WO2020001336A1

WO2020001336A1 - Information processing method and device

Info

Publication number: WO2020001336A1
Application number: PCT/CN2019/091795
Authority: WO
Inventors: 辛阳; 吴晓波; 孙满利; 朱方园
Original assignee: 华为技术有限公司
Priority date: 2018-06-26
Filing date: 2019-06-18
Publication date: 2020-01-02

Abstract

The present invention relates to the technical field of communications, and embodiments of the present application provide an information processing method and device, for use in providing expected terminal behavioral information of a network side having high credibility. The solution comprises: a data analysis network element acquires terminal behavioral information of a plurality of terminals; the data analysis network element determines the expected terminal behavioral information of the network side according to the terminal behavioral information; and the data analysis network element sends the expected terminal behavioral information of the network side to a user data management network element. Since the data analysis network element is a network element managed by an operator, the credibility of the expected terminal behavioral information of the network side is higher and more truly than that of expected terminal behavioral information of a third party provided by an application function network element or a service server in the prior art.

Description

Information processing method and device

This application claims priority from Chinese patent applications filed on June 26, 2018 with the State Intellectual Property Office, application number 201810705963.X, and application name "An Information Processing Method and Device", and on February 25, 2019 The priority of a Chinese patent application filed with the State Intellectual Property Office with an application number of 201910143741.8 and the application name of "an information processing method and device" is incorporated herein by reference in its entirety.

Technical field

The embodiments of the present application relate to the field of communication technologies, and in particular, to an information processing method and device.

Background technique

In the fifth generation (5-Generation, 5G) communication technology, a mass Internet of Things (mIoT) terminal is introduced. In the prior art, the 5G network side allows a third-party network element (for example, an Application Function (AF) network element) to provide some terminal behavior information (expected UE information) expected by the third party or the service server. Then the 5G network element in the 5G network can use the terminal behavior information expected by the third party or the service server provided by the AF network element. For example, a 5G network element may store terminal behavior information expected by the network side in a unified data management network element (unified data management (UDM) network element) as a part of the contract information of the terminal.

However, the process by which the AF network element provides the terminal behavior information expected by the third party or the service server to the 5G network element is not mandatory. Therefore, when the AF network element does not provide the terminal behavior information expected by the network side, the UDM network element may not be updated. Contract information of mIoT terminal. In addition, the terminal behavior information expected by the network side provided by the AF network element is less reliable for the operator network.

Summary of the invention

Embodiments of the present invention provide an information processing method and device, which are used to provide terminal behavior information expected by a network side with high reliability.

To solve the above problems, the embodiments of the present application provide the following technical solutions:

In a first aspect, the present application provides an information processing method, including: a data analysis network element acquiring terminal behavior information of multiple terminals. The data analysis network element determines the terminal behavior information expected by the network side according to the terminal behavior information. The data analysis network element sends the terminal behavior information expected by the network side to the user data management network element.

An embodiment of the present application provides an information processing method. A data analysis network element obtains terminal behavior information of multiple terminals, determines terminal behavior information expected by the network side based on the terminal behavior information of multiple terminals, and then The behavior information is sent to the user data management network element. Since the data analysis network element belongs to the network element managed by the operator, the credibility of the terminal behavior information expected by the network side is compared with the terminal behavior information expected by the third party or service server provided by the application function network element in the prior art. Higher and more authentic. In addition, the terminal behavior information expected by the network side provided by the data analysis network element is more comprehensive. In addition, the terminal behavior information expected by the network side provided by the data analysis network element can also be used to verify the terminal behavior information expected by a third party or a service server provided by the application function network element.

In a possible implementation manner, the data analysis network element acquiring terminal behavior information of multiple terminals includes: the data analysis network element acquiring terminal behavior information from at least two core network element respectively corresponding to at least two core network elements. Terminal behavior information. By obtaining terminal behavior information of multiple terminals on at least two core network element from at least two core network elements, the terminal behavior information obtained by the data analysis network element can be made more comprehensive.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element sends to at least two core network elements to request terminal behaviors corresponding to the plurality of terminals on the at least two core network elements. The first request message for information. This is used to trigger at least two core network elements to send terminal behavior information of multiple terminals to the data analysis network element.

In a possible implementation manner, the first request message includes filtering information used to indicate a collection range of terminal behavior information of each terminal in the multiple terminals. On the one hand, it is convenient for at least two core network elements to determine a range for collecting terminal behavior information of each terminal. On the other hand, the core network element collects terminal behavior information of each terminal according to the filtering information, so that the terminal behavior information collected by at least two core network elements can meet the requirements of the network side.

In a possible implementation manner, the filtering information includes one or more of the following information: identification information of the terminal, a network area corresponding to the terminal, a terminal type, and a time window. The scope of collecting terminal behavior information by at least two core network elements is further reduced.

Exemplarily, the identification information of the terminal in the embodiment of the present application may be one or more of the following: an internet protocol address (IP), a subscription permanent identifier (SUPI), and a permanent equipment identifier (permanent equipment identifier) , PEI), generic public subscription identifier (GPSI), international mobile subscriber identifier (IMSI), international mobile equipment identity (IMEI), IP five-tuple (5 -tuple) and mobile station international integrated service digital network number (MSISDN). In the following embodiments, any identification information related to the terminal can be referred to the description here, and will not be repeated later.

In a possible implementation manner, the terminal behavior information includes identification information of the terminal and one or more of the following information corresponding to the terminal: identification information of the core network element, location information, communication start time, communication end time, and packet time Delay, the number of data packets, the size of the data packets, and at least one first type of data of the terminal corresponding to the core network element. The coverage of the obtained terminal behavior information is wider and more comprehensive.

In a possible implementation manner, the location information corresponding to the terminal includes time and location, where the location information is used to indicate the location of the terminal at a certain time.

Exemplarily, the location of the terminal in the embodiment of the present application may be one or more of the following information: a radio access network device identification (RAN ID), a cell identification (Cell ID), and a tracking area (Tracking Area, TA). ), Routing Area (RA), and Global Positioning System (GPS). For the location information of the terminal in the following embodiments, reference may be made to the description herein, and details are not described later.

In a possible implementation manner, the data analysis network element acquiring terminal behavior information of multiple terminals includes: the data analysis network element acquiring corresponding terminal behavior information of at least two core network elements from the operation management and maintenance network element. Terminal behavior information.

In a possible implementation manner, the terminal behavior information expected by the network side and expected by the network side includes one or more of the following information: stationary indication, terminal movement trajectory, periodic communication indication, communication duration, communication period, and planned communication time. , The maximum packet transmission delay, the maximum packet transmission response time, the number of packet buffers, and at least one second type of data.

In a possible implementation manner, the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of terminals among multiple terminals.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element sends the first information of the terminal corresponding to the terminal behavior information expected by the network side to the user data management network element, and the first information of the terminal includes the terminal The identification information of the terminal group.

In a possible implementation manner, the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least two core network elements. It is convenient for the user data management network element to receive the expected terminal behavior information of the network side to each core network element according to the expected behavior of the terminal on the network side corresponding to at least two core network elements after receiving the expected behavior of the terminal on the network side. Behavioral information.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element sends at least one of identification information and type information of at least two core network element to the user data management network element. The identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side, and the type information of the core network element is used to indicate that the terminal behavior information expected by the network side corresponds to the core network element Types of. It is convenient for the user data management network element to determine the core network element to which the terminal behavior information expected by the network side is sent.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element determines the abnormal type of the terminal according to the terminal behavior information expected by the network side. The data analysis network element sends alarm information indicating the abnormal type of the terminal to the policy control network element. It is convenient for the policy control network element to determine the abnormal type of the terminal, and then take further measures. For example, shut down the network used by abnormal terminals.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element receives a second request message sent by the user data management network element for requesting terminal behavior information expected by the network side, and the second request message includes Identification information of multiple terminals. The data analysis network element can obtain the terminal behavior information expected by the network side at the request of the user data management network element.

In a possible implementation manner, the data analysis network element obtains terminal behavior information of multiple terminals, including: the data analysis network element obtains, from the operation management and maintenance network element, terminals corresponding to multiple terminals on at least two core network element Behavioral information.

In a second aspect, an embodiment of the present application provides an information sending method, including: a core network element receiving a first request message sent by a data analysis network element to request terminal behavior information corresponding to multiple terminals. The core network element sends terminal behavior information corresponding to the plurality of terminals to the core network element according to the first request message to the data analysis network element. The core network element receives the first request message sent by the data analysis network element, and triggers the first request message to send to the data analysis network element the terminal behavior information corresponding to the multiple terminals at the core network element. In this way, the data analysis network element can obtain more comprehensive terminal behavior information.

In a possible implementation manner, the first request message includes filtering information used to indicate a collection range of terminal behavior information of each terminal in the multiple terminals.

In a possible implementation manner, the filtering information includes one or more of the following information: identification information of the terminal, a network area corresponding to the terminal, a terminal type, and a time window.

In a possible implementation manner, the terminal behavior information includes identification information of the terminal and one or more of the following information corresponding to the terminal: identification information of the core network element, location information, communication start time, communication end time, and packet time Delay, the number of data packets, the size of the data packets, and at least one first type of data of the terminal corresponding to the core network element.

In a possible implementation manner, the location information corresponding to the terminal includes time and location, where the terminal is located at the location at the time.

In a possible implementation manner, the core network element may send terminal behavior information corresponding to multiple terminals to the data analysis network element to the data analysis network element through the operation management and maintenance network element. Specifically, the core network element sends terminal behavior information corresponding to multiple terminals to the core network element to the operation management and maintenance network element, and the operation management and maintenance network element is used to correspond to multiple terminals at the core network element. The terminal's behavior information is sent to the data analysis network element.

According to a third aspect, an embodiment of the present application provides an information processing method, including: a user data management network element receiving data analysis terminal behavior information expected by the network side sent by the data analysis network element; the user data management network element receiving terminal behavior information expected by the network side As user contract data.

An embodiment of the present application provides an information processing method. A user data management network element receives data analysis terminal behavior information expected by a network side sent by the data analysis network element, and stores the terminal behavior information expected by the network side as user subscription data of the terminal. This can make the terminal behavior information expected by the network side provided by the data analysis network element more reliable.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the user data management network element sends a second request message to the data analysis network element for requesting terminal behavior information expected by the network side, where the second request message includes Identification information of multiple terminals.

In a possible implementation manner, the terminal behavior information expected by the network side and expected by the network side includes one or more of the following information: stationary indication, terminal movement trajectory, periodic communication indication, communication duration, communication cycle, planned communication time, The maximum data packet transmission delay, the maximum data packet transmission response time, the number of data packet buffers, and at least one second type of data.

In a possible implementation manner, the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of the multiple terminals.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the user data management network element receives the first information of the terminal corresponding to the terminal behavior information expected by the network side sent by the data analysis network element, The first information includes identification information of a terminal or identification information of a terminal group.

In a possible implementation manner, the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least two core network elements.

In a possible implementation manner, the method provided in this embodiment of the present application further includes: the user data management network element receives at least one of identification information and type information of at least two core network network elements sent by the data analysis network element. The identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side, and the type information of the core network element is used to indicate that the terminal behavior information expected by the network side corresponds to the core network. Network element type.

In a fourth aspect, the present application provides an information processing apparatus that can implement the first aspect or the method in any possible implementation manner of the first aspect, and therefore can also implement the first aspect or any possible implementation of the first aspect. Beneficial effects in implementation. The information processing device may be a data analysis network element or a device that can support the data analysis network element to implement the first aspect or the method in any possible implementation manner of the first aspect, such as a chip applied to the data analysis network element . The information processing apparatus may implement the above method by software, hardware, or by executing corresponding software by hardware.

An information processing apparatus provided in a fourth aspect includes: an acquiring unit for acquiring terminal behavior information of a plurality of terminals; and a determining unit for determining terminal behavior information expected by a network side according to the terminal behavior information. The sending unit is configured to send the behavior information of the terminal expected by the network side to the user data management network element.

In a possible implementation manner, the obtaining unit is specifically configured to obtain terminal behavior information corresponding to at least two core network network elements of the terminal behavior information from at least two core network network elements.

In a possible implementation manner, the sending unit is further configured to send, to at least two core network elements, a first request message for requesting terminal behavior information corresponding to multiple terminals on the at least two core network elements.

In a possible implementation manner, the first request message includes filtering information for indicating a range of terminal behavior information of each terminal in the multiple terminals.

In a possible implementation manner, the location information corresponding to the terminal includes time and location. The location information is used to indicate a specific location where the terminal is located at each time. The location information may be one or more time periods and the location of the terminal corresponding to each of the one or more time periods.

In a possible implementation manner, the obtaining unit is specifically configured to obtain terminal behavior information corresponding to at least two core network elements in the terminal behavior information from the operation management and maintenance network elements.

In a possible implementation manner, the sending unit is further configured to send the first information of the terminal corresponding to the terminal behavior information expected by the network side to the user data management network element, and the first information of the terminal includes the identification information of the terminal or the identification of the terminal group. information.

In a possible implementation manner, the sending unit is further configured to send at least one of identification information and type information of each core network element in at least two core network elements to the user data management network element. The identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side, and the type information of the core network element is used to indicate that the terminal behavior information expected by the network side corresponds to the core network. Network element type.

In a possible implementation manner, the determining unit is further configured to determine an abnormal type of the terminal according to the terminal behavior information expected by the network side. The sending unit is further configured to send alarm information for indicating the abnormal type of the terminal to the policy control network element.

In a possible implementation manner, the information processing apparatus further includes: a receiving unit, configured to receive a second request message sent by the user data management network element and used to request terminal behavior information expected by the network side, where the second request message includes multiple Terminal identification information.

In a possible implementation manner, an embodiment of the present application further provides an information processing apparatus. The information processing apparatus may be a data analysis network element or a chip applied to the data analysis network element. The information processing apparatus includes a processor and A communication interface, where the communication interface is used to support the information processing apparatus to perform the steps of receiving / sending messages / data on the information processing apparatus side described in any one of the first aspect to the first possible implementation manner of the first aspect. The processor is configured to support the information processing apparatus to execute the steps of performing message / data processing on the information processing apparatus side described in any one of the possible implementation manners of the first aspect to the first aspect. For specific corresponding steps, reference may be made to the description in any one of the possible implementation manners of the first aspect to the first aspect, and details are not described herein again.

Optionally, the communication interface and the processor of the information processing apparatus are coupled to each other.

Optionally, the information processing apparatus may further include a memory for storing codes and data, and the processor, the communication interface, and the memory are coupled to each other.

In a fifth aspect, the present application provides an information sending device that can implement the second aspect or the method in any possible implementation manner of the second aspect, and therefore can also implement the second aspect or any possible implementation of the second aspect. Beneficial effects in implementation. The information sending device may be a core network element, or a device that can support the core network element to implement the second aspect or the method in any possible implementation manner of the second aspect, such as a chip applied to the core network element. . The information sending device may implement the foregoing method by using software, hardware, or executing corresponding software by hardware.

An information sending device provided by a fifth aspect of the present application includes: a sending unit, configured to send, to a data analysis network element, terminal behavior information corresponding to multiple terminals at the core network element.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: a receiving unit, configured to receive a first request message sent by the data analysis network element and used to request terminal behavior information corresponding to multiple terminals. The sending unit is specifically configured to send, to the data analysis network element according to the first request message, terminal behavior information corresponding to multiple terminals at the core network element.

In a possible implementation manner, the first request message includes filtering information used to indicate a range of terminal behavior information of the terminal.

In a possible implementation manner, the terminal behavior information includes identification information of the terminal and one or more of the following information: identification information of the core network element, location information, communication start time, communication end time, data packet delay, The number of data packets, the size of the data packets, and at least one first type of data of the terminal corresponding to the core network element.

In a possible implementation manner, the sending unit is specifically configured to send terminal behavior information corresponding to multiple terminals at the core network element to the operation management and maintenance network element, and the operation management and maintenance network element is used to send multiple The terminal behavior information corresponding to the terminal at the core network element is sent to the data analysis network element.

In a possible implementation manner, an embodiment of the present application further provides an information sending device. The information sending device may be a core network element or a chip applied to the core network element. The information sending device includes a processor and A communication interface, where the communication interface is used to support the information sending device to perform the steps of receiving / sending data / data on the information sending device side described in any one of the possible implementation manners of the second aspect to the second aspect. The processor is configured to support the information sending apparatus to perform the steps of performing message / data processing on the information sending apparatus side described in any one of the possible implementation manners of the second aspect to the second aspect. For specific corresponding steps, reference may be made to the description in any one of the possible implementation manners of the second aspect to the second aspect, and details are not described herein again.

