WO2020001336A1 - Dispositif et procédé de traitement d'informations - Google Patents

Dispositif et procédé de traitement d'informations Download PDF

Info

Publication number
WO2020001336A1
WO2020001336A1 PCT/CN2019/091795 CN2019091795W WO2020001336A1 WO 2020001336 A1 WO2020001336 A1 WO 2020001336A1 CN 2019091795 W CN2019091795 W CN 2019091795W WO 2020001336 A1 WO2020001336 A1 WO 2020001336A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
terminal
information
behavior information
expected
Prior art date
Application number
PCT/CN2019/091795
Other languages
English (en)
Chinese (zh)
Inventor
辛阳
吴晓波
孙满利
朱方园
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201910143741.8A external-priority patent/CN110650034B/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19827133.0A priority Critical patent/EP3813304A4/fr
Priority to BR112020026636-1A priority patent/BR112020026636A2/pt
Publication of WO2020001336A1 publication Critical patent/WO2020001336A1/fr
Priority to US17/131,127 priority patent/US11595810B2/en
Priority to US18/148,013 priority patent/US20230133980A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to an information processing method and device.
  • a mass Internet of Things (mIoT) terminal is introduced.
  • the 5G network side allows a third-party network element (for example, an Application Function (AF) network element) to provide some terminal behavior information (expected UE information) expected by the third party or the service server.
  • the 5G network element in the 5G network can use the terminal behavior information expected by the third party or the service server provided by the AF network element.
  • a 5G network element may store terminal behavior information expected by the network side in a unified data management network element (unified data management (UDM) network element) as a part of the contract information of the terminal.
  • UDM unified data management
  • the process by which the AF network element provides the terminal behavior information expected by the third party or the service server to the 5G network element is not mandatory. Therefore, when the AF network element does not provide the terminal behavior information expected by the network side, the UDM network element may not be updated. Contract information of mIoT terminal. In addition, the terminal behavior information expected by the network side provided by the AF network element is less reliable for the operator network.
  • Embodiments of the present invention provide an information processing method and device, which are used to provide terminal behavior information expected by a network side with high reliability.
  • the present application provides an information processing method, including: a data analysis network element acquiring terminal behavior information of multiple terminals.
  • the data analysis network element determines the terminal behavior information expected by the network side according to the terminal behavior information.
  • the data analysis network element sends the terminal behavior information expected by the network side to the user data management network element.
  • An embodiment of the present application provides an information processing method.
  • a data analysis network element obtains terminal behavior information of multiple terminals, determines terminal behavior information expected by the network side based on the terminal behavior information of multiple terminals, and then The behavior information is sent to the user data management network element. Since the data analysis network element belongs to the network element managed by the operator, the credibility of the terminal behavior information expected by the network side is compared with the terminal behavior information expected by the third party or service server provided by the application function network element in the prior art. Higher and more authentic. In addition, the terminal behavior information expected by the network side provided by the data analysis network element is more comprehensive. In addition, the terminal behavior information expected by the network side provided by the data analysis network element can also be used to verify the terminal behavior information expected by a third party or a service server provided by the application function network element.
  • the data analysis network element acquiring terminal behavior information of multiple terminals includes: the data analysis network element acquiring terminal behavior information from at least two core network element respectively corresponding to at least two core network elements. Terminal behavior information.
  • the terminal behavior information obtained by the data analysis network element can be made more comprehensive.
  • the method provided in the embodiment of the present application further includes: the data analysis network element sends to at least two core network elements to request terminal behaviors corresponding to the plurality of terminals on the at least two core network elements.
  • the first request message for information This is used to trigger at least two core network elements to send terminal behavior information of multiple terminals to the data analysis network element.
  • the first request message includes filtering information used to indicate a collection range of terminal behavior information of each terminal in the multiple terminals.
  • filtering information used to indicate a collection range of terminal behavior information of each terminal in the multiple terminals.
  • the core network element collects terminal behavior information of each terminal according to the filtering information, so that the terminal behavior information collected by at least two core network elements can meet the requirements of the network side.
  • the filtering information includes one or more of the following information: identification information of the terminal, a network area corresponding to the terminal, a terminal type, and a time window.
  • identification information of the terminal e.g., a Wi-Fi address
  • a network area corresponding to the terminal e.g., a Wi-Fi address
  • a terminal type e.g., a Wi-Fi Protected Access (WPA)
  • a time window e.g., a time window.
