TWI721693B - Network behavior anomaly detection system and method based on mobile internet of things - Google Patents

Abstract

The invention discloses network behavior anomaly detection system and method based on mobile internet of things (IoT). The system includes a network terminal anomaly detection module and a network topology anomaly detection module. The network terminal anomaly detection module has a signaling anomaly detection mechanism, a traffic anomaly detection mechanism and a connection state anomaly detection mechanism to respectively detect abnormalities of the signaling, the traffic and the connection state of the network terminal. The network topology anomaly detection module has a cell data analysis mechanism and an IoT terminal group data analysis mechanism to detect abnormalities of the cell and the IoT terminal group.

Description

Network behavior abnormal detection system and method based on mobile internet of things

The present invention relates to a network behavior anomaly detection technology. Specifically, it relates to a network behavior anomaly detection system and method based on the mobile Internet of Things.

In recent years, with the continuous growth of the mobile Internet of Things business, the number of Internet of Things terminals has increased significantly, and various mobile network operators are actively deploying Internet of Things monitoring systems in order to quickly grasp the connection status of the Internet of Things terminals and optimize them. Own network quality.

The conventional network behavior abnormal detection technology of the Internet of Things requires analysis on the Internet of Things terminal, or additional devices are added to some terminals. However, in addition to the limited number of samples, this conventional technique also causes a sharp increase in cost. In particular, because the number of IoT terminals is huge and scattered in various places, the efficiency of monitoring and maintenance through manpower is obviously not good, and it is difficult to grasp the exact status of each terminal. In addition, because it is difficult to determine whether the terminal is really abnormal, it is impossible to label the network behavior of the abnormal terminal. Furthermore, due to the lack of an automated mechanism for judging the abnormalities of the IoT terminals, the detection methods are not comprehensive enough, and the accuracy rate is not high, making it difficult for mobile operators to grasp the operation status of a large number of IoT terminals.

Therefore, how to provide a novel or innovative network behavior anomaly detection technology based on the Internet of Mobile Things has actually become a major research topic for those skilled in the art.

The present invention provides a network behavior abnormality detection system based on mobile Internet of Things, including: a network terminal abnormality detection module, which has a signaling surface abnormality detection mechanism, a traffic surface abnormality detection mechanism, and an abnormal connection state Detection mechanism to separately detect the abnormalities of the signaling side, traffic side and connection status of the network terminal; and the network topology anomaly detection module, which has a cellular data analysis mechanism and an Internet of Things terminal Group surface data analysis mechanism to detect abnormalities of both cell and IoT terminal groups respectively.

In one embodiment, the network behavior anomaly detection system includes a network feature collection module for collecting signaling plane data, traffic plane data, and connection status data of the mobile network, and monitoring the signaling plane Data, communication face data, and connection status data are compiled and preprocessed.

In one embodiment, the network feature collection module executes the following process: determine whether there is historical data of the network terminal, and if there is no historical data, collect historical time-sharing data to obtain the information of the mobile network within a predetermined period. Make face data, communication face data and offline time of the network terminal; collect the latest time-sharing data to obtain the signal face data and communication face data of the mobile network; and perform the historical time-sharing data and the latest time-sharing data Consolidation and preprocessing, and update historical data.

In one embodiment, the signaling plane anomaly detection mechanism of the network terminal anomaly detection module includes the following procedures: periodically import the signaling plane history data of the network terminal, and retrain the signaling based on the signaling plane history data To update the model parameters, import the latest time-sharing data of the signalling surface of the network terminal; use the signalling surface anomaly determination model for abnormality determination; and export the list of abnormal network terminals.

In one embodiment, the signaling plane abnormality determination model is used for abnormal sample identification and abnormal cause estimation, wherein the abnormal sample identification is determined by an outlier determination algorithm, and the abnormal cause estimation is aggregated and recorded Behavioral characteristics that lead to outliers.

In one embodiment, the network terminal anomaly detection module's traffic surface anomaly detection mechanism includes the following procedures: regularly importing the network terminal’s historical data of the traffic surface; retraining the traffic based on the historical data of the network terminal Surface anomaly determination model; use the traffic surface anomaly determination model to predict the operation trajectory of the network terminal on the day; import the latest time-sharing data of the network terminal's traffic surface; detect whether the network terminal is abnormal; and export the abnormal network terminal List.