Optionally, the communication interface of the information sending device and the processor are coupled to each other.

Optionally, the information sending apparatus may further include a memory for storing codes and data, and the processor, the communication interface, and the memory are coupled to each other.

In a sixth aspect, the present application provides an information processing apparatus that can implement the third aspect or the method in any possible implementation manner of the third aspect, and therefore can also implement the third aspect or any possible implementation of the third aspect. Beneficial effects in implementation. The information processing device may be a user data management network element, or may be a device that can support the user data management network element to implement the third aspect or the method in any possible implementation manner of the third aspect, for example, is applied to a user data management network element In the chip. The information processing apparatus may implement the above method by software, hardware, or by executing corresponding software by hardware.

The information processing apparatus provided in the sixth aspect includes: a sending unit, configured to send a second request message to the data analysis network element for requesting terminal behavior information expected by the network side, where the second request message includes identification information of multiple terminals . The receiving unit is configured to receive terminal behavior information expected by the network side sent by the data analysis network element.

In a possible implementation manner, the receiving unit is further configured to receive first information of a terminal corresponding to terminal behavior information expected by a network side sent by a data analysis network element, where the first information of the terminal includes identification information of the terminal or a terminal group Identification information.

In a possible implementation manner, the receiving unit is further configured to receive at least one of identification information and type information of each core network element among the at least two core network elements sent by the data analysis network element. The identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side, and the type information of the core network element is used to indicate that the terminal behavior information expected by the network side corresponds to the core network. Network element type.

In a possible implementation manner, an embodiment of the present application further provides an information processing apparatus. The information processing apparatus may be a user data management network element or a chip applied to the user data management network element. The information processing apparatus includes: A processor and a communication interface, wherein the communication interface is used to support the information processing device to perform message / data reception and transmission on the information processing device side as described in any one of the possible implementation manners of the third aspect to the third aspect A step of. The processor is configured to support the information processing apparatus to execute the steps of performing message / data processing on the information processing apparatus side described in any one of the possible implementation manners of the third aspect to the third aspect. For specific corresponding steps, reference may be made to the description in any one of the possible implementation manners of the third aspect to the third aspect, and details are not described herein again.

In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program or an instruction. When the computer program or the instruction is run on the computer, the computer executes the first aspect or the first aspect. On the one hand, the information processing method described in any possible implementation manner.

In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program or an instruction. When the computer program or the instruction is run on the computer, the computer executes the second aspect or the first aspect. The information sending method described in any one of the two possible implementation manners.

In a ninth aspect, an embodiment of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program or an instruction. When the computer program or the instruction runs on the computer, the computer executes the third aspect or the first The information processing method described in any one of the three possible implementations.

In a tenth aspect, the present application provides a computer program product including instructions that, when run on a computer, causes the computer to execute one or more of the first aspect and various possible implementations of the first aspect.

In an eleventh aspect, the present application provides a computer program product including instructions that, when run on a computer, causes the computer to perform one or more of the second aspect or various possible implementations of the second aspect.

In a twelfth aspect, the present application provides a computer program product including instructions that, when run on a computer, causes the computer to execute the third aspect or one or more of the various possible implementations of the third aspect.

In a thirteenth aspect, the present application provides a chip that includes a processor and an interface circuit. The interface circuit is coupled to the processor, and the processor is configured to run a computer program or instructions to implement the first aspect or the various possible aspects of the first aspect. One or more of the implementations.

In a fourteenth aspect, the present application provides a chip. The chip includes a processor and an interface circuit. The interface circuit is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the second aspect or the various possible aspects of the second aspect. One or more of the implementations.

In a fifteenth aspect, the present application provides a chip. The chip includes a processor and an interface circuit. The interface circuit is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the third aspect or various possible implementations of the third aspect. One or more of the ways.

Optionally, the chip described above in this application may further include at least one memory, and the at least one memory stores instructions or a computer program.

In a sixteenth aspect, an embodiment of the present application provides a communication system including the information processing device described in the fourth aspect and various possible implementation manners of the fourth aspect, and at least two as described in the fifth aspect or The information sending apparatus described in various possible implementations of the fifth aspect, and the information processing apparatus described in various aspects of the sixth aspect or the various possible implementations of the sixth aspect.

In a seventeenth aspect, an embodiment of the present application provides a method for determining abnormality information of a terminal, including: the data analysis network element receives indication information from the first network element for indicating the abnormality of the terminal; the data analysis network element obtains the indication information according to the indication information Terminal behavior information of the terminal on the second network element; the data analysis network element determines abnormal information of the terminal according to the terminal behavior information.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element receives from the first network element one or more of the following information corresponding to the terminal: identification information of the terminal, network Area, terminal type, time information, and terminal behavior information of the terminal on the first network element.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element obtains terminal behavior information of the terminal on the first network element. Correspondingly, the method provided in the embodiment of the present application further includes: the data analysis network element obtains the terminal behavior information of the terminal according to the terminal behavior information of the terminal on the first network element and the terminal behavior information of the terminal on the second network element.

Specifically, the data analysis network element associates the terminal behavior information of the terminal on the first network element and the terminal behavior information of the terminal on the second network element according to the terminal identification information to obtain the terminal behavior information of the terminal. The data analysis network element determines the abnormality information of the terminal according to the terminal behavior information of the terminal.

In a possible implementation manner, the data analysis network element acquiring terminal behavior information corresponding to the terminal on the second network element according to the instruction information includes: the data analysis network element sends a request message to the second network element. The request message is used to request terminal behavior information of the terminal on the second network element. The data analysis network element receives a response message from the second network element, where the response message includes terminal behavior information of the terminal on the second network element.

In a possible implementation manner, the request message includes one or more of the following information corresponding to the terminal: identification information of the terminal, network area, terminal type, and time information.

In a possible implementation manner, the terminal behavior information of the terminal on the second network element includes one or more of the terminal identification information of the terminal and the following information corresponding to the terminal: the first Second network element identification information, location information, communication start time, communication end time, packet delay, packet number, packet size, mobility re-registration frequency information, data network name reachable after DNN failure, geography The number of terminals in the area, the permanent user identifier SUPI-permanent device identifier PEI association update information, roaming status information, and at least one first type of data of the terminal on the second network element.

In a possible implementation manner, the data analysis network element determines the abnormal information of the terminal according to the terminal behavior data, including: the data analysis network element determines the terminal behavior information of the terminal and the terminal behavior information expected by the network side of the terminal Abnormal information of the terminal.

Specifically, the data analysis network element determines the abnormality information of the terminal according to the terminal behavior data, including: the data analysis network element determines the abnormality of the terminal according to the terminal behavior information of the terminal and the terminal behavior information expected by the network side of the terminal The information includes: the data analysis network element determines the abnormality of the terminal according to the terminal behavior information of the terminal on the first network element, the terminal behavior information of the terminal on the second network element, and the terminal behavior information expected by the network side of the terminal. information.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element obtains the terminal behavior information expected by the network side of the terminal from the application function network element.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element obtains the terminal behavior information expected by the network side of the terminal from the application function network element through the network capability open function network element.

In a possible implementation manner, the abnormality information of the terminal includes one or more of the following information corresponding to the terminal: identification information of the terminal, an abnormality type, an abnormality identification, and an abnormality level. Among them, the abnormality identifier is used to identify the abnormality type, and the abnormality level is used to indicate the degree or size of the abnormality type.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element sends abnormal information of the terminal to the third network element, and the abnormal information is used for policy control of the terminal.

In an eighteenth aspect, an embodiment of the present application provides a method for determining terminal abnormality information. The method includes: a first network element determining that the terminal is abnormal. The first network element sends instruction information to the data analysis network element, the instruction information is used to indicate that the terminal is abnormal; the data analysis network element receives the instruction information from the first network element; the data analysis network element obtains the terminal in the second network according to the instruction information Terminal behavior information on the element; the data analysis network element determines the abnormal information of the terminal according to the terminal behavior information.

In a possible implementation manner, the method provided in the embodiment of the present application further includes: the data analysis network element sends the abnormal information of the terminal to the third network element; the third network element receives the abnormal information from the data analysis network element, so The third network element performs policy control on the terminal according to the abnormal information.

In a possible implementation manner, the first network element may be any one or more of a session management network element, a mobility management network element, a user plane network element, a policy control network element, or a user data management network element. The second network element may be any one or more of a session management network element, a mobility management network element, a user plane network element, a policy control network element, or a user data management network element. The first network element and the second network element may be the same network element or different network elements.

In a possible implementation manner, the third network element may be an application function network element or a policy control network element.

In a possible implementation manner, the first network element determining that the terminal is abnormal includes: the first network element according to terminal behavior information expected by the terminal on a network side of the first network element and the terminal in the first The terminal behavior information on a network element determines that the terminal is abnormal.

In a possible implementation manner, the terminal behavior information of the terminal on the second network element includes: a terminal identifier of the terminal and one or more of the following information corresponding to the terminal: identification information, location information, and communication of the second network element Start time, communication end time, data packet delay, data packet number, data packet size, mobility re-registration frequency information, data network name reachable after failure of DNN, number of terminals in geographic area, permanent user identification SUPI- The permanent device identifies PEI association update information, roaming status information, and at least one first type of data of the terminal on the second network element.

In a nineteenth aspect, the present application provides a device for determining terminal abnormality information. The device for determining terminal abnormality information can implement the method in the seventeenth aspect or any possible implementation manner of the seventeenth aspect, and therefore can also implement the first The beneficial effects in the seventeenth aspect or any possible implementation manner of the seventeenth aspect. The device for determining the abnormality information of the terminal may be a data analysis network element, or may be a device that can support the data analysis network element to implement the method in the seventeenth aspect or any possible implementation manner of the seventeenth aspect, for example, applied to data analysis. A chip in a network element. The apparatus for determining abnormal information of a terminal may implement the foregoing method by using software, hardware, or executing corresponding software by hardware.

An example, the apparatus for determining abnormality information of a terminal includes: a receiving unit, configured to receive indication information from a first network element that is used to indicate abnormality of the terminal. The receiving unit is configured to obtain terminal behavior information of the terminal on the second network element according to the instruction information. The processing unit is configured to determine abnormal information of the terminal according to the terminal behavior information.

In a possible implementation manner, the receiving unit is further configured to receive one or more of the following information corresponding to the terminal from the first network element: identification information of the terminal, network area, terminal type, time information, and mobility re-registration Frequency information, reachability after DNN failure, number of terminals in a geographic area, SUPI-PEI association update information, roaming status information, terminal behavior information of the terminal on the first network element.

In a possible implementation manner, the receiving unit is further configured to obtain terminal behavior information of the terminal on the first network element. The processing unit is further configured to associate the terminal behavior information of the terminal according to the terminal behavior information of the terminal on the first network element and the terminal behavior information of the terminal on the second network element.

In a possible implementation manner, the apparatus for determining abnormality information of a terminal further includes: a sending unit, configured to send a request message to a second network element. The request message is used to request terminal behavior information of the terminal on the second network element. The receiving unit is specifically configured to receive a response message from the second network element, where the response message includes terminal behavior information of the terminal on the second network element.

In a possible implementation manner, the terminal behavior information of the terminal on the second network element includes: a terminal identifier of the terminal and one or more of the following information corresponding to the terminal: identification information and location information of the second network element , Communication start time, communication end time, data packet delay, data packet number, data packet size, mobility re-registration frequency information, data network name reachable after failure of DNN, number of terminals in geographic area, permanent user identification SUPI-permanent device identification PEI association update information, roaming status information, and at least one first type of data of the terminal on the second network element.

In a possible implementation manner, the processing unit is specifically configured to determine abnormal information of the terminal according to the terminal behavior data of the terminal and the terminal behavior information expected by the network side.

In a possible implementation manner, the processing unit is specifically configured to associate the terminal behavior information of the terminal with the terminal behavior information of the terminal on the first network element and the terminal behavior information of the terminal on the second network element and the network side expectation. The terminal behavior information determines abnormal information of the terminal.

In a possible implementation manner, the receiving unit is further configured to obtain terminal behavior information expected by a network side of the terminal from an application function network element.

In a possible implementation manner, the receiving unit is further configured to obtain terminal behavior information expected by a network side of the terminal from an application function network element through a network capability open function network element.

In a possible implementation manner, the abnormality information of the terminal includes one or more of the following information corresponding to the terminal: identification information of the terminal, an abnormality type, an abnormality identification, and an abnormality level. The abnormality identifier is used to identify an abnormality type, and the abnormality level is used to indicate the degree or size of the abnormality type.

In a possible implementation manner, the sending unit is further configured to send abnormal information of the terminal to the third network element.

In another example, an embodiment of the present application further provides a device for determining terminal abnormality information. The device for determining terminal abnormality information may be a data analysis network element or a chip applied to the data analysis network element. The determining device includes: a processor and a communication interface, where the communication interface is configured to support the abnormality information of the terminal, and execute the abnormality in the terminal described in any one of the seventeenth aspect to the seventeenth possible implementation manner. The step of receiving / transmitting messages / data on the device side for determining information. The processor is configured to support the information processing apparatus to execute the steps of performing message / data processing on the apparatus for determining the abnormality information of the terminal, as described in any one of the possible implementation manners of the seventeenth aspect to the seventeenth aspect. For specific corresponding steps, reference may be made to the description in any one of the possible implementation manners of the seventeenth aspect to the seventeenth aspect, and details are not described herein again.

In a possible implementation, the communication interface and the processor of the apparatus for determining terminal abnormality information are coupled to each other.

In a possible implementation, the apparatus for determining abnormality information of a terminal may further include a memory, configured to store code and data, and the processor, the communication interface, and the memory are coupled to each other.

In a twentieth aspect, the present application provides a communication system including a first network element, a data analysis network element that communicates with the first network element, and a second network element that communicates with the data analysis network element. The first network element is used to determine the abnormality of the terminal and is used to send instruction information to the data analysis network element, the instruction information is used to indicate the abnormality of the terminal; the data analysis network element is used to receive the instruction information from the first network element, and Obtaining terminal behavior information of the terminal on the second network element according to the instruction information. The data analysis network element is also used to determine abnormal information of the terminal according to the terminal behavior information.

In a possible implementation manner, the first network element may be any one or more of a session management network element, a mobility management network element, or a user data management network element.

In a possible implementation manner, the communication system further includes a third network element that communicates with the data analysis network element, and the data analysis network element is further configured to send the abnormal information of the terminal to the third network element. The third network element is configured to receive abnormal information from the data analysis network element, and to perform policy control on the terminal according to the abnormal information.

In a possible implementation manner, the first network element is used to determine the abnormality of the terminal, and specifically includes: the first network element is used to determine the terminal behavior information expected by the terminal on the network side of the first network element and the terminal on the first network element. The behavior information of the terminal on the terminal determines that the terminal is abnormal.

In a possible implementation manner, the first network element is further configured to send one or more of the following information corresponding to the terminal to the data analysis network element: identification information of the terminal, network area, terminal type, and time information. Terminal behavior information on a network element.

In a twenty-first aspect, an embodiment of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program or an instruction. When the computer program or the instruction is run on the computer, the computer executes the seventeenth The method for determining terminal abnormality information described in any one of the possible implementation manners of the aspect or the seventeenth aspect.

In a twenty-second aspect, an embodiment of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program or an instruction. When the computer program or the instruction runs on the computer, the computer executes the eighteenth embodiment. The method for determining terminal abnormality information described in any one of the possible implementation manners of the aspect or the eighteenth aspect.

In a twenty-third aspect, the present application provides a computer program product including instructions that, when run on a computer, causes the computer to execute one or more of the seventeenth aspect and various possible implementations of the seventeenth aspect. .

In a twenty-fourth aspect, the present application provides a computer program product including instructions that, when run on a computer, causes the computer to execute one or more of the eighteenth aspect or various possible implementations of the eighteenth aspect. .

In a twenty-fifth aspect, the present application provides a chip including a processor and an interface circuit. The interface circuit is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the seventeenth aspect or each of the seventeenth aspect. One or more of these possible implementations.

In a twenty-sixth aspect, the present application provides a chip that includes a processor and an interface circuit. The interface circuit is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the eighteenth aspect or the eighteenth aspect. One or more of these possible implementations.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of a communication system architecture according to an embodiment of the present invention; FIG.

FIG. 2 is a schematic structural diagram of a 5G network according to an embodiment of the present invention; FIG.

FIG. 3 is a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application; FIG.