  • the identification information of the terminal in the embodiment of the present application may be one or more of the following: an internet protocol address (IP), a subscription permanent identifier (SUPI), and a permanent equipment identifier (permanent equipment identifier) , PEI), generic public subscription identifier (GPSI), international mobile subscriber identifier (IMSI), international mobile equipment identity (IMEI), IP five-tuple (5 -tuple) and mobile station international integrated service digital network number (MSISDN).
  • IP internet protocol address
  • SUPI subscription permanent identifier
  • PEI permanent equipment identifier
  • GPSI generic public subscription identifier
  • IMSI international mobile subscriber identifier
  • IMEI international mobile equipment identity
  • IP five-tuple 5 -tuple
  • MSISDN mobile station international integrated service digital network number
  • the terminal behavior information includes identification information of the terminal and one or more of the following information corresponding to the terminal: identification information of the core network element, location information, communication start time, communication end time, and packet time Delay, the number of data packets, the size of the data packets, and at least one first type of data of the terminal corresponding to the core network element.
  • identification information of the core network element identification information of the core network element
  • location information communication start time, communication end time, and packet time Delay
  • the number of data packets the size of the data packets
  • at least one first type of data of the terminal corresponding to the core network element The coverage of the obtained terminal behavior information is wider and more comprehensive.
  • the location information corresponding to the terminal includes time and location, where the location information is used to indicate the location of the terminal at a certain time.
  • the location of the terminal in the embodiment of the present application may be one or more of the following information: a radio access network device identification (RAN ID), a cell identification (Cell ID), and a tracking area (Tracking Area, TA). ), Routing Area (RA), and Global Positioning System (GPS).
  • RAN ID radio access network device identification
  • Cell ID Cell ID
  • Tracking Area TA
  • RA Routing Area
  • GPS Global Positioning System
  • the data analysis network element acquiring terminal behavior information of multiple terminals includes: the data analysis network element acquiring corresponding terminal behavior information of at least two core network elements from the operation management and maintenance network element. Terminal behavior information.
  • the terminal behavior information expected by the network side and expected by the network side includes one or more of the following information: stationary indication, terminal movement trajectory, periodic communication indication, communication duration, communication period, and planned communication time. , The maximum packet transmission delay, the maximum packet transmission response time, the number of packet buffers, and at least one second type of data.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of terminals among multiple terminals.
  • the method provided in the embodiment of the present application further includes: the data analysis network element sends the first information of the terminal corresponding to the terminal behavior information expected by the network side to the user data management network element, and the first information of the terminal includes the terminal The identification information of the terminal group.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least two core network elements. It is convenient for the user data management network element to receive the expected terminal behavior information of the network side to each core network element according to the expected behavior of the terminal on the network side corresponding to at least two core network elements after receiving the expected behavior of the terminal on the network side. Behavioral information.
  • the method provided in the embodiment of the present application further includes: the data analysis network element sends at least one of identification information and type information of at least two core network element to the user data management network element.
  • the identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side
  • the type information of the core network element is used to indicate that the terminal behavior information expected by the network side corresponds to the core network element Types of. It is convenient for the user data management network element to determine the core network element to which the terminal behavior information expected by the network side is sent.
  • the method provided in the embodiment of the present application further includes: the data analysis network element determines the abnormal type of the terminal according to the terminal behavior information expected by the network side.
  • the data analysis network element sends alarm information indicating the abnormal type of the terminal to the policy control network element. It is convenient for the policy control network element to determine the abnormal type of the terminal, and then take further measures. For example, shut down the network used by abnormal terminals.
  • the method provided in the embodiment of the present application further includes: the data analysis network element receives a second request message sent by the user data management network element for requesting terminal behavior information expected by the network side, and the second request message includes Identification information of multiple terminals.
  • the data analysis network element can obtain the terminal behavior information expected by the network side at the request of the user data management network element.
  • the data analysis network element obtains terminal behavior information of multiple terminals, including: the data analysis network element obtains, from the operation management and maintenance network element, terminals corresponding to multiple terminals on at least two core network element Behavioral information.
  • an embodiment of the present application provides an information sending method, including: a core network element receiving a first request message sent by a data analysis network element to request terminal behavior information corresponding to multiple terminals.
  • the core network element sends terminal behavior information corresponding to the plurality of terminals to the core network element according to the first request message to the data analysis network element.
  • the core network element receives the first request message sent by the data analysis network element, and triggers the first request message to send to the data analysis network element the terminal behavior information corresponding to the multiple terminals at the core network element. In this way, the data analysis network element can obtain more comprehensive terminal behavior information.
