding to the parameter names shown in FIG. 3, and the parameters after statistical processing are calculated.

[Clustering processing unit 424]
The clustering processing unit 424 inputs the parameters after statistical processing (parameters after statistical processing), classifies the clustering based on the parameters shown in FIG. 4, and obtains the feature amount data (feature data) depending on the number of clusters. It is output to the normal learning unit 43 and the abnormal learning unit 44.
Specifically, the clustering processing unit 424 uses parameter 1 based on the feature parameter name of FIG. 4 for the four post-statistical processing parameters of "reception interval", "reception data size", "reception number", and "transmission waiting time". Performs a clustering classification using ..

[Partial configuration of control terminal 4: FIG. 7]
Next, a specific configuration of the control terminal 4 will be described with reference to FIG. 7. FIG. 7 is a partial block diagram of the control terminal.
As shown in FIG. 7, a partial configuration of the control terminal 4 shows a statistical display / control unit 41, a normal learning unit 43, and an abnormal learning unit 44.
As shown in FIG. 7, the statistical display / control unit 41 includes an output control unit 411, a display unit 412, a white / blacklist control unit 413, and a router / communication device control unit 414.

[Output control unit 411]
The output control unit 411 has a learning / abnormality detection switching unit 4111, a white / black determination unit 4112, a white list storage unit 4113, and a blacklist storage unit 4114.

[Learning / abnormality detection switching unit 4111]
The learning / abnormality detection switching unit 4111 inputs the received frame information from the frame information output unit 114 and outputs it to the white / black determination unit 4112, and the reception frame is normal (white) based on the determination result from the white / black determination unit 4112. ) Or abnormality (black) is detected, received frame information is output to the display unit 412, and the detection result is output to the normal learning unit 43 and the abnormality learning unit 44 as output switching.
However, when neither normal nor abnormal is detected, the learning / abnormality detection switching unit 4111 outputs only the received frame information to the display unit 412 without outputting the detection result.

Further, when the learning / abnormality detection switching unit 4111 determines that the input received frame information is white (normal), the learning / abnormality detection switching unit 4111 uses an instruction (learning instruction) for learning the input feature data to the normal learning unit 43 as output switching for normal learning. Output to unit 43.
Further, when the learning / abnormality detection switching unit 4111 determines that the input received frame information is black (abnormal), the learning / abnormality detection switching unit 4111 uses an instruction (learning instruction) for learning the input feature data to the abnormality learning unit 44 as output switching for abnormality learning. Output to unit 44.
That is, the learning / abnormality detection switching unit 4111 outputs the output switching (learning instruction) to either the normal learning unit 43 or the abnormality learning unit 44 for each input received frame information.

[White / Black determination unit 4112]
The white / black determination unit 4112 inputs the received frame information from the learning / abnormality detection switching unit 4111, refers to the white list storage unit 4113 and the black list storage unit 4114, and the received frame information is the white list storage unit 4113. It is determined whether it is stored in the blacklist storage unit 4114 or the determination result is output to the learning / abnormality detection switching unit 4111.
The determination result is "normal" if it is stored in the white list storage unit 4113, and "abnormal" if it is stored in the blacklist storage unit 4114.

[White list storage unit 4113]
The white list storage unit 4113 stores a plurality of normal (white) received frame information as a list, and when the received frame information for updating the white list is input from the white / blacklist control unit 413, the white list storage unit 4113 stores the white list. Update part 4113.
That is, the received frame information for updating the white list from the white / blacklist control unit 413 is stored in the whitelist storage unit 4113.

[Blacklist storage unit 4114]
The blacklist storage unit 4114 stores a plurality of abnormal (black) received frame information as a list, and when the received frame information for blacklist update is input from the white / blacklist control unit 413, the blacklist storage unit 4114 stores the blacklist. Part 4114 is updated.
That is, the received frame information for updating the blacklist from the white / blacklist control unit 413 is stored in the blacklist storage unit 4114.