4 is a schematic flowchart of an interaction between an information processing method and an information sending method according to an embodiment of the present application;

5 is a schematic diagram of information processing provided by an embodiment of the present application;

6 is a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application;

7 is a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application;

8 is a schematic flowchart of an interaction between an information processing method and an information sending method according to an embodiment of the present application;

FIG. 9 is a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application;

FIG. 10 is a schematic flowchart of an information processing method according to an embodiment of the present application;

11 is a schematic flowchart of an information processing method according to an embodiment of the present application;

FIG. 12 is a schematic flowchart of an information processing method according to an embodiment of the present application; FIG.

13 is a schematic flowchart of a method for determining abnormal terminal information according to an embodiment of the present application;

14 is a schematic flowchart of a method for determining abnormal terminal information according to an embodiment of the present application;

15 is a schematic flowchart of a method for determining abnormal terminal information according to an embodiment of the present application;

16 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application;

17 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application;

18 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application;

19 is a schematic structural diagram of an information sending apparatus according to an embodiment of the present application;

20 is a schematic structural diagram of an information sending apparatus according to an embodiment of the present application;

21 is a schematic structural diagram of an information sending apparatus according to an embodiment of the present application;

22 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application;

FIG. 23 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application; FIG.

FIG. 24 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application; FIG.

FIG. 25 is a schematic structural diagram of a device for determining abnormal terminal information according to an embodiment of the present application; FIG.

FIG. 26 is a schematic structural diagram of a device for determining abnormal terminal information according to an embodiment of the present application; FIG.

FIG. 27 is a schematic structural diagram of a chip according to an embodiment of the present application.

detailed description

In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as “first” and “second” are used to distinguish the same or similar items having substantially the same functions and functions. For example, the first core network element and the second core network element are only used to distinguish different core network elements, and their sequence is not limited. Those skilled in the art can understand that the words "first", "second" and the like do not limit the number and execution order, and the words "first" and "second" are not necessarily different.

It should be noted that in the present application, words such as "exemplary" or "for example" are used as examples, illustrations or illustrations. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as more preferred or advantageous over other embodiments or designs. Rather, the use of the words "exemplary" or "for example" is intended to present the relevant concept in a concrete manner.

The network architecture and service scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that with the network The evolution of the architecture and the emergence of new business scenarios. The technical solutions provided in the embodiments of the present application are also applicable to similar technical issues.

In the present application, "at least one" means one or more, and "multiple" means two or more. "And / or" describes the association relationship of related objects, and indicates that there can be three kinds of relationships, for example, A and / or B can represent: the case where A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural. The character "/" generally indicates that the related objects are an "or" relationship. "At least one or more of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one (a), a, b, or c can be expressed as: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .

The technical solutions in the embodiments of the present application can be applied to various communication systems, such as: code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (frequency division multiple access) access (FDMA), orthogonal frequency-division multiple access (OFDMA), single carrier frequency division multiple access (single carrier FDMA, SC-FDMA), and other systems. The term "system" can be used interchangeably with "network." The CDMA system can implement wireless technologies such as universal wireless terrestrial access (UTRA) and CDMA2000. UTRA may include Wideband CDMA (WCDMA) technology and other CDMA variant technologies. CDMA2000 can cover the Interim Standard (IS) 2000 (IS-2000), IS-95 and IS-856 standards. The TDMA system can implement wireless technologies such as the Global System for Mobile Communication (GSM). OFDMA system can implement e.g. evolved universal UTRA (E-UTRA), ultra mobile broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash OFDMA And other wireless technologies. UTRA and E-UTRA are UMTS and UMTS evolved versions. 3GPP is a new version of UMTS using E-UTRA in long term evolution (LTE) and various versions based on LTE evolution. The 5G communication system and New Radio (NR) are the next-generation communication systems under study. In addition, the communication system may also be applicable to future-oriented communication technologies, and both are applicable to the technical solutions provided in the embodiments of the present application.

The system architecture and service scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those of ordinary skill in the art may know that The evolution of the architecture and the emergence of new business scenarios. The technical solutions provided in the embodiments of the present application are also applicable to similar technical issues. In the embodiment of the present application, the method provided is applied to an NR system or a 5G network as an example for description.

FIG. 1 is a schematic structural diagram of a communication system to which an information processing method and an information sending method according to an embodiment of the present application are applied. As shown in FIG. 1, the communication system includes: a user data management network element 101, at least two core network elements (only two core network elements are shown in FIG. 1, for example, the first core network element 102 and The second core network element 103 is taken as an example. It can be understood that in the actual process, there may be more than two core network elements), a data analysis network element 104, and a policy control (PCF) network element 107.

In the embodiment of the present application, the at least two core network elements may be one or more of the control plane network elements of the core network. For example, at least two core network elements may be any two of the session management function (SMF) network elements and access and mobility management function (AMF) network elements.

In a possible implementation manner, one or more of the user data management network element 101, the at least two core network network elements, the data analysis network element 104, and the policy control network element 107 may be virtual network elements. Elements can communicate by way of service operations. One or more of the user data management network element 101, the at least two core network elements, the data analysis network element 104, and the policy control network element 107 may be virtual network elements. In another possible implementation manner, one or more of the user data management network element 101, the at least two core network elements, the data analysis network element 104, and the policy control network element 107 may be physical network elements. Elements are connected through existing standardized interfaces.

As an example, as shown in FIG. 1, the communication system may further include one or more terminals (for example, two terminals are taken as an example in FIG. 1, and the two terminals are the first terminal 105 and the second terminal 106). . The one or more terminals are connected to the core network element in a wired or wireless manner.

In the embodiment of the present invention, the terminals may be distributed throughout the communication network, and each terminal may be static or mobile.

Wherein, at least two core network elements are used to provide data analysis network element 104 with each terminal of a plurality of terminals corresponding to terminal behavior information on at least two core network elements.

For example, the first core network element 102 is configured to provide the data analysis network element 104 with terminal behavior information corresponding to the first terminal 105 and the second terminal 106 on the first core network element 102, respectively.

The PCF network element 107 is used to send or receive signaling or data with the AF network element or the SMF network element, and may also be used to receive data analysis results from the data analysis network element, such as the type of abnormality of the terminal.

For example, if the above communication system is applied to a 4th generation (4G) network, the control plane network element in the 4G network element may be a mobility management entity (MME).

For example, if the above communication system is applied to a 5G network, as shown in FIG. 2, the network element corresponding to the data analysis network element 104 may be a network data analysis function (NWDAF) network element. The network element corresponding to the at least two core network network elements may be any two different network elements among the following multiple network elements: for example, a 5G system network function (5G System Function). Exemplarily, the at least two core network elements may be any two of an SMF network element and an AMF network element. The user data management network element 101 may be any one of a unified data management (UDM) network element, a user data warehouse (UDR) network element, and a user home server (HSS) network element. .

Exemplarily, the first core network element 102 is an AMF network element, and the second core network element 103 is an SMF network element.

In addition, as shown in FIG. 2, the 5G network may further include an application function (AF) network element, a user plane function (UPF), and an access device (for example, an access network (access network, AN)), authentication server function (AUSF) network element, network slice selection function (NSSF) network element, network capability open function (NEF) network element, network warehouse storage Function (network, function, NRF) network element, data network (DN), operation management and maintenance (operation, maintenance, and maintenance (OAM) network element (also referred to as operation management and maintenance network element), etc., this application The embodiment does not specifically limit this.

As shown in FIG. 2, the OAM network element can cover the network elements of the access network and the core network, and data can be collected from these network elements of the access network and the core network, and the OAM network element in the embodiment of the present application can also Collect terminal behavior data corresponding to terminals on each core network element.

The terminal communicates with the AMF network element through an N1 interface (referred to as N1). The AMF network element communicates with the SMF network element through the N11 interface (referred to as N11). The SMF network element communicates with one or more UPF network elements through an N4 interface (referred to as N4). Any two UPF network elements in one or more UPF network elements communicate through an N9 interface (referred to as N9 for short). The UPF network element communicates with a data network (DN) through an N6 interface (referred to as N6). The terminal accesses the network through an access device (for example, a RAN device). The access device communicates with the AMF network element through an N2 interface (N2 for short). The SMF network element communicates with the PCF network element through the N7 interface (referred to as N7), and the PCF network element communicates with the AF network element through the N5 interface. The access device communicates with the UPF network element through an N3 interface (referred to as N3). Any two or more AMF network elements communicate through an N14 interface (referred to as N14 for short). The SMF network element communicates with the UDM network element through the N10 interface (referred to as N10). The AMF network element communicates with the AUSF network element through the N12 interface (referred to as N12 for short). The AUSF network element communicates with the UDM network element through the N13 interface (referred to as N13). The AMF network element communicates with the UDM network element through the N8 interface (referred to as N8).

It should be noted that in FIG. 2, the 3rd AF network element and the operator AF belong to the AF network element. The difference is that the 3rd AF network element (such as WeChat service server and Alipay payment service server) is not controlled by the operator, and the operator AF network element (for example, proxy-call session control function in IP multimedia system) Call control (P-CSCF) network element) is under the control of the operator. The 3rd AF network element needs to pass through the NEF network element when interacting with the NWDAF network element.

It should be noted that the interface names between the various network elements in FIG. 2 are only examples, and the interface names may be other names in specific implementations, which are not specifically limited in this embodiment of the present application.

It should be noted that the access device, AF network element, AMF network element, SMF network element, AUSF network element, UDM network element, UPF network element and PCF network element in FIG. 2 are only a name, and the name does not belong to the device itself. Composition limitation. In the 5G network and other networks in the future, the network element corresponding to the access device, AF network element, AMF network element, SMF network element, AUSF network element, UDM network element, UPF network element, and PCF network element may also be other The name is not specifically limited in the embodiment of the present application. For example, the UDM network element may also be replaced with a user home server (HSS), a user subscription database (USD), or a database entity, etc., which will be described collectively here, and will not be described later. .

Exemplarily, the access device referred to in the embodiment of the present application refers to a device that accesses a core network, and may be, for example, a base station, a broadband network service gateway (BNG), an aggregation switch, and a non-third generation Partner project (3rd generation partnership project, 3GPP) access equipment, etc. The base station may include various forms of base stations, such as: macro base stations, micro base stations (also called small stations), relay stations, access points, and the like.

Exemplarily, the AMF network element involved in the embodiment of the present application may also be responsible for functions such as registration management, mobility management, and lawful interception, which are not specifically limited in the embodiment of the present application.

Exemplarily, the SMF network elements involved in the embodiments of the present application are used for session management, including: session establishment, session modification, session release, and Internet Protocol (IP) address allocation of terminals' networks. And management, UPF network element selection and control, legal monitoring and other session-related control functions.

Exemplarily, in addition to the functions of the user plane function network element shown in FIG. 2, the UPF network elements involved in the embodiments of the present application can also implement a serving gateway (SGW) and a packet data network gateway (packet data). network gateway (PGW). In addition, the UPF network element may also be a software-defined network (SDN) switch, which is not specifically limited in the embodiment of the present application.

Exemplarily, the AUSF network element involved in the embodiment of the present application is used to perform authentication and authentication on the terminal based on user subscription data of the terminal.

Exemplarily, the UDM network elements involved in the embodiments of the present application are used to store user subscription data. In addition, the UDM network element also includes functions such as authentication and authentication, processing user identification, and contract management, which are not specifically limited in this embodiment of the present application.

Exemplarily, the PCF network elements involved in the embodiments of the present application are also used to provide policy rules and support a unified policy architecture to manage network behaviors and other policy-related functions.

Optionally, the user plane function network element in FIG. 2 may be implemented by one device, or may be implemented by multiple devices, or may be a logical function module in one device, which is not specifically limited in the embodiment of the present application.

The SMF network element is used to reassign the UPF network element to the terminal based on the location information of the terminal or the characteristics of the data sent by the terminal or the location information between the UPF network element and the terminal. Newly allocated sessions between UPF network elements, thus improving the reconstructed session can optimize the user plane.

The access device is used to provide data services for the terminal, for example, receiving data sent by the terminal, or sending data to the terminal. In actual use, the access device may be a base station. Wherein, in the embodiment of the present invention, a base station (BS) may be a device that communicates with a user equipment (UE) or other communication site such as a relay station, and the base station may provide communication coverage of a specific physical area.

The PCF network element is used to receive service information from the AF network element, generate and distribute QoS parameters corresponding to the service flow based on the service information, and can also be used to receive data analysis results from the NWDAF network element, and take corresponding measures based on the data analysis results, such as Receive the abnormal type of the terminal from the NWDAF network element and shut down the network to service the terminal with one click.

The AF network element can be used to provide the UDM network element with terminal behavior information expected by a third party or a service server. Specifically, the AF network element initiates the Nnef_ParameterProvision_Update Request service operation to the NEF network element, and provides the NEF network element with the terminal behavior data expected by the third party or service server of each of the one or more terminals of the terminal. The Nnef_ParameterProvision_Update Request service operation carries the identification information of the terminal and the Transaction reference ID. The Transaction reference ID is used to identify an interaction request between the AF network element and the NEF network element.

The NEF network element first determines whether the Nnef_ParameterProvision_Update Request service operation sent by the AF network element is legal. In the case where the NEF network element determines that the Nnef_ParameterProvision_Update Request service operation is legal, the NEF network element sends a Nudm_ParameterProvision_Update Request service operation to the UDM network element and provides the UDM network element with one or more third party or service server terminal behaviors expected by the AF network element information. The Nudm_ParameterProvision_Update Request service operation also carries a NEF reference ID, which is used to identify an interaction request between the NEF network element and the UDM network element.

The UDM network element first authenticates whether the request of the AF network element is valid. If the request is valid, the UDM network element first maps the identification information of the terminal (for example, mapping the identification information of the terminal from GPSI to SUPI). Or terminal behavior data expected by multiple third parties or service servers is used as part of the user contract data of each terminal. It also initiates a Nudr_DM_Update Request service operation to the UDR network element, requesting to update and store to the UDR network element the terminal behavior data expected by a third party or service server from one or more terminals of the AF network element. The UDR network element parses or maps GPSI to SUPI, and stores terminal behavior data expected by a third party or service server of one or more terminals of the AF network element as the user subscription data of each of the one or more terminals. . The UDR network element then initiates the Nudm_DM_UpdateResponse service operation to the UDM. If the UDR network element cannot parse or map the GPSI to SUPI, the Nudm_DM_UpdateResponse service operation indicates that the UDM terminal behavior data provision fails and carries the cause value.

If the UDM network element determines that the request of the AF network element is illegal, the UDM network element initiates the Nudm_ParameterProvision_UpdateResponse service operation to the NEF network element, and indicates in the Nudm_ParameterProvision_UpdateResponse service operation that the provision of terminal behavior data expected by the third party or service server fails, and carries the terminal behavior data expectation, and carries the Reason value.

In the case where the NEF network element determines that the Nnef_ParameterProvision_Update Request service operation is illegal, the NEF network element initiates the Nnef_ParameterProvision_UpdateResponse service operation to the AF network element, and the Nnef_ParameterProvision_UpdateResponse service operation indicates that the terminal behavior data provision fails and carries the cause value.

Among them, the DN is used for external networks that provide data services.

The NWDAF network element is used to collect terminal behavior information corresponding to a terminal on a different core network element, where the terminal behavior information may include terminal identification information and terminal behavior information. Then, the terminal behavior information corresponding to the terminal on the different core network element is associated with the terminal identification information to obtain the terminal behavior information corresponding to the terminal. Wherein, the terminal behavior information includes at least terminal behavior information corresponding to terminals on different core network elements. In addition, the NWDAF network element is also used to analyze terminal behavior information corresponding to multiple terminals to obtain terminal behavior information expected by the network side. And send the terminal behavior information expected by the network side to the user data management network element. In the case where the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least two core network elements, the NWDAF network element is further used to send at least two core network elements to the user data management network element. Identification information or type information of each core network element.

Optionally, the data analysis network element may obtain the terminal behavior information expected by the third party of the terminal or the service server from the AF network element, and then may obtain the terminal behavior information expected by the network side through the above analysis to the terminal expected by the third party or the service server. The behavior information is verified. When the data analysis network element finds that the terminal behavior information expected by the third party or the service server is inconsistent with the terminal behavior information expected by the network side, it can update the terminal behavior information expected by the network side as expected by the third party or the service server. Terminal behavior information, and then send the updated terminal behavior information expected by the third party or the service server (that is, the terminal behavior information expected by the network side obtained by the data analysis network element analysis) to the user data management network element to store the contracted data as the terminal It can also warn the user management data network element that the third party or service server expects terminal behavior information to be unreliable.

