WO2017028031A1 - 一种移动网络安全的处理方法、警示方法及用户终端 - Google Patents

一种移动网络安全的处理方法、警示方法及用户终端 Download PDF

Info

Publication number
WO2017028031A1
WO2017028031A1 PCT/CN2015/087033 CN2015087033W WO2017028031A1 WO 2017028031 A1 WO2017028031 A1 WO 2017028031A1 CN 2015087033 W CN2015087033 W CN 2015087033W WO 2017028031 A1 WO2017028031 A1 WO 2017028031A1
Authority
WO
WIPO (PCT)
Prior art keywords
event
network
target
communication
switching
Prior art date
Application number
PCT/CN2015/087033
Other languages
English (en)
French (fr)
Inventor
黄征
郝勇钢
龙宇
来学嘉
陈璟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2015/087033 priority Critical patent/WO2017028031A1/zh
Priority to CN201580046897.4A priority patent/CN106664309B/zh
Publication of WO2017028031A1 publication Critical patent/WO2017028031A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present invention relates to the field of mobile network security, and in particular, to a mobile network security processing method, a warning method, and a user terminal.
  • the prompt character is used to represent various network conditions on the screen of the mobile user terminal.
  • the network is displayed as a GPRS network, and the display is performed.
  • the character is E, it means that the network is an EDGE network. Both of these are 2G networks.
  • the display characters are 3G, H or H+, they indicate that they are in 3G network and HSPA network. Or HSPA+ network, users can use these identifiers to understand the current network status.
  • the present invention provides a mobile network security processing method, a warning method, and a user terminal, which can solve the problem that the user cannot know the communication between the mobile user terminal and the base station, so that the user may communicate under an insecure network.
  • the problem of poor network security is caused, and after an attack event against the user occurs, the possible cause of the event cannot be traced through the event.
  • a first aspect of the embodiments of the present invention provides a method for processing mobile network security, which may include:
  • the user terminal receives the event information of the attack event, and the event information includes the event type of the attack event. And the moment when the event of the attack event occurs;
  • the user terminal determines the target communication event according to the event information of the attack event in the communication status table, and the event type of the attack event is the same as the event type of the target communication event, and the event occurrence time of the target communication event corresponds to the event occurrence time of the attack event, and the communication
  • the event type records the event type of the target communication event and the event occurrence time of the target communication event;
  • the user terminal determines a target switching event according to the event occurrence time of the target communication event, and the event occurrence time of the target communication event corresponds to the network switching time of the target switching event, and the target switching event and the target switching are stored in the communication switching table.
  • the user terminal marks the target network as a suspicious network.
  • the event information that the user terminal receives the attack event is specifically:
  • the user terminal receives an attack event including event information input through an external input device or an input device provided in the user terminal.
  • the event type of the attack event may include:
  • At least one of a short message event, a phone event, and an application access network event At least one of a short message event, a phone event, and an application access network event.
  • the user terminal determines the target communication event in the communication status table according to the event information of the attack event, which is specifically:
  • the user terminal determines the target communication event in the communication status table according to the event type of the attack event and the event occurrence time of the attack event, and the target communication event has the same event type and event occurrence time as the attack event.
  • the determining, by the user terminal, the target handover event in the communication switching table according to the event occurrence time of the target communication event may include:
  • the user terminal determines the time in the communication switching table according to the event occurrence time of the target communication event. At the time of two adjacent network switching moments, the event occurrence time of the target communication event is located between two adjacent network switching moments;
  • the user terminal determines that the previous network switching moment among the two network switching moments adjacent in time is the network switching moment corresponding to the event occurrence time of the target communication event;
  • the user terminal determines a corresponding target handover event in the communication status table according to the network handover time corresponding to the event occurrence time of the target communication event.
  • the target switching event may include:
  • the network information of the network before the handover and the network information of the network after the handover, and the network information carries the network parameters of the network.
  • the determining, by the user terminal, the target network corresponding to the target handover event according to the target handover event may include:
  • the user terminal determines a network parameter of the network after the handover according to the target handover event
  • the user terminal determines whether the network parameter of the network after the handover exceeds a preset threshold:
  • the user terminal determines that the network after the handover is the target network.
  • a second aspect of the present invention provides a method for alerting a mobile network security, which may include:
  • the user terminal receives a network scan request
  • the user terminal scans a network switching event in the communication switching table, and the network switching event corresponding to the network switching event and the network switching event is recorded in the communication switching table;
  • the user terminal determines that the network corresponding to the network handover event is a suspicious network
  • the user terminal determines that the network handover time corresponding to the network handover event corresponding to the suspicious network is the target network time
  • the user terminal determines a communication event in the communication status table according to the target network time, the communication event has an event occurrence time corresponding to the target network time, and the communication event table records the event occurrence time of the communication event and the communication event;
  • the user terminal prompts the communication event as a suspicious event.
  • the communication event includes:
  • At least one of a text message event, a phone event, and an application access network event At least one of a text message event, a phone event, and an application access network event.
  • the network switching event includes:
  • the network information of the network before the handover and the network information of the network after the handover, and the network information carries the network parameters of the network.
  • the method may further include:
  • the user terminal determines a network parameter of the network after the handover according to the target handover event
  • the user terminal determines whether the network parameter of the network after the handover exceeds a preset threshold:
  • the user terminal determines that the network is a suspicious network after the handover.
  • the third aspect of the embodiment of the present invention further provides a mobile terminal, which may include:
  • the first receiving module is configured to receive event information of the attack event, where the event information includes an event type of the attack event and an event occurrence time of the attack event;
  • the first communication event determining module determines the target communication event in the communication status table according to the event information of the attack event, the event type of the attack event is the same as the event type of the target communication event, and the event occurrence time of the target communication event and the event of the attack event occur.
  • the event status table records the event type of the target communication event and the event occurrence time of the target communication event;
  • the switching event determining module determines the target switching event in the communication switching table according to the event occurrence time of the target communication event, the event occurrence time of the target communication event corresponds to the network switching time of the target switching event, and the target switching event is stored in the communication switching table. And the network switching moment of the target switching event;
  • a target network determining module determining a target network corresponding to the target switching event according to the target switching event
  • the marking module marks the target network determined by the target network determining module as a suspicious network.
  • the first receiving module is specifically configured to:
  • An attack event including event information input through an external input device or an input device provided in the user terminal is received.
  • the types of events for an attack event include:
  • At least one of a short message event, a phone event, and an application access network event At least one of a short message event, a phone event, and an application access network event.
  • the first communication event determining module is specifically configured to:
  • the target communication event is determined in the communication status table according to the event type of the attack event and the event occurrence time of the attack event, and the target communication event has the same event type and event occurrence time as the attack event.
  • the handover event determining module includes:
  • a first determining unit configured to determine, in the communication switching table, two temporally adjacent network switching moments according to an event occurrence time of the target communication event, where an event occurrence time of the target communication event is located between two adjacent network switching moments ;
  • a second determining unit configured to determine that a previous network switching moment of the two network switching moments that are temporally adjacent is a network switching moment corresponding to an event occurrence time of the target communication event
  • the handover event determining unit is configured to determine a corresponding target handover event in the communication status table according to the network handover time corresponding to the event occurrence time of the target communication event.
  • the target switching event includes:
  • the network information of the network before the handover and the network information of the network after the handover, and the network information carries the network parameters of the network;
  • the target network determination module includes:
  • a network parameter determining unit configured to determine a network parameter of the network after the handover according to the target switching event
  • the first determining unit is configured to determine whether the network parameter of the network after the handover exceeds a preset threshold:
  • the target network determining unit is configured to determine that the network after the handover is the target network when the first determining unit determines that the preset threshold is exceeded.
  • the fourth aspect of the embodiment of the present invention further provides a user terminal, which may include:
  • a second receiving module configured to receive a network scanning request
  • a scanning module is configured to describe a network switching event in the communication switching table, where a network switching event corresponding to the network switching event and the network switching event is recorded in the communication switching table;
  • a determining module configured to determine whether the network corresponding to the network switching event is a suspicious network
  • a network time determination module configured to determine, when the network corresponding to the network switching event is a suspicious network, the network switching time corresponding to the network switching event corresponding to the suspicious network as the target network time;
  • a second communication event determining module configured to determine a communication event in the communication status table according to the target network time, the communication event has an event occurrence time corresponding to the target network time, and the communication condition table records the event of the communication event and the communication event The moment of occurrence;
  • a prompt module that prompts for communication events as suspicious events.
  • the network switching event includes:
  • the network information of the network before the handover and the network information of the network after the handover, and the network information carries the network parameters of the network.
  • the judgment module includes:
  • a network parameter query unit configured to determine a network parameter of the network after the handover according to the network handover event
  • the second determining unit determines whether the network parameter of the network after the handover exceeds a preset threshold:
  • the suspicious network determining unit is configured to determine that the network after the handover is a suspicious network when the second determining unit determines that the preset threshold is exceeded.
  • the embodiment of the present invention has the following advantages: in the embodiment of the present invention, a communication status table and a network switching table are established, and after receiving the event information of the attack event through the user terminal, according to the event in the event information
  • the type determines a target communication event having the same event type in the communication status table, and determines a target switching event in the communication switching table according to the event occurrence time of the target communication event, and then determines the target switching event through the target switching event, and
  • the network in which the target communication event occurs is determined according to the target switching event, and the network is determined as the target network according to the target switching event, and the target network is marked as a suspicious network.
  • the attack event can be traced to find the network when the attack event is generated, so that the network can be marked as a suspicious network, and the network reselection will not be re-selected to the network in the future, thereby improving the mobile network.
  • 1 is a network structure diagram of a mobile network
  • FIG. 3 is a diagram of an embodiment of a processing method according to an embodiment of the present invention.
  • FIG. 4 is a view showing another embodiment of a processing method in an embodiment of the present invention.
  • Figure 5 is a diagram showing another embodiment of a processing method in an embodiment of the present invention.
  • FIG. 6 is a diagram showing an embodiment of a warning method in an embodiment of the present invention.
  • FIG. 7 is a diagram showing another embodiment of a warning method in an embodiment of the present invention.
  • FIG. 8 is a diagram showing an embodiment of a user terminal according to an embodiment of the present invention.
  • FIG. 9 is a diagram showing another embodiment of a user terminal according to an embodiment of the present invention.
  • FIG. 10 is a diagram showing an embodiment of a user terminal according to an embodiment of the present invention.
  • Figure 11 is a diagram showing an embodiment of a user terminal according to an embodiment of the present invention.
  • the embodiment of the invention provides a mobile network security processing method, a warning method and a user terminal, which can trace the attack event according to the attack event to find the network when the attack event is generated, so that the network can be marked as a suspicious network. And in the future network re-selection will not re-select the network, which can improve the security of the mobile network.
  • FIG. 1 is a network structure diagram of a mobile network, where the mobile network mainly includes a mobile station (MS Mobile Station), and a base station subsystem (BSS BaseStation Subsystem) that wirelessly communicates with the MS. , the NSS Network Sub-System connected to the BSS, the OSS Operation-Support System connected to the NSS, and the PSTN Public Switched Telephone Network connected to the OSS ), Public Data Network (PDN Public Data Network) or Integrated Services Digital Network (ISDN Integrated Services Digital Network).
  • MS Mobile Station mobile station
  • BSS BaseStation Subsystem base station subsystem
  • the BSS includes at least one base station transceiver station (BTS Base Transceiver Station) that communicates with the MS and a base station controller (BSC Base Station Controller) that controls the BTS;
  • BSC Base Station Controller Base Station Controller
  • the NSS includes a mobile switching center (MSC Mobile Switching Center) connected to the BSC.
  • the EIR Equipment Identify Register, the VLR Visiting Location Register, and the HLR Home Location Register respectively connected to the MSC may further include an authentication center (AUC) connected to the MSC. Authentication Center).
  • AUC authentication center
  • the MS is a device of a user in the mobile communication network (hereinafter referred to as a mobile user), and the BSS communicates with the MS in a wireless manner, specifically, the BTS transmits and receives information, and the BSC controls the BTS, and one BSC can control multiple BTSs;
  • NSS handles the exchange of external network and mobile subscriber calls, and manages and operates some related mobile subscriber databases.
  • MSC is the core of the entire mobile communication network. It controls the services of all BSCs, provides switching functions and other services within the NSS system. Functional connection, and can connect mobile users with PTSN, PDN and ISDN. MSC obtains all data required by user location level and call request from HLR, EIR, VLR and AUC in NSS system, and MSC can also update Data within the NSS system.
  • an NSS can contain several MSCs, HLRs, and VLRs.
  • the VLR serves mobile users in its control area, and stores related information of roaming mobile users who have registered in its control area, and the VLR can obtain the HLR from the mobile user. Storing the necessary data; the HLR is a central database of the mobile communication network, and stores data related to all registered mobile users controlled by the HLR; the AUC stores authentication information and an encryption key to prevent unauthorized users from accessing the system. And ensure the communication security of mobile users communicating through the wireless interface; EIR stores the IMEI International Mobile Equipment Identity of the mobile user's device; OSS mainly completes mobile user management, mobile device management, and network And maintenance and other functions.
  • the pseudo base station is more harmful in the insecure mobile network.
  • the pseudo base station is usually deployed in a crowded area, and the mobile phone user in the coverage area is forced to go from normal by means of a counterfeit operator network number.
  • the carrier network is switched to the pseudo base station network, and then the short message is forged and sent to the user by simulating the network signaling.
  • the existing 2G/3G mobile network adopts one-way authentication authentication, that is, the legitimacy of the mobile phone does not authenticate the network, and the mobile phone is authenticated only on the network side, so that the mobile phone cannot effectively distinguish the true of the base station. Pseudo.
  • FIG. 2 is a signaling flowchart of a pseudo base station sending a spam message, including:
  • the user terminal enters the pseudo base station area, and automatically reselects the access pseudo base station cell.
  • the user terminal initiates a location update request to the pseudo base station.
  • the pseudo base station receives the location update request, and sends a location update success message.
  • the pseudo base station acquires the IMSI and IMEI of the mobile user.
  • the pseudo base station sends a short message to the user terminal according to the called process of the short message
  • the pseudo base station actively changes the location area code (LAC Location Area Code), and notifies the accessed user terminal by using a broadcast message, and triggers the user terminal to update the location again.