  • the first request message includes filtering information used to indicate a collection range of terminal behavior information of each terminal in the multiple terminals.
  • the filtering information includes one or more of the following information: identification information of the terminal, a network area corresponding to the terminal, a terminal type, and a time window.
  • the terminal behavior information includes identification information of the terminal and one or more of the following information corresponding to the terminal: identification information of the core network element, location information, communication start time, communication end time, and packet time Delay, the number of data packets, the size of the data packets, and at least one first type of data of the terminal corresponding to the core network element.
  • the location information corresponding to the terminal includes time and location, where the terminal is located at the location at the time.
  • the core network element may send terminal behavior information corresponding to multiple terminals to the data analysis network element to the data analysis network element through the operation management and maintenance network element.
  • the core network element sends terminal behavior information corresponding to multiple terminals to the core network element to the operation management and maintenance network element, and the operation management and maintenance network element is used to correspond to multiple terminals at the core network element.
  • the terminal's behavior information is sent to the data analysis network element.
  • an embodiment of the present application provides an information processing method, including: a user data management network element receiving data analysis terminal behavior information expected by the network side sent by the data analysis network element; the user data management network element receiving terminal behavior information expected by the network side As user contract data.
  • An embodiment of the present application provides an information processing method.
  • a user data management network element receives data analysis terminal behavior information expected by a network side sent by the data analysis network element, and stores the terminal behavior information expected by the network side as user subscription data of the terminal. This can make the terminal behavior information expected by the network side provided by the data analysis network element more reliable.
  • the method provided in the embodiment of the present application further includes: the user data management network element sends a second request message to the data analysis network element for requesting terminal behavior information expected by the network side, where the second request message includes Identification information of multiple terminals.
  • the terminal behavior information expected by the network side and expected by the network side includes one or more of the following information: stationary indication, terminal movement trajectory, periodic communication indication, communication duration, communication cycle, planned communication time, The maximum data packet transmission delay, the maximum data packet transmission response time, the number of data packet buffers, and at least one second type of data.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of the multiple terminals.
  • the method provided in the embodiment of the present application further includes: the user data management network element receives the first information of the terminal corresponding to the terminal behavior information expected by the network side sent by the data analysis network element,
  • the first information includes identification information of a terminal or identification information of a terminal group.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least two core network elements.
  • the method provided in this embodiment of the present application further includes: the user data management network element receives at least one of identification information and type information of at least two core network network elements sent by the data analysis network element.
  • the identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side
  • the type information of the core network element is used to indicate that the terminal behavior information expected by the network side corresponds to the core network.
  • Network element type is used to indicate that the terminal behavior information expected by the network side corresponds to the core network.
  • the present application provides an information processing apparatus that can implement the first aspect or the method in any possible implementation manner of the first aspect, and therefore can also implement the first aspect or any possible implementation of the first aspect.
  • the information processing device may be a data analysis network element or a device that can support the data analysis network element to implement the first aspect or the method in any possible implementation manner of the first aspect, such as a chip applied to the data analysis network element .
  • the information processing apparatus may implement the above method by software, hardware, or by executing corresponding software by hardware.
  • An information processing apparatus provided in a fourth aspect includes: an acquiring unit for acquiring terminal behavior information of a plurality of terminals; and a determining unit for determining terminal behavior information expected by a network side according to the terminal behavior information.
  • the sending unit is configured to send the behavior information of the terminal expected by the network side to the user data management network element.
  • the obtaining unit is specifically configured to obtain terminal behavior information corresponding to at least two core network network elements of the terminal behavior information from at least two core network network elements.
  • the sending unit is further configured to send, to at least two core network elements, a first request message for requesting terminal behavior information corresponding to multiple terminals on the at least two core network elements.
  • the first request message includes filtering information for indicating a range of terminal behavior information of each terminal in the multiple terminals.
  • the filtering information includes one or more of the following information: identification information of the terminal, a network area corresponding to the terminal, a terminal type, and a time window.
  • the terminal behavior information includes identification information of the terminal and one or more of the following information corresponding to the terminal: identification information of the core network element, location information, communication start time, communication end time, and packet time Delay, the number of data packets, the size of the data packets, and at least one first type of data of the terminal corresponding to the core network element.
  • the location information corresponding to the terminal includes time and location.
  • the location information is used to indicate a specific location where the terminal is located at each time.
  • the location information may be one or more time periods and the location of the terminal corresponding to each of the one or more time periods.
  • the obtaining unit is specifically configured to obtain terminal behavior information corresponding to at least two core network elements in the terminal behavior information from the operation management and maintenance network elements.