Optionally, the data analysis network element cannot obtain the terminal behavior information expected by the third party of the terminal or the service server from the AF network element. After the data analysis network element sends the terminal behavior information expected by the network side of the terminal to the user data management network element , The user data management network element may verify the terminal behavior information expected by the third party or the service server that obtained the terminal from the AF network element, and when the user data management network element discovers the terminal behavior information expected by the third party or the service server and the network side expectation When the terminal behavior information is inconsistent, the user data management network element may update the terminal behavior information expected by the network side to be the terminal behavior information expected by the third party or the service server, and update the terminal behavior information expected by the third party or the service server (i.e. The data analysis network element analysis obtains terminal behavior information expected by the network side) and stores contract data as the terminal.

It should be noted that, in addition to the core network element, the data analysis network element may also obtain terminal behavior information of the terminal from a terminal, a radio access network (RAN) network element, an OAM network element, or another server. The data analysis network element is used to analyze and obtain the terminal behavior information expected by the network side according to the terminal behavior information of the terminal.

As shown in Table 1, Table 1 shows the terminal behavior data related information collected by the NWDAF network element from the 5GC NF or the Radio Access Network (RAN):

Table 1 Terminal behavior data

Among them, at least one first type of terminal behavior data on the AMF network element, the SMF network element, the UPF network element, and the RAN network element is terminal behavior data that can be identified or used by the AMF network element or the SMF network element. Optionally, each first type of data may be subjected to normalization processing, where the normalization processing mainly uses a maximum-minimum normalization method, a Z-Score normalization method, etc. The physical data values of the data types are mapped to a fixed numerical space. This process facilitates on the one hand the speed of model training convergence during the analysis of big data, and on the other hand provides a way of transmitting characteristic data.

As shown in Table 2, Table 2 shows related content of terminal behavior information expected by the network side in the embodiment of the present application.

Table 2 Information on terminal behaviors expected on the network side

Wherein, the terminal behavior data expected by the network side of at least one second type of data on the AMF network element (SMF network element) is the terminal behavior data expected by the network side that the AMF network element (SMF network element) can recognize or can use.

Optionally, each second type of data in the at least one second type of data may be subjected to a normalization process, where the normalization process may use a maximum-minimum normalization method and a Z-Score normalization The method of mapping maps the physical data values of each data type to a fixed numerical space. This process facilitates on the one hand the speed of model training convergence during the analysis of big data, and on the other hand provides a way of transmitting characteristic data.

The first type and the second type in the embodiments of the present application may be the same or different. Specifically, the first type is various types of terminal behavior data obtained by the data analysis network element from the core network element, the RAN network element, or the terminal, and the second type is the data analysis network element combining the core network element and the RAN network. The type of data obtained by analyzing terminal behavior data obtained at the yuan or terminal.

Optionally, the terminal in this application may also be referred to as terminal equipment, user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, A user terminal, a wireless communication device, a user agent, or a user device. The terminal can be a station (STA) in a wireless local area network (WLAN), a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (wireless local loop) , WLL) stations, personal digital processing (PDA) devices, handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, and next-generation communication systems, such as , A terminal device in a fifth-generation (5G) communication network or a terminal in a future evolved public land mobile network (PLMN) network.

As an example, in the embodiment of the present invention, the terminal may also be a wearable device. Wearable devices can also be referred to as wearable smart devices, which are the general name for applying wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes. A wearable device is a device that is worn directly on the body or is integrated into the user's clothing or accessories. Wearable devices are not only a hardware device, but also powerful functions through software support, data interaction, and cloud interaction. Broad-spectrum wearable smart devices include full-featured, large-sized, full or partial functions that do not rely on smart phones, such as smart watches or smart glasses, and only focus on certain types of application functions, and need to cooperate with other devices such as smart phones Use, such as smart bracelets, smart jewelry, etc. for physical signs monitoring.

It can be understood that an information processing method in the embodiments of the present application may be executed by a data analysis network element, and may also be executed by a device (for example, a chip) applied to the data analysis network element. A method for transmitting information may be performed by a network element, and may also be performed by a device (for example, a chip) applied to the network element. Another information processing method may be performed by a user data management network element, and may also be performed by a device (for example, a chip) applied to the user data management network element. The following embodiments will be described by taking an information processing method executed by a data analysis network element, an information transmission method executed by a core network element, and another information processing method executed by a user data management network element.

Example one

As shown in FIG. 3, FIG. 3 shows a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application. The method includes:

S101. The data analysis network element obtains terminal behavior information of multiple terminals.

The terminal behavior information of the multiple terminals may be terminal behavior information of each terminal among the multiple terminals.

Exemplarily, the terminal behavior information of a terminal includes identification information of the one terminal and terminal behavior data corresponding to the terminal associated with the terminal identification information.

Specifically, the terminal behavior data can refer to the description in Table 1 above, for example, the terminal's location information, communication start time, communication end time, data packet delay, data packet size, number of data packets, etc., here I won't go into details.

As an example, as shown in FIG. 4, S101 may be specifically implemented in the following manner:

S1011. The data analysis network element obtains terminal behavior information corresponding to at least two core network elements from among at least two core network elements from the at least two core network elements.

Specifically, the data analysis network element obtains terminal behavior information (including terminal identification information and terminal behavior data) corresponding to each terminal of the multiple terminals on each core network element of the at least two core network elements. Then, the data analysis network element correlates terminal behavior data of each terminal on each core network element according to the identification information of each terminal, and obtains terminal behavior information corresponding to each terminal. Wherein, the terminal behavior information corresponding to a terminal includes at least identification information of the terminal and terminal behavior information corresponding to the terminal on each of the core network elements of the at least two core network elements.

Exemplarily, taking at least two core network elements as AMF network elements and SMF network elements as an example, according to Table 1, the data analysis network element can obtain the terminal behavior corresponding to the terminal 1 on the AMF network element from the AMF network element. Information 1. The terminal behavior information 1 includes identification information of the terminal 1 and location information (including time and location) on the AMF network element. The data analysis network element may also obtain the terminal behavior information 2 of the terminal 1 on the SMF network element from the SMF network element. The terminal behavior information 2 includes identification information of the terminal 1, communication mode information (communication start time and communication end time) on the SMF network element, and network configuration information (upstream or downstream data packet delay, size, and number). Then the data analysis network element associates the terminal behavior information 1 on the AMF network element and the terminal behavior information 2 on the SMF network element through the identification information of the terminal 1 to obtain the terminal behavior information corresponding to the terminal 1. .

It should be noted that, in the embodiment of the present application, the terminal behavior data corresponding to the same terminal on different core network elements may be the same or different.

It should be noted that, in the embodiment of the present application, the data analysis network element may also obtain the terminal from the terminal, the wireless access network element, and the application function network element on the terminal itself, the wireless access network element, and the application function network element. Corresponding terminal behavior information.

In the actual process, if the data analysis network element finds that it needs to report terminal behavior information for certain terminal types, certain network areas, and certain time periods, and analyzes the terminal behavior information, the data analysis network element can report to each Each core network element proposes a need to analyze the above reasons, so that each core network element collects terminal behavior information corresponding to the terminal from the respective network element, as another possible embodiment of this application, as shown in FIG. 4 The method provided in the embodiment of the present application further includes:

S1012. The data analysis network element sends a first request message to each core network element in at least two core network elements (the first core network element and the second core network element are taken as an example in FIG. 4). A request message is used to request terminal behavior information on the core network element corresponding to multiple terminals.

Optionally, the first request message carries filtering information, and the filtering information is used to indicate a range of terminal behavior information of each terminal in the multiple terminals.

Exemplarily, the filtering information includes one or more of the following information: identification information of the terminal, a network area corresponding to the terminal, a terminal type, and a time window. For example, the filtering information includes the network area and terminal type corresponding to the terminal.

The time window is used by the core network element to determine and collect terminal behavior information of the terminal within a specified time period. For example, the time window is from March 1, 2018 to March 8, 2018. In this way, the core network element can determine the need to collect terminal behavior information on the core network element corresponding to the terminal from March 1, 2018 to March 8, 2018.

The network area is used by the core network element to determine and collect terminal behavior information of the terminal in the specified area. (For example, tracking area (TA) or TA list or routing area (RA) or RA list).

For example, when the filtering information includes identification information of a terminal, a network area, and a terminal type, the filtering information is used to instruct a core network element to collect terminal identification information indicated by the terminal, and the terminal behavior of the terminal type specified in the specified network area information.

For example, when the filtering information includes the identification information of the terminal, the network area, and the time window, the filtering information is used to instruct the core network element to collect the terminals indicated by the identification information of the terminals within the specified time window within the specified network area. Behavioral information.

S1013. At least two core network elements receive the first request message.

It can be understood that, in S1013, each of the at least two core network elements receives the first request message.

S1014. At least two core network elements send terminal behavior information corresponding to multiple terminals on the respective core network element to the data analysis network element according to the first request message.

Specifically, each of the at least two core network elements may send a response message to the data analysis network element for the first request message, and the response message carries multiple terminals corresponding to the respective core network element. Terminal behavior information.

Specifically, a core network element sends to the data analysis network element the terminal behavior information of at least one of the multiple terminals on the core network element.

For example, taking the core network element as an AMF network element as an example, the AMF network element sends terminal behavior information of at least one terminal on the AMF network element to the data analysis network element.

The terminal behavior information includes identification information of the terminal and one or more of the following information corresponding to the terminal: identification information of the core network element, location information, communication start time, communication end time, data packet delay, and data packet. The number, the data packet size, and at least one first type of data of the terminal corresponding to the core network element.

It should be noted that the name of the information obtained by the data analysis network element (for example, terminal behavior information) in the embodiment S101 of the present application is only an example, and the name of the terminal behavior information in the specific implementation may be other names, for example, user behavior information The behavior information or the terminal information is not specifically limited in this embodiment of the present application. Those skilled in the art can understand that in an actual process, if one piece of information includes identification information of a terminal and one or more of the foregoing information corresponding to the terminal, it can be understood as terminal behavior information in the embodiment of the present application.

The terminal behavior information on the core network element corresponding to multiple terminals reported by a core network element includes identification information of the multiple terminals and terminal behavior data corresponding to each of the multiple terminals. Specifically, the terminal behavior data may refer to the description in Table 1 above.

Due to differences in terminal behavior data reported by different core network network elements to the data analysis network element, the following will be introduced separately:

For example, taking the core network element as an AMF network element as an example, the terminal behavior information reported by the AMF network element includes identification information of the terminal and one or more of the following information: location information (including time and location).

Taking the core network element as an SMF network element as an example, the terminal behavior information reported by the SMF network element includes one or more of the following information: communication start time, communication end time, data packet delay, number of data packets, The packet size.

S1014 may also be implemented in the following manner: each core network element sends terminal behavior information corresponding to multiple terminals to the respective core network element to the operation management and maintenance network element according to the first request message. The operation management and maintenance network element sends terminal behavior information corresponding to multiple terminals on each core network element to the data analysis network element.

As another example, S101 in the embodiment of the present application may also be implemented in the following manner: The data analysis network element obtains, from the operation management and maintenance network element, multiple terminals corresponding to each terminal on at least two core network element. Terminal behavior information.

Specifically, the data analysis network element sends a first request message to the operation management and maintenance network element, and the operation management and maintenance network element sends the data analysis network element to the data analysis network element at least two corresponding to each terminal according to the first request message. Terminal behavior information on core network elements.

Wherein, the terminal behavior information on at least two core network elements corresponding to each terminal provided by the operation management and maintenance network element to the data analysis network element may be stored in the operation management and maintenance network element or may be After receiving the first request message, the operation management and maintenance network element obtains the request from at least two core network element. Specifically, the process of the operation management and maintenance network element requesting terminal behavior information from at least two core network elements can refer to the process in S1012-S1014 above, and the data analysis network element can be replaced with the operation management and maintenance network element. .

S102. The data analysis network element determines the terminal behavior information expected by the network side according to the terminal behavior information.

Specifically, the data analysis network element determines the terminal behavior information expected by the network side according to the terminal behavior information of each terminal among the multiple terminals.

Exemplarily, S102 may be implemented by using the following process:

Process 1. Data analysis The network element uses the terminal behavior data included in the collected terminal behavior information (which can be called training data) of each terminal as a sample data, and represents each sample data as a vector , As follows: (x _i1 , ... x _ij , ..., x _iM ) where i = 1,2, ..., N. N represents the number of sample data, which can also be understood as the number of terminals, N is an integer greater than or equal to 1, x _ij represents terminal behavior information provided by any one of at least two core network elements, and M represents The dimensions of each sample data.

Process 2. The data analysis network element clusters the terminals corresponding to each sample data in the training data. The clustering process is as follows. As shown in Figure 5, a three-layer deep neural network is used as an example. The terminals are grouped into Q groups of terminals, and multiple terminals of each group have the same terminal behavior data expected by the network side.

1) Input layer

A) As defined in Table 1, x ₁ is the time from the AMF network element, x ₂ is the position from the AMF network element, x ₃ is the communication start time from the SMF network element, and x ₄ is the end of communication from the SMF network element. Time, ..., x _M is a first type of data from the SMF network element.

B) M is the data dimension of the terminal behavior information in Table 1.

2) hidden layer

A) According to the definition in Table 2, y ₁ is a stationary instruction, y ₂ is a terminal movement track, y ₃ is a periodic communication instruction, ..., y _M is a second type of data from an SMF network element.

B) P is the data dimension of the terminal behavior information in Table 1.

3) Output layer

A) Q is the number of groupings after clustering multiple terminals. It can also be called that multiple terminals are classified into Q categories, where each group of terminals has the same terminal behavior data expected by the network side, as follows:

z ₁ : (y ₁₁ , y ₁₂ , y ₁₃ , ..., y _1P )

z ₂ : (y ₂₁ , y ₂₂ , y ₂₃ , ..., y _2P )

...

z _Q : (y _Q1 , y _Q2 , y _Q3 , ..., y _QP )

In this way, all the terminals in the training data are divided into Q categories. Each category corresponds to a group of terminals (corresponding to a set of terminal identification information). Each category is represented by a vector. This vector is a group of terminals in the corresponding category A terminal behavioral feature vector of (1), (y _k1 , y _k2 , y _k3 , ..., y _kP ), k = 1,2, ..., Q.

The terminal behavior feature vector of each category can be used as the user subscription data of all terminals in the terminal set corresponding to this category, that is, the terminal behavior information expected by the network side, as shown in Table 2.

It should be noted that, in the embodiment of the present application, the first distance thresholds corresponding to the centroids of each class may be the same or different, which is not limited in the embodiment of the present application.

As an example, take the terminal behavior information as the communication duration, and take the same first distance threshold corresponding to each class as an example, that is, the first distance threshold is 5 minutes as an example, the communication duration corresponding to terminal 1 is 10 minutes, and the communication duration corresponding to terminal 2 is The communication duration is 20min, the communication duration corresponding to terminal 3 is 14min, the communication duration corresponding to terminal 4 is 12min, the communication duration corresponding to terminal 5 is 18min, the communication duration corresponding to terminal 6 is 21min, and the communication duration corresponding to terminal 7 is 20min.

If the centroid selected by the data analysis network element is category 1: the communication duration corresponding to terminal 3 is 14 min and category 2: the communication duration corresponding to terminal 5 is 18 min. Then the data analysis network element can determine that the communication duration corresponding to terminal 3 is 14min, the communication duration corresponding to terminal 1 is 10min, and the communication duration corresponding to terminal 4 is 12min, which belongs to category 1, as the expected behavior of the network side corresponding to a group of terminals information. The data analysis network element can determine that the communication duration corresponding to terminal 2 is 20min, the communication duration corresponding to terminal 5 is 18min, the communication duration corresponding to terminal 6 is 21min, and the communication duration corresponding to terminal 7 is 20min, which belongs to category 1 as another group. Terminal behavior information expected by the network side corresponding to the terminal.

In this case, the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of the multiple terminals.

It should be noted that, in the embodiment of the present application, the data analysis network element may determine the terminal behavior information expected by the network side corresponding to the Q group terminals according to the terminal behavior data corresponding to multiple terminals. The data analysis network element can send all expected terminal behavior information to the user data management network element / policy control network element (for example, send all Q groups to the user data management network element or policy control network element), or it can send Terminal behavior information expected by the network side corresponding to at least one terminal in the Q group. Wherein, Q is an integer greater than or equal to 1, and the sum of the number of terminals included in each group of the Q group of terminals is equal to the number of the plurality of terminals.

For example, taking multiple terminals as terminals 1 to 100 as an example, terminals 1 to 20 correspond to a set of terminal behavior information expected by the network side, terminals 21 to 62 correspond to a set of terminal behavior information expected by the network side, and terminals 63 to The terminal 100 corresponds to a set of terminal behavior information expected by the network side. For the three sets of terminal behavior information expected by the network side, the data analysis network element may select at least one of the three sets as the terminal behavior information expected by the network side determined by the data analysis network element. For example, the terminal behavior information expected by the network side determined by the data analysis network element is the terminal behavior information expected by a group of terminals 1 to 20 corresponding to the network side. Or for another example, the terminal behavior information expected by the network side determined by the data analysis network element is a set of terminal behavior information expected by the network side corresponding to terminal 1 to terminal 20 and a set of terminal behavior information expected by the network side corresponding to terminal 63 to terminal 100.