  • LAC Location Area Code location area code
  • the user terminal initiates a location update request to the pseudo base station.
  • the pseudo base station rejects the location update request of the user terminal, and sends a location update failure message.
  • the user terminal location update fails, and is reselected to the normal base station cell.
  • the user terminal initiates a location update request to the normal base station.
  • the normal base station receives the location update request, and sends a location update success message.
  • the user terminal receives the location update success message and switches back to the carrier network.
  • the pseudo base station makes the user terminal entering the pseudo base station area self-selected by the higher reselection parameter.
  • the pseudo base station only sends a short message to the user terminal, and the pseudo base station acquires the IMSI and the IMEI of the user when receiving the location request of the user terminal.
  • Figure 2 shows the process of spam attacks. Of course, it can also be used for other attacks, such as harassing calls and pushing spam.
  • FIG. 3 is a schematic diagram of an embodiment of a processing method according to an embodiment of the present invention. As shown in FIG. 3, the present invention is implemented.
  • the example provides a method for processing mobile network security, which may include the following contents:
  • the user terminal receives event information of an attack event.
  • the event information includes the event type of the attack event and the event occurrence time of the attack event; that is, after receiving the event information of the attack event, the user terminal can know the event type of the attack event and the event occurrence time of the attack event.
  • the user terminal determines a target communication event in the communication status table according to the event information of the attack event.
  • the event type of the attack event is the same as the event type of the target communication event, and the event occurrence time of the target communication event corresponds to the event occurrence time of the attack event, and the event type and the target communication event of the target communication event are recorded in the communication status table. The moment of the event.
  • the user terminal can match the two types of information according to the event information of the attack event, and if it can match, it can be determined.
  • the target communication event may be performed by first matching the time, that is, first finding the event occurrence time of the target communication event corresponding to the event occurrence time of the attack event, and then performing event type matching, that is, only the event type and the attack.
  • the event type of the event is the same as the target communication event.
  • the event type matching can be performed first, and then the event occurrence time is matched.
  • the user terminal determines a target handover event in the communication switching table according to an event occurrence time of the target communication event.
  • the event occurrence time of the target communication event is opposite to the network switching time of the target handover event
  • the network switching moment of the target switching event and the target switching event is stored in the communication switching table
  • the user terminal determines a target network corresponding to the target handover event according to the target handover event.
  • the target network corresponding to the target handover event is found and determined.
  • the user terminal marks the target network as a suspicious network.
  • the user terminal marks the target network as a suspicious network.
  • the communication status table and the network switching table are established, after the event information of the attack event is received by the user terminal, it is determined in the communication status table that the phases have the same according to the event type in the event information.
  • the target communication event of the event type, and determining the target switching event in the communication switching table according to the event occurrence time of the target communication event, and determining the network in which the target communication event occurs according to the target switching event, and determining the network according to the target switching event Target the network and mark the target network as a suspicious network.
  • the attack event can be traced to find the network when the attack event is generated, so that the network can be marked as a suspicious network, and the network reselection will not be re-selected to the network in the future, thereby improving the mobile network. safety.
  • the event information that the user terminal receives the attack event may be that the user terminal receives an attack event that includes event information that is input through an external input device or an input device provided in the user terminal.
  • the user terminal may receive an attack event with time information by directly transmitting the user equipment, and specifically may adopt a wired manner. That is, it can be connected to another user terminal for receiving, or can be received by wireless, such as mobile 2G network, 3G network or 4G network, or wireless network such as WIFI or Bluetooth, depending on actual use conditions.
  • wireless such as mobile 2G network, 3G network or 4G network, or wireless network such as WIFI or Bluetooth
  • the event type of the attack event in the embodiment of the present invention includes at least one of a short message event, a phone event, and an application access network event.
  • event occurrence time of the target communication event corresponds to the event occurrence time of the attack event, and the following two cases exist in different event types:
  • the event occurrence time of an attack event corresponds to the event occurrence time of a target communication event, that is, one attack event corresponds to one target communication event.
  • the event occurrence time of an attack event corresponds to the occurrence of more than one target communication event
  • an attack event can correspond to more than one target communication event.
  • FIG. 4 is a combination of the case of an attack event corresponding to a target communication event.
  • the embodiment of the present invention provides a method for processing mobile network security, in which the event information further includes an event occurrence time of an attack event, and the method Step 402 is different from step 302, and the remaining steps are basically similar, and are not described herein.
  • the user terminal determines the target communication event in the communication status table according to the event type of the attack event and the event occurrence time of the attack event.
  • the target communication event has the same event type and event occurrence time as the attack event.
  • the characteristic is that the moment that actually causes the user to be troubled (such as receiving the spam message, receiving the sales call, etc.) and the event occurrence time of the attack event.
  • the event occurrence time of the attack event is a specific moment when the incoming call occurs for the telephone event, and is the user terminal for the short message event.
  • the subsequent steps can be performed by directly searching for the corresponding network switching time in the communication switching table by the specific moment that occurs, that is, the event occurrence time.
  • step 303 in the embodiment shown in FIG. 3 may be replaced by the following steps:
  • the user terminal determines two network switching moments adjacent in time in the communication switching table according to an event occurrence time of the target communication event.
  • the event occurrence time of the target communication event is located between two adjacent network switching moments. After the target communication event is determined in step 402, the event occurrence time of the target communication event is searched for in the communication switching table. The two network switching moments, and the event occurrence time of the target communication event is located between the two adjacent network switching moments.
  • the user terminal determines that the previous network switching moment of the two network switching moments adjacent in time is the network switching moment corresponding to the event occurrence time of the target communication event.
  • the previous network switching moment among the two network switching moments adjacent in time is determined and used as the network switching moment corresponding to the event occurrence time of the target communication event.
  • the user terminal determines a corresponding target handover event in the communication status table according to a network handover time corresponding to an event occurrence time of the target communication event.
  • the corresponding target switching event is searched and determined in the communication switching table by the network switching moment, and the target switching event is stored in the communication switching table.
  • the network switching moment of the target switching event is searched and determined in the communication switching table by the network switching moment, and the target switching event is stored in the communication switching table.
  • the target communication by first determining the temporally adjacent network switching time according to the event occurrence time of the target communication event in the communication switching table, and determining the previous one as the required network switching time, and switching the time through the network. Determining the corresponding target handover event, because the event occurrence time of the target communication event is lagging relative to the network handover time, that is, the network handover is completed first, and then the target communication event occurs in the switched network, therefore, the target communication The event occurrence time of the event corresponds to the previous one of the temporally adjacent network switching moments, and the determination manner can quickly determine the corresponding target handover event in the communication switching table, thereby improving the adaptability of the solution.
  • the arrangement can be performed in the order of time, which is convenient for traversing when searching for the corresponding time.
  • it can also be arranged in the order of time, and the effect of determining the target communication event can be realized after storage.
  • FIG. 5 is another embodiment of the processing method in the embodiment of the present invention, which is different from step 402 in the embodiment shown in FIG.
  • An attack event may correspond to more than one target communication event, in which case step 402 is replaced by the following steps:
  • the user terminal determines, in the communication status table, one or more target communication events according to an event type of the attack event and an event occurrence time of the attack event, where the target communication event has the same event type and corresponding event occurrence time as the attack event. .
  • the network event has the characteristics that the moment when it actually plagues the user is often different from the event occurrence time of the attack event, the time that causes trouble to the user is relatively lagging, for example, the user runs a network at a time.
  • the application, the pseudo base station obtains some private information of the user through the network application, such as the account information of the user, and after collecting the information, does not immediately generate an attack event for the user, but may be after collecting the information.
  • the time when the user is actually troubled is actually unable to correspond to the event occurrence time of the attack event, so that the determined suspicious network is not the network where the user is located when the user information is stolen, therefore,
  • the corresponding event occurrence time can be set according to a time range, and the time that actually plagues the user is the deadline, within a preset time range before the deadline time.
  • the same type of network event that occurs can be used as a target communication event. .
  • all the event types with the same event type as the attack event in the week before the event occurrence time of the attack event are target communication events, and the event occurrence time of these target communication events is attacking.
  • the target handover event includes network information of the network before the handover and network information of the network after the handover, where the network information carries network parameters of the network.
  • the target switching event includes the network information of the network before the handover and the network information of the network after the handover, so that after the target handover event is determined, the network after the handover corresponding to the target handover time can be quickly determined as the target network. .
  • Each row represents a target handover event, including network information of the network before handover and network information of the network after handover, and corresponding handover time.
  • the stored network information may include at least one of the following information:
  • PLMN Public Land Mobile Network ID PLMN Public Land Mobile Network ID
  • LAI Location Area Identity for location update of mobile users
  • LAI MCC+MNC+LAC
  • the MCC is the mobile country number, which has three digits, like the MCC in the IMSI, for identifying one country, and China is 460.
  • the MNC is the mobile network number and identifies the domestic GSM network, which is the same value as the MNC in the IMSI.
  • the LAC is the location area number and identifies the location area in a GSM network.
  • the maximum length of the LAC is 16 Bit.
  • 65,536 location areas can be defined in one GSM/VLR.
  • RAI Routing Area Identification which is used for routing area selection of mobile users
  • RAI MCC+MNC+LAC+RAC
  • MCC Mobile Country Number, with the same number as the MCC in IMSI, is used to identify a country, China is 460.
  • MNC mobile network number, identifying the domestic GSM network, the same value as the MNC in the IMSI.
  • LAC location area number identifying a location area in a GSM network.
  • RAC routing area number identifying a routing area in a GSM network.
  • the tracking area code (TAC Tracking area code of cell served by neighbor Enb) defines a tracking area code to which the cell belongs, and one tracking area may cover one or more cells;
  • step 509 is similar to step 407, and is different from step 406 in the embodiment shown in FIG. 4, and the step 406 in the embodiment shown in FIG. 5 can be replaced by the following steps:
  • the user terminal determines, according to the target handover event, a network parameter of the network after the handover.
  • the network switching information includes the network information of the pre-switching network, and the network information includes the corresponding network parameters. Therefore, after determining the target switching event, the network parameter can be quickly obtained.
  • the user terminal determines whether the network parameter of the network after the handover exceeds a preset threshold.
  • the network parameter of the acquired network after the handover is determined, and the criterion for determining is a preset threshold. If the parameter is LAI, the preset threshold may be set to a high value of 60000 or higher, for example, 65534.
  • the user terminal determines that the network after the handover is the target network.
  • the network after the handover is determined to be the target network.
  • the network parameter is used to determine whether the network having the network parameter is the target network, and whether the network parameter exceeds the preset threshold is specifically determined. When the preset threshold is exceeded, the target network is determined. By performing a comparison, the target network can be quickly determined, and the applicability of the embodiment of the present invention can be improved.
  • a suspicious network list may be set in the user terminal, where the suspicious network list stores all the suspicious networks scanned, and the network of the suspicious network. Information, when the user terminal enters the area of any suspicious network in the suspicious network list, it will not re-select to the network.
  • the suspicious network list can edit the suspicious network itself, for example, the suspicious network can be added to the suspicious network through the input device. In the network list, of course, other network methods may also be used.
  • a server for maintaining a list of suspicious networks may be set, and the user terminal uploads a list of suspicious networks to the server, and the user terminal in the server
  • the uploaded suspicious network list is integrated for the user terminal to update the list of suspicious networks stored locally through the server.
  • the server can also analyze the list of suspicious networks uploaded, such as integrating into multiple suspicious network lists by region.
  • the user terminal updates the list of suspicious networks in the corresponding area, it will Update the corresponding suspicious network list, and sort the suspicious network according to the frequency of the suspicious network in the suspicious network list, and intercept the part with high frequency as a list of suspicious networks that must be updated, and the frequency of occurrence is low as an optional update.
  • List of suspicious networks is
  • FIG. 6 is a schematic diagram of an embodiment of the warning method in the embodiment of the present invention, as shown in FIG.
  • the embodiment of the invention provides a warning method for mobile network security, which may include:
  • the user terminal receives a network scan request.
  • the network scan is triggered after receiving the network scan request.
  • the network scan request may be input by an external input device or an input device provided in the user terminal, and the user terminal may receive an attack event with time information by directly transmitting the user equipment.
  • Wired mode that is, connected to another user terminal for reception, or wirelessly, such as mobile 2G network, 3G network or 4G network, or wireless network such as WIFI or Bluetooth, depending on actual use conditions. set.
  • the user terminal scans a network switching event in the communication switching table.
  • the network switching moment corresponding to the network switching event and the network switching event is recorded in the communication switching table, and the user terminal scans the network switching event stored in the communication switching table, and determines whether the network corresponding to the network switching event has a suspicious network. .
  • the user terminal determines that the network switching time corresponding to the network switching event corresponding to the suspicious network is the target network time.
  • the network switching time corresponding to the network switching event corresponding to the suspicious network is determined as the target network time.
  • the user terminal determines a communication event in the communication status table according to the target network moment.
  • the communication event has an event occurrence time corresponding to the target network time
  • the communication event table records the event occurrence time of the communication event and the communication event
  • the user terminal searches for and determines the corresponding event in the communication status table according to the target network time.
  • the user terminal prompts the communication event as a suspicious event.
  • the user terminal After the corresponding communication event is found, the user terminal prompts the communication event as a suspicious event.
  • the network scan is triggered, and then the network switch event stored in the communication switch table is scanned, and whether the network corresponding to the network switch event is suspicious is determined.
  • a network when the user terminal determines that the network corresponding to the network handover event is a suspicious network, the network handover time corresponding to the network handover event corresponding to the suspect network is determined as the target network time, and then according to the target network time in the communication status table. Determining the communication event and then prompting the communication event as a suspicious event. In this way, the user can know the suspicious network that he or she is familiar with, and the suspicious event prompt can remind the user what to do under the suspicious network, thereby Users can perform remedial actions in a timely manner, which can greatly improve mobile Network security.
  • the embodiment of the present invention further has a determining manner for the suspicious network.