  • the terminal behavior information expected by the network side and expected by the network side includes one or more of the following information: stationary indication, terminal movement trajectory, periodic communication indication, communication duration, communication cycle, planned communication time, The maximum data packet transmission delay, the maximum data packet transmission response time, the number of data packet buffers, and at least one second type of data.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of the multiple terminals.
  • the sending unit is further configured to send the first information of the terminal corresponding to the terminal behavior information expected by the network side to the user data management network element, and the first information of the terminal includes the identification information of the terminal or the identification of the terminal group. information.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least two core network elements.
  • the sending unit is further configured to send at least one of identification information and type information of each core network element in at least two core network elements to the user data management network element.
  • the identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side
  • the type information of the core network element is used to indicate that the terminal behavior information expected by the network side corresponds to the core network.
  • Network element type is used to indicate that the terminal behavior information expected by the network side corresponds to the core network.
  • the determining unit is further configured to determine an abnormal type of the terminal according to the terminal behavior information expected by the network side.
  • the sending unit is further configured to send alarm information for indicating the abnormal type of the terminal to the policy control network element.
  • the information processing apparatus further includes: a receiving unit, configured to receive a second request message sent by the user data management network element and used to request terminal behavior information expected by the network side, where the second request message includes multiple Terminal identification information.
  • an embodiment of the present application further provides an information processing apparatus.
  • the information processing apparatus may be a data analysis network element or a chip applied to the data analysis network element.
  • the information processing apparatus includes a processor and A communication interface, where the communication interface is used to support the information processing apparatus to perform the steps of receiving / sending messages / data on the information processing apparatus side described in any one of the first aspect to the first possible implementation manner of the first aspect.
  • the processor is configured to support the information processing apparatus to execute the steps of performing message / data processing on the information processing apparatus side described in any one of the possible implementation manners of the first aspect to the first aspect.
  • the communication interface and the processor of the information processing apparatus are coupled to each other.
  • the information processing apparatus may further include a memory for storing codes and data, and the processor, the communication interface, and the memory are coupled to each other.
  • the present application provides an information sending device that can implement the second aspect or the method in any possible implementation manner of the second aspect, and therefore can also implement the second aspect or any possible implementation of the second aspect.
  • the information sending device may be a core network element, or a device that can support the core network element to implement the second aspect or the method in any possible implementation manner of the second aspect, such as a chip applied to the core network element.
  • the information sending device may implement the foregoing method by using software, hardware, or executing corresponding software by hardware.
  • An information sending device provided by a fifth aspect of the present application includes: a sending unit, configured to send, to a data analysis network element, terminal behavior information corresponding to multiple terminals at the core network element.
  • the method provided in the embodiment of the present application further includes: a receiving unit, configured to receive a first request message sent by the data analysis network element and used to request terminal behavior information corresponding to multiple terminals.
  • the sending unit is specifically configured to send, to the data analysis network element according to the first request message, terminal behavior information corresponding to multiple terminals at the core network element.
  • the first request message includes filtering information used to indicate a range of terminal behavior information of the terminal.
  • the filtering information includes one or more of the following information: identification information of the terminal, a network area corresponding to the terminal, a terminal type, and a time window.
  • the terminal behavior information includes identification information of the terminal and one or more of the following information: identification information of the core network element, location information, communication start time, communication end time, data packet delay, The number of data packets, the size of the data packets, and at least one first type of data of the terminal corresponding to the core network element.
  • the location information corresponding to the terminal includes time and location, where the terminal is located at the location at the time.
  • the sending unit is specifically configured to send terminal behavior information corresponding to multiple terminals at the core network element to the operation management and maintenance network element, and the operation management and maintenance network element is used to send multiple The terminal behavior information corresponding to the terminal at the core network element is sent to the data analysis network element.
  • an embodiment of the present application further provides an information sending device.
  • the information sending device may be a core network element or a chip applied to the core network element.
  • the information sending device includes a processor and A communication interface, where the communication interface is used to support the information sending device to perform the steps of receiving / sending data / data on the information sending device side described in any one of the possible implementation manners of the second aspect to the second aspect.
  • the processor is configured to support the information sending apparatus to perform the steps of performing message / data processing on the information sending apparatus side described in any one of the possible implementation manners of the second aspect to the second aspect.
  • the communication interface of the information sending device and the processor are coupled to each other.
  • the information sending apparatus may further include a memory for storing codes and data, and the processor, the communication interface, and the memory are coupled to each other.