In one embodiment, the traffic surface abnormality determination model is a time series model, such as an Autoregressive Integrated Moving Average (ARIMA) model. The prediction network terminal's daily operation trajectory includes a predicted value and a confidence interval And the detection of whether the network terminal is abnormal is determined by comparing the predicted value with the actual value.

In one embodiment, the connection status anomaly detection mechanism of the network terminal anomaly detection module includes the following procedures: import offline time history data of each IoT terminal group; use an offline time threshold identification model to determine The offline threshold of each IoT terminal group; real-time determine the connection status of the network terminal in each IoT terminal group, if it is determined that the connection status is offline, determine whether the offline period of the network terminal is too long according to the offline threshold; And export the network terminal with too long offline period and its offline time.

In one embodiment, the offline time threshold determination model uses a univariate clustering algorithm to determine the offline threshold.

In one embodiment, the cell surface data analysis mechanism of the network topology anomaly detection module includes the following procedures: the determination of resident cells is performed by selecting the cell with the most frequently connected network terminal, and the cell is in the most recent period. The number of network terminals connected during the period exceeds a predetermined threshold and the cell is recognized as a resident cell; the signalling surface data, the traffic surface data and the connection status data of each network terminal are imported into the mobile network, and the data is filtered and Resident cell-related data; and determine whether each resident cell is abnormal from the signaling plane, the communication plane, and the connection status.

In one embodiment, the IoT terminal group surface of the network topology anomaly detection module The data analysis mechanism includes the following procedures: set the network terminal that has been online in the most recent period in each IoT terminal group as the active network terminal; The connection status data of the network terminal, and the data related to the active network terminal are filtered; and the signaling surface, the communication surface and the connection status are used to determine whether each IoT terminal group is abnormal.

The present invention also provides a method for detecting abnormal network behavior based on the Internet of Animals, including: capturing signaling plane data, traffic plane data, and connection status data of a mobile network; using outlier algorithm to process signaling Surface data to detect whether the signaling surface of the mobile network is abnormal; use the time series model to process the signal surface data and make predictions to determine whether the signal surface of the mobile network is abnormal; and use a univariate clustering algorithm to process the connection Online status data to detect whether the mobile network connection status is abnormal.

In one embodiment, the method for detecting abnormal network behavior further includes: determining resident cells; screening signaling plane data, communication plane data, and connection status data belonging to resident cells; The surface and connection status are used to determine whether the resident cells are abnormal.

In one embodiment, the method for detecting abnormal network behavior further includes: finding recently connected network terminals from each IoT terminal group; filtering the signaling plane data and communication planes related to the network terminal Data and connection status data; and determine whether each IoT terminal group is abnormal from the signaling plane, traffic plane, and connection state respectively.

The network behavior anomaly detection system and method based on the mobile Internet of Things of the present invention have at least the following advantages or technical effects.

First, by collecting mobile network data, the connection behavior between the terminal and the central office is constructed using artificial intelligence algorithms such as time series and outliers to construct an abnormal behavior detection model for the Internet of Things terminal, so it can effectively analyze the behavior. The actual usage status of all terminals of the animal network can be observed at each terminal without the need for conventional technology. In addition, even when any IoT terminal is damaged and disconnected, the abnormality can be detected in the first time through the detection model of the present invention. Affect operational performance.

Furthermore, the signaling plane anomaly detection mechanism, traffic plane anomaly detection mechanism, and connection status anomaly detection mechanism of the present invention can perform comprehensive abnormal behavior detection for signaling, traffic, and connection status, respectively, and The related detection mechanism is fully automated, so it can effectively improve the efficiency of maintaining a large number of IoT terminals.

In addition, since the training model of the present invention introduces the concept of moving panes, the detection model can be adjusted regularly (for example, daily or hourly) according to the latest collected data, so it can fully and effectively respond to the behavior of the IoT terminal Trend.