  • the event type of the attack event in the embodiment of the present invention includes a short message. At least one of an event, a phone event, and an application access network event.
  • the target handover event includes network information of the network before the handover and network information of the network after the handover, where the network information carries network parameters of the network.
  • the target switching event includes the network information of the network before the handover and the network information of the network after the handover, so that after the target handover event is determined, the network after the handover corresponding to the target handover time can be quickly determined as the target network. .
  • FIG. 7 is another embodiment of a warning method in an embodiment of the present invention.
  • an embodiment of the present invention provides an early warning method for mobile network security, where steps 701 and 702 are performed. Similar to steps 601 and 602, steps 706 to 708 are similar to steps 603 to 605, and are not described herein.
  • the user terminal determines, according to the network handover event, a network parameter of the network after the handover.
  • the network switching information includes the network information of the pre-switching network, and the network information includes the corresponding network parameters. Therefore, after determining the target switching event, the network parameter can be quickly obtained.
  • the user terminal determines whether the network parameter of the network after the handover exceeds a preset threshold.
  • the network parameter of the acquired network after the handover is determined, and the criterion for determining is a preset threshold. If the parameter is LAI, the preset threshold may be set to a high value of 60000 or higher, for example, 65534.
  • the user terminal determines that the network is a suspicious network after the handover.
  • the network after the handover is determined to be the target network.
  • the network parameter is used to determine whether the network having the network parameter is the target network, and whether the network parameter exceeds the preset threshold is specifically determined. When the preset threshold is exceeded, the target network is determined. By performing a comparison, the target network can be quickly determined, and the applicability of the embodiment of the present invention can be improved.
  • a suspicious network list may also be set in the user terminal, where the suspicious network list stores all the suspicious networks scanned, and the network of the suspicious network.
  • Information when the user terminal enters the area of any suspicious network in the suspicious network list, it will not re-select to the network, and the suspicious network list can edit the suspicious network itself, such as
  • the input device adds a suspicious network to the list of suspicious networks, and of course, through other network methods, such as to complete the list of suspicious networks, and also set a server for maintaining a list of suspicious networks, and the user terminal uploads a list of suspicious networks to the server.
  • the suspicious network list uploaded by the user terminal is integrated, so that the user terminal updates the list of suspicious networks stored locally through the server, and of course, the server may also analyze the uploaded suspicious network list, such as by region. Synthesize multiple suspicious network lists.
  • the user terminal updates the suspicious network list in the corresponding area, it automatically updates the corresponding suspicious network list, and sorts the suspicious networks according to the frequency of the suspicious network in the suspicious network list. The portion with a high frequency of occurrence is intercepted as a list of suspicious networks that must be updated, and a list of suspicious networks with a low frequency as an optional update will appear.
  • FIG. 8 is a diagram of an embodiment of the user terminal according to the embodiment of the present invention.
  • an embodiment of the present invention provides a user terminal, which may include:
  • the first receiving module 801 is configured to receive event information of an attack event, where the event information includes an event type of the attack event and an event occurrence time of the attack event;
  • the first communication event determining module 802 determines the target communication event in the communication status table according to the event information of the attack event, the event type of the attack event is the same as the event type of the target communication event, and the event occurrence time of the target communication event and the event of the attack event Corresponding to the occurrence time, the event status table records the event type of the target communication event and the event occurrence time of the target communication event;
  • the switching event determining module 803 determines a target switching event in the communication switching table according to the event occurrence time of the target communication event, and the event occurrence time of the target communication event corresponds to the network switching time of the target switching event, and the target switching is stored in the communication switching table.
  • the target network determining module 804 determines a target network corresponding to the target switching event according to the target switching event;
  • the marking module 805 marks the target network determined by the target network determining module as a suspicious network.
  • the first communication event determining module 802 is based on the event type in the event information. Determining that the phases have the same event type in the communication status table a target communication event, and the target event switching event is determined by the switching event determining module 803 according to the event occurrence time of the target communication event, and then the target network determining module 804 determines the network in which the target communication event occurs according to the target switching event. And determining the network as the target network according to the target switching event, and marking the target network as a suspicious network by the marking module 805.
  • the attack event can be traced to find the network when the attack event is generated, so that the network can be marked as a suspicious network, and the network reselection will not be re-selected to the network in the future, thereby improving the mobile network. safety.
  • the first receiving module 801 is specifically configured to:
  • An attack event including event information input through an external input device or an input device provided in the user terminal is received.
  • the attack event including the event information can be input by the input device, and thus can be used by the first receiving module 801, and the input device can be an input device inside the user terminal or an external input device, and specifically can be wired, that is, connected. Received by another user terminal, or wirelessly, such as mobile 2G network, 3G network or 4G network, or wireless network such as WIFI or Bluetooth, depending on the actual use.
  • the event type of the attack event includes at least one of a short message event, a phone event, and an application access network event
  • the event occurrence time of the target communication event corresponds to the event occurrence time of the attack event, in different events.
  • Types have the following two situations:
  • the event occurrence time of an attack event corresponds to the event occurrence time of a target communication event, that is, one attack event corresponds to one target communication event.
  • the event occurrence time of an attack event corresponds to the event occurrence time of more than one target communication event, that is, one attack event may correspond to more than one target communication event.
  • FIG. 9 is a description of an attack event corresponding to a target communication event.
  • Another embodiment of the user terminal in the embodiment of the present invention, as shown in FIG. 9, is different from the user terminal in the embodiment shown in FIG. 8, and the first communication event determining module in the user terminal in the embodiment shown in FIG. 902 is specifically used to:
  • the target communication event in the communication status table according to the event type of the attack event and the event occurrence time of the attack event.
  • the target communication event has the same event type and event when the attack event occurs. engraved.
  • the characteristic is that the moment that actually causes the user to be troubled (such as receiving the spam message, receiving the sales call, etc.) and the event occurrence time of the attack event.
  • the event occurrence time of the attack event is a specific moment when the incoming call occurs for the telephone event, and is the user terminal for the short message event.
  • the corresponding network switching moment can be found in the communication switching table by the specific moment when the attack event occurs, that is, the event occurrence time.
  • the first communication event determining module 902 is specifically configured to:
  • more than one target communication event is determined in the communication status table, and the target communication event has the same event type and corresponding event occurrence time as the attack event.
  • the network event has the characteristics that the moment when it actually plagues the user is often different from the event occurrence time of the attack event, the time that causes trouble to the user is relatively lagging, for example, the user runs a network at a time.
  • the application, the pseudo base station obtains some private information of the user through the network application, such as the account information of the user, and after collecting the information, does not immediately generate an attack event for the user, but may be after collecting the information.
  • the time when the user is actually troubled is actually unable to correspond to the event occurrence time of the attack event, so that the determined suspicious network is not the network where the user is located when the user information is stolen, therefore,
  • the corresponding event occurrence time can be set according to a time range, and the time that actually plagues the user is the deadline, within a preset time range before the deadline time.
  • the same type of network event that occurs can be used as a target communication event. .
  • all the event types with the same event type as the attack event in the week before the event occurrence time of the attack event are target communication events, and the event occurrence time of these target communication events is attacking.
  • the target event switching event is determined by the switching event determining module 903, and the following manner may be adopted:
  • the handover event determining module 903 in the user terminal may include:
  • the first determining unit 9031 is configured to determine, in the communication switching table, two temporally adjacent network switching moments according to the event occurrence time of the target communication event, where the event occurrence time of the target communication event is located at two adjacent network switching moments. between;
  • the second determining unit 9032 is configured to determine that the previous network switching moment of the two network switching moments that are temporally adjacent is the network switching moment corresponding to the event occurrence time of the target communication event;
  • the handover event determining unit 9033 is configured to determine a corresponding target handover event in the communication status table according to the network handover time corresponding to the event occurrence time of the target communication event.
  • the event occurrence time of the target communication event is located between two adjacent network switching moments.
  • the first determining unit 9031 passes the event occurrence time of the target communication event. Locating two network switching moments adjacent in time in the communication switching table, and the event occurrence time of the target communication event is located between the two adjacent network switching moments, and then determining the temporal phase by the second determining unit 9032.
  • the previous network switching moment among the two network switching moments of the neighbor is the network switching moment corresponding to the event occurrence time of the target communication event, and may be switched after the network switching moment corresponding to the event occurrence time of the target communication event is found.
  • the event determining unit 9033 finds and determines its corresponding target switching event in the communication switching table by this network switching timing.
  • the above determining method can quickly determine the corresponding target switching event in the communication switching table, and improve the adaptability of the solution.
  • the target network determining module 904 may determine the target network corresponding to the target switching event in the following manner, where the target switching event includes network information of the network before the handover and network information of the network after the handover, where the network information carries the network. Network parameters.
  • the target network determining module 904 includes:
  • the network parameter determining unit 9041 is configured to determine a network parameter of the network after the handover according to the target switching event
  • the first determining unit 9042 is configured to determine whether the network parameter of the network after the handover exceeds a preset threshold:
  • the target network determining unit 9043 is configured to determine that the network after the handover is the target network when the first determining unit 9042 determines that the preset threshold is exceeded.
  • the network parameter determining unit 9041 first determines the network parameter of the network after the handover according to the target switching event, and then the first determining unit 9042 determines whether the network parameter of the network after the switching exceeds
  • the preset threshold is determined by the target network determining unit 9043 as the target network when the preset threshold is exceeded.
  • FIG. 10 is a diagram of an embodiment of a user terminal according to an embodiment of the present invention.
  • an embodiment of the present invention provides a user terminal, which may include:
  • the second receiving module 1001 is configured to receive a network scanning request.
  • the scanning module 1002 is configured to describe a network switching event in the communication switching table, where the network switching event corresponding to the network switching event and the network switching event is recorded;
  • the determining module 1003 is configured to determine whether the network corresponding to the network switching event is a suspicious network
  • the network time determination module 1004 is configured to: when determining that the network corresponding to the network switching event is a suspicious network, determine that the network switching time corresponding to the network switching event corresponding to the suspicious network is the target network time;
  • the second communication event determining module 1005 is configured to determine a communication event in the communication status table according to the target network time, where the communication event has an event occurrence time corresponding to the target network time, and the communication status table records the communication event and the communication event. The moment of the event;
  • the prompting module 1006 is configured to prompt the communication event as a suspicious event.
  • the network scanning is triggered, and then the scanning module 1002 scans the network switching event stored in the communication switching table, and passes the determining module.
  • 1003 determining whether the network corresponding to the network switching event has a suspicious network.
  • the network time determination module 1004 determines the network corresponding to the network switching event corresponding to the suspicious network. The switching moment is determined as the target network time, and then the second communication event determining module 1005 determines the communication event in the communication status table according to the target network time, and finally prompts the communication event as a suspicious event by the prompting module 1006.
  • the user can be familiar with the suspicious network that he or she enters, and can prompt the user to perform operations under the suspicious network through the suspicious event prompt, so that the user can perform the remedial operation in time, which can greatly improve Mobile network security.
  • the target network determining module 1004 can determine the target switching by the following manners.
  • the determining module 1003 may include:
  • the network parameter query unit 10031 is configured to determine network parameters of the network after the handover according to the network handover event
  • the second determining unit 10032 determines whether the network parameter of the network after the handover exceeds a preset threshold:
  • the suspicious network determining unit 10033 is configured to determine that the network after the handover is a suspicious network when the second determining unit determines that the preset threshold is exceeded.
  • the network parameter query unit 10031 determines the network parameter of the network after the handover according to the target handover event, and then the second determining unit 10032 determines whether the network parameter of the network after the handover exceeds a preset threshold, when the preset threshold is exceeded,
  • the suspicious network determining unit 10033 determines that it is the target network. It can be seen that by adopting this method, only a comparison can be performed, and the suspicious network can be quickly determined, the efficiency of finding the target network can be improved, and the applicability of the embodiment of the present invention can be improved.
  • FIG. 11 is a diagram of an embodiment of a user terminal according to an embodiment of the present invention, where the user equipment 11 may include at least one processing that is connected to the bus. 1101, at least one receiver 1102 and at least one transmitter 1103, the base station according to an embodiment of the present invention may have more or less components than those shown in FIG. 11, and two or more components may be combined, or There may be different component configurations or arrangements, each component being implemented in hardware, software or a combination of hardware and software including one or more signal processing and/or application specific integrated circuits.
  • the processor 1101 can implement the first communication event determining module 802, the switching event determining module 803, the target network determining module 804, and the marking module in the embodiment shown in FIG.
  • the function of the 805, the receiver 1102 can implement the function of the first receiving module 801 in the embodiment shown in FIG. 8;
  • the processor 1101 can implement the functions of the first communication event determining module 902 , the switching event determining module 903 , the target network determining module 904 , and the marking module 905 in the embodiment shown in FIG. 9 , and the receiver 1102
  • the function of the first receiving module 901 in the embodiment shown in FIG. 9 can be implemented;
  • the processor 1101 can implement the scanning module in the embodiment shown in FIG.
  • the functions of the second receiving module 1001 in the embodiment shown in FIG. 10 can be implemented by the function of the determining module 1003, the network time determining module 1004, the second communication event determining module 1005, and the prompting module 1006.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of cells is only a logical function division.
  • multiple units or components may be combined or integrated. Go to another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • An integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, can be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the various embodiments of the present invention.
  • the foregoing storage medium includes: a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like.
  • the medium of the program code includes: a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种移动网络安全的处理方法、警示方法及用户终端。用户终端接收攻击事件的事件信息（301），用户终端根据攻击事件的事件信息在通信状况表中确定目标通信事件（302），用户终端根据目标通信事件的事件发生时刻在通信切换表中确定目标切换事件（303），用户终端根据目标切换事件确定与目标切换事件对应的目标网络（304），用户终端将目标网络标记为可疑网络（305）。通过本移动网络安全的处理方法、警示方法及用户终端能够针对攻击事件进行追溯，从而找到产生攻击事件时的网络，从而能够将该网络标记为可疑网络，并且在以后的网络重选中也不会重选到该网络，从而能够提高移动网络安全性。