  • the present application provides an information processing apparatus that can implement the third aspect or the method in any possible implementation manner of the third aspect, and therefore can also implement the third aspect or any possible implementation of the third aspect.
  • Beneficial effects in implementation may be a user data management network element, or may be a device that can support the user data management network element to implement the third aspect or the method in any possible implementation manner of the third aspect, for example, is applied to a user data management network element In the chip.
  • the information processing apparatus may implement the above method by software, hardware, or by executing corresponding software by hardware.
  • the information processing apparatus provided in the sixth aspect includes: a sending unit, configured to send a second request message to the data analysis network element for requesting terminal behavior information expected by the network side, where the second request message includes identification information of multiple terminals .
  • the receiving unit is configured to receive terminal behavior information expected by the network side sent by the data analysis network element.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of the multiple terminals.
  • the receiving unit is further configured to receive first information of a terminal corresponding to terminal behavior information expected by a network side sent by a data analysis network element, where the first information of the terminal includes identification information of the terminal or a terminal group Identification information.
  • the terminal behavior information expected by the network side and expected by the network side includes one or more of the following information: stationary indication, terminal movement trajectory, periodic communication indication, communication duration, communication period, and planned communication time. , The maximum packet transmission delay, the maximum packet transmission response time, the number of packet buffers, and at least one second type of data.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least two core network elements.
  • the receiving unit is further configured to receive at least one of identification information and type information of each core network element among the at least two core network elements sent by the data analysis network element.
  • the identification information of the core network element is used to indicate the core network element corresponding to the terminal behavior information expected by the network side
  • the type information of the core network element is used to indicate that the terminal behavior information expected by the network side corresponds to the core network. Network element type.
  • an embodiment of the present application further provides an information processing apparatus.
  • the information processing apparatus may be a user data management network element or a chip applied to the user data management network element.
  • the information processing apparatus includes: A processor and a communication interface, wherein the communication interface is used to support the information processing device to perform message / data reception and transmission on the information processing device side as described in any one of the possible implementation manners of the third aspect to the third aspect A step of.
  • the processor is configured to support the information processing apparatus to execute the steps of performing message / data processing on the information processing apparatus side described in any one of the possible implementation manners of the third aspect to the third aspect.
  • the communication interface and the processor of the information processing apparatus are coupled to each other.
  • the information processing apparatus may further include a memory for storing codes and data, and the processor, the communication interface, and the memory are coupled to each other.
  • an embodiment of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program or an instruction.
  • the computer program or the instruction is run on the computer, the computer executes the first aspect or the first aspect.
  • an embodiment of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program or an instruction.
  • the computer program or the instruction is run on the computer, the computer executes the second aspect or the first aspect.
  • the information sending method described in any one of the two possible implementation manners.
  • an embodiment of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program or an instruction.
  • the computer program or the instruction runs on the computer, the computer executes the third aspect or the first The information processing method described in any one of the three possible implementations.
  • the present application provides a computer program product including instructions that, when run on a computer, causes the computer to execute one or more of the first aspect and various possible implementations of the first aspect.
  • the present application provides a computer program product including instructions that, when run on a computer, causes the computer to perform one or more of the second aspect or various possible implementations of the second aspect.
  • the present application provides a computer program product including instructions that, when run on a computer, causes the computer to execute the third aspect or one or more of the various possible implementations of the third aspect.
  • the present application provides a chip that includes a processor and an interface circuit.
  • the interface circuit is coupled to the processor, and the processor is configured to run a computer program or instructions to implement the first aspect or the various possible aspects of the first aspect.
  • the present application provides a chip.
  • the chip includes a processor and an interface circuit.
  • the interface circuit is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the second aspect or the various possible aspects of the second aspect.
  • the present application provides a chip.
  • the chip includes a processor and an interface circuit.
  • the interface circuit is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the third aspect or various possible implementations of the third aspect.
  • the chip described above in this application may further include at least one memory, and the at least one memory stores instructions or a computer program.
  • an embodiment of the present application provides a communication system including the information processing device described in the fourth aspect and various possible implementation manners of the fourth aspect, and at least two as described in the fifth aspect or The information sending apparatus described in various possible implementations of the fifth aspect, and the information processing apparatus described in various aspects of the sixth aspect or the various possible implementations of the sixth aspect.
  • an embodiment of the present application provides a method for determining abnormality information of a terminal, including: the data analysis network element receives indication information from the first network element for indicating the abnormality of the terminal; the data analysis network element obtains the indication information according to the indication information Terminal behavior information of the terminal on the second network element; the data analysis network element determines abnormal information of the terminal according to the terminal behavior information.