1‧‧‧Network behavior anomaly detection system

10‧‧‧Network Feature Collection Module

101‧‧‧Signaling plane data

102‧‧‧Communication information

103‧‧‧Connection status data

11‧‧‧Network terminal anomaly detection module

111‧‧‧Signaling plane anomaly detection mechanism

112‧‧‧Traffic surface anomaly detection mechanism

113‧‧‧Connection status abnormal detection mechanism

12‧‧‧Network topology anomaly detection module

121‧‧‧Cell surface data analysis mechanism

122‧‧‧IOT terminal group data analysis mechanism

13‧‧‧Maintenance query interface

14‧‧‧Maintenance terminal

Steps S21 to S26, S31 to S35‧‧‧

Steps S41 to S46, S51 to S55‧‧‧

Steps S61 to S65, S651 to S659‧‧‧

Steps S71 to S75, S751 to S758‧‧‧

Steps S81 to S84, S851 to S853‧‧‧

Steps S861 to S863‧‧‧

Figure 1 shows a schematic block diagram of the mobile Internet of Things-based network behavior anomaly detection system of the present invention;

Figure 2 shows the operation flow chart of the network feature collection module of the present invention;

Figure 3 shows a flowchart of the signaling plane anomaly detection mechanism of the present invention;

Figure 4 shows a flow chart of the traffic surface anomaly detection mechanism of the invention;

Figure 5 shows a flow chart of the connection status abnormal detection mechanism of the present invention;

Figure 6 shows a flow chart of the cell surface data analysis mechanism of the present invention;

Figure 7 shows a flowchart of the data analysis mechanism of the IoT terminal group plane of the present invention; and

Figure 8 shows a flow chart of the method for detecting abnormal network behavior based on the mobile Internet of Things of the present invention.

The following specific examples illustrate the implementation of the present invention, familiar with this Those skilled in the art can easily understand the advantages and effects of the present invention from the contents disclosed in this specification.

Figure 1 shows a schematic block diagram of the network behavior anomaly detection system 1 based on the mobile Internet of Things of the present invention. The main components of the network behavior anomaly detection system 1 include a network terminal anomaly detection module 11 and a The network topology anomaly detection module 12, for example, the network terminal anomaly detection module 11 or the network topology anomaly detection module 12 can be a hardware detector or a software detection program. The network terminal anomaly detection module 11 includes a signaling plane anomaly detection mechanism 111, a communication plane anomaly detection mechanism 112, and a connection status anomaly detection mechanism 113 to detect the signaling of the network terminal separately Abnormalities in the three aspects of the interface, communication interface, and connection status. The network topology anomaly detection module 12 includes a cell surface data analysis mechanism 121 and an IoT terminal group data analysis mechanism 122 to detect abnormalities of both the cell and the IoT terminal group respectively. The cell referred to here refers to the base station of the mobile network.

As shown in Figure 1, the network behavior anomaly detection system 1 may include a network feature collection module 10, such as a hardware collector or a software collection program. The network feature collection module 10 can collect the signaling plane data 101, the communication plane data 102, and the connection state data 103 of the network terminal, and the signaling plane data 101, the communication plane data 102 and the connection state data 103 Perform aggregation and preprocessing. The aggregated mobile network data collected by the network feature collection module 10 can be provided to the network terminal anomaly detection module 11 and the network topology anomaly detection module 12 for the network terminal anomaly detection module 11 The network topology anomaly detection module 12 performs anomaly detection and determination based on these mobile network data.

In one embodiment, the network feature collection module 10 can use a signal capture unit to automatically and regularly capture the cross-interface signaling and traffic data of the network terminal on the network, and perform the network from the signaling plane. The online connection behavior and offline information analysis of the road terminal, and the online information analysis of the application service of the network terminal from the communication side. Therefore, the network feature collection module 10 can regularly aggregate the data of a specific Internet of Things network terminal, and perform data preprocessing at the same time, and then the preprocessed data The results are stored in a database to provide model training and automatic detection mechanisms required by the subsequent network terminal anomaly detection module 11 and network topology anomaly detection module 12 for use.

According to the various aspects of data generated by the network feature collection module 10, the network terminal anomaly detection module 11 can execute the signaling plane anomaly detection mechanism 111, the traffic plane anomaly detection mechanism 112, and the connection status anomaly detection mechanism 113. Use methods such as outlier algorithm and time series analysis to detect abnormalities in various aspects of the network terminal, and store the abnormal detection results in the database for maintenance and operation query interface 13 and network topology The Park anomaly detection module 12 is used for subsequent analysis. At the same time, the network terminal anomaly detection module 11 will also modify the algorithm and model parameters based on the detection and verification results and feedback of the maintenance terminal 14. In addition, the maintenance personnel can also provide the network feature collection module 10 with a list of door numbers of the network terminals to be collected via the maintenance terminal 14.