Exemplarily, the terminal behavior information expected by the network side includes one or more of the following information:

Inactivity indication, terminal movement trajectory, periodic communication indication, communication duration, communication cycle, planned communication time, maximum packet transmission delay, maximum packet transmission response time, number of packet buffers, and at least one second type of data.

It should be noted that the information name (for example, terminal behavior information expected by the network side) determined by the data analysis network element according to the terminal behavior information in the embodiment S102 of this application is only an example. In an actual process, the data analysis network element is based on The information name determined by the terminal behavior information may also be other names, for example, information expected by the network side, behavior information expected by the network side, or terminal information expected by the network side. Those skilled in the art can understand that in an actual process, if a piece of information includes a stationary indication, a terminal movement trajectory, a periodic communication indication, a communication duration, a communication cycle, a planned communication time, a maximum packet transmission delay, and a maximum packet transmission response One or more of the time, the number of data packet buffers, and at least one second type of data can be understood as the terminal behavior information expected by the network side in the embodiment of the present application.

It should be noted that the first type of data in the embodiments of the present application refers to terminal behavior information collected by the data analysis network element from at least one core network element. The second type of data refers to a data type obtained by the data analysis network element based on terminal behavior information (including data of the first type) collected from at least one network element.

Exemplarily, the data analysis network element can obtain the stationary indication and terminal movement trajectory of the terminal behavior information expected by the network side according to the location information (including time and location) in the terminal behavior data, and can start communication based on the terminal behavior data. And the communication end time to obtain the periodic communication instruction, communication duration, communication period, and planned communication time in the terminal behavior information expected by the network side, and the terminal behavior expected by the network side can be obtained according to at least one first type of data in the terminal behavior information. At least one second type of data in the message. Further, the first type of data belongs to input information of the data analysis network element, that is, terminal behavior information, and the second type of data belongs to output information of the data analysis network element, that is, terminal behavior information expected by the network side.

S103. The data analysis network element sends the terminal behavior information expected by the network to the user data management network element / policy control network element.

S104. The user data management network element / policy control network element receives data analysis terminal behavior information expected by the network side sent by the data analysis network element.

S104-1. The user data management network element uses the terminal behavior information expected by the network side as the user subscription data of the terminal.

Specifically, after receiving the terminal behavior information expected by the network side, the user data management network element may use the received terminal behavior information expected by the network side as the contract information of each terminal. After receiving the terminal behavior information expected by the network side, the policy control network element may further forward the terminal behavior information expected by the network side to the user data management network element.

An embodiment of the present application provides an information processing method. The method obtains terminal behavior information of multiple terminals through a data analysis network element, and then determines the terminal behavior information expected by the network side based on the terminal behavior information of the multiple terminals, and expects the network side to expect. The behavior information is sent to the user data management network element / policy control network element. Compared with the behavior information expected by the network side in the prior art, which is provided by the AF network element, this improves the data received by the user data management network element / policy control network element. The credibility of behavior information expected by the network.

Optionally, as another embodiment of the present application, as shown in FIG. 6, the method provided in the embodiment of the present application further includes:

S105. The data analysis network element sends the first information of the terminal corresponding to the terminal behavior information expected by the network side to the user data management network element.

It can be understood that the first information of the terminal corresponding to the terminal behavior information expected by the network side in S105 and the terminal behavior information expected by the network side in S103 may be sent to the user data management network element in the same message, or may be carried in different The message is sent to the user data management network element.

The first information of the terminal is used to indicate terminal behavior information expected by the network side corresponding to each terminal. The first information of the terminal may be identification information of the terminal or identification information of the terminal group. The identification information of the terminal group is used to indicate the identification of a group of terminals.

Exemplarily, if the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of terminals, the terminal behavior information expected by the network side corresponding to each group of terminals in the at least one group corresponds to the first An information list. A first information list of a terminal is used to indicate terminal behavior information expected by a network side corresponding to each terminal of at least one terminal.

S106. The user data management network element receives the first information of the terminal corresponding to the terminal behavior information expected by the network side sent by the data analysis network element.

In this way, after receiving the first information of the terminal, the user data management network element may use the terminal behavior information expected by the network side corresponding to each terminal as the subscription information corresponding to the terminal. For example, the user data management network element uses the terminal behavior information expected by the network side corresponding to the terminal 1 as the subscription information corresponding to the terminal 1.

As another embodiment of the present application, as shown in FIG. 7, the method provided in the embodiment of the present application further includes:

S107. The user data management network element / policy control network element sends a second request message to the data analysis network element, where the second request message is used to request terminal behavior information expected by the network side, and the second request message includes identifiers of multiple terminals. information.

It should be noted that if the second request message is sent by the user data management network element to the data analysis network element in the embodiment of the present application, the data analysis network element determines the terminal behavior information expected by the network side, and then sends the network side The expected terminal behavior information is sent to the user data management network element, or the expected terminal behavior information on the network side is sent to the policy control network element.

If the second request message is sent by the policy control network element to the data analysis network element: On the one hand, the data analysis network element may send the terminal behavior information expected by the network side to the policy control network element, so that the policy control network element Send the terminal behavior information expected by the network side to the core network element. On the other hand, the data analysis network element may also send the terminal behavior information expected by the network side to the user data management network element.

It can be understood that the second request message includes identification information of each terminal in the multiple terminals.

Exemplarily, the second request message may be a newly defined message between the user data management network element / policy control network element and the data analysis network element, and may also be an Nnwdaf_EventsSubscription_Subscribe service operation. This embodiment of the present application does not limit this.

Optionally, the second request message further includes at least one of a network area corresponding to the terminal, a time window corresponding to the terminal, and a terminal type.

S108. The data analysis network element receives a second request message sent by the user data management network element / policy control network element.

Optionally, the second request message may further carry the foregoing filtering information.

As an example, a terminal behavior vector (y _k1 , y _k2 , y _k3 , ..., y _kP ) expected by a network side can be divided into terminal's mobility management (MM) according to the corresponding core network element. Class or session management (SM) class behavior vectors can be divided into two types of terminal behavior vectors according to Table 1 (y _k1 , y _k2 , y _k3 , ..., y _kP ) according to AMF and SMF. MM class (y _k1 , y _k2 , y _k3 , ..., y _kS ) and SM class (y _k1 , y _k2 , y _k3 , ..., y _kT ), where S + T = P. The terminal behavior sub-vector of the MM or SM class in each category can be used as the behavior characteristic information of the MM or SM class of all terminals in the terminal set corresponding to this category.

Optionally, each MM class or SM class feature vector corresponds to a distance threshold. When the distance between the MM class behavior sample data of a new terminal and the MM class feature vector exceeds the second distance threshold, the core network The network element may determine that the MM-type behavior sample data of the new terminal does not belong to the category corresponding to the MM-type feature vector. When the distance between the SM-type behavior sample data of a new terminal and the SM-type feature vector exceeds a third distance threshold, the core network element may determine that the SM-type behavior sample data of the new terminal does not belong to the SM-type feature The category corresponding to the vector.

The embodiment of the present application does not limit the first distance threshold, the second distance threshold, and the third distance threshold, and may be set according to requirements.

As another embodiment of the present application, the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least two core network element, so that the data analysis network element may further obtain the terminal behavior expected by the network side. The information is classified to determine terminal behavior information expected by the network side corresponding to each core network element. Based on this, as shown in FIG. 8, the method provided in the embodiment of the present application further includes:

S109. The data analysis network element sends at least one of identification information and type information of each core network element among the at least two core network elements to the user data management network element / policy control network element. The identification information of the core network element is used to indicate the core network element corresponding to each of the terminal behavior information expected by the network side among the plurality of terminal behavior information expected by the network side included in the terminal behavior information expected by the network side. The type information of the core network element is used to indicate the type of core network element type corresponding to each of the terminal behavior information expected by the network side among the plurality of terminal behavior information expected by the network side. SM type.

Optionally, the core network element of the MM type may be an AMF network element, and the network element of the SM type may be an SMF network element.

Optionally, before S109, the method provided in this embodiment of the present application further includes: the data analysis network element determines each of the terminal behavior information expected by the network side according to the identification information of the core network element included in the behavior information of each terminal. Terminal behavior information expected by the network side corresponding to the core network element.

S110. The user data management network element / policy control network element receives at least one of identification information and type information of each core network element among the at least two core network elements sent by the data analysis network element.

It can be understood that after S110, the user data management network element / policy control network element can determine the core network network element corresponding to the received terminal behavior information expected by the network side.

As a possible embodiment, after S110, the method provided in the embodiment of the present application further includes: a user data management network element / policy control network element according to at least one of identification information and type information of each core network element Send each core network element the terminal behavior information expected by the corresponding network side.

For example, if the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to the AMF network element, the user data management network element / policy control network element sends the terminal behavior information expected by the network side corresponding to the AMF network element To the AMF network element.

The user data management network element may send the terminal behavior information expected by the corresponding network side to each core network element in the following process.

In an example, when the user data management network element determines that the AMF network element requests the terminal to register in the 5G network, it sends the AMF network element the terminal behavior information expected by the network side corresponding to the AMF network element. Specifically, the terminal sends a registration request (Registration Request) to the AMF network element, where the registration request carries identification information of the terminal, and the registration request is used to request registration of the terminal corresponding to the identification information of the terminal to the 5G network. The AMF network element sends a Nudm_SDM_Get service operation to the user data management network element. The Nudm_SDM_Get service operation carries identification information of the terminal. The user data management network element sends the terminal behavior information expected by the MM network side corresponding to the terminal identification information to the AMF network element. The AMF network element sends a Registration to the terminal.

In another example, the user data management network element sends an expected terminal behavior corresponding to the SMF network element to the SMF network element during the SMF network element request to establish a Protocol Data Unit (PDU) session for the terminal. information. For example, the terminal sends a session establishment request (PDU Session Establishment Request) to the SMF network element through the AMF network element, where the session establishment request carries identification information of the terminal. The SMF network element sends a Nudm_SDM_Get service operation to the user data management network element. The Nudm_SDM_Get service operation carries identification information of the terminal. The UDM network element sends the terminal behavior information expected by the session management network side corresponding to the terminal identification information to the SMF network element. The SMF network element sends the PDU Session EstablishmentAccept to the terminal through the AMF network element.

As another possible embodiment, as shown in FIG. 9, the method provided in this embodiment of the present application further includes:

S111. The data analysis network element determines the abnormal type of the terminal according to the terminal behavior information expected by the network side.

As an example, S111 in the embodiment of the present application may be implemented in the following manner:

Step 1. The core network element obtains new terminal behavior information (for details, refer to the description in Table 1). The multiple terminals used to obtain the terminal behavior information expected by the network side in this application are the first terminal, and the new terminal may be the second terminal. If the core network element determines that the terminal behavior information of the second terminal does not match the terminal behavior information expected by the network side received by the core network element, that is, the vector composed of the second terminal behavior information and the terminal behavior expected by the network side If the distance of the vector exceeds the set threshold, the core network element determines that the second terminal is abnormal. Therefore, the core network element sends the terminal behavior information of the second terminal to the core network element to the data analysis network element. The core network element sends the identification information of the second terminal to another core network element to notify the other core network element to send the data analysis network element that the second terminal corresponds to the terminal behavior on the other core network element information.

Optionally, the core network element may periodically report the terminal behavior information corresponding to the second terminal to the data analysis network element according to a preset period.

Step 2. The data analysis network element obtains terminal behavior information corresponding to the second terminal sent by at least two core network network elements (taking the SMF network element and the AMF network element as examples) on the SMF network element and the AMF network element, respectively.

Step 3: The data analysis network element obtains terminal behavior data of a single abnormal terminal according to the identification information of the first terminal. After accumulating a certain number of abnormal terminal behavior data, the data analysis network element further analyzes the abnormal terminal behavior data. If most or all of the abnormal terminal behavior data is found to be grouped into one category, the data analysis network element considers these terminals Exception type.

For example, the exception type can be one or more of the following: (1), being used by mistake; (2), being hijacked; (3), a new type of terminal.

S112. The data analysis network element sends alarm information to the policy control network element, where the alarm information is used to indicate an abnormal type of the terminal.

S113. The policy control network element receives the alarm information sent by the data analysis network element. Then, the policy control network element can take further measures on the abnormal terminal, such as one-click shutdown, that is, stopping the network from serving the abnormal terminal.

As shown in FIG. 10, FIG. 10 shows a specific embodiment of an information processing method provided by an embodiment of the present application. The method includes:

S201. The UDM network element sends a first service operation to the NWDAF network element, and the first service operation is used to subscribe to terminal behavior data information expected by a network side of the terminal.

Exemplarily, the first service operation may be a Nnwdaf_EventsSubscription_Subscribe service operation.

For details of the first service operation, refer to the description of the second request message in the foregoing embodiment, and details are not described herein again.

S202, the NWDAF network element sends a second service operation to the AMF network element and the SMF network element, respectively, and the second service operation is used to subscribe the terminal behavior information corresponding to the terminal on the AMF network element and the SMF network element, respectively.

Exemplarily, the second service operation is the Nnf_UEBehavioralDataCollectionSubscription_Subscribe service operation.

For specific content of the second service operation, reference may be made to the description of the first request message in the foregoing embodiment, and details are not described herein again.

S203. The AMF network element reports the terminal behavior information on the AMF network element corresponding to the terminal to the NWDAF network element.

S204. The SMF network element reports the terminal behavior information on the SMF network element corresponding to the terminal to the NWDAF network element.

S205. The NWDAF network element determines the terminal behavior information expected by the network side according to the terminal behavior information on the AMF network element corresponding to the terminal and the terminal behavior information on the SMF network element corresponding to the terminal.

For the implementation of S205, reference may be made to the description at S102, and details are not described herein again.

S206. The NWDAF network element sends a third service operation to the UDM network element, and the third service operation carries terminal behavior information expected by the network side.

Exemplarily, the third service operation may be a Nnwdaf_EventsSubscription_Notify service operation.

As shown in FIG. 11, FIG. 11 shows a specific embodiment of another information processing method provided by an embodiment of the present application. The embodiment shown in FIG. 11 is different from that shown in FIG. 10 in that: The first service operation is sent by the UDM network element to the NWDAF network element in S201, and the first service operation is sent by the PCF network element to the NWDAF network element in S301 of FIG. The content of the remaining steps 302-305 may correspond to the content of S202-S205, and will not be repeated here. In addition, the solution shown in FIG. 11 after S305 also includes:

S306. The NWDAF network element determines the terminal behavior information expected by the AMF network element from the terminal behavior information expected by the network side and the terminal behavior information expected by the network side corresponding to the SMF network element.

S307. The NWDAF network element sends a third service operation to the PCF network element. The third service operation includes the terminal behavior information expected by the network side corresponding to the AMF network element and the terminal behavior information expected by the network side corresponding to the SMF network element.

S308, the PCF network element initiates a fourth service operation to the AMF network element or the SMF network element, and the fourth service operation is used to send the terminal behavior information expected by the network side corresponding to the AMF network element to the AMF network element, and the SMF network element The terminal behavior information expected by the network side corresponding to the element is sent to the SMF network element.

Exemplarily, the fourth service operation may be an Npcf_UEExpectedBehavioralInfo_Notify service operation.

Further, the PCF network element may distribute the terminal behavior data information expected by the MM type network side corresponding to each category to the AMF network element, and distribute the terminal behavior data information expected by the SM type network side corresponding to each category to the SMF network element. .

S309. The AMF network element obtains MM-type terminal behavior information of the first terminal (see Table 2), where the first terminal is any one of a plurality of terminals.

S310. If the AMF network element determines that the MM type terminal behavior information of the first terminal does not match the MM type network side expected terminal behavior information corresponding to the terminal sent by the NWDAF network element to the AMF network element, then determine that the first terminal is abnormal.

S311. The AMF network element sends the MM-type terminal behavior information corresponding to the first terminal to the NWDAF network element.

S312. The AMF network element sends the identification information corresponding to the first terminal to the SMF network element, and the information of the first terminal is used to instruct the SMF network element to report to the NWDAF network element the MM-type terminal behavior corresponding to the first terminal on the SMF network element. information. It can be understood that after receiving the identification information corresponding to the first terminal, the SMF network element reports the MM-type terminal behavior information corresponding to the first terminal on the SMF network element to the NWDAF network element.