  • the method provided in the embodiment of the present application further includes: the data analysis network element receives from the first network element one or more of the following information corresponding to the terminal: identification information of the terminal, network Area, terminal type, time information, and terminal behavior information of the terminal on the first network element.
  • the method provided in the embodiment of the present application further includes: the data analysis network element obtains terminal behavior information of the terminal on the first network element.
  • the method provided in the embodiment of the present application further includes: the data analysis network element obtains the terminal behavior information of the terminal according to the terminal behavior information of the terminal on the first network element and the terminal behavior information of the terminal on the second network element.
  • the data analysis network element associates the terminal behavior information of the terminal on the first network element and the terminal behavior information of the terminal on the second network element according to the terminal identification information to obtain the terminal behavior information of the terminal.
  • the data analysis network element determines the abnormality information of the terminal according to the terminal behavior information of the terminal.
  • the data analysis network element acquiring terminal behavior information corresponding to the terminal on the second network element according to the instruction information includes: the data analysis network element sends a request message to the second network element.
  • the request message is used to request terminal behavior information of the terminal on the second network element.
  • the data analysis network element receives a response message from the second network element, where the response message includes terminal behavior information of the terminal on the second network element.
  • the request message includes one or more of the following information corresponding to the terminal: identification information of the terminal, network area, terminal type, and time information.
  • the terminal behavior information of the terminal on the second network element includes one or more of the terminal identification information of the terminal and the following information corresponding to the terminal: the first Second network element identification information, location information, communication start time, communication end time, packet delay, packet number, packet size, mobility re-registration frequency information, data network name reachable after DNN failure, geography The number of terminals in the area, the permanent user identifier SUPI-permanent device identifier PEI association update information, roaming status information, and at least one first type of data of the terminal on the second network element.
  • the data analysis network element determines the abnormal information of the terminal according to the terminal behavior data, including: the data analysis network element determines the terminal behavior information of the terminal and the terminal behavior information expected by the network side of the terminal Abnormal information of the terminal.
  • the data analysis network element determines the abnormality information of the terminal according to the terminal behavior data, including: the data analysis network element determines the abnormality of the terminal according to the terminal behavior information of the terminal and the terminal behavior information expected by the network side of the terminal.
  • the information includes: the data analysis network element determines the abnormality of the terminal according to the terminal behavior information of the terminal on the first network element, the terminal behavior information of the terminal on the second network element, and the terminal behavior information expected by the network side of the terminal. information.
  • the method provided in the embodiment of the present application further includes: the data analysis network element obtains the terminal behavior information expected by the network side of the terminal from the application function network element.
  • the method provided in the embodiment of the present application further includes: the data analysis network element obtains the terminal behavior information expected by the network side of the terminal from the application function network element through the network capability open function network element.
  • the abnormality information of the terminal includes one or more of the following information corresponding to the terminal: identification information of the terminal, an abnormality type, an abnormality identification, and an abnormality level.
  • the abnormality identifier is used to identify the abnormality type
  • the abnormality level is used to indicate the degree or size of the abnormality type.
  • the method provided in the embodiment of the present application further includes: the data analysis network element sends abnormal information of the terminal to the third network element, and the abnormal information is used for policy control of the terminal.
  • an embodiment of the present application provides a method for determining terminal abnormality information.
  • the method includes: a first network element determining that the terminal is abnormal.
  • the first network element sends instruction information to the data analysis network element, the instruction information is used to indicate that the terminal is abnormal;
  • the data analysis network element receives the instruction information from the first network element;
  • the data analysis network element obtains the terminal in the second network according to the instruction information Terminal behavior information on the element; the data analysis network element determines the abnormal information of the terminal according to the terminal behavior information.
  • the method provided in the embodiment of the present application further includes: the data analysis network element sends the abnormal information of the terminal to the third network element; the third network element receives the abnormal information from the data analysis network element, so The third network element performs policy control on the terminal according to the abnormal information.
  • the first network element may be any one or more of a session management network element, a mobility management network element, a user plane network element, a policy control network element, or a user data management network element.
  • the second network element may be any one or more of a session management network element, a mobility management network element, a user plane network element, a policy control network element, or a user data management network element.
  • the first network element and the second network element may be the same network element or different network elements.
  • the third network element may be an application function network element or a policy control network element.
  • the first network element determining that the terminal is abnormal includes: the first network element according to terminal behavior information expected by the terminal on a network side of the first network element and the terminal in the first The terminal behavior information on a network element determines that the terminal is abnormal.