Description

一种移动网络安全的处理方法、警示方法及用户终端 技术领域
本发明涉及移动网络安全领域，尤其涉及的是一种移动网络安全的处理方法、警示方法及用户终端。
背景技术
保障移动网络的安全性一直是移动通信面临的重要问题。随着移动用户终端的广泛应用，对于其安全性的需求也越来越高，特别如即时通信、移动支付等应用有着强安全性需求。
现有技术方案中，为了方便用户实时查看其当前所处的网络，会在移动用户终端的屏幕上使用提示字符表征各类网络状况，如显示字符G时，表示所处网络为GPRS网络，显示字符为E时，表示所处网络为EDGE网络，这两类均为2G网络，也有直接显示字符2G作为网络标字符，当显示字符为3G、H或H+时，分别表示处于3G网络、HSPA网络或HSPA+网络，用户通过这些标识符可以了解当前的网络状况。
然而这类标字符仅能表示用户所处的是何种网络，即用户通过这些标识符了解所处的网络状况但对于所处网络的安全性无法了解，从而使用户可能会在不安全的网络下进行通信；另外，由于用户无法获知移动用户终端与基站之间的通信情况，在发生针对用户的攻击事件后，无法通过该事件追溯产生该事件的可能原因。
发明内容
本发明提供了一种移动网络安全的处理方法、警示方法及用户终端，能够解决由于用户无法获知移动用户终端与基站之间的通信情况，使用户可能会在不安全的网络下进行通信，从而造成的网络安全性差的问题，并且在发生针对用户的攻击事件后，无法通过该事件追溯产生该事件的可能原因。
本发明实施例第一方面提供了一种移动网络安全的处理方法，可包括：
用户终端接收攻击事件的事件信息，事件信息中包括攻击事件的事件类型 和攻击事件的事件发生时刻；
用户终端根据攻击事件的事件信息在通信状况表中确定目标通信事件，攻击事件的事件类型与目标通信事件的事件类型相同，目标通信事件的事件发生时刻与攻击事件的事件发生时刻相对应，通信状况表中记录有目标通信事件的事件类型和目标通信事件的事件发生时刻；
用户终端根据目标通信事件的事件发生时刻在通信切换表中确定目标切换事件，目标通信事件的事件发生时刻与目标切换事件的网络切换时刻相对应，通信切换表中存储有目标切换事件和目标切换事件的网络切换时刻；
用户终端根据目标切换事件确定与目标切换事件对应的目标网络；
用户终端将目标网络标记为可疑网络。
结合第一方面，在第一方面的第一种可能的实现方式中，用户终端接收攻击事件的事件信息具体为：
用户终端接收通过外部输入设备或设于用户终端内的输入设备输入的包括事件信息的攻击事件。
结合第一方面或第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，攻击事件的事件类型可包括：
短信事件、电话事件和应用程序访问网络事件中的至少一种。
结合第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，当攻击事件的事件类型为短信事件或电话事件时，
用户终端根据攻击事件的事件信息在通信状况表中确定目标通信事件具体为：
用户终端根据攻击事件的事件类型和攻击事件的事件发生时刻在通信状况表中确定目标通信事件，目标通信事件与攻击事件具有相同的事件类型和事件发生时刻。
结合第一方面、第一方面的第一种可能的实现方式、第一方面的第二种可能的实现方式和第一方面的第三种可能的实现方式之中的任一种，在第一方面的第四种可能的实现方式中，用户终端根据目标通信事件的事件发生时刻在通信切换表中确定目标切换事件可包括：
用户终端根据目标通信事件的事件发生时刻在通信切换表中确定时间上 相邻的两个网络切换时刻，目标通信事件的事件发生时刻位于相邻的两个网络切换时刻之间；
用户终端确定时间上相邻的两个网络切换时刻之中的前一个网络切换时刻为与目标通信事件的事件发生时刻对应的网络切换时刻；
用户终端根据与目标通信事件的事件发生时刻对应的网络切换时刻在通信状况表中确定对应的目标切换事件。
结合第一方面、第一方面的第一种可能的实现方式、第一方面的第二种可能的实现方式、第一方面的第三种可能的实现方式和第一方面的第四种可能的实现方式之中的任一种，在第一方面的第五种可能的实现方式中，目标切换事件可包括：
切换前网络的网络信息和切换后网络的网络信息，网络信息中携带有网络的网络参数。
结合第一方面的第五种可能的实现方式，在第一方面的第六种可能的实现方式中，用户终端根据目标切换事件确定与目标切换事件对应的目标网络可包括：
用户终端根据目标切换事件确定切换后网络的网络参数；
用户终端判断切换后网络的网络参数是否超出预设阈值：
当超出预设阈值时，用户终端确定切换后网络为目标网络。
本发明第二方面还提供一种移动网络安全的警示方法，可包括：
用户终端接收网络扫描请求；
用户终端扫描通信切换表中的网络切换事件，通信切换表中记录有网络切换事件和网络切换事件对应的网络切换时刻；
当用户终端确定对应网络切换事件对应的网络为可疑网络时，用户终端确定可疑网络对应的网络切换事件对应的网络切换时刻为目标网络时刻；
用户终端根据目标网络时刻在通信状况表中确定通信事件，通信事件中具有与目标网络时刻相对应的事件发生时刻，通信状况表中记录有通信事件和通信事件的事件发生时刻；
用户终端将通信事件作为可疑事件进行提示。
结合第二方面，在第二方面的第一种可能的实现方式中，通信事件包括：
短信事件、电话事件和应用程序访问网络事件之中至少一种。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，网络切换事件包括：
切换前网络的网络信息和切换后网络的网络信息，网络信息中携带有网络的网络参数。
结合第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，方法还可包括：
用户终端根据目标切换事件确定切换后网络的网络参数；
用户终端判断切换后网络的网络参数是否超出预设阈值：
当超出预设阈值时，用户终端确定切换后网络为可疑网络。
本发明实施例第三方面还提供一种移动终端，可包括：
第一接收模块，用于接收攻击事件的事件信息，事件信息中包括攻击事件的事件类型和攻击事件的事件发生时刻；
第一通信事件确定模块，根据攻击事件的事件信息在通信状况表中确定目标通信事件，攻击事件的事件类型与目标通信事件的事件类型相同，目标通信事件的事件发生时刻与攻击事件的事件发生时刻相对应，通信状况表中记录有目标通信事件的事件类型和目标通信事件的事件发生时刻；
切换事件确定模块，根据目标通信事件的事件发生时刻在通信切换表中确定目标切换事件，目标通信事件的事件发生时刻与目标切换事件的网络切换时刻相对应，通信切换表中存储有目标切换事件和目标切换事件的网络切换时刻；
目标网络确定模块，根据目标切换事件确定与目标切换事件对应的目标网络；
标记模块，将目标网络确定模块确定的目标网络标记为可疑网络。
结合第三方面，在第三方面的第一种可能的实现方式中，第一接收模块具体用于：
接收通过外部输入设备或设于用户终端内的输入设备输入的包括事件信息的攻击事件。
结合第三方面或第三方面的第一种可能的实现方式，在第三方面的第二种 可能的实现方式中，攻击事件的事件类型包括：
短信事件、电话事件和应用程序访问网络事件中的至少一种。
结合第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，当攻击事件的事件类型为短信事件或电话事件时，
第一通信事件确定模块具体用于：
根据攻击事件的事件类型和攻击事件的事件发生时刻在通信状况表中确定目标通信事件，目标通信事件与攻击事件具有相同的事件类型和事件发生时刻。
结合第三方面、第三方面的第一种可能的实现方式、第三方面的第二种可能的实现方式和第三方面的第三种可能的实现方式之中的任一种可能的实现方式，在第三方面的第四种可能的实现方式中，切换事件确定模块包括：
第一确定单元，用于根据目标通信事件的事件发生时刻在通信切换表中确定时间上相邻的两个网络切换时刻，目标通信事件的事件发生时刻位于相邻的两个网络切换时刻之间；
第二确定单元，用于确定时间上相邻的两个网络切换时刻之中的前一个网络切换时刻为与目标通信事件的事件发生时刻对应的网络切换时刻；
切换事件确定单元，用于根据与目标通信事件的事件发生时刻对应的网络切换时刻在通信状况表中确定对应的目标切换事件。
结合第三方面、第三方面的第一种可能的实现方式、第三方面的第二种可能的实现方式、第三方面的第三种可能的实现方式和第三方面的第四种可能的实现方式之中的任一种可能的实现方式，在第三方面的第五种可能的实现方式中，目标切换事件包括：
切换前网络的网络信息和切换后网络的网络信息，网络信息中携带有网络的网络参数；
目标网络确定模块包括：
网络参数确定单元，用于根据目标切换事件确定切换后网络的网络参数；
第一判断单元，用于判断切换后网络的网络参数是否超出预设阈值：
目标网络确定单元，用于当第一判断单元确定超出预设阈值时，确定切换后网络为目标网络。
本发明实施例第四方面还提供一种用户终端，可包括：
第二接收模块，用于接收网络扫描请求；
扫描模块，用于描通信切换表中的网络切换事件，通信切换表中记录有网络切换事件和网络切换事件对应的网络切换时刻；
判断模块，用于判断网络切换事件对应的网络是否为可疑网络；
网络时刻确定模块，用于当确定对应网络切换事件对应的网络为可疑网络时，确定可疑网络对应的网络切换事件对应的网络切换时刻为目标网络时刻；
第二通信事件确定模块，用于根据目标网络时刻在通信状况表中确定通信事件，通信事件中具有与目标网络时刻相对应的事件发生时刻，通信状况表中记录有通信事件和通信事件的事件发生时刻；
提示模块，用于将通信事件作为可疑事件进行提示。
结合第四方面，在第四方面的第一种可能的实现方式中，网络切换事件包括：
切换前网络的网络信息和切换后网络的网络信息，网络信息中携带有网络的网络参数。
判断模块包括：
网络参数查询单元，用于根据网络切换事件确定切换后网络的网络参数；
第二判断单元，判断切换后网络的网络参数是否超出预设阈值：
可疑网络确定单元，用于当第二判断单元确定超出预设阈值时，确定切换后网络为可疑网络。
从以上技术方案可以看出，本发明实施例具有以下优点：本发明实施例中建立了通信状况表和网络切换表，在通过用户终端接收攻击事件的事件信息后，根据该事件信息中的事件类型在通信状况表中确定相具有相同的事件类型的目标通信事件，并根据目标通信事件的事件发生时刻在通信切换表中确定目标切换事件，而后通过该目标切换事件的确定目标切换事件，并根据目标切换事件确定目标通信事件发生时所处的网络，并根据目标切换事件确定该网络为目标网络，并将该目标网络标记为可疑网络。通过上述方式能够针对攻击事件进行追溯，从而找到产生攻击事件时的网络，从而能够将该网络标记为可疑网络，并且在以后的网络重选中也不会重选到该网络，从而能够提高移动网络安 全性。
附图说明
图1是移动网络的网络结构图；
图2是伪基站发送垃圾短信的信令流程图；
图3为本发明实施例中处理方法的一个实施例图；
图4是本发明实施例中处理方法的另一个实施例图；
图5是本发明实施例中处理方法的另一个实施例图；
图6是本发明实施例中警示方法的一个实施例图；
图7是本发明实施例中警示方法的另一个实施例图；
图8是本发明实施例中用户终端的一个实施例图；
图9是本发明实施例中用户终端的另一个实施例图；
图10是本发明实施例中用户终端的一个实施例图；
图11是本发明实施例的用户终端的一个实施例图。
具体实施方式
本发明实施例提供了一种一种移动网络安全的处理方法、警示方法及用户终端，能够根据针对攻击事件进行追溯，从而找到产生攻击事件时的网络，从而能够将该网络标记为可疑网络，并且在以后的网络重选中也不会重选到该网络，从而能够提高移动网络安全性。
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。
以下分别进行详细说明。
本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例 如，包含了一系列步骤或模块的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或模块，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或模块。
本发明实施例可应用在如图1所示场景中，图1是移动网络的网络结构图，移动网络主要包括移动台(MS Mobile Station)，与MS通过无线通信的基站子系统(BSS BaseStationSubsystem)，与BSS相连接的网络子系统(NSS Network Sub-System)，与NSS相连接的操作支持子系统(OSS Operation-Support System)，以及与OSS相连接的公用电话交换网(PSTN Public Switched Telephone Network)、公共数据网(PDN Public Data Network)或综合业务数字网(ISDN Integrated Services Digital Network)。
其中BSS中包含至少一个与MS通信的基站收发信台(BTS Base Transceiver Station)以及控制BTS的基站控制器(BSC Base Station Controller)；NSS包括与BSC相连接的移动交换中心(MSC Mobile Switching Center)，分别与MSC相连接的设备识别寄存器(EIR Equipment Identify Register)、访问位置寄存器(VLR Visiting Location Register)和归属位置寄存器(HLR Home Location Register)，还可包括与MSC相连接的鉴权中心(AUC Authentication Center)。
其中，MS是移动通信网络中的用户(以下简称移动用户)的设备，BSS通过无线方式与MS通信，具体通过BTS收发信息，由BSC控制BTS，一个BSC可以控制多个BTS；
NSS处理外部网络和移动用户呼叫的交换，并对一些相关的移动用户数据库进行管理和操作，MSC是整个移动通信网络的核心，它控制所有BSC的业务，提供交换功能及和NSS系统内的其它功能的连接，并可将移动用户与PTSN、PDN和ISDN连接起来，MSC从NSS系统内的HLR、EIR、VLR和AUC中获取用户位置等级和呼叫请求所需的全部数据，另外MSC也可更新NSS系统内的数据，对于较大的网络，一个NSS可以包含若干个MSC、HLR和VLR。
其中，VLR服务于其控制区域内的移动用户，其内存储有进入其控制区域已登记的漫游移动用户的相关信息，VLR可从该移动用户的HLR中获取并 存储必要的数据；HLR是移动通信网络的中央数据库，存储着HLR控制的所有注册登记的移动用户的相关数据；AUC中存储着鉴权信息和加密秘钥，用来防止无权用户接入系统并保证通过无线接口进行通信的移动用户的通信安全；EIR中存储着移动用户的设备的国际移动设备识别码(IMEI International Mobile Equipment Identity)；OSS主要完成移动用户管理、移动设备管理、网络才做和维护等功能。
在现有的移动网络中，在不安全的移动网络中，伪基站的危害较大，伪基站通常在人员密集区域部署，通过假冒运营商网号等方式，迫使覆盖区域的手机用户从正常的运营商网络切换到伪基站网络,然后通过模拟网络信令，伪造短信并下发给用户。以某运营商网络为例，现有2G/3G移动网络采用单向鉴权认证，即手机不鉴权网络的合法性，仅在网络侧对手机进行鉴权，导致手机无法有效辨别基站的真伪。伪基站设置某运营商网号，使用该运营商GSM频段,并设置更优的小区重选参数；当手机进入伪基站覆盖区域时，很容易通过位置更新切换到伪基站小区。下面对伪基站发送垃圾短信原理进行说明，如图2所示，图2是伪基站发送垃圾短信的信令流程图，包括：