S313. The NWDAF network element summarizes the MM type terminal behavior information from the AMF network element and the SM type terminal behavior information from the SMF network element of the first terminal, and determines the abnormal type of the first terminal.

S314. The NWDAF network element sends the abnormal type of the first terminal to the PCF network element.

It can be understood that the AMF network element in the above S310-S311 may also be replaced by an SMF network element. When it is replaced by an SMF network element, the identification information corresponding to the first terminal in S312 will be sent by the SMF network element to the AMF network element.

As shown in FIG. 12, FIG. 12 shows a specific flowchart of an information processing method provided by an embodiment of the present application. In the solution shown in FIG. 12, S401-S406 can refer to the specific content in the above S301-S306, S416 For the specific content of -S421, please refer to the description in S309-S314, which will not be repeated here. In the scheme shown in Figure 12:

S407. The NWDAF network element sends a fifth service operation to the UDM network element. The fifth service operation includes: terminal behavior information expected by the network side corresponding to the AMF network element and terminal behavior information expected by the network side corresponding to the SMF network element.

Exemplarily, the fifth service operation may be a Nnwdaf_EventsSubscription_Notify service operation.

S408. The terminal sends a Registration Request (Registration Request) message to the AMF network element. The Registration Request message includes identification information of the terminal. The Registration Request message is used to request registration of a terminal corresponding to the terminal's identification information to the 5G network.

S409. The AMF network element sends a sixth service operation to the UDM network element, where the sixth service operation includes identification information of the terminal.

Exemplarily, the sixth service operation may be a Nudm_SDM_Get service operation.

S410. The UDM network element sends the terminal behavior information expected by the MM network side corresponding to the terminal identification information to the AMF network element.

S411. The AMF network element sends a Registration and Accept message to the terminal.

S412. The terminal sends a PDU Session Establishment Request (Session Establishment Request) message to the SMF network element, and the PDU Session Establishment Request message carries identification information of the terminal.

Specifically, the terminal may send a PDU Session Establishment Request message to the SMF network element through the AMF network element.

S413. The SMF network element sends a seventh service operation to the UDM network element, and the seventh service operation includes identification information of the terminal.

Exemplarily, the seventh service operation may be a Nudm_SDM_Get service operation.

S414. The UDM network element sends the terminal behavior information expected by the SM network side corresponding to the terminal identification information to the SMF network element.

S415. The SMF network element sends a PDU session establishment acceptance (Session Establishment Accept) message to the terminal through the AMF network element.

Example two

As shown in FIG. 13, FIG. 13 is a schematic flowchart of a method for determining terminal abnormality information provided by an embodiment of the present application. The method includes:

S501. The first network element determines that the terminal is abnormal.

Exemplarily, the first network element may be the first core network element, the user data management network element 101, or the policy control network element 107 in the communication system shown in FIG. In addition, the first network element may also be a user plane network element. For example, the first core network element may be a session management network element or a mobility management network element.

It should be understood that, in S501 and the following steps in this embodiment, the terminal may refer to one terminal or multiple terminals or a group of terminals, which will not be described in detail below.

In a possible implementation, S501 in the embodiment of the present application may be implemented in the following manner: The first network element is based on the terminal behavior information (Expected UE UE behavior information) expected by the terminal on the network side of the first network element and the terminal is in The terminal behavior information on the first network element determines that the terminal is abnormal.

Step 501 may be specifically implemented in the following manner: If the terminal behavior information expected by the network side of the terminal on the first network element does not match the terminal behavior information of the terminal on the first network element, the first network element determines that the terminal is abnormal.

The first network element may obtain, from the user data management network element, terminal behavior information expected by the terminal on the network side of the first network element (for example, see Table 2). The user data management network element may obtain the terminal behavior information expected by the network side from the data analysis network element, or may obtain the terminal behavior information expected by the network side from the application function network element. The specific process for the user data management network element to obtain the terminal behavior information expected by the network side can refer to the first embodiment, which will not be repeated here.

Specifically, the terminal behavior information expected by the terminal on the network side of the first network element may be understood as the behavior characteristic information of the terminal.

Exemplarily, the terminal behavior information of the terminal on the first network element may include identification information of the terminal and behavior data of the terminal on the first network element (for exemplary information, see Table 1). The terminal behavior information of the terminal on the first network element refers to the terminal behavior data collected on the first network element. In addition, in addition to the information shown in Table 1, terminal behavior data can also be shown in Table 3:

Table 3 Terminal behavior data

S502. The first network element sends instruction information to the data analysis network element. The indication information is used to indicate that the terminal is abnormal.

Exemplarily, the data analysis network element may be the data analysis network element 104 shown in FIG. 1. For example, the data analysis network element may be an NWDAF network element.

In a possible implementation, S502 may be implemented in the following manner: The first network element may send a Nnf_EventExposure_Notify service operation that carries indication information to the data analysis network element. Where nf is the name of the first network element. For example, if the first network element is an AMF network element, the service operation may be Namf_EventExposure_Notify. If the first network element is an SMF network element, the service operation may be Nsmf_EventExposure_Notify.

Exemplarily, the first network element may separately send other messages or service operations carrying the indication information to the data analysis network element, such as a terminal abnormal notification message or a Nnf_UEAbnormal_Notify service operation.

S503. The data analysis network element receives instruction information from the first network element.

S504. The data analysis network element obtains terminal behavior information of the terminal on the second network element according to the instruction information.

It should be understood that the data analysis network element in S504 may obtain terminal behavior information of the terminal on one or more second network elements. The terminal behavior information of the terminal on one or more second network elements may be the same or different. For example, taking the second network element as the policy control network element and the session management network element as examples, the data analysis network element can obtain the terminal behavior information of the terminal on the policy control network element and the terminal behavior of the terminal on the session management network element. Information 2. In addition, the terminal behavior information 1 of the terminal on the policy control network element and the terminal behavior information 2 of the terminal on the session management network element may be different.

It should be understood that the one or more second network elements may include a first network element, and of course, the one or more second network elements may not include the first network element, which is not limited in this embodiment of the present application. If the one or more second network elements include the first network element, the data analysis network element may remove the first network element from the first network element that triggers it to determine terminal abnormality information and the one or more second network elements. The network element other than the network element obtains the behavior information of the terminal. For example, the first network element is a mobile management network element, and the one or more second network elements may include a mobile management network element and a session management network element, that is, the mobile management network element triggers a data analysis network element to obtain terminal abnormality information. The data analysis network element may obtain terminal behavior information from the mobile management network element and the session management network element. When one or more second network elements do not include the first network element, the data analysis network element may obtain terminal behavior information from other network elements that trigger it to determine terminal abnormality information. For example, the first network element is a mobile management network element, and one or more second network elements include a policy control network element and a session management network element. The data analysis network element may obtain terminal behavior information from the policy control network element or the session management network element. .

It should be noted that when the data analysis network element obtains terminal behavior information from one or more second network elements, the data analysis network element may associate the terminal behavior information of the terminal on one or more second network elements. The abnormal information of the terminal is determined based on the terminal behavior information obtained after the association.

It should be understood that, in S504, if the data analysis network element obtains terminal behavior information of the terminal on at least two second network elements, the data analysis network element needs to associate the terminal on at least two second network elements according to the terminal identification information. Terminal behavior information to get the complete terminal behavior information. Of course, in addition to the terminal identification information, the data analysis network element may also associate terminal behavior information of one terminal on at least two network elements according to area information, time information, and terminal type information. The process of the data analysis network element associating the terminal behavior information of one terminal on at least two second network elements is described in detail at S1011 in the first embodiment, and is not repeated here.

S505. The data analysis network element determines abnormal information of the terminal according to the terminal behavior information.

Exemplarily, the abnormality information of the terminal includes one or more of the following information corresponding to the terminal: identification information of the terminal, an abnormality type, an abnormality identification, and an abnormality level. Among them, the abnormality identifier is used to identify the abnormality type, and the abnormality level is used to indicate the degree or size of the abnormality type.

In an optional embodiment, as shown in FIG. 13, as shown in FIG. 13, before S504 provided in the embodiment of the present application, the method provided in the embodiment of the present application further includes:

S506. The first network element sends one or more of the following information corresponding to the terminal to the data analysis network element: identification information of the terminal, network area, terminal type, time information, and terminal behavior information on the first network element.

The role of the terminal identification information, network area, terminal type, time information, and terminal behavior information on the first network element are shown in Table 4.

Table 4 Information functions provided by the first network element to the data analysis network element

For ease of description, in the embodiment of the present application, the information sent by the first network element in S506 to the data analysis network element may be referred to as terminal-related information. The information related to the terminal may be sent to the data analysis network element by the first network element and the indication information in the same message (for example, Nnf_EventExposure_Notify service operation). This can save signaling overhead.

Of course, the terminal-related information may also be sent by the first network element and the indication information to the data analysis network element through different messages. For example, after the first network element sends the instruction information, the data analysis network element subscribes the terminal behavior information to the first network element, and then the first network element sends the terminal behavior information to the data. The specific steps are the same as S504.

S507. The data analysis network element receives one or more of the following information corresponding to the terminal from the first network element: identification information of the terminal, network area, terminal type, time information, and terminal behavior information on the first network element.

For specific information about the terminal's identification information, network area, terminal type, and time information, and the terminal behavior data on the first network element, reference may be made to the foregoing related description, and details are not described herein again.

Correspondingly, S504 can be implemented in the following manner: The data analysis network element obtains terminal behavior information of one or more terminals on the second network element according to any one or more of the information received in S507.

It should be understood that the terminal identification information may indicate one or more terminals (see Table 4). For specific terminal behavior data, reference may be made to the description in Tables 1 and 3 above, and details are not described herein again.

In a possible implementation manner, the terminal-related information received by the data analysis network element through S507 may be used singly or in combination. For specific usage, refer to the process of filtering information used by the data analysis network element at S1012.

In a possible implementation manner, as shown in FIG. 14, S504 in the embodiment of the present application may be specifically implemented in the following manners:

S5041. The data analysis network element sends a request message to the second network element, so that the second network element receives the request message from the data analysis network element. The request message is used to request terminal behavior information of the terminal on the second network element.

Exemplarily, the request message may be a Nnf_EventExposure_Subscribe service operation, that is, the data analysis network element subscribes data to the second network element.

In an optional implementation, the request message may further include one or more of the following information corresponding to the terminal: terminal identification, network area, terminal type, and time information. See Table 4 for specific information. This information is used to collect terminal behavior information of the terminal on the second network element from the second network element, see Tables 1 and 3.

S5042, the data analysis network element receives a response message from the second network element. The response message includes terminal behavior information of the terminal on the second network element. For example, the response message may be a Nnf_EventExposure_Notify service operation.

Exemplarily, the terminal behavior information includes any one or more of the following information: identification information of the second network element, location information, communication start time, communication end time, data packet delay, number of data packets, and data packet size And at least one first type of data on the second network element by the one or more terminals. Specifically, the terminal behavior information is shown in Tables 1 and 3.

For at least one piece of data of the first type, reference may be made to the description in the foregoing Embodiment 1, and details are not described herein again. It should be understood that, in S505, if the first network element sends the terminal behavior information of the terminal on the first network element to the data analysis network element. Then, the data analysis network element in S5041 does not need to subscribe the terminal behavior information of the terminal on the first network element to the first network element. At this time, the data analysis network element needs to correlate the terminal behavior information of the terminal on the first network element and the second network element according to the terminal identification information to obtain complete terminal behavior information of the terminal. In addition to the terminal identification information, the data analysis network element may also associate terminal behavior information on at least two network elements according to area information, time information, and terminal type information.

Continuing to combine with FIG. 14, S505 in the embodiment of the present application may be specifically implemented in the following manner: The data analysis network element determines the abnormal information of the terminal according to the terminal behavior information and the terminal behavior information expected by the network side of the terminal.

For example, if the data analysis network element also obtains the terminal behavior information of the terminal on the first network element, S505 in the embodiment of the present application may be specifically implemented in the following manner: The data analysis network element The terminal behavior information, the terminal behavior information of the terminal on the second network element, and the terminal behavior information expected by the network side of the terminal determine the abnormality information of the terminal.

The terminal behavior information expected by the network side of the terminal may be stored in the data analysis network element in advance. If the data analysis network element obtains the terminal behavior information, the data analysis network element does not have the terminal behavior expected by the network side of the terminal Information, in an optional embodiment, continuing to combine with FIG. 14, before S505 provided in the embodiment of the present application, the method provided in the embodiment of the present application further includes:

S508. The application function network element sends the terminal behavior information expected by the network side of the terminal to the data analysis network element.

Specifically, before S508, the method provided in the embodiment of the present application further includes: the data analysis network element requests the application function network element for behavior characteristic data of one or more terminals.

Optionally, before S508, the method provided in the embodiment of the present application further includes: the data analysis network element requests the application function network element's behavior characteristic data from the application function network element through the network capability open function network element.

S509. The data analysis network element obtains, from the application function network element, terminal behavior information expected by the network side of the terminal.

Specifically, the method provided in the embodiment of the present application further includes: the data analysis network element obtains the terminal behavior information expected by the network side of the terminal from the application function network element through the network capability open function network element.

It should be noted that if the terminal behavior information expected by the network side of the terminal can be obtained by the data analysis network element itself, S508 and S509 can be omitted.

In an optional embodiment, continuing to combine with FIG. 14, after S505, the method provided in this embodiment of the present application further includes:

S510. The data analysis network element sends abnormal information to the third network element. Among them, the abnormal information is used for policy control of the terminal.

Exemplarily, the third network element may be an AF network element or a policy control network element. In FIG. 14, the third network element is an AF network element as an example.

S511. The third network element receives abnormal information from the data analysis network element.

Example three

As shown in FIG. 15, FIG. 15 shows a method for determining terminal abnormality information provided by an embodiment of the present application. The method includes:

S601. The data analysis network element sends a first request message to the first network element. The first request message is used to request terminal behavior information of the abnormal terminal on the first network element.

Exemplarily, the first network element may be any one of a session management network element, a policy control network element, a user data management network element, a policy control network element, a user plane network element, or a mobility management network element.

In a possible implementation manner, the first request message may carry a first indication. The first instruction is used to instruct the first network element to report terminal behavior information of the abnormal terminal on the first network element.

In another possible implementation manner, the first request message itself has a meaning for requesting terminal behavior information of the abnormal terminal on the first network element.

Exemplarily, taking the first network element as the session management network element as an example, the first request message may be Nsmf_EventExposure_Subscribe. The first instruction includes: an event ID (Event ID) and event filtering information (Event Filter). On the one hand, the Event ID can be used to indicate abnormal terminal behavior information, and the Event Filter does not make any special provisions. The first network element can compare the terminal behavior information of the terminal on the first network element with the terminal behavior information expected by the network side of the terminal on the first network element according to the Event ID. If a mismatch is found, the terminal further reports the terminal behavior. The terminal behavior information on the first network element is given to the data analysis network element. On the other hand, Event ID can be used to indicate terminal behavior information (UE behavior information), and Event Filter can include indication information (for example, pre-check indicator). The instruction information is used to instruct the first network element to compare the terminal behavior information of the terminal on the first network element with the terminal behavior information expected by the terminal on the network side of the first network element. If a mismatch is found, the terminal is further reported to the terminal. The terminal behavior information on the first network element is given to the data analysis network element.

S602. In response to the first request message, the first network element sends a first response message to the data analysis network element. The first response message includes identification information of one or more terminals, and terminal behavior information of each terminal of the one or more terminals on the first network element.

For the terminal behavior information of each terminal on the first network element, reference may be made to the description in the second embodiment, and details are not described herein again.

It should be understood that after receiving the first request message, the first network element may perform step 501 to determine that there is an abnormal termination on the first network element. Or determine abnormal terminal behavior information.

S603. The data analysis network element requests the second network element for terminal behavior information of the one or more terminals on the second network element according to the identification information of the one or more terminals.

Specifically, S603 may be implemented in the following manner: The data analysis network element sends a second request message to the second network element, so that the second network element receives the second request message from the data analysis network element. The second request message is used to request terminal behavior information of the one or more terminals on the second network element. The second network element sends a second response message to the data analysis network element, so that the data analysis network element receives the second response message. The second response message includes terminal behavior information of one or more terminals on the second network element. Exemplarily, the second request message may carry a first field, where the first field is used to request terminal behavior information of the one or more terminals on the second network element. Or the second request message itself has a meaning of requesting the second network element for terminal behavior information of the one or more terminals on the second network element.

Exemplarily, the second request message may include identification information of one or more terminals.