The network topology anomaly detection module 12 is responsible for analyzing various network topology detection benchmarks. The applicable network topology, in addition to the cell and IoT terminal groups mentioned above, can also be applied to Access Point Name (APN), etc., or extended to various mobile network components (such as packet Packet Gateway) and so on. In this embodiment, taking the cell and IoT terminal group as an example, the network topology anomaly detection module 12 may include a cell surface data analysis mechanism 121 and an IoT terminal group surface data analysis mechanism 122, using the network The statistical data and anomaly list produced by the feature collection module 10 and the network terminal anomaly detection module 11 are further integrated, and the set network topology analysis logic is used to detect the abnormal state, and the result can be written Into the database or any storage medium for the maintenance personnel to access and use.

It is worth noting that multiple modules, such as the network feature collection module 10, the network terminal anomaly detection module 11, and the network topology anomaly detection module 12, can be deployed on the same hardware platform, and more The communication between the two modules is carried out through the program interface; or, it can also be deployed on different hardware platforms, and the communication between multiple modules is through the IP (Internet Protocol; Internet Protocol)-based communication protocol. get on. For example, the mobile network to which the present invention can be implemented includes UMTS (Universal Mobile Communication) Communication system) mobile network, LTE (Long Term Evolution Technology) mobile network, 5G mobile network, etc., but not limited to this.

FIG. 2 shows the operation flow chart of the network feature collection module 10 of the present invention and includes the following steps, and is described with reference to FIG. 1. First, the network feature collection module 10 can periodically (for example, daily) determine whether there is historical data of the network terminal (step S21). That is, it is determined whether the network terminal that the maintenance personnel pays attention to in the door number list has historical data that can provide model training. If there is no historical data, then re-collect historical time-sharing data (step S22) to obtain the mobile network signaling surface data 101, communication surface data 102 and offline time of the network terminal within a predetermined period. If there is historical data, the historical data can be directly read (step S23). On the other hand, the latest time-sharing data is collected regularly (for example, every hour) (step S24) to obtain the latest signaling plane data 101 and traffic plane data 102 of the mobile network. Subsequently, the acquired historical time-sharing data and the latest time-sharing data are collected and preprocessed (step S25), and then the historical data is updated and the latest data is exported (step S26).

In one embodiment, if the LTE mobile network is taken as an example, the above-mentioned signaling plane data 101 may include the number of control signaling of each network terminal per hour (for example, Attach, Track Area Update, Handover, Path Switch, Service Request (normal), Service Request (abnormal), Control Plane Service Request, ESM data transport), the number of resident cells, and the traffic data 102 can include the download transmission volume, upload transmission volume, downlink throughput, and uplink of the network terminal Information such as throughput and LTE packet ratio. In addition, the offline information of the network terminal can also be aggregated from the accounting signaling (such as Radius accounting) data of the mobile network.

Figure 3 shows the flow chart of the signaling plane anomaly detection mechanism of the present invention and includes the following steps. First, the historical data of the signaling plane of the network terminal can be imported regularly (for example, daily) (step S31). Next, the signaling plane abnormality determination model is trained based on the historical data of the signaling plane (step S32) to update the model parameters. On the other hand, it is possible to import the latest time-sharing data of the signaling plane of the network terminal (step S33), and use the updated signaling plane abnormality determination model for abnormality determination (step S34). After completing the anomaly After setting, the list of abnormal network terminals can be exported (step S35).

The signaling plane abnormality determination model is mainly used for abnormal sample identification and abnormal cause estimation. The abnormal sample identification is determined by an outlier determination algorithm (for example, isolation forest and/or local anomaly factor). Outlier Factor)), the purpose is to identify outlier samples with special behavior, and treat the outlier samples as abnormal. After setting the outlier ratio and training data, it can be determined whether the data with the same distribution is an outlier. At the same time, the cause of the anomaly is speculated to be the behavioral characteristics that lead to outliers, such as outliers caused by too many characteristic values. In this way, the maintenance personnel can observe the extreme values (such as the 99th percentile) of each characteristic historical data, and regard the extreme values as the criterion for judging abnormal outliers.

In addition, it should be pointed out that because the signaling plane anomaly detection mechanism imports the latest time-sharing data every hour, and obtains the judgment model parameters such as outliers of the day and the extreme values of each feature through the aforementioned process, it is in progress. After the abnormality judgment is compared, a list of abnormal door numbers and their causes can be immediately obtained. Specifically, the outlier threshold of each eigenvalue can be calculated by the outlier algorithm through the above abnormal sample identification; then, it is determined whether each eigenvalue is higher than the outlier threshold one by one, and the eligible features are listed as the cause (phenomenon) ) Field.