201、用户终端进入伪基站区域，自动重选接入伪基站小区；
202、用户终端向伪基站发起位置更新请求；
203、伪基站接收该位置更新请求，并下发位置更新成功消息；
在此过程中，伪基站获取到移动用户的IMSI和IMEI。
204、伪基站按照短信被叫流程，向用户终端下发短信；
205、伪基站主动变更位置区码(LAC Location Area Code)，并通过广播消息告知已接入的用户终端，触发用户终端再次位置更新；
206、用户终端向伪基站发起位置更新请求；
207、伪基站拒绝用户终端的位置更新请求，下发位置更新失败消息；
208、用户终端位置更新失败，重选至正常基站小区；
209、用户终端向正常基站发起位置更新请求；
210、正常基站接收此位置更新请求，并下发位置更新成功消息；
211、用户终端接收位置更新成功消息并切换回运营商网络。
由上可见，伪基站通过较高的重选参数使得进入伪基站区域的用户终端自 动重选至该伪基站，而一般情况下，伪基站为了降低被发现的机率，只会向用户终端发送一条短信，并且伪基站在接收用户终端的位置请求时会获取用户的IMSI和IMEI，会产生针对用户的安全隐患，图2所示的为垃圾短信攻击的流程，当然还可以为其他攻击方式，如骚扰电话，推送垃圾消息等。
本发明实施例为了应对这些攻击事件，采取对这些攻击事件进行追溯的方式，从而查找到攻击事件产生时用户终端所处的网络，并推定出该网络为伪基站的网络，并将该网络标识为可疑网络，从而在再进入该网络区域时不会自动连接至该网络，请参阅图3，图3为本发明实施例中处理方法的一个实施例图，如图3所示，本发明实施例提供一种移动网络安全的处理方法，可包括以下内容：
301、用户终端接收攻击事件的事件信息。
其中，该事件信息中包括攻击事件的事件类型和攻击事件的事件发生时刻；即用户终端接收到该攻击事件的事件信息后即可获知该攻击事件具有的事件类型以及攻击事件的事件发生时刻。
302、用户终端根据攻击事件的事件信息在通信状况表中确定目标通信事件。
其中，攻击事件的事件类型与目标通信事件的事件类型相同，目标通信事件的事件发生时刻与攻击事件的事件发生时刻相对应，通信状况表中记录有目标通信事件的事件类型和目标通信事件的事件发生时刻。
由于在通信状况表中也存储了目标通信事件的事件类型和目标通信事件的事件发生时刻，用户终端可根据攻击事件的事件信息与这两种信息与进行匹配，若能匹配上，即可确定出目标通信事件，具体匹配的方式可以是先进行时间匹配，即先找到能与攻击事件的事件发生时刻对应的目标通信事件的事件发生时刻，然后再进行事件类型匹配，即只有事件类型与攻击事件的事件类型相同的才被确定为目标通信事件，当然也可以先进行事件类型匹配，而后再进行事件发生时刻的匹配。
303、用户终端根据目标通信事件的事件发生时刻在通信切换表中确定目标切换事件。
其中，目标通信事件的事件发生时刻与目标切换事件的网络切换时刻相对 应，通信切换表中存储有目标切换事件和目标切换事件的网络切换时刻；
304、用户终端根据目标切换事件确定与目标切换事件对应的目标网络。
其中，在确定了目标切换事件后，查找并确定与目标切换事件对应的目标网络。
305、用户终端将目标网络标记为可疑网络。
其中，在找到该目标网络后，用户终端将该目标网络标记为可疑网络。
由此可见，本发明实施例中由于建立了通信状况表和网络切换表，在通过用户终端接收攻击事件的事件信息后，根据该事件信息中的事件类型在通信状况表中确定相具有相同的事件类型的目标通信事件，并根据目标通信事件的事件发生时刻在通信切换表中确定目标切换事件，并根据目标切换事件确定目标通信事件发生时所处的网络，并根据目标切换事件确定该网络为目标网络，并将该目标网络标记为可疑网络。通过上述方式能够针对攻击事件进行追溯，从而找到产生攻击事件时的网络，从而能够将该网络标记为可疑网络，并且在以后的网络重选中也不会重选到该网络，从而能够提高移动网络安全性。
其中，作为可选的，用户终端接收攻击事件的事件信息可以是，用户终端接收通过外部输入设备或设于用户终端内的输入设备输入的包括事件信息的攻击事件。
需要说明的是，除了通过外部输入设备或设于用户终端内的输入设备输入之外，还可通过直接上用户设备传输的方式使用户终端接收到具有时间信息的攻击事件，具体可采用有线方式，即连接到另一台用户终端接收，也可以采用无线方式进行接收，如移动2G网络、3G网络或4G网络，再或者是WIFI、蓝牙等无线网络均可，具体视实际使用状况而定。
作为可选的，本发明实施例中的攻击事件的事件类型包括短信事件、电话事件和应用程序访问网络事件中的至少一种。
其中，需要说明的是，目标通信事件的事件发生时刻与攻击事件的事件发生时刻相对应，在不同的事件类型具有以下两种情况：
一、一个攻击事件的事件发生时刻对应一个目标通信事件的事件发生时刻，即一个攻击事件对应一个目标通信事件。
二、一个攻击事件的事件发生时刻对应一个以上目标通信事件的事件发生 时刻，即一个攻击事件可对应一个以上的目标通信事件。
下面以攻击事件的事件类型为短信事件或电话事件为例，结合情况一即一个攻击事件对应一个目标通信事件对本发明实施例中攻击事件的追溯过程进行描述，请参阅图4，图4是本发明实施例中处理方法的另一个实施例图，如图4所示，本发明实施例提供一种移动网络安全的处理方法，在该方法中事件信息还包括攻击事件的事件发生时刻，该方法中步骤402与步骤302不同，其余步骤基本相似，不在赘述，其中，
402、用户终端根据攻击事件的事件类型和攻击事件的事件发生时刻在通信状况表中确定目标通信事件。
其中，目标通信事件与攻击事件具有相同的事件类型和事件发生时刻。
可以理解的是，对于短信事件和电话事件两种攻击事件来说，其特点在于，实际给用户产生困扰(如接收到垃圾短信、接收到推销电话等)的时刻与该攻击事件的事件发生时刻是相同的，即这两种攻击事件只要一发生就立即会对用户产生困扰，从而攻击事件的事件发生时刻对于电话事件来说，是来电发生的具体时刻，对于短信事件来说，是用户终端接收到短信的具体时刻，对于这两类攻击事件，直接通过发生的具体时刻，即事件发生时刻在通信切换表中查找对应的网络切换时刻，即可进行后续的步骤。
作为可选的，在本实施例中，图3所示实施例中的步骤303可被替换为如下步骤：
403、用户终端根据目标通信事件的事件发生时刻在通信切换表中确定时间上相邻的两个网络切换时刻。
其中，目标通信事件的事件发生时刻位于相邻的两个网络切换时刻之间，在步骤402中确定出目标通信事件后，通过目标通信事件的事件发生时刻在通信切换表中查找时间上相邻的两个网络切换时刻，而目标通信事件的事件发生时刻位于这两个相邻的网络切换时刻之间。
404、用户终端确定时间上相邻的两个网络切换时刻之中的前一个网络切换时刻为与目标通信事件的事件发生时刻对应的网络切换时刻。
其中，确定时间上相邻的两个网络切换时刻之中的前一个网络切换时刻，并将其作为与目标通信事件的事件发生时刻相对应的网络切换时刻。
405、用户终端根据与目标通信事件的事件发生时刻对应的网络切换时刻在通信状况表中确定对应的目标切换事件。
其中，在找到与目标通信事件的事件发生时刻相对应的网络切换时刻后，通过这个网络切换时刻在通信切换表中查找并确定其对应的目标切换事件，通信切换表中存储有目标切换事件和目标切换事件的网络切换时刻。
可以理解的是，通过在通信切换表中首先根据目标通信事件的事件发生时刻确定出时间上相邻的网络切换时刻，并将前一个确定为所需的网络切换时刻，并通过这个网络切换时刻确定对应的目标切换事件，由于目标通信事件的事件发生时刻相对于网络切换时刻来说是滞后的，即先完成了网络切换，然后才在切换后的网络中发生目标通信事件，因此，目标通信事件的事件发生时刻对应的是时间上相邻的网络切换时刻中的前一个，采用这种确定方式能够快速在通信切换表中确定出对应的目标切换事件，提高方案的适应性。
需要说明的是，本发明实施例中的通信状况表可采用如下表1方式记录信息：
表1
序号 事件类型 内容 时间
21 短信 接收短信 2014_11_20 11:12:57
22 电话 拨打电话 2014_11_20 11:15:20
23 网络 应用连网 2014_11_20 11:25:43
…… …… …… ……
可见，可采用按照时间的顺序进行排列，便于在查找对应时间时进行遍历，当然，也可不按照时间的顺序排列，也能在存储后实现确定目标通信事件的效果。
需要说明的是，若攻击事件的事件类型为网络事件，请参阅图5，图5是本发明实施例中处理方法的另一个实施例图，区别于图4所示的实施例中的步骤402，一个攻击事件可对应一个以上的目标通信事件，在此情况下，步骤402被如下步骤替换：
502、用户终端根据攻击事件的事件类型和攻击事件的事件发生时刻在通信状况表中确定一个以上的目标通信事件，该目标通信事件均与攻击事件具有相同的事件类型和相对应的事件发生时刻。
其中，由于网络事件具有的特点是其实际对用户产生困扰的时刻与攻击事件的事件发生时刻往往是不相同的，对用户产生困扰的时刻是相对滞后的，比如用户在一个时刻运行了一个网络应用，伪基站通过该网络应用获取到用户的一些私人信息，比如用户的账户信息，再收集到这些信息后，并不会马上产生一个针对用户的攻击事件，而可能是在收集到信息后的一天或是一周以后等时间，因此实际对用户产生困扰的时刻实际上是无法对应上攻击事件的事件发生时刻，从而确定出的可疑网络并不是盗取用户信息时用户所在的网络，因此，针对这种情况，其中一种方式是，对相对应的事件发生时刻可根据设定一个时间范围，以实际对用户产生困扰的时刻为截止时间，在此截止时间之前的预先设定的时间范围内发生的相同类型的网络事件均可作为目标通信事件。
举例来说，如将该时间范围设置为一周，即将所有在攻击事件的事件发生时刻前一周内的具有与攻击事件相同事件类型的均为目标通信事件，这些目标通信事件的事件发生时刻在攻击事件的事件发生时刻的前一周内。
作为可选的，目标切换事件包括切换前网络的网络信息和切换后网络的网络信息，网络信息中携带有网络的网络参数。
可以理解的是，目标切换事件中包括切换前网络的网络信息和切换后网络的网络信息，使得在确定了目标切换事件后，即可快速确定该目标切换时间所对应的切换后网络为目标网络。
需要说明的是，本发明实施例中的通信状况表可采用如下表1方式记录信息：
Figure PCTCN2015087033-appb-000001
Figure PCTCN2015087033-appb-000002
其中，每一行代表一个目标切换事件，包括切换前网络的网络信息和切换后网络的网络信息，以及对应的切换时间，另外存储的网络信息中可包含以下信息中的至少一种：
公共陆地移动网络(PLMN Public Land Mobile Network)ID；
如移动为46000，联通为46001。
位置区识别码(LAI Location Area Identity)，用于移动用户的位置更新；
其结构如下：
LAI＝MCC+MNC+LAC
MCC为移动国家号，与IMSI中的MCC一样具有3个数字，用于识别一个国家，中国为460。
MNC为移动网号，识别国内GSM网，与IMSI中的MNC的值是一样的。
LAC为位置区号码，识别一个GSM网中的位置区，LAC最大长度为16Bit，理论上可以在一个GSM/VLR内定义65536个位置区。
路由区域识别(RAI Routing Area Identification)，用于移动用户的路由区域选择；
其格式如下：
RAI＝MCC+MNC+LAC+RAC
MCC＝移动国家号，与IMSI中的MCC一样具有3个数字，用于识别一个国家，中国为460。
MNC＝移动网号，识别国内GSM网，与IMSI中的MNC的值是一样的。
LAC＝位置区号码，识别一个GSM网中的位置区。
RAC＝路由区域号码，识别一个GSM网中的路由区域。
跟踪区域码(TAC Tracking area code of cell servedby neighbor Enb)，定义了小区所属的跟踪区域码，一个跟踪区域可以涵盖一个或多个小区；
以及网络的信号强度。
作为可选的，步骤509与步骤407类似，区别于图4所示实施例中步骤406，在图5所示实施例中的该步骤406可被如下步骤所替代，：
506、用户终端根据目标切换事件确定切换后网络的网络参数。
其中，由于目标切换事件中包含有切换前网络的网络信息，而该网络信息中包含了对应的网络参数，因此在确定目标切换事件后，能够快速获取到该网络参数。
507、用户终端判断切换后网络的网络参数是否超出预设阈值。
其中，对获取的切换后网络的网络参数进行判断，判断的基准为预设的阈值，如该参数为LAI，则预设阈值可设为60000以上的高数值，如设为65534。
508、用户终端确定切换后网络为目标网络。
其中，在判断出超出预设阈值后，即可确定该切换后网络为目标网络。
由此可见，采用网络参数对判断具有该网络参数的网络是否为目标网络，具体判断网络参数是否超出预设阈值，当超出预设阈值时，则判定为目标网络，通过此方法，由于只需要进行一次对比，能够快速的确定出目标网络，能提高本发明实施例的适用性。
作为可选的，在图3至图5所示的实施例中，还可在用户终端中设置可疑网络列表，该可疑网络列表中存储有所有被扫描出的可疑网络，以及该可疑网络的网络信息，当用户终端进入可疑网络列表中任何可疑网络的区域时，都不会重选至该网络，可疑网络列表可自行对其中的可疑网络进行编辑，如可通过输入设备添加可疑网络至该可疑网络列表中，当然还可通过其他网络方式，如为了完善该可疑网络列表，还可设置用于维护可疑网络列表的服务器，用户终端将可疑网络列表上传至该服务器，在该服务器中对用户终端上传的可疑网络列表进行整合，以供用户终端通过该服务器对存储于本地的可疑网络列表进行更新，当然服务器还可对上传的可疑网络列表进行分析，如按区域整合成多张可疑网络列表，当用户终端在对应的区域更新可疑网络列表时，会自动更新对应的可疑网络列表，还可根据可疑网络列表中可疑网络出现频率的高低对可疑网络进行排序，并截取出现频率高的部分作为必更新的可疑网络列表，将出现频率低的作为可选更新的可疑网络列表。
上面介绍了本发明实施例中的处理方法，下面对本发明实施例中的警示方法予以说明，请参阅图6，图6是本发明实施例中警示方法的一个实施例图，如图6所示，本发明实施例提供一种移动网络安全的警示方法，可包括：
601、用户终端接收网络扫描请求；
其中，在接收到网络扫描请求后会触发进行网络扫描。
需要说明的是，网络扫描请求可由外部输入设备或设于用户终端内的输入设备输入之外，还可通过直接上用户设备传输的方式使用户终端接收到具有时间信息的攻击事件，具体可采用有线方式，即连接到另一台用户终端接收，也可以采用无线方式进行接收，如移动2G网络、3G网络或4G网络，再或者是WIFI、蓝牙等无线网络均可，具体视实际使用状况而定。
602、用户终端扫描通信切换表中的网络切换事件。
其中，通信切换表中记录有网络切换事件和网络切换事件对应的网络切换时刻，用户终端会对通信切换表中存储的网络切换事件进行扫描，并判断网络切换事件对应的网络中是否具有可疑网络。
603、用户终端确定可疑网络对应的网络切换事件对应的网络切换时刻为目标网络时刻。
其中，当用户终端确定对应网络切换事件对应的网络为可疑网络时，会将该可疑网络对应的网络切换事件所对应的网络切换时刻确定为目标网络时刻。
604、用户终端根据目标网络时刻在通信状况表中确定通信事件。