  • the terminal behavior information of the terminal on the second network element includes: a terminal identifier of the terminal and one or more of the following information corresponding to the terminal: identification information, location information, and communication of the second network element Start time, communication end time, data packet delay, data packet number, data packet size, mobility re-registration frequency information, data network name reachable after failure of DNN, number of terminals in geographic area, permanent user identification SUPI-
  • the permanent device identifies PEI association update information, roaming status information, and at least one first type of data of the terminal on the second network element.
  • the present application provides a device for determining terminal abnormality information.
  • the device for determining terminal abnormality information can implement the method in the seventeenth aspect or any possible implementation manner of the seventeenth aspect, and therefore can also implement the first The beneficial effects in the seventeenth aspect or any possible implementation manner of the seventeenth aspect.
  • the device for determining the abnormality information of the terminal may be a data analysis network element, or may be a device that can support the data analysis network element to implement the method in the seventeenth aspect or any possible implementation manner of the seventeenth aspect, for example, applied to data analysis.
  • the apparatus for determining abnormal information of a terminal may implement the foregoing method by using software, hardware, or executing corresponding software by hardware.
  • the apparatus for determining abnormality information of a terminal includes: a receiving unit, configured to receive indication information from a first network element that is used to indicate abnormality of the terminal.
  • the receiving unit is configured to obtain terminal behavior information of the terminal on the second network element according to the instruction information.
  • the processing unit is configured to determine abnormal information of the terminal according to the terminal behavior information.
  • the receiving unit is further configured to receive one or more of the following information corresponding to the terminal from the first network element: identification information of the terminal, network area, terminal type, time information, and mobility re-registration Frequency information, reachability after DNN failure, number of terminals in a geographic area, SUPI-PEI association update information, roaming status information, terminal behavior information of the terminal on the first network element.
  • the receiving unit is further configured to obtain terminal behavior information of the terminal on the first network element.
  • the processing unit is further configured to associate the terminal behavior information of the terminal according to the terminal behavior information of the terminal on the first network element and the terminal behavior information of the terminal on the second network element.
  • the apparatus for determining abnormality information of a terminal further includes: a sending unit, configured to send a request message to a second network element.
  • the request message is used to request terminal behavior information of the terminal on the second network element.
  • the receiving unit is specifically configured to receive a response message from the second network element, where the response message includes terminal behavior information of the terminal on the second network element.
  • the request message includes one or more of the following information corresponding to the terminal: identification information of the terminal, network area, terminal type, and time information.
  • the terminal behavior information of the terminal on the second network element includes: a terminal identifier of the terminal and one or more of the following information corresponding to the terminal: identification information and location information of the second network element , Communication start time, communication end time, data packet delay, data packet number, data packet size, mobility re-registration frequency information, data network name reachable after failure of DNN, number of terminals in geographic area, permanent user identification SUPI-permanent device identification PEI association update information, roaming status information, and at least one first type of data of the terminal on the second network element.
  • the processing unit is specifically configured to determine abnormal information of the terminal according to the terminal behavior data of the terminal and the terminal behavior information expected by the network side.
  • the processing unit is specifically configured to associate the terminal behavior information of the terminal with the terminal behavior information of the terminal on the first network element and the terminal behavior information of the terminal on the second network element and the network side expectation.
  • the terminal behavior information determines abnormal information of the terminal.
  • the receiving unit is further configured to obtain terminal behavior information expected by a network side of the terminal from an application function network element.
  • the receiving unit is further configured to obtain terminal behavior information expected by a network side of the terminal from an application function network element through a network capability open function network element.
  • the abnormality information of the terminal includes one or more of the following information corresponding to the terminal: identification information of the terminal, an abnormality type, an abnormality identification, and an abnormality level.
  • the abnormality identifier is used to identify an abnormality type
  • the abnormality level is used to indicate the degree or size of the abnormality type.
  • the sending unit is further configured to send abnormal information of the terminal to the third network element.
  • an embodiment of the present application further provides a device for determining terminal abnormality information.
  • the device for determining terminal abnormality information may be a data analysis network element or a chip applied to the data analysis network element.
  • the determining device includes: a processor and a communication interface, where the communication interface is configured to support the abnormality information of the terminal, and execute the abnormality in the terminal described in any one of the seventeenth aspect to the seventeenth possible implementation manner.
  • the processor is configured to support the information processing apparatus to execute the steps of performing message / data processing on the apparatus for determining the abnormality information of the terminal, as described in any one of the possible implementation manners of the seventeenth aspect to the seventeenth aspect.