[Display unit 412]
The display unit 412 inputs the received frame information from the learning / abnormality detection switching unit 4111 of the output control unit 411, inputs the error output from the normal learning unit 43, inputs the error output from the abnormality learning unit 44, and manages communication. Display the reception error for normal or abnormal reception frame information to the person or the like.
Further, the display unit 412 outputs the input received frame information to the white / blacklist control unit 413. When outputting the received frame information, a normal error output or an abnormal error output may be output together.

[White / Blacklist Control Unit 413]
The white / blacklist control unit 413 stores a threshold value for an error in determining whether reception is permitted or prohibited (permitted / prohibited) with respect to the received frame information, and the input normal received frame information is input. A normal (white) or abnormal (black) determination is made based on the error between the error and the abnormality, and the determination result and the received frame information are output to the white list storage unit 4113 or the blacklist storage unit 4114.
The normal or abnormal error output input from the display unit 412 is referred to in the normal or abnormal determination process.

Specifically, when the white / black list control unit 413 determines that the input received frame information is normal, the white / black list control unit 413 outputs the received frame information to the white list storage unit 4113 as received frame information for updating the white list. If the input received frame information is determined to be abnormal, the received frame information is output to the black list storage unit 4114 as received frame information for updating the black list.

Further, the white / blacklist control unit 413 changes and adjusts the threshold value for determining permission / prohibition based on the registration of permission / prohibition from the communication administrator or the like.
The white / blacklist control unit 413 does not determine whether reception is permitted / prohibited by the threshold value, but determines all by the permission / prohibition registration instruction from the communication administrator or the like, and determines the whitelist storage unit 4113 or the blacklist storage. The unit 4114 may be updated to control access to the router / communication device control unit 414. This is a manual control operation.

Further, when the white / blacklist control unit 413 determines whether the received frame information is normal / abnormal, the white / blacklist control unit 413 outputs access control information to the router / communication device control unit 414.
If the received frame information is abnormal, it is the access control information for which reception is prohibited, and if the received frame information is normal, it is the access information for canceling the reception prohibition.

[Router / Communication device control unit 414]
The router / communication device control unit 414 inputs access control information for reception prohibition or reception prohibition cancellation from the white / blacklist control unit 413, and outputs the access control information to the relay device 3 such as a router and the communication device 1. .. In the communication device 1, access control information is output particularly to the frame transmission / reception unit 112 of the network unit 11. In the relay device 3 and the communication device 1 in which the access control information is input, the process of prohibiting or canceling reception is performed.

[Normal learning unit 43, Abnormal learning unit 44: FIG. 8]
Next, the normal learning unit 43 and the abnormal learning unit 44 will be described with reference to FIG. FIG. 8 is a block diagram showing a normal learning unit / abnormal learning unit.
As shown in FIG. 8A, the normal learning unit 43 has a self-encoder 431, an error extraction / difference detection unit 432, and an output determination unit 433.
Further, as shown in FIG. 8B, the abnormality learning unit 44 has a self-encoder 441, an error extraction / difference detection unit 442, and an output determination unit 443.

[Self-encoder 431]
The autoencoder 431 is trained so that when only normal feature data is input as teacher data, the input data is encoded, and the encoded data is decoded, the input data and the decoded data are the same. It is an encoder (Autoencoder) having a model (learning model), and input data and decoded data are output to the error extraction / difference detection unit 432.

Therefore, the self-encoder 431 decodes the learning model so that the learning model becomes the normal feature data when the normal feature data is input, and the error between the input data and the decoded data is small. However, when the feature amount data that is not normal is input, the error between the input data and the decoded data becomes large because the learning model does not learn about the feature amount data that is not normal.

[Self-encoder 441]
The self-encoder 441 is trained so that when only abnormal feature amount data is input as teacher data, the input data is encoded, and the encoded data is decoded, the input data and the decoded data are the same. It is a encoder having a learning model, and input data and decoding data are output to the error extraction / difference detection unit 442.