其中，通信事件中具有与目标网络时刻相对应的事件发生时刻，通信状况表中记录有通信事件和通信事件的事件发生时刻，用户终端根据目标网络时刻在通信状况表查找并确定具有对应的事件发生时刻的通信事件。
605、用户终端将通信事件作为可疑事件进行提示。
其中，在查找到对应的通信事件后，用户终端会将该通信事件作为可疑事件进行提示。
由此可见，本发明实施例中首先通过接收到网络扫描请求后会触发进行网络扫描，然后会对通信切换表中存储的网络切换事件进行扫描，并判断网络切换事件对应的网络中是否具有可疑网络，当用户终端确定对应网络切换事件对应的网络为可疑网络时，会将该可疑网络对应的网络切换事件所对应的网络切换时刻确定为目标网络时刻，再根据目标网络时刻在通信状况表中确定通信事件，而后将通信事件作为可疑事件进行提示，通过这种方式，能使得用户能够对自己进入的可疑网络了如指掌，并且通过可疑事件提示能够提醒用户在可疑网络下做了哪些操作，从而使用户能够及时进行补救操作，能够大大提高移动 网络的安全性。
需要说明的是，在图6所示实施例的基础上，本发明实施例中还具有针对可疑网络的确定的方式，作为可选的，在本发明实施例中的攻击事件的事件类型包括短信事件、电话事件和应用程序访问网络事件中的至少一种。
作为可选的，目标切换事件包括切换前网络的网络信息和切换后网络的网络信息，网络信息中携带有网络的网络参数。可以理解的是，目标切换事件中包括切换前网络的网络信息和切换后网络的网络信息，使得在确定了目标切换事件后，即可快速确定该目标切换时间所对应的切换后网络为目标网络。
如图7所示，图7是本发明实施例中警示方法的另一个实施例图，如图7所示，本发明实施例提供一种移动网络安全的预警方法，该方法中步骤701和702与步骤601和步骤602类似，步骤706至步骤708与步骤603至步骤605类似，不在赘述，其中，
703、用户终端根据网络切换事件确定切换后网络的网络参数。
其中，由于目标切换事件中包含有切换前网络的网络信息，而该网络信息中包含了对应的网络参数，因此在确定目标切换事件后，能够快速获取到该网络参数。
704、用户终端判断切换后网络的网络参数是否超出预设阈值。
其中，对获取的切换后网络的网络参数进行判断，判断的基准为预设的阈值，如该参数为LAI，则预设阈值可设为60000以上的高数值，如设为65534。
705、当超出预设阈值时，用户终端确定切换后网络为可疑网络。
其中，在判断出超出预设阈值后，即可确定该切换后网络为目标网络。
由此可见，采用网络参数对判断具有该网络参数的网络是否为目标网络，具体判断网络参数是否超出预设阈值，当超出预设阈值时，则判定为目标网络，通过此方法，由于只需要进行一次对比，能够快速的确定出目标网络，能提高本发明实施例的适用性。
作为可选的，在图6至图7所示的实施例中，还可在用户终端中设置可疑网络列表，该可疑网络列表中存储有所有被扫描出的可疑网络，以及该可疑网络的网络信息，当用户终端进入可疑网络列表中任何可疑网络的区域时，都不会重选至该网络，可疑网络列表可自行对其中的可疑网络进行编辑，如可通过 输入设备添加可疑网络至该可疑网络列表中，当然还可通过其他网络方式，如为了完善该可疑网络列表，还可设置用于维护可疑网络列表的服务器，用户终端将可疑网络列表上传至该服务器，在该服务器中对用户终端上传的可疑网络列表进行整合，以供用户终端通过该服务器对存储于本地的可疑网络列表进行更新，当然服务器还可对上传的可疑网络列表进行分析，如按区域整合成多张可疑网络列表，当用户终端在对应的区域更新可疑网络列表时，会自动更新对应的可疑网络列表，还可根据可疑网络列表中可疑网络出现频率的高低对可疑网络进行排序，并截取出现频率高的部分作为必更新的可疑网络列表，将出现频率低的作为可选更新的可疑网络列表。
上面对本发明实施例中移动网络安全的处理方法和警示方法进行了描述，下面本发明实施例中用户终端进行描述，请参阅图8，图8是本发明实施例的用户终端的一个实施例图，如图8所示，本发明实施例提供一种用户终端，可包括：
第一接收模块801，用于接收攻击事件的事件信息，事件信息中包括攻击事件的事件类型和攻击事件的事件发生时刻；
第一通信事件确定模块802，根据攻击事件的事件信息在通信状况表中确定目标通信事件，攻击事件的事件类型与目标通信事件的事件类型相同，目标通信事件的事件发生时刻与攻击事件的事件发生时刻相对应，通信状况表中记录有目标通信事件的事件类型和目标通信事件的事件发生时刻；
切换事件确定模块803，根据目标通信事件的事件发生时刻在通信切换表中确定目标切换事件，目标通信事件的事件发生时刻与目标切换事件的网络切换时刻相对应，通信切换表中存储有目标切换事件和目标切换事件的网络切换时刻；
目标网络确定模块804，根据目标切换事件确定与目标切换事件对应的目标网络；
标记模块805，将目标网络确定模块确定的目标网络标记为可疑网络。
由此可见，本发明实施例中由于建立了通信状况表和网络切换表，在通过第一接收模块801接收攻击事件的事件信息后，第一通信事件确定模块802根据该事件信息中的事件类型在通信状况表中确定相具有相同的事件类型的 目标通信事件，并由切换事件确定模块803根据目标通信事件的事件发生时刻在通信切换表中确定目标切换事件，而后目标网络确定模块804根据目标切换事件确定目标通信事件发生时所处的网络，并根据目标切换事件确定该网络为目标网络，并由标记模块805将该目标网络标记为可疑网络。通过上述方式能够针对攻击事件进行追溯，从而找到产生攻击事件时的网络，从而能够将该网络标记为可疑网络，并且在以后的网络重选中也不会重选到该网络，从而能够提高移动网络安全性。
作为可选的，第一接收模块801具体用于：
接收通过外部输入设备或设于用户终端内的输入设备输入的包括事件信息的攻击事件。
由此可知，包含事件信息的攻击事件可由输入设备输入，从而被第一接收模块801，且该输入设备可为用户终端内部的输入设备或是外部的输入设备，具体可采用有线方式，即连接到另一台用户终端接收，也可以采用无线方式进行接收，如移动2G网络、3G网络或4G网络，再或者是WIFI、蓝牙等无线网络均可，具体视实际使用状况而定。
需要说明的是，攻击事件的事件类型包括短信事件、电话事件和应用程序访问网络事件中的至少一种，且目标通信事件的事件发生时刻与攻击事件的事件发生时刻相对应，在不同的事件类型具有以下两种情况：
一、一个攻击事件的事件发生时刻对应一个目标通信事件的事件发生时刻，即一个攻击事件对应一个目标通信事件。
二、一个攻击事件的事件发生时刻对应一个以上目标通信事件的事件发生时刻，即一个攻击事件可对应一个以上的目标通信事件。
下面以攻击事件的事件类型为短信事件或电话事件为例，结合情况一即一个攻击事件对应一个目标通信事件对本发明实施例中攻击事件的追溯过程进行描述，请参阅图9，图9是本发明实施例中用户终端的另一个实施例图，如图9所示，区别于图8所示的实施例中的用户终端，在图9所示实施例的用户终端中第一通信事件确定模块902具体用于：
根据攻击事件的事件类型和攻击事件的事件发生时刻在通信状况表中确定目标通信事件，目标通信事件与攻击事件具有相同的事件类型和事件发生时 刻。
可以理解的是，对于短信事件和电话事件两种攻击事件来说，其特点在于，实际给用户产生困扰(如接收到垃圾短信、接收到推销电话等)的时刻与该攻击事件的事件发生时刻是相同的，即这两种攻击事件只要一发生就立即会对用户产生困扰，从而攻击事件的事件发生时刻对于电话事件来说，是来电发生的具体时刻，对于短信事件来说，是用户终端接收到短信的具体时刻，对于这两类攻击事件，可直接通过攻击事件发生的具体时刻，即事件发生时刻在通信切换表中查找对应的网络切换时刻。
需要说明的是，若攻击事件的事件类型为网络事件，即为第二种情况时，则第一通信事件确定模块902具体用于：
根据攻击事件的事件类型和攻击事件的事件发生时刻在通信状况表中确定一个以上的目标通信事件，该目标通信事件均与攻击事件具有相同的事件类型和相对应的事件发生时刻。
其中，由于网络事件具有的特点是其实际对用户产生困扰的时刻与攻击事件的事件发生时刻往往是不相同的，对用户产生困扰的时刻是相对滞后的，比如用户在一个时刻运行了一个网络应用，伪基站通过该网络应用获取到用户的一些私人信息，比如用户的账户信息，再收集到这些信息后，并不会马上产生一个针对用户的攻击事件，而可能是在收集到信息后的一天或是一周以后等时间，因此实际对用户产生困扰的时刻实际上是无法对应上攻击事件的事件发生时刻，从而确定出的可疑网络并不是盗取用户信息时用户所在的网络，因此，针对这种情况，其中一种方式是，对相对应的事件发生时刻可根据设定一个时间范围，以实际对用户产生困扰的时刻为截止时间，在此截止时间之前的预先设定的时间范围内发生的相同类型的网络事件均可作为目标通信事件。
举例来说，如将该时间范围设置为一周，即将所有在攻击事件的事件发生时刻前一周内的具有与攻击事件相同事件类型的均为目标通信事件，这些目标通信事件的事件发生时刻在攻击事件的事件发生时刻的前一周内。
需要说明的是：在确定目标通信事件后，会由切换事件确定模块903确定出目标切换事件，具体可采用如下方式：
作为可选的，用户终端中的切换事件确定模块903可包括：
第一确定单元9031，用于根据目标通信事件的事件发生时刻在通信切换表中确定时间上相邻的两个网络切换时刻，目标通信事件的事件发生时刻位于相邻的两个网络切换时刻之间；
第二确定单元9032，用于确定时间上相邻的两个网络切换时刻之中的前一个网络切换时刻为与目标通信事件的事件发生时刻对应的网络切换时刻；
切换事件确定单元9033，用于根据与目标通信事件的事件发生时刻对应的网络切换时刻在通信状况表中确定对应的目标切换事件。
其中，目标通信事件的事件发生时刻位于相邻的两个网络切换时刻之间，在由第一通信事件确定模块902确定出目标通信事件后，第一确定单元9031通过目标通信事件的事件发生时刻在通信切换表中查找时间上相邻的两个网络切换时刻，而目标通信事件的事件发生时刻位于这两个相邻的网络切换时刻之间，之后再通过第二确定单元9032确定时间上相邻的两个网络切换时刻之中的前一个网络切换时刻为与目标通信事件的事件发生时刻对应的网络切换时刻，在找到与目标通信事件的事件发生时刻相对应的网络切换时刻后，可由切换事件确定单元9033通过这个网络切换时刻在通信切换表中查找并确定其对应的目标切换事件。
由此可见，采用上述确定方式能够快速在通信切换表中确定出对应的目标切换事件，提高方案的适应性。
需要说明的是，目标网络确定模块904可采用以下方式确定与目标切换事件对应的目标网络，其中，目标切换事件包括切换前网络的网络信息和切换后网络的网络信息，网络信息中携带有网络的网络参数。
作为可选的，目标网络确定模块904包括：
网络参数确定单元9041，用于根据目标切换事件确定切换后网络的网络参数；
第一判断单元9042，用于判断切换后网络的网络参数是否超出预设阈值：
目标网络确定单元9043，用于当第一判断单元9042确定超出预设阈值时，确定切换后网络为目标网络。
其中，首先由网络参数确定单元9041根据目标切换事件确定切换后网络的网络参数，而后由第一判断单元9042判断切换后网络的网络参数是否超出 预设阈值，当超出预设阈值时，则由目标网络确定单元9043判定为目标网络。
由此可见，通过采用此方法，只需要进行一次对比，就能快速的确定出目标网络，能提高查找目标网络的效率，且能提高本发明实施例的适用性。
除上述图8和图9所示实施例中的用户终端之外，本发明实施例还提供一种用户终端，请参阅图10，图10是本发明实施例中用户终端的一个实施例图，如图10所示，本发明实施例提供一种用户终端，可包括：
第二接收模块1001，用于接收网络扫描请求；
扫描模块1002，用于描通信切换表中的网络切换事件，通信切换表中记录有网络切换事件和网络切换事件对应的网络切换时刻；
判断模块1003，用于判断网络切换事件对应的网络是否为可疑网络；
网络时刻确定模块1004，用于当确定对应网络切换事件对应的网络为可疑网络时，确定可疑网络对应的网络切换事件对应的网络切换时刻为目标网络时刻；
第二通信事件确定模块1005，用于根据目标网络时刻在通信状况表中确定通信事件，通信事件中具有与目标网络时刻相对应的事件发生时刻，通信状况表中记录有通信事件和通信事件的事件发生时刻；
提示模块1006，用于将通信事件作为可疑事件进行提示。
其中，在本发明实施例中首先通过第二接收模块1001接收到网络扫描请求后会触发进行网络扫描，然后会由扫描模块1002对通信切换表中存储的网络切换事件进行扫描，并通过判断模块1003判断网络切换事件对应的网络中是否具有可疑网络，当用户终端确定对应网络切换事件对应的网络为可疑网络时，会通过网络时刻确定模块1004将该可疑网络对应的网络切换事件所对应的网络切换时刻确定为目标网络时刻，接着由第二通信事件确定模块1005根据目标网络时刻在通信状况表中确定通信事件，并最终由提示模块1006将通信事件作为可疑事件进行提示。
由此可见，通过这种方式，能使得用户能够对自己进入的可疑网络了如指掌，并且通过可疑事件提示能够提醒用户在可疑网络下做了哪些操作，从而使用户能够及时进行补救操作，能够大大提高移动网络的安全性。
需要说明的是，目标网络确定模块1004可采用以下方式确定与目标切换 事件对应的目标网络，其中，目标切换事件包括切换前网络的网络信息和切换后网络的网络信息，网络信息中携带有网络的网络参数。
作为可选的，判断模块1003可包括：
网络参数查询单元10031，用于根据网络切换事件确定切换后网络的网络参数；
第二判断单元10032，判断切换后网络的网络参数是否超出预设阈值：
可疑网络确定单元10033，用于当第二判断单元确定超出预设阈值时，确定切换后网络为可疑网络。
其中，首先由网络参数查询单元10031根据目标切换事件确定切换后网络的网络参数，而后由第二判断单元10032判断切换后网络的网络参数是否超出预设阈值，当超出预设阈值时，则由可疑网络确定单元10033判定为目标网络。由此可见，通过采用此方法，只需要进行一次对比，就能快速的确定出可疑网络，能提高查找目标网络的效率，且能提高本发明实施例的适用性。
下面对本发明实施例中用户终端的结构进行描述，请参阅图11，图11是本发明实施例的用户终端的一个实施例图，其中，用户设备11可包括均与总线相连接的至少一个处理器1101、至少一个接收器1102和至少一个发送器1103，本发明实施例涉及的基站可以具有比图11所示出的更多或更少的部件，可以组合两个或更多个部件，或者可以具有不同的部件配置或设置，各个部件可以在包括一个或多个信号处理和/或专用集成电路在内的硬件、软件或硬件和软件的组合实现。
具体的，对于图8所示的实施例来说，该处理器1101能实现图8所示实施例中的第一通信事件确定模块802、切换事件确定模块803、目标网络确定模块804以及标记模块805的功能，该接收器1102能实现图8所示实施例中的第一接收模块801的功能；
对于图9来说，该处理器1101能实现图9所示实施例中的第一通信事件确定模块902、切换事件确定模块903、目标网络确定模块904以及标记模块905的功能，该接收器1102能实现图9所示实施例中的第一接收模块901的功能；
对于图10来说，该处理器1101能实现图10所示实施例中的扫描模块 1002、判断模块1003、网络时刻确定模块1004、第二通信事件确定模块1005以及提示模块1006的功能，该接收器1102能实现图10所示实施例中的第二接收模块1001的功能。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储 程序代码的介质。
以上，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (19)