S604. The data analysis network element is based on the terminal behavior information of the one or more terminals on the first network element, the terminal behavior information of the one or more terminals on the second network element, and the terminal expected by the network side of the one or more terminals. Behavioral information, identifying abnormal information.

Specifically, for the specific implementation of S604, reference may be made to the specific implementation process of S505 in Embodiment 2, and details are not described herein again.

In a possible implementation, after S604, the method provided in the embodiment of the present application further includes: S605 and S606. Among them, S605 and S606 are the same as those described in S510 and S511 in the second embodiment, and details are not described herein again.

It should be understood that the difference between the third embodiment and the second embodiment is that in the second embodiment, the first network element triggers the data analysis network element to obtain the terminal behavior information of the terminal through the instruction information. In this way, the data analysis network element can determine the abnormality information of the terminal according to the terminal behavior information of the terminal obtained from the second network element. In the third embodiment, after the data analysis network element actively subscribes the abnormal terminal information to the first network element, and then obtains the identification information of the abnormal terminal and the terminal behavior information on the first network element, the data analysis network element starts from the second network element. The network element obtains terminal behavior information of the abnormal terminal on the second network element according to the identification information of the abnormal terminal. The abnormality information of the terminal is obtained by analyzing the terminal behavior information of the abnormal terminal on the first network element and the terminal behavior information of the abnormal terminal on the second network element.

The above mainly introduces the solution of the embodiment of the present application from the perspective of interaction between various network elements. It can be understood that, in order to implement the above functions, each network element, such as an information processing device and an information sending device, includes a hardware structure and / or a software module corresponding to each function. Those skilled in the art should easily realize that, with reference to the units and algorithm steps of the various examples described in the embodiments disclosed herein, this application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is performed by hardware or computer software-driven hardware depends on the specific application and design constraints of the technical solution. A professional technician can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

In the embodiment of the present application, the functional units may be divided according to the method examples described above. For example, each functional unit may be divided corresponding to each function, or two or more functions may be integrated into one processing unit. . The above integrated unit may be implemented in the form of hardware or in the form of software functional unit. It should be noted that the division of units in the embodiments of the present application is schematic, and is only a logical function division. There may be another division manner in actual implementation.

The following description is made by taking each functional module as an example:

In the case of using an integrated unit, FIG. 16 shows a possible structure diagram of an information processing device involved in the foregoing embodiment. The information processing device may be a data analysis network element, or may be applied to data. Analyze the chip in the network element. The information processing apparatus includes: an obtaining unit 201, a determining unit 202, and a sending unit 203. The obtaining unit 201 is configured to support the information processing apparatus to execute S101 and S1011 in the foregoing embodiment. The determining unit 202 is configured to support the information processing apparatus to execute S102, S111, and S112 in the foregoing embodiment. The sending unit 103 is configured to support the information processing apparatus to execute S103, S1012, S105, and S109 in the foregoing embodiment. Optionally, the information processing apparatus may further include: a receiving unit 204, configured to support the information processing apparatus to execute S108 in the foregoing embodiment. All relevant content of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

In the case of using an integrated unit, FIG. 17 shows a schematic diagram of a possible logical structure of the information processing device involved in the foregoing embodiment, and the information processing device may be a data analysis network element in the foregoing embodiment, or Chips used in data analysis network elements. The information processing apparatus includes a processing module 212 and a communication module 213. The processing module 212 is configured to control and manage the actions of the information processing device. For example, the processing module 212 is configured to perform the steps of performing message or data processing on the information processing device side. For example, the information processing device is supported to execute S102 and S111, S112, S102, S111, and S112. The communication module 213 is used to support the information processing device to execute S103, S1012, S105, S108, and S109 in the above embodiments. And / or other processes performed by the information processing apparatus for the techniques described herein.

Optionally, the information processing apparatus may further include a storage module 211 for storing program code and data of the information processing apparatus.

The processing module 212 may be a processor or a controller, for example, it may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, Hardware components or any combination thereof. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on. The communication module 213 may be a transceiver, a transceiver circuit, or a communication interface. The storage module 211 may be a memory.

When the processing module 212 is the processor 220, the communication module 213 is the communication interface 230 or the transceiver, and the storage module 211 is the memory 240, the information processing apparatus involved in this application may be the device shown in FIG. 18.

The communication interface 230, one or more (including two) processors 220, and the memory 240 are connected to each other through the bus 210. The bus 210 may be a PCI bus, an EISA bus, or the like. The bus 210 may be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 18, but it does not mean that there is only one bus or one type of bus. The memory 240 is configured to store program code and data of the information processing apparatus. The communication interface 230 is used for supporting the information processing apparatus to communicate with other devices (for example, the information transmitting apparatus). For example, the supporting information processing apparatus executes S1012, S105, S108, and S109. The processor 220 is configured to support the information processing device to execute the program code and data stored in the memory 240 to implement S102 and S111, S112, S102, S111, and S112 provided in the present application.

In the case of using an integrated unit, FIG. 19 shows a possible structural schematic diagram of the information sending device involved in the foregoing embodiment. The information sending device may be a core network element or a core network device. Meta chip. The information sending apparatus includes a receiving unit 301 and a sending unit 302. The receiving unit 301 is used to support the information sending apparatus to execute S1013 in the above embodiment, and the sending unit 302 is used to support the information sending apparatus to execute S1014 in the above embodiment. All relevant content of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

In the case of using an integrated unit, FIG. 20 shows a schematic diagram of a possible logical structure of the information sending device involved in the foregoing embodiment, and the information sending device may be a core network element in the foregoing embodiment, or Chips used in core network elements. The information sending apparatus includes a processing module 312 and a communication module 313. The processing module 312 is configured to control and manage the actions of the information sending device. For example, the processing module 312 is configured to perform steps of performing message or data processing on the information sending device side. The communication module 313 is configured to support the information transmitting device to execute S1014 and S1013 in the foregoing embodiment. And / or other processes performed by the information transmitting device for the techniques described herein.

Optionally, the information sending device may further include a storage module 311 for storing program code and data of the information sending device.

The processing module 312 may be a processor or a controller, for example, it may be a central processing unit, a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, Hardware components or any combination thereof. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on. The communication module 313 may be a transceiver, a transceiver circuit, or a communication interface. The storage module 311 may be a memory.

When the processing module 312 is the processor 320, the communication module 313 is the communication interface 330 or the transceiver, and the storage module 311 is the memory 340, the information sending device involved in this application may be the device shown in FIG. 21.

The communication interface 330, one or more (including two) processors 320, and the memory 340 are connected to each other through a bus 310. The bus 310 may be a PCI bus, an EISA bus, or the like. The bus 310 may be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only a thick line is used in FIG. 21, but it does not mean that there is only one bus or one type of bus. The memory 340 is configured to store program code and data of the information sending device. The communication interface 330 is used to support the information sending device to communicate with other devices (for example, terminals), and the processor 320 is used to support the information sending device to execute the program code and data stored in the memory 340 to implement S1013 and S1014 provided in this application.

In the case of using an integrated unit, FIG. 22 shows a possible structure diagram of the information processing apparatus involved in the foregoing embodiment. The information processing apparatus may be a user data management network element, or may be applied to user data. Manage chips in network elements. The information processing apparatus includes a receiving unit 401 and a processing unit 402. The receiving unit 401 is configured to support the information processing apparatus to execute S104, S106, and S110 in the foregoing embodiment. The processing unit 402 is configured to support the information processing apparatus to execute S104-1 in the foregoing embodiment. Optionally, the information processing apparatus may further include: a sending unit 403 configured to support the information processing apparatus to execute S107 in the foregoing embodiment. All relevant content of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

Optionally, the information processing device shown in FIG. 22 may also be a policy control network element or a chip in the policy control network element. At this time, the processes performed by each unit in the information processing device refer to the above description, and are not described here. More details. The difference is that the receiving unit 401 may not be used to execute S106, but used to execute S113. At this time, the processing unit 402 may not execute the above S104-1, but may perform determining the terminal behavior information expected by the network side corresponding to each core network element in the terminal behavior information expected by the network side.

In the case of using an integrated unit, FIG. 23 shows a schematic diagram of a possible logical structure of the information processing apparatus involved in the foregoing embodiment, and the information processing apparatus may be a user data management network element in the foregoing embodiment. Or a chip applied to a user data management network element. The information processing apparatus includes a processing module 412 and a communication module 413. The processing module 412 is configured to control and manage the actions of the information processing device. For example, the processing module 412 is configured to perform steps of performing message or data processing on the information processing device side, for example, S104-1. The communication module 413 is configured to support the information processing apparatus to execute S104, S106, S107, and S110 in the foregoing embodiment. And / or other processes performed by the information processing apparatus for the techniques described herein.

Optionally, the information processing apparatus may further include a storage module 411 for storing program code and data of the information processing apparatus.

Optionally, when the information processing device is a policy control network element or a chip applied to the policy control network element, the steps performed by each module in the information processing device can refer to the above description, and are not repeated here. The difference is that the communication module 413 may not be used to execute S106, but used to execute S113. At this time, the processing module 412 may not execute the above S104-1, but may perform determining the terminal behavior information expected by the network side corresponding to each core network element among the terminal behavior information expected by the network side.

The processing module 412 may be a processor or a controller. For example, the processing module 412 may be a central processing unit, a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, Hardware components or any combination thereof. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on. The communication module 413 may be a transceiver, a transceiver circuit, or a communication interface. The storage module 411 may be a memory.

When the processing module 412 is a processor 420, the communication module 413 is a communication interface 430 or a transceiver, and the storage module 411 is a memory 440, the information processing apparatus involved in this application may be the device shown in FIG. 24.

The communication interface 430, one or more (including two) processors 420, and the memory 440 are connected to each other through a bus 410. The bus 410 may be a PCI bus, an EISA bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 24, but it does not mean that there is only one bus or one type of bus. The memory 440 is configured to store program code and data of the information processing apparatus. The communication interface 430 is used to support the information processing apparatus to communicate with other devices (for example, an information sending apparatus), and the processor 420 is used to support the information processing apparatus to execute the program code and data stored in the memory 440 to implement S104 provided in this application, S104-1, S106, S107, and S110.

As shown in FIG. 25, FIG. 25 shows a possible logical structure diagram of a device for determining terminal abnormality information involved in the foregoing embodiment. The device for determining terminal abnormality information may be a data analysis network in the foregoing embodiment. Or a chip used in a data analysis network element. The device for determining terminal abnormality information includes a receiving unit 501 and a processing unit 502.

The receiving unit 501 is configured to support a data analysis network element to perform S503 and S504 in the foregoing embodiment. The processing unit 502 is configured to support the data analysis network element to execute S505 in the foregoing embodiment.

In an optional implementation, the receiving unit 501 is further configured to support the data analysis network element to execute S507, S5042, and S509 in the foregoing embodiment. In an optional implementation, the apparatus for determining abnormality information of a terminal may further include: a sending unit 503, configured to support a data analysis network element to execute S5041 and S510 in the foregoing embodiment. That is, when the apparatus shown in FIG. 25 is used to implement the steps of the data analysis network element in the second embodiment, the sending unit 503 is an optional unit.

In an optional implementation, the apparatus for determining terminal abnormality information shown in FIG. 25 may further include: a storage unit, configured to store an instruction or a program.

When the apparatus for determining terminal abnormality information shown in FIG. 25 adopts the structure shown in FIG. 18, the sending unit 503 and the receiving unit 501 may correspond to the communication interface 230. The processing unit 502 may correspond to the processor 220. In an optional implementation, when the apparatus for determining terminal abnormality information shown in FIG. 25 adopts the structure shown in FIG. 18, the storage unit may correspond to the memory 240. The communication interface 230 is configured to support the device for determining terminal abnormality information shown in FIG. 18 to execute S503 and S504 in the foregoing embodiment. The processor 220 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S505 in the foregoing embodiment.

In an optional implementation, the communication interface 230 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S507, S5042, and S509 in the foregoing embodiment. In an optional implementation, the communication interface 230 is further configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S5041 and S510 in the foregoing embodiment.

As shown in FIG. 26, FIG. 26 shows a possible logical structure diagram of a device for determining terminal abnormality information involved in the foregoing embodiment, and the device for determining terminal abnormality information may be a data analysis network element in the foregoing embodiment. , Or a chip applied to a data analysis network element, or the device for determining abnormality information of the terminal may be the first network element in the foregoing embodiment or a chip applied to the first network element. The device for determining terminal abnormality information includes a processing unit 601 and a sending unit 602.

An example is that the device shown in FIG. 26 is the data analysis network element in the foregoing embodiment, or a chip applied to the data analysis network element is taken as an example. The sending unit 602 is configured to support a data analysis network element to perform S601 and S603 in the foregoing embodiment. The processing unit 601 is configured to support the data analysis network element to execute S604 in the foregoing embodiment. The sending unit 602 is further configured to support the data analysis network element to execute S605 in the foregoing embodiment.

In another example, the device shown in FIG. 26 is the first network element in the foregoing embodiment or a chip applied to the first network element as an example. The processing unit 601 is configured to support the first network element to perform S501 in the foregoing embodiment. The sending unit 602 is configured to support the first network element to perform S502 in the foregoing embodiment.

In an optional implementation, the sending unit 602 is further configured to support the first network element to perform S506 in the foregoing embodiment.

In an optional implementation, the apparatus shown in FIG. 26 may further include a storage unit for storing instructions or programs.

When the device shown in FIG. 26 adopts the structure shown in FIG. 18, the sending unit 602 may correspond to the communication interface 230. The processing unit 602 may correspond to the processor 220. In an optional implementation, when the apparatus for determining terminal abnormality information shown in FIG. 26 adopts the structure shown in FIG. 18, the storage unit may correspond to the memory 240.

Among them, when the device shown in FIG. 18 is a data analysis network element, the communication interface 230 is configured to support the device for determining terminal abnormality information shown in FIG. 18 to execute S601, S603, and S605 in the foregoing embodiment. The processor 220 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S604 in the foregoing embodiment.

In another example, when the device shown in FIG. 18 is the first network element, the processor 220 is configured to support the determining device for terminal abnormality information shown in FIG. 18 to execute S501 in the foregoing embodiment. The communication interface 230 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S502 in the foregoing embodiment.

In an optional implementation, the communication interface 230 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S506 in the foregoing embodiment.

An embodiment of the present application provides a communication device. The communication device includes one or more modules, and is configured to implement the method in steps 601 to 606. The one or more modules may be the same as those in steps 601 to 606. The steps of the method correspond. Specifically, in the embodiments of the present application, each step in the method performed by the first network element includes a unit or module in the first network element that executes each step in the method. Each step in the method performed by the data analysis network element includes a unit or module in the data analysis network element that performs each step in the method. For example, a module that controls or processes an operation of the information transmission device may be referred to as a processing module. A module that executes steps for performing message or data processing on the information transmission device side may be referred to as a communication module.

FIG. 27 is a schematic structural diagram of a chip 150 according to an embodiment of the present invention. The chip 150 includes one or more (including two) processors 1510 and an interface circuit 1530.

Optionally, the chip 150 further includes a memory 1540. The memory 1540 may include a read-only memory and a random access memory, and provide operation instructions and data to the processor 1510. A part of the memory 1540 may further include a non-volatile random access memory (NVRAM).

In some implementations, the memory 1540 stores the following elements, executable modules or data structures, or their subsets, or their extended sets:

In the embodiment of the present invention, a corresponding operation is performed by calling an operation instruction stored in the memory 1540 (the operation instruction may be stored in an operating system).

A possible implementation manner is: a data analysis network element, a user data management network element, and a core network network element. The chips used are similar in structure, and different devices can use different chips to achieve their respective functions.

The processor 1510 controls operations of the data analysis network element, the user data management network element, and the core network network element. The processor 1510 may also be referred to as a central processing unit (CPU). The memory 1540 may include a read-only memory and a random access memory, and provide instructions and data to the processor 1510. A part of the memory 1540 may further include a non-volatile random access memory (NVRAM). For example, in the application, the memory 1540, the interface circuit 1530, and the memory 1540 are coupled through a bus system 1520. The bus system 1520 may include a power bus, a control bus, and a status signal bus in addition to a data bus. However, for the sake of clarity, various buses are marked as the bus system 1520 in FIG. 27.

The method disclosed in the foregoing embodiment of the present invention may be applied to the processor 1510, or implemented by the processor 1510. The processor 1510 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 1510 or an instruction in the form of software. The above-mentioned processor 1510 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or Other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Various methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or executed. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in combination with the embodiments of the present invention may be directly implemented by a hardware decoding processor, or may be performed by using a combination of hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the field, such as a random memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, and the like. The storage medium is located in the memory 1540, and the processor 1510 reads the information in the memory 1540 and completes the steps of the foregoing method in combination with its hardware.