Figure 4 shows a flow chart of the traffic plane anomaly detection mechanism of the present invention. First, periodically (for example, daily) import the historical data of the network terminal's traffic face (step S41). Then, retrain the abnormality determination model of the traffic plane according to the historical data of the traffic plane (step S42). Then, the traffic surface abnormality determination model is used to predict the operation trajectory of the network terminal on that day (step S43). On the other hand, import the latest time-sharing data of the network terminal's communication surface regularly (for example, every hour) (step S44). Furthermore, by comparing the predicted operation trajectory with the latest time-sharing data of the communication surface, it is detected whether the network terminal is abnormal (step S45). Finally, a list of abnormal network terminals (for example, a list of door numbers of abnormal network terminals) can be exported (step S46).

In one embodiment, it is considered that the traffic data has obvious periodicity and the front and back phases. Relatedly, the traffic surface abnormality determination model may select a time series model, such as an integrated moving average autoregressive (ARIMA) model. This time series model can calculate the reasonable traffic volume at the time point according to the change of time. For example, the traffic volume of some network terminals at night is much lower than the day traffic volume. This time series model can be used to target different time points. Calculate the appropriate traffic changes. The predicted operation trajectory of the network terminal on the day includes the predicted value and the confidence interval. Therefore, when detecting whether the network terminal is abnormal, it can be judged by comparing the predicted value with the actual value. That is, in the aspect of anomaly detection, the judgment will be made by comparing the forecast value of the day with the latest time-sharing data. If the actual value falls outside the confidence interval, it is determined that the communication surface of the network terminal at this point in time is abnormal.

Figure 5 shows a flow chart of the connection status abnormal detection mechanism of the present invention. First, import the offline time history data of each IoT terminal group regularly (for example, daily) (step S51). Next, the offline time threshold identification model is used to determine the offline threshold of each IoT terminal group (step S52). On the other hand, the connection status of the network terminal in each IoT terminal group is determined in real time (step S53). If it is determined that the connection status is offline, it is determined whether the offline period of the network terminal is too long according to the offline threshold (step S54). ). Finally, a list of network terminals with too long offline period and offline time can be exported (step S55).

In one embodiment, the above-mentioned offline time threshold determination model determines the offline threshold through a univariate grouping algorithm (such as Jenks Break).

It should be noted that, because the network terminals of each IoT terminal group may have specific short-term offline or enter the dormant mechanism, when determining whether the network terminal is abnormal, in addition to capturing the offline ones, Further filter the network terminals with abnormal offline time. The connection status anomaly detection mechanism finds the most suitable cutting point through the univariate grouping algorithm, which is regarded as the offline time threshold of the network terminal of each IoT terminal group. These breakpoint values can reasonably cut the offline time distribution, divide the offline time into different clusters, and then select one of the offline time of the clusters as a reasonable offline time threshold. After obtaining the offline time threshold, that is When an offline network terminal is detected, it can be filtered through this mechanism. That is, a network terminal whose offline time is greater than the offline time threshold (for example, 300 minutes) will be regarded as an abnormal connection status.

Figure 6 shows the flow chart of the cell surface data analysis mechanism of the present invention. First, determine the resident cells on a regular basis (e.g. daily) (step S61), in which the cell with the most frequent connection to the network terminal is selected, and the network terminal that the cell is connected to in the most recent period (such as the last few days) If the number exceeds a predetermined threshold, it will be recognized as resident cells, and a list of resident cells will be generated (step S62). That is, by analyzing the number of cell connections, the cells with too few connections can be filtered out. On the other hand, periodically (e.g. every hour) import the signalling surface data, the traffic surface data and the connection status data of each network terminal of the mobile network (step S63), and filter the data related to the resident cells (step S63). S64). Then, it can be determined whether each resident cell is abnormal from the signaling plane, the traffic plane and the connection status (step S65).