  1. 一种移动网络安全的处理方法，其特征在于，包括：
    用户终端接收攻击事件的事件信息，所述事件信息中包括所述攻击事件的事件类型和所述攻击事件的事件发生时刻；
    所述用户终端根据所述攻击事件的事件信息在通信状况表中确定目标通信事件，所述攻击事件的事件类型与所述目标通信事件的事件类型相同，所述目标通信事件的事件发生时刻与所述攻击事件的事件发生时刻相对应，所述通信状况表中记录有所述目标通信事件的事件类型和所述目标通信事件的事件发生时刻；
    所述用户终端根据所述目标通信事件的事件发生时刻在通信切换表中确定目标切换事件，所述目标通信事件的事件发生时刻与所述目标切换事件的网络切换时刻相对应，所述通信切换表中存储有所述目标切换事件和所述目标切换事件的网络切换时刻；
    所述用户终端根据所述目标切换事件确定与所述目标切换事件对应的目标网络；
    所述用户终端将所述目标网络标记为可疑网络。
  2. 根据权利要求1所述的移动网络安全的处理方法，其特征在于，所述用户终端接收攻击事件的事件信息具体为：
    所述用户终端接收通过外部输入设备或设于所述用户终端内的输入设备输入的包括事件信息的攻击事件。
  3. 根据权利要求1或2所述的移动网络安全的处理方法，其特征在于，所述攻击事件的事件类型包括：
    短信事件、电话事件和应用程序访问网络事件中的至少一种。
  4. 根据权利要求3所述的移动网络安全的处理方法，其特征在于，当所述攻击事件的事件类型为短信事件或电话事件时，
    所述用户终端根据所述攻击事件的事件信息在通信状况表中确定目标通信事件具体为：
    所述用户终端根据所述攻击事件的事件类型和所述攻击事件的事件发生时刻在通信状况表中确定目标通信事件，所述目标通信事件与所述攻击事件具 有相同的事件类型和事件发生时刻。
  5. 根据权利要求1至4中任一项所述所述的移动网络安全的处理方法，其特征在于，所述用户终端根据所述目标通信事件的事件发生时刻在通信切换表中确定目标切换事件包括：
    所述用户终端根据目标通信事件的事件发生时刻在通信切换表中确定时间上相邻的两个网络切换时刻，所述目标通信事件的事件发生时刻位于所述相邻的两个网络切换时刻之间；
    所述用户终端确定所述时间上相邻的两个网络切换时刻之中的前一个网络切换时刻为与所述目标通信事件的事件发生时刻对应的网络切换时刻；
    所述用户终端根据与所述目标通信事件的事件发生时刻对应的网络切换时刻在所述通信状况表中确定对应的目标切换事件。
  6. 根据权利要求1至5中任一项所述所述的移动网络安全的处理方法，其特征在于，所述目标切换事件包括：
    切换前网络的网络信息和切换后网络的网络信息，所述网络信息中携带有网络的网络参数。
  7. 根据权利要求6所述的移动网络安全的处理方法，其特征在于，所述用户终端根据所述目标切换事件确定与所述目标切换事件对应的目标网络包括：
    所述用户终端根据所述目标切换事件确定切换后网络的网络参数；
    所述用户终端判断所述切换后网络的网络参数是否超出预设阈值：
    当超出预设阈值时，所述用户终端确定所述切换后网络为所述目标网络。
  8. 一种移动网络安全的警示方法，其特征在于，包括：
    用户终端接收网络扫描请求；
    所述用户终端扫描通信切换表中的网络切换事件，所述通信切换表中记录有所述网络切换事件和所述网络切换事件对应的网络切换时刻；
    所述用户终端判断所述网络切换事件对应的网络是否为可疑网络；
    当所述用户终端确定对应所述网络切换事件对应的网络为可疑网络时，所述用户终端确定所述可疑网络对应的网络切换事件对应的网络切换时刻为目标网络时刻；
    用户终端根据所述目标网络时刻在通信状况表中确定通信事件，所述通信事件中具有与所述目标网络时刻相对应的事件发生时刻，所述通信状况表中记录有所述通信事件和所述通信事件的事件发生时刻；
    用户终端将所述通信事件作为可疑事件进行提示。
  9. 根据权利要求8所述的移动网络安全的警示方法，其特征在于：所述通信事件包括：
    短信事件、电话事件和应用程序访问网络事件之中至少一种。
  10. 根据权利要求8或9所述所述的移动网络安全的预警方法，其特征在于，所述网络切换事件包括：
    切换前网络的网络信息和切换后网络的网络信息，所述网络信息中携带有网络的网络参数。
  11. 根据权利要求10所述的移动网络安全的预警方法，其特征在于，所述方法还包括：
    所述用户终端根据所述网络切换事件确定切换后网络的网络参数；
    所述用户终端判断所述切换后网络的网络参数是否超出预设阈值：
    当超出预设阈值时，所述用户终端确定所述切换后网络为可疑网络。
  12. 一种用户终端，其特征在于，包括：
    第一接收模块，用于接收攻击事件的事件信息，所述事件信息中包括所述攻击事件的事件类型和所述攻击事件的事件发生时刻；
    第一通信事件确定模块，根据所述攻击事件的事件信息在通信状况表中确定目标通信事件，所述攻击事件的事件类型与所述目标通信事件的事件类型相同，所述目标通信事件的事件发生时刻与所述攻击事件的事件发生时刻相对应，所述通信状况表中记录有所述目标通信事件的事件类型和所述目标通信事件的事件发生时刻；
    切换事件确定模块，根据所述目标通信事件的事件发生时刻在通信切换表中确定目标切换事件，所述目标通信事件的事件发生时刻与所述目标切换事件的网络切换时刻相对应，所述通信切换表中存储有所述目标切换事件和所述目标切换事件的网络切换时刻；
    目标网络确定模块，根据所述目标切换事件确定与所述目标切换事件对应 的目标网络；
    标记模块，将所述目标网络确定模块确定的目标网络标记为可疑网络。
  13. 根据权利要求12所述的用户终端，其特征在于，所述第一接收模块具体用于：
    接收通过外部输入设备或设于所述用户终端内的输入设备输入的包括事件信息的攻击事件。
  14. 根据权利要求12或13所述的用户终端，其特征在于，所述攻击事件的事件类型包括：
    短信事件、电话事件和应用程序访问网络事件中的至少一种。
  15. 根据权利要求14所述的用户终端，其特征在于，当所述攻击事件的事件类型为短信事件或电话事件时，
    所述第一通信事件确定模块具体用于：
    根据所述攻击事件的事件类型和所述攻击事件的事件发生时刻在通信状况表中确定目标通信事件，所述目标通信事件与所述攻击事件具有相同的事件类型和事件发生时刻。
  16. 根据权利要求12至15中任一项所述的用户终端，其特征在于，所述切换事件确定模块包括：
    第一确定单元，用于根据目标通信事件的事件发生时刻在通信切换表中确定时间上相邻的两个网络切换时刻，所述目标通信事件的事件发生时刻位于所述相邻的两个网络切换时刻之间；
    第二确定单元，用于确定所述时间上相邻的两个网络切换时刻之中的前一个网络切换时刻为与所述目标通信事件的事件发生时刻对应的网络切换时刻；
    切换事件确定单元，用于根据与所述目标通信事件的事件发生时刻对应的网络切换时刻在所述通信状况表中确定对应的目标切换事件。
  17. 根据权利要求12至16中任一项所述的用户终端，其特征在于，所述目标切换事件包括：
    切换前网络的网络信息和切换后网络的网络信息，所述网络信息中携带有网络的网络参数；
    所述目标网络确定模块包括：
    网络参数确定单元，用于根据所述目标切换事件确定切换后网络的网络参数；
    第一判断单元，用于判断所述切换后网络的网络参数是否超出预设阈值：
    目标网络确定单元，用于当所述第一判断单元确定超出预设阈值时，确定所述切换后网络为所述目标网络。
  18. 一种用户终端，其特征在于，包括：
    第二接收模块，用于接收网络扫描请求；
    扫描模块，用于描通信切换表中的网络切换事件，所述通信切换表中记录有所述网络切换事件和所述网络切换事件对应的网络切换时刻；
    判断模块，用于判断所述网络切换事件对应的网络是否为可疑网络；
    网络时刻确定模块，用于当确定对应所述网络切换事件对应的网络为可疑网络时，确定所述可疑网络对应的网络切换事件对应的网络切换时刻为目标网络时刻；
    第二通信事件确定模块，用于根据所述目标网络时刻在通信状况表中确定通信事件，所述通信事件中具有与所述目标网络时刻相对应的事件发生时刻，所述通信状况表中记录有所述通信事件和所述通信事件的事件发生时刻；
    提示模块，用于将所述通信事件作为可疑事件进行提示。
  19. 根据权利要求18所述的用户终端，其特征在于，所述网络切换事件包括：
    切换前网络的网络信息和切换后网络的网络信息，所述网络信息中携带有网络的网络参数。
    所述判断模块包括：
    网络参数查询单元，用于根据所述网络切换事件确定切换后网络的网络参数；
    第二判断单元，判断所述切换后网络的网络参数是否超出预设阈值：
    可疑网络确定单元，用于当所述第二判断单元确定超出预设阈值时，确定所述切换后网络为可疑网络。
PCT/CN2015/087033 2015-08-14 2015-08-14 一种移动网络安全的处理方法、警示方法及用户终端 WO2017028031A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2015/087033 WO2017028031A1 (zh) 2015-08-14 2015-08-14 一种移动网络安全的处理方法、警示方法及用户终端
CN201580046897.4A CN106664309B (zh) 2015-08-14 2015-08-14 一种移动网络安全的处理方法、警示方法及用户终端