Therefore, the self-encoder 441 decodes the learning model so that the learning model becomes the abnormal feature amount data when the abnormal feature amount data is input, and the error between the input data and the decoded data is small. However, when the feature amount data that is not abnormal is input, the error between the input data and the decoded data becomes large because the learning model does not learn about the feature amount data that is not abnormal.

[Error extraction / difference detection unit 432,442]
The error extraction / difference detection unit 432,442 inputs the feature amount data and the decoding data from the self- encoder 431, 441, extracts the error for both data, detects the difference, and the information of the difference (difference). Information) is output to the output determination units 433 and 443.

[Output determination 433,443]
The output determination 433 and 443 input the difference information from the error extraction / difference detection unit 432 and 442, and output the difference information to the display unit 412 as an error.
Further, when the output switching instruction from the learning / abnormality detection switching unit 4111 of the output control unit 411 is input to the output determination 433 and 443, the gradient information for correcting the difference is transmitted to the self- encoder 431 and 441. Feed back and reflect the gradient.

Specifically, the output determination unit 433 inputs an output switching instruction when the received frame information from the learning / abnormality detection switching unit 4111 is in the white list storage unit 4113. That is, since the feature amount data is that of a normal reception frame in the white list, the feature amount data is learned as normal teacher data by reflecting the gradient on the self-encoder 431.

Further, the output determination unit 443 inputs an output switching instruction when the received frame information from the learning / abnormality detection switching unit 4111 is in the blacklist storage unit 4114. That is, since the feature amount data is for an abnormal reception frame in the blacklist, the self-encoder 441 reflects the gradient and trains the feature amount data as abnormal teacher data.

[Processing operation in this system: Fig. 1]
Next, the characteristic processing operation of this system will be described with reference to FIG.
In this system, communication data (reception frame) received via the antenna 15, high frequency unit 14, wireless signal processing unit 13, and wireless access control unit 12 is input to the network unit 11, and the frame transmission / reception unit in the network unit 11 112 acquires control information about the received frame from the received frame and outputs it to the frame information output unit 114.

The frame information output unit 114 generates received frame information for extracting a feature amount from the control information related to the received frame, and outputs the received frame information to the control terminal 4.
The control terminal 4 extracts feature amount data (feature data) from the received frame information and outputs the feature amount data (feature data) to the normal learning unit 43 or the abnormal learning unit 44.
The normal learning unit 43 and the abnormal learning unit 44 learn normal received frame information and abnormal received frame information based on the feature data.

Further, the statistical display / control unit 41 of the control terminal 4 determines whether the input received frame information is normal or abnormal based on the learning results of the normal learning unit 43 and the abnormal learning unit 44, and if it is abnormal, relays. The device 3 and the frame transmission / reception unit 112 are instructed to prohibit reception, the reception of the reception frame is blocked, and if normal, the relay device 3 and the frame transmission / reception unit 112 are instructed to cancel the reception prohibition, and the reception frame is received.
As a result, this system can detect abnormal wireless communication (malicious wireless communication), block the communication, avoid unauthorized occupation of the wireless line, and ensure the security and quality of the communication. be.

[Effect of embodiment]
According to this system, the frame transmission / reception unit 112 of the communication device 1 outputs the control information of the received frame to the frame information output unit 114, and the frame information output unit 114 receives the reception frame for extracting the feature amount of the frame. Information is output to the control terminal 4, and the control terminal 4 determines whether the received frame information is normal or abnormal based on the white list or the black list, and if it is determined to be abnormal, the frame transmission / reception unit 112 of the communication device 1 and the relay. A movement that outputs reception prohibition access control information to the device 3 and outputs reception prohibition release access control information to the frame transmission / reception unit 112 and the relay device 3 when it is determined to be normal, and blocks or cancels reception. Since it is a communication system, even if there is no error in the control information used for communication, malicious wireless communication is detected as abnormal wireless communication, unauthorized occupation of the wireless line is prevented, and communication security and quality are ensured. There is an effect that can be done.