In particular, when determining whether each resident cell is abnormal from the signaling plane, the traffic plane, and the connection status, the aforementioned signaling plane anomaly detection mechanism, the traffic plane anomaly detection mechanism, and the connection status are abnormal. The relevant processes revealed by the detection mechanism are carried out. As shown in Figure 6, for the data related to the resident cells after screening, the signaling surface data can be summed by cell and time (step S651) to obtain the signaling surface data of each resident cell; or take the data of each cell The median or percentile of the time-sharing communication surface data is represented (step S652), and the time-sharing trend estimation of the communication surface data of each resident cell is obtained. Then, perform signaling plane anomaly detection mechanism, traffic plane anomaly detection mechanism, and connection status anomaly detection mechanism for signaling plane data, traffic plane data, and network terminal status data related to each resident cell connection. Related procedures of the testing mechanism. In addition, executing the signaling plane abnormality detection mechanism (step S653) can generate a list of abnormal cells (step S654); executing the signaling plane abnormality detection mechanism (step S655) can generate cell characteristic trajectories and related alarms (step S656) Execute the connection status abnormal detection mechanism (step S657), which can generate an offline threshold for abnormal cells (step S658), and generate a list of offline cells and offline time (step S659).

Figure 7 shows a flow chart of the data analysis mechanism of the IoT terminal group plane of the present invention. First, determine the active door number regularly (for example, daily) (step S71) to set the network terminal that has been online in the most recent period (for example, the last few days) in each IoT terminal group as the active network terminal. Then, a list of active door numbers is generated according to the active network terminal (step S72). That is, by filtering the network terminals that have been online in the last few days for analysis, the overall indicators of the IoT terminal group can be prevented from being affected by the offline network terminals. On the other hand, periodically (e.g. every hour) import the signalling surface data, the communication surface data and the connection status data of each network terminal of the mobile network (step S73), and filter the data related to the active network terminal (Step S74). Then, it can be determined whether each IoT terminal group is abnormal from the signaling plane, the traffic plane, and the connection status (step S75).

Similarly, when determining whether each IoT terminal group is abnormal from the signaling plane, the traffic plane, and the connection status, the aforementioned signaling plane anomaly detection mechanism and the traffic plane anomaly detection mechanism can also be used to determine whether they are abnormal. get on. As shown in Figure 7, the relevant data of the active network terminals after screening can be added to the signaling plane data according to the IoT terminal group and time (step S751) to obtain the signaling plane data of each active network terminal ; Or take the median or percentile of the time-sharing data of each IoT terminal group as a representative (step S752), and get the time-sharing trend estimation of the data of each active network terminal . Then, perform the signaling plane anomaly detection mechanism and the traffic plane anomaly detection mechanism on the obtained signaling plane data, the time-sharing trend estimation of the traffic plane data, and the connection status data of each active network terminal. Related processes. In addition, executing the signaling plane anomaly detection mechanism (step S753) can generate a list of abnormal IoT terminal groups (step S754); executing the traffic plane anomaly detection mechanism (step S755) can generate a list of IoT terminal groups Characteristic trajectory and related alarms (step S756); analyze the connection number trend of each IoT terminal group through the time series model to determine whether the number of connections is abnormal (step S757), and generate an IoT terminal group with abnormal connection The time point of the group (step S758).

It is worth noting that the detection of the connection status of the IoT terminal group can be By regularly recording the online door numbers of the network terminals of each IoT terminal group, and try to raise an alarm at the time when the online door numbers are too few. Since each Internet of Things terminal group has different online behaviors, and has a certain degree of periodicity, front-end correlation, the present invention adopts a traffic surface anomaly detection mechanism to estimate the time point of each Internet of Things terminal group through a time series model Reasonable range of online number, and use this as the basis for determining the abnormal value of the number of connections in each period of the Internet of Things terminal group.

Figure 8 shows the flow chart of the method for detecting abnormal network behaviors based on the mobile Internet of Things of the present invention, and this method mainly includes the following steps. The rest of the content is the same as the description of Figures 1 to 7 above, and will not be omitted here. Repeat the narrative. First, retrieve the signaling plane data, traffic plane data, and connection status data of the mobile network (step S81). Then, the outlier algorithm is used to process the signaling plane data to detect whether the signaling plane of the mobile network is abnormal (step S82). Then, the time series model is used to process the traffic surface data and make predictions to determine whether the traffic surface of the mobile network is abnormal (step S83). Then, a univariate grouping algorithm is used to process the connection status data to detect whether the connection status of the mobile network is abnormal (step S84).

In one embodiment, the above-mentioned method for detecting abnormal network behavior further includes the following steps. First, the resident cell determination is performed (step S851). Then, the signaling plane data, the traffic plane data and the connection status data belonging to the resident cell are screened (step S852). Finally, it is determined whether the resident cell is abnormal from the signaling plane, the traffic plane and the connection status (step S853).