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/087033 WO2017028031A1 (zh) 2015-08-14 2015-08-14 一种移动网络安全的处理方法、警示方法及用户终端

Publications (1)

Publication Number Publication Date
WO2017028031A1 true WO2017028031A1 (zh) 2017-02-23

Family

ID=58050440

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/087033 WO2017028031A1 (zh) 2015-08-14 2015-08-14 一种移动网络安全的处理方法、警示方法及用户终端

Country Status (2)

Country Link
CN (1) CN106664309B (zh)
WO (1) WO2017028031A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113709147A (zh) * 2021-08-26 2021-11-26 北京天融信网络安全技术有限公司 网络安全事件的响应方法、装置及设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101184094A (zh) * 2007-12-06 2008-05-21 北京启明星辰信息技术有限公司 一种适于局域网环境的网络节点扫描检测方法和系统
CN103491076A (zh) * 2013-09-09 2014-01-01 杭州华三通信技术有限公司 一种网络攻击的防范方法和系统
US20140230059A1 (en) * 2011-12-07 2014-08-14 Beijing Runstone Technology Incorporation Method and Apparatus for Tracing Attack Source of Abnormal Network Traffic

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101184094A (zh) * 2007-12-06 2008-05-21 北京启明星辰信息技术有限公司 一种适于局域网环境的网络节点扫描检测方法和系统
US20140230059A1 (en) * 2011-12-07 2014-08-14 Beijing Runstone Technology Incorporation Method and Apparatus for Tracing Attack Source of Abnormal Network Traffic
CN103491076A (zh) * 2013-09-09 2014-01-01 杭州华三通信技术有限公司 一种网络攻击的防范方法和系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113709147A (zh) * 2021-08-26 2021-11-26 北京天融信网络安全技术有限公司 网络安全事件的响应方法、装置及设备

Also Published As

Publication number Publication date
CN106664309B (zh) 2019-10-22
CN106664309A (zh) 2017-05-10

Similar Documents

Publication Publication Date Title
US10034324B2 (en) Optimization of power consumption in dual SIM mobiles in connected mode in a wireless network
KR101712865B1 (ko) 이동 통신 시스템에서 비계층 프로토콜을 이용한 통신 지원 방법 및 장치
US9197645B2 (en) Distribution of access control information in a network
US9072118B2 (en) Method for implementing WiFi communication, user equipment and wireless routing device
EP3596985B1 (en) Method and apparatus for protection of privacy in paging of user equipment
US10448286B2 (en) Mobility in mobile communications network
US11044276B2 (en) Cellular security framework
CN107333311B (zh) 一种防止lte终端在空闲态反复发起跟踪区更新流程的方法
EP3488577B1 (en) Node and method for detecting that a wireless device has been communicating with a non-legitimate device
US20140162619A1 (en) Methods, apparatuses and computer program products for securing communications
US11792633B2 (en) Device authentication verification for device registration
EP3576366B1 (en) Method and fake base station for detecting subscriber identity
CN113099455B (zh) 一种lte终端用户手机号码的抗捕获方法
WO2020019328A1 (zh) 一种伪基站识别方法及装置
US11337054B2 (en) System and method for obtaining an identifier of a mobile communication terminal at a control checkpoint
EP2928230B1 (en) Method and device to collect event statistics during inter-rat mobility
WO2017028031A1 (zh) 一种移动网络安全的处理方法、警示方法及用户终端
CN101938746B (zh) 一种用户标识模块反克隆的方法及装置
EP2938109B1 (en) Indication of IMEISV over MAP for inter-MSC handover
KR102129901B1 (ko) 회선 교환 폴백을 지원하는 이동 통신 시스템 및 방법
KR101748246B1 (ko) 이동 통신 시스템에서 비계층 프로토콜을 이용한 통신 지원 방법 및 장치
WO2015021580A1 (zh) 异系统互操作的方法、装置及移动终端

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15901236

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15901236

Country of ref document: EP

Kind code of ref document: A1