Optionally, the interface circuit 1530 is configured to execute the embodiments shown in FIG. 3, FIG. 4, FIG. 6, FIG. 7, FIG. 8, FIG. 9, FIG. 10, FIG. 11 and FIG. 12, FIG. 13, FIG. The steps of receiving and sending the data analysis network element, user data management network element, and core network network element in.

The processor 1510 is configured to perform data analysis in the embodiments shown in FIG. 3, FIG. 4, FIG. 6, FIG. 7, FIG. 8, FIG. 9, FIG. 10, FIG. 11, and FIG. 13, FIG. 14, FIG. Network element, user data management network element and core network network element processing steps.

In the above embodiments, the instructions stored in the memory for execution by the processor may be implemented in the form of a computer program product. The computer program product may be written in the memory in advance, or may be downloaded and installed in the memory in the form of software.

A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to the embodiments of the present application are generated in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server, or data center via a wired (e.g., Coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) transmission to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server, a data center, and the like that includes one or more available mediums integrated. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).

In one aspect, a computer-readable storage medium is provided, and instructions are stored in the computer-readable storage medium. When the instructions are executed, the data analysis network element or a chip applied to the data analysis network element executes S102 and S111, S112, S103, S1012, S105, S108, S109. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.

On the other hand, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions. When the instructions are executed, the core network element or a chip applied to the core network element executes S1014 in the embodiment. And S1013. And / or other processes performed by the core network element or a chip applied in the core network element for the techniques described herein.

In another aspect, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions. When the instructions are executed, the user data management network element or a chip applied to the user data management network element executes the embodiments. S104-1, S104, S106, S107, and S110. And / or other processes for the techniques described herein performed by a user data management network element or a chip applied in a user data management network element.

On the other hand, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions. When the instructions are executed, the data analysis network element or a chip applied to the data analysis network element executes S503 in the embodiment. And S504, S505, S507, S5042, S509, S5041, S510. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.

In another aspect, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions, and when the instructions are executed, the data analysis network element or a chip applied to the data analysis network element executes S601 in the embodiment. , S603, S604, and S605. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.

In another aspect, a computer-readable storage medium is provided. The computer-readable storage medium stores instructions. When the instructions are executed, the first network element or a chip applied to the first network element executes S501 in the embodiment. , S502, S506. And / or other processes performed by the first network element or a chip applied in the first network element for the techniques described herein.

The foregoing readable storage medium may include: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk, or an optical disk.

In one aspect, a computer program product including instructions is provided. The computer program product stores instructions. When the instructions are executed, the data analysis network element or a chip applied to the data analysis network element executes S102 and S111 in the embodiment. , S112, S103, S1012, S105, S108, S109. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.

On the other hand, there is provided a computer program product including instructions. The computer program product stores instructions. When the instructions are executed, the core network element or a chip applied to the core network element executes S1014 and S1014 in the embodiment. S1013. And / or other processes performed by the core network element or a chip applied in the core network element for the techniques described herein.

On the other hand, a computer program product including instructions is provided. The computer program product stores instructions. When the instructions are executed, the user data management network element or a chip applied to the user data management network element executes the instructions in the embodiment. S104-1, S104, S106, S107, and S110. And / or other processes for the techniques described herein performed by a user data management network element or a chip applied in a user data management network element.

On the other hand, a computer program product including instructions is provided. When the instructions are executed, the data analysis network element or a chip applied to the data analysis network element executes S503 and S504, S505, S507, S5042, S509, S5041, S510. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.

In another aspect, a computer program product including instructions is provided. The computer program product stores instructions. When the instructions are executed, the data analysis network element or a chip applied to the data analysis network element executes S601, S603, S604, and S605. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.

In another aspect, a computer program product including instructions is provided. The computer program product stores instructions. When the instructions are executed, the first network element or a chip applied to the first network element executes S501, S502, S506. And / or other processes performed by the first network element or a chip applied in the first network element for the techniques described herein.

In one aspect, a chip is provided. The chip is used in a data analysis network element. The chip includes one or more (including two) processors and interface circuits, and the interface circuit and the one or more (including two) processors. The processors are interconnected through lines, and the processors are used to execute instructions to execute S102, S111, S112, S103, S1012, S105, S108, and S109 in the embodiment. And / or other processes performed by the data analysis network element for the techniques described herein.

In another aspect, a chip is provided. The chip is used in a core network element. The chip includes one or more processors (including two) and an interface circuit. The interface circuit and the one or two processors (including two) ) The processors are interconnected through lines, and the processors are used to run instructions to execute S1014 and S1013 in the embodiments. And / or other processes performed by the core network elements for the techniques described herein.

In another aspect, a chip is provided, and the chip is applied to a user data management network element. The chip includes one or more (including two) processors and an interface circuit. The interface circuit and the one or more (including two) processors are interconnected through a line. The processor is used to run instructions to execute the implementation in the embodiment. S104-1, S104, S106, S107, and S110 in the example. And / or other processes performed by the user data management network element for the techniques described herein.

In another aspect, a chip is provided, and the chip is applied to a data analysis network element. The chip includes: one or more (including two) processors and an interface circuit, the interface circuit and the one or more (including two) processors are interconnected through a line, and the processor is used to run instructions to execute the embodiments S503, S504, S505, S507, S5042, S509, S5041, S510.

In another aspect, a chip is provided, and the chip is applied to a data analysis network element. The chip includes: one or more (including two) processors and an interface circuit, the interface circuit and the one or more (including two) processors are interconnected through a line, and the processor is used to run instructions to execute the embodiments S601, S603, S604, and S605.

In another aspect, a chip is provided. The chip is applied to a first network element, and the chip includes: one or more (including two) processors and an interface circuit, and the interface circuit and the one or more (including two) processors (2) The processors are interconnected through lines, and the processors are used to run instructions to execute S501, S502, and S506 in the embodiment.

In addition, the present application also provides a communication system including the information processing device shown in FIGS. 16 to 18, the information sending device shown in FIGS. 19 to 21, and the information processing shown in FIGS. 22 to 24. Device.

In addition, the present application also provides a communication system including: a device for determining terminal abnormality information shown in FIG. 25 as a data analysis network element, and a device for determining terminal abnormality information shown in FIG. 26 as a first network element. . Specifically, the specific steps performed by the data analysis network element and the first network element in the system may refer to the specific descriptions in FIG. 25 and FIG. 26, and are not repeated here.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using a software program, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to the embodiments of the present application are generated in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server, or data center via a wired (for example, Coaxial cable, optical fiber, digital subscriber line (DSL), or wireless (such as infrared, wireless, microwave, etc.) for transmission to another website site, computer, server, or data center. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device including one or more servers, data centers, and the like that can be integrated with the medium. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (solid state disk (SSD)), and the like.

Although the present application is described in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art can understand and realize the disclosure by looking at the drawings, the disclosure, and the appended claims. Other variations of the embodiment. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit may fulfill the functions of several items recited in the claims. Certain measures are recited in mutually different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

Although the present application has been described in connection with specific features and embodiments thereof, it is apparent that various modifications and combinations can be made thereto without departing from the spirit and scope of the application. Accordingly, the specification and drawings are merely exemplary illustrations of the application as defined by the appended claims, and are deemed to have covered any and all modifications, changes, combinations, or equivalents that fall within the scope of the application. Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. In this way, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, this application is also intended to include these modifications and variations.

Claims

An information processing method, comprising:

The data analysis network element obtains terminal behavior information of multiple terminals;

Determining, by the data analysis network element, terminal behavior information expected by a network side according to the terminal behavior information;

The data analysis network element sends to the user data management network element the terminal behavior information expected by the network side.
The information processing method according to claim 1, wherein the acquiring, by the data analysis network element, terminal behavior information of multiple terminals comprises:

The data analysis network element obtains, from at least two core network elements, terminal behavior information corresponding to the at least two core network elements in the terminal behavior information.
The information processing method according to claim 2, wherein the method further comprises:

The data analysis network element sends a first request message to the at least two core network element, the first request message is used to request the plurality of terminals corresponding to the at least two core network element Terminal behavior information.
The information processing method according to claim 3, wherein the first request message includes filtering information, and the filtering information is used to indicate a range of terminal behavior information of the multiple terminals.
The information processing method according to claim 4, wherein the filtering information comprises one or more of the following information:

Identification information of the terminal, network area corresponding to the terminal, terminal type, and time window.
The information processing method according to any one of claims 1-5, wherein the terminal behavior information includes one or more of identification information of the terminal and the following information corresponding to the terminal:

Identification information, location information, communication start time, communication end time, data packet delay, number of data packets, data packet size, and at least one first type of the terminal corresponding to the core network element The data.
The information processing method according to any one of claims 1-6, wherein the terminal behavior information expected by the network side includes one or more of the following information:

Inactivity indication, terminal movement trajectory, periodic communication indication, communication duration, communication cycle, planned communication time, maximum packet transmission delay, maximum packet transmission response time, number of packet buffers, and at least one second type of data.
The information processing method according to any one of claims 1 to 7, wherein the terminal behavior information expected by the network side includes the terminal behavior expected by the network side corresponding to at least one group of the multiple terminals. information.
An information processing method according to any one of claims 1-8, wherein the method further comprises:

The data analysis network element sends to the user data management network element the first information of the terminal corresponding to the terminal behavior information expected by the network side, and the first information of the terminal includes identification information of the terminal or identification information of the terminal group. .
The information processing method according to any one of claims 1 to 9, wherein the terminal behavior information expected by the network side includes terminal behavior information expected by the network side corresponding to at least two core network elements.
The information processing method according to claim 10, wherein the method further comprises:

The data analysis network element sends at least one of identification information and type information of the at least two core network element to the user data management network element, where the identification information of the core network element is used to indicate the The core network element corresponding to the terminal behavior information expected by the network side, and the type information of the core network element is used to indicate that the terminal behavior information expected by the network side corresponds to the core network element type.
An information processing method according to any one of claims 1-11, wherein the method further comprises:

Determining, by the data analysis network element, the abnormal type of the terminal according to the terminal behavior information expected by the network side;

The data analysis network element sends alarm information to a policy control network element, and the alarm information is used to indicate an abnormal type of the terminal.
An information processing method according to any one of claims 1-12, wherein the method further comprises:

The data analysis network element receives a second request message sent by the user data management network element, the second request message is used to request terminal behavior information expected by the network side, and the second request message includes the multiple Terminal identification information.
An information processing method, comprising:

The user data management network element receives the terminal behavior information expected by the network side sent by the data analysis network element;

The user data management network element uses the terminal behavior information expected by the network side as user subscription data.
The information processing method according to claim 14, wherein the terminal behavior information expected by the network side includes terminal behavior information expected by the network side corresponding to at least one group of the multiple terminals.
An information processing method according to claim 14 or 15, wherein the method further comprises:

The user data management network element sends a second request message to the data analysis network element, the second request message is used to request terminal behavior information expected by the network side, and the second request message includes identification information of multiple terminals .
An information processing method according to any one of claims 14-16, wherein the method further comprises:

Receiving, by the user data management network element, first information of a terminal corresponding to terminal behavior information expected by the network side sent by the data analysis network element, and the first information of the terminal includes identification information of a terminal or an identification of a terminal group information.
The information processing method according to any one of claims 14 to 17, wherein the terminal behavior information expected by the network side includes terminal behavior information expected by the network side corresponding to at least two core network elements.
An information processing method according to any one of claims 14 to 18, wherein the method further comprises:

The user data management network element receives at least one of identification information and type information of at least two core network network elements sent by the data analysis network element, where the identification information of the core network network element is used to indicate the network The core network element corresponding to the terminal behavior information expected from the side, and the type information of the core network element is used to indicate that the terminal behavior information expected from the network side corresponds to the core network element type.
An information processing device, characterized in that the information processing device includes:

An obtaining unit, configured to obtain terminal behavior information of multiple terminals;

A determining unit, configured to determine terminal behavior information expected by the network side according to the terminal behavior information;

The sending unit is configured to send the behavior information of the terminal expected by the network side to the user data management network element.
The information processing device according to claim 20, wherein the obtaining unit is specifically configured to obtain the terminal behavior information corresponding to the at least two core network network elements respectively from at least two core network network elements. Terminal behavior information.
The information processing device according to claim 21, wherein the sending unit is further configured to send a first request message to the at least two core network elements, and the first request message is used to request the Terminal behavior information corresponding to multiple terminals on the at least two core network elements.
The information processing apparatus according to claim 22, wherein the first request message includes filtering information, and the filtering information is used to indicate a range of terminal behavior information of the multiple terminals.
The information processing apparatus according to claim 23, wherein the filtering information comprises one or more of the following information: identification information of a terminal, a network area corresponding to the terminal, a terminal type, and a time window.
The information processing device according to any one of claims 20 to 24, wherein the terminal behavior information includes one or more of identification information of the terminal and the following information corresponding to the terminal:

Identification information, location information, communication start time, communication end time, data packet delay, number of data packets, data packet size, and at least one first type of the terminal corresponding to the core network element The data.
The information processing apparatus according to any one of claims 20 to 25, wherein the terminal behavior information expected by the network side includes one or more of the following information:

Inactivity indication, terminal movement trajectory, periodic communication indication, communication duration, communication cycle, planned communication time, maximum packet transmission delay, maximum packet transmission response time, number of packet buffers, and at least one second type of data.
The information processing device according to any one of claims 20 to 26, wherein the terminal behavior information expected by the network side includes terminal behavior information expected by the network side corresponding to at least one group of the multiple terminals.
The information processing device according to any one of claims 20 to 27, wherein the sending unit is further configured to send the terminal corresponding to the terminal behavior information expected by the network side to the user data management network element. First information, the first information of the terminal includes identification information of a terminal or identification information of a terminal group.
The information processing device according to any one of claims 20 to 28, wherein the terminal behavior information expected by the network side includes terminal behavior information expected by the network side corresponding to at least two core network element.
The information processing device according to claim 29, wherein the sending unit is further configured to send at least one of identification information and type information of the at least two core network network elements to the user data management network element. One item, wherein the identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side, and the type information of the core network element is used to indicate the terminal behavior information expected by the network side Corresponds to the core network element type.
The information processing device according to any one of claims 20 to 30, wherein the determining unit is further configured to determine an abnormal type of the terminal according to the terminal behavior information expected by the network side;

The sending unit is further configured to send alarm information to a policy control network element, where the alarm information is used to indicate an abnormal type of the terminal.
The information processing device according to any one of claims 20 to 31, wherein the information processing device further comprises:

A receiving unit, configured to receive a second request message sent by the user data management network element, where the second request message is used to request terminal behavior information expected by the network side, and the second request message includes the multiple Identification information of the terminal.
An information processing device, comprising:

A receiving unit, configured to receive terminal behavior information expected by a network side sent by a data analysis network element;

A processing unit, configured to use the terminal behavior information expected by the network side as user subscription data.
The information processing device according to claim 33, wherein the terminal behavior information expected by the network side includes terminal behavior information expected by the network side corresponding to at least one group of the multiple terminals.
The information processing device according to claim 33 or 34, wherein the device further comprises:

The sending unit is configured to send a second request message to the data analysis network element, where the second request message is used to request terminal behavior information expected by the network side, and the second request message includes identification information of multiple terminals.
The information processing device according to any one of claims 33-35, wherein the receiving unit is further configured to receive the behavior information of the terminal expected by the network side sent by the data analysis network element. The first information of the terminal, where the first information of the terminal includes identification information of the terminal or identification information of the terminal group.
The information processing device according to any one of claims 33 to 36, wherein the terminal behavior information expected by the network side includes terminal behavior information expected by the network side corresponding to at least two core network element.
The information processing device according to any one of claims 33 to 37, wherein the receiving unit is further configured to receive identification information of at least two core network network elements sent by the data analysis network element and At least one item of type information, where the identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side, and the type information of the core network element is used to indicate the The terminal behavior information expected by the network side corresponds to the core network element type.
A computer-readable storage medium, characterized in that instructions are stored in the computer-readable storage medium, and when the instructions are executed, the method according to any one of claims 1 to 13 is implemented, or the foregoing is implemented. A method according to any of claims 14-19.
A communication system, comprising: the information processing device according to any one of claims 20 to 30; and a user data management network element that communicates with the information processing device.
A communication system, comprising: the information processing device according to any one of claims 33 to 38; and a data analysis network element that communicates with the information processing device.
An information processing device, comprising a processor and a memory coupled to the processor;

The memory is used to store computer instructions. When the device is running, the processor executes the computer instructions stored in the memory, so that the device executes the method according to any one of claims 1-13 or implements the foregoing. A method according to any of claims 14-19.