In one embodiment, the above-mentioned method for detecting abnormal network behavior further includes the following steps. First, find the recently connected network terminal from each IoT terminal group (step S861). Then, the signaling plane data, traffic plane data, and connection status data related to the network terminal are filtered (step S862). Finally, the signaling plane, the traffic plane and the connection status are used to determine whether each IoT terminal group is abnormal (step S863).

The network behavior anomaly detection system and method based on the mobile Internet of Things of the present invention have at least the following advantages or technical effects.

First, by collecting mobile network data, the connection behavior between the terminal and the central office is constructed using artificial intelligence algorithms such as time series and outliers to construct an abnormal behavior detection model for the Internet of Things terminal, so it can effectively analyze the behavior. The actual usage status of all terminals of the animal network can be observed at each terminal without the need for conventional technology. Moreover, even when any IoT terminal is damaged and disconnected, the abnormality can be detected in the first time through the detection model of the present invention, without affecting the operating performance.

Furthermore, the signaling plane anomaly detection mechanism, traffic plane anomaly detection mechanism, and connection status anomaly detection mechanism of the present invention can perform comprehensive abnormal behavior detection for signaling, traffic, and connection status, respectively, and The related detection mechanism is fully automated, so it can effectively improve the efficiency of maintaining a large number of IoT terminals.

In addition, because the training model of the present invention introduces the concept of moving panes, the detection model can be adjusted regularly (for example, daily or hourly) according to the latest collected data, so it can fully and effectively respond to changes in the behavior of IoT terminals trend.

The above-mentioned embodiments are only illustrative to illustrate the technical principles, features and effects of the present invention, and are not intended to limit the scope of the present invention. Anyone familiar with this technology can do the same without departing from the spirit and scope of the present invention. The above embodiments are modified and changed. However, any equivalent modifications and changes made by using the teachings of the present invention should still be covered by the scope of the attached patent application. The scope of protection of the rights of the present invention shall be as listed in the scope of the attached patent application.

1‧‧‧Network behavior anomaly detection system

10‧‧‧Network Feature Collection Module

101‧‧‧Signaling plane data

102‧‧‧Communication information

103‧‧‧Connection status data

11‧‧‧Network terminal anomaly detection module

111‧‧‧Signaling plane anomaly detection mechanism

112‧‧‧Traffic surface anomaly detection mechanism

113‧‧‧Connection status abnormal detection mechanism

12‧‧‧Network topology anomaly detection module

121‧‧‧Cell surface data analysis mechanism

122‧‧‧IOT terminal group data analysis mechanism

13‧‧‧Maintenance query interface

14‧‧‧Maintenance terminal

Claims (14)