Further, in this system, the feature extraction unit 42 of the control terminal 4 extracts the feature amount data from the received frame information, and the statistical display / control unit 41 is normal as normal feature amount data if the received frame information is normal. Since the mobile communication system is such that the learning unit 43 is made to learn, and if the received frame information is abnormal, the abnormal learning unit 44 is made to learn as abnormal feature amount data, and the white list or the black list is updated using the learning result. , The feature amount data can be learned and the white list or the black list can be updated to improve the normality or abnormality determination accuracy of the received frame information.

The present invention is suitable for a mobile communication system that detects malicious wireless communication as abnormal wireless communication, blocks the communication, avoids unauthorized occupation of the wireless line, and secures the security and quality of the communication.

1 ... communication device, 2 ... communication terminal, 3 ... relay device, 4,40 ... control terminal, 10 ... communication device, 11,110 ... network unit, 12 ... wireless access control unit, 12a ... transmission / reception counter, 13 ... wireless signal Processing unit, 14 ... high frequency unit, 15 ... antenna, 41 ... statistical display / control unit, 42 ... feature extraction unit, 43 ... normal learning unit, 44 ... abnormal learning unit, 45 ... statistical display unit, 111, 1101 ... QoS function Unit, 112, 1102 ... Frame transmission / reception unit, 113, 1103 ... Communication method function unit, 114 ... Frame information output unit, 411 ... Output control unit, 412 ... Display unit, 413 ... White / black list control unit, 414 ... Router / Communication device control unit, 422 ... parameter extraction unit, 423 ... incremental statistical processing unit, 424 ... clustering processing unit, 431,441 ... self-encoder, 432,442 ... error extraction / difference detection unit, 433,443 ... output judgment Unit, 4111 ... Learning / abnormality detection switching unit, 4112 ... White / black judgment unit, 4113 ... White list storage unit, 4114 ... Black list storage unit

Claims (7)

1. A mobile communication system used in mobile networks.
   Received frame information for extracting the feature amount of the frame from the control information of the received frame is output, reception is blocked by the access control information of reception prohibition, and reception is canceled by the access control information of reception prohibition cancellation. Communication device and
   When the received frame information is input, whether the received frame information is normal or abnormal is determined based on a list of normal or abnormal received frame information stored in advance, and when it is determined to be abnormal, the above-mentioned A mobile communication system having a control terminal that outputs reception-prohibited access control information to a communication device and outputs access control information for canceling reception prohibition to the communication device when it is determined to be normal.
2. A relay device is installed between the communication device and the communication terminal.
   The control terminal outputs the reception prohibition access control information or the reception prohibition release access control information to the relay device.
   The mobile communication system according to claim 1, wherein the relay device blocks reception by using access control information for which reception is prohibited, and cancels reception by using access control information for releasing reception prohibition.
3. The control terminal extracts feature amount data from the received frame information, learns it as normal feature amount data if the received frame information is normal, and learns it as abnormal feature amount data if the received frame information is abnormal. The mobile communication system according to claim 1 or 2, wherein the list of normal or abnormal is updated by using the learning result.
4. The control terminal uses a self-encoder in learning, inputs the feature amount data about the received frame to the self-encoder as input data, and uses the difference between the output data from the self-encoder and the input data. The mobile communication system according to claim 3, wherein the normality or abnormality of the frame is determined based on the above.
5. The mobile communication system according to claim 4, wherein when the control terminal determines whether the received frame is normal or abnormal, the list of normal or abnormal is updated with the received frame information of the determined frame.
6. The mobile communication system according to any one of claims 1 to 5, wherein the control terminal calculates feature amount data by calculating a correlation between a plurality of parameters related to reception by a statistical method.
7. The mobile communication system according to any one of claims 1 to 6, wherein the control terminal clusters feature amount data from a plurality of parameters related to reception and obtains feature amount data for each cluster.

Images