A network behavior anomaly detection system based on the mobile Internet of Things, including: a network terminal anomaly detection module, which has a signaling plane anomaly detection mechanism, a traffic plane anomaly detection mechanism, and a connection status anomaly detection mechanism , To detect the abnormalities of the signaling side, the communication side and the connection status of the network terminal separately; and the network topology anomaly detection module, which has the cell surface data analysis mechanism and the IoT terminal group surface Data analysis mechanism to detect abnormalities of both cells and IoT terminal groups respectively. Among them, the network behavior abnormality detection system uses an outlier algorithm to process the signaling surface data of the mobile network to detect the movement Whether the signaling surface of the network is abnormal, use the integrated moving average autoregressive (ARIMA) model to process the mobile network’s traffic surface data and make predictions to determine whether the mobile network’s traffic surface is abnormal, and use univariate grouping The algorithm processes the connection status data of the mobile network to detect whether the connection status of the mobile network is abnormal. For example, the network behavior anomaly detection system described in item 1 of the scope of the patent application further includes a network feature collection module for collecting signaling surface data, communication surface data, and connection status data of the mobile network , And perform aggregation and preprocessing on the signaling plane data, the communication plane data, and the connection status data. For example, the network behavior anomaly detection system described in item 2 of the scope of patent application, wherein the network feature collection module executes the following process: determine whether there is historical data of the network terminal, if there is no historical data, then Collect historical time-sharing data to obtain the signalling surface data, the communication surface data and the offline time of the network terminal of the mobile network within a predetermined period; Collect the latest time-sharing data to obtain the signaling plane data and the communication plane data of the mobile network; and perform aggregation and preprocessing on the historical time-sharing data and the latest time-sharing data, and update the historical data. For example, the network behavior anomaly detection system described in item 1 of the scope of patent application, wherein the signaling surface anomaly detection mechanism of the network terminal anomaly detection module includes the following procedures: regularly importing the network terminal Based on the historical data of the signaling plane, retrain the signaling plane abnormality determination model to update the model parameters; import the latest time-sharing data of the signaling plane of the network terminal; use the signaling plane abnormality determination model Perform abnormal judgment; and export a list of abnormal network terminals. For example, the network behavior abnormality detection system described in item 4 of the scope of patent application, wherein the signaling plane abnormality determination model is used for abnormal sample identification and abnormal cause estimation, and wherein the abnormal sample identification is based on separation The group value is determined by the algorithm, and the cause of the abnormality is presumed to be the behavioral characteristics of outliers caused by the aggregation and recording. For example, the network behavior anomaly detection system described in item 1 of the scope of patent application, wherein the traffic surface anomaly detection mechanism of the network terminal anomaly detection module includes the following procedures: regularly import the network terminal's Historical data of the traffic plane; based on the historical data of the traffic plane, it is retrained as the traffic plane anomaly determination model of the integrated moving average autoregressive (ARIMA) model; the traffic plane anomaly determination model is used to predict the network terminal's current Operation track; import the latest time-sharing data of the network terminal's communication surface; Detect whether the network terminal is abnormal; and export a list of abnormal network terminals. For example, the network behavior abnormality detection system described in item 6 of the scope of patent application, wherein the prediction of the network terminal's operation trajectory on the day includes a prediction value and a confidence interval, and the detection of whether the network terminal is abnormal is It is determined by comparing the predicted value with the actual value. For example, the network behavior anomaly detection system described in item 1 of the scope of patent application, wherein the connection status anomaly detection mechanism of the network terminal anomaly detection module includes the following procedures: import each IoT terminal group The offline time history data of the group; use an offline time threshold recognition model to determine the offline threshold of each IoT terminal group; determine the connection status of the network terminal in each IoT terminal group in real time, and if the connection is determined When the online status is offline, it is determined whether the offline period of the network terminal is too long according to the offline threshold; and the network terminal with too long offline period and its offline time are exported. For example, the network behavior abnormality detection system described in item 8 of the scope of patent application, wherein the offline time threshold determination model determines the offline threshold through the univariate clustering algorithm. For example, the network behavior anomaly detection system described in item 1 of the scope of patent application, wherein the cell surface data analysis mechanism of the network topology anomaly detection module includes the following procedures: resident cell determination, wherein, by selecting The cell with which the network terminal connects most frequently, and the number of the network terminal connected by the cell in the most recent period exceeds a predetermined threshold, and the cell is recognized as a resident cell; it is connected to the signaling surface of the mobile network Data, communication surface data, and connection status data of each network terminal, and filter data related to the resident cell; and The signaling plane, the communication plane, and the connection status are used to determine whether each resident cell is abnormal. For example, in the network behavior anomaly detection system described in item 1 of the scope of patent application, the network topology anomaly detection module's IoT terminal group data analysis mechanism includes the following procedures: The network terminal that has been online in the most recent period in the terminal group is set as the active network terminal; the signaling surface data, the communication surface data and the connection status data of each network terminal are imported into the mobile network, And filter the data related to the active network terminal; and determine whether each of the IoT terminal groups is abnormal from the signaling plane, the communication plane, and the connection status. A method for detecting abnormal network behavior based on the mobile Internet of Things, including: capturing signaling plane data, communication plane data, and connection status data of a mobile network; using outlier algorithm to process the information of the mobile network Make surface data to detect whether the signaling surface of the mobile network is abnormal; use an integrated moving average autoregressive (ARIMA) model to process the mobile network’s traffic surface data and make predictions to determine the signal of the mobile network Whether the business surface is abnormal; and using a single variable clustering algorithm to process the connection status data of the mobile network to detect whether the connection status of the mobile network is abnormal. The network behavior abnormal detection method described in item 12 of the scope of the patent application further includes: determining the resident cells; Screen the signaling plane data, the communication plane data and the connection state data belonging to the resident cell; and determine whether the resident cell is abnormal from the signaling plane, the communication plane and the connection state respectively. For example, the method for detecting abnormal network behavior described in item 12 of the scope of the patent application further includes: finding the recently connected network terminal from each IoT terminal group; filtering the information related to the network terminal Make the surface data, the communication surface data and the connection status data; and determine whether each of the IoT terminal groups is abnormal from the signaling surface, the communication surface, and the connection status, respectively.

Images