  • the communication interface and the processor of the apparatus for determining terminal abnormality information are coupled to each other.
  • the apparatus for determining abnormality information of a terminal may further include a memory, configured to store code and data, and the processor, the communication interface, and the memory are coupled to each other.
  • the present application provides a communication system including a first network element, a data analysis network element that communicates with the first network element, and a second network element that communicates with the data analysis network element.
  • the first network element is used to determine the abnormality of the terminal and is used to send instruction information to the data analysis network element, the instruction information is used to indicate the abnormality of the terminal;
  • the data analysis network element is used to receive the instruction information from the first network element, and Obtaining terminal behavior information of the terminal on the second network element according to the instruction information.
  • the data analysis network element is also used to determine abnormal information of the terminal according to the terminal behavior information.
  • the first network element may be any one or more of a session management network element, a mobility management network element, or a user data management network element.
  • the communication system further includes a third network element that communicates with the data analysis network element, and the data analysis network element is further configured to send the abnormal information of the terminal to the third network element.
  • the third network element is configured to receive abnormal information from the data analysis network element, and to perform policy control on the terminal according to the abnormal information.
  • the third network element may be an application function network element or a policy control network element.
  • the first network element is used to determine the abnormality of the terminal, and specifically includes: the first network element is used to determine the terminal behavior information expected by the terminal on the network side of the first network element and the terminal on the first network element. The behavior information of the terminal on the terminal determines that the terminal is abnormal.
  • the first network element is further configured to send one or more of the following information corresponding to the terminal to the data analysis network element: identification information of the terminal, network area, terminal type, and time information. Terminal behavior information on a network element.
  • an embodiment of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program or an instruction.
  • the computer program or the instruction is run on the computer, the computer executes the seventeenth The method for determining terminal abnormality information described in any one of the possible implementation manners of the aspect or the seventeenth aspect.
  • an embodiment of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program or an instruction.
  • the computer program or the instruction runs on the computer, the computer executes the eighteenth embodiment.
  • the method for determining terminal abnormality information described in any one of the possible implementation manners of the aspect or the eighteenth aspect.
  • the present application provides a computer program product including instructions that, when run on a computer, causes the computer to execute one or more of the seventeenth aspect and various possible implementations of the seventeenth aspect. .
  • the present application provides a computer program product including instructions that, when run on a computer, causes the computer to execute one or more of the eighteenth aspect or various possible implementations of the eighteenth aspect. .
  • the present application provides a chip including a processor and an interface circuit.
  • the interface circuit is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the seventeenth aspect or each of the seventeenth aspect.
  • the present application provides a chip that includes a processor and an interface circuit.
  • the interface circuit is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the eighteenth aspect or the eighteenth aspect.
  • FIG. 1 is a schematic diagram of a communication system architecture according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a 5G network according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application
  • FIG. 4 is a schematic flowchart of an interaction between an information processing method and an information sending method according to an embodiment of the present application
  • FIG. 5 is a schematic diagram of information processing provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application
  • FIG. 7 is a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application
  • FIG. 8 is a schematic flowchart of an interaction between an information processing method and an information sending method according to an embodiment of the present application
  • FIG. 9 is a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application.
  • FIG. 10 is a schematic flowchart of an information processing method according to an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of an information processing method according to an embodiment of the present application.
  • FIG. 12 is a schematic flowchart of an information processing method according to an embodiment of the present application.
  • FIG. 13 is a schematic flowchart of a method for determining abnormal terminal information according to an embodiment of the present application.
  • FIG. 14 is a schematic flowchart of a method for determining abnormal terminal information according to an embodiment of the present application.
  • 15 is a schematic flowchart of a method for determining abnormal terminal information according to an embodiment of the present application.
  • 16 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application.
  • FIG. 19 is a schematic structural diagram of an information sending apparatus according to an embodiment of the present application.
  • 20 is a schematic structural diagram of an information sending apparatus according to an embodiment of the present application.
  • 21 is a schematic structural diagram of an information sending apparatus according to an embodiment of the present application.
  • 22 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application.
  • FIG. 23 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application.
  • FIG. 24 is a schematic structural diagram of an information processing apparatus according to an embodiment of the present application.
  • FIG. 25 is a schematic structural diagram of a device for determining abnormal terminal information according to an embodiment of the present application.
  • FIG. 26 is a schematic structural diagram of a device for determining abnormal terminal information according to an embodiment of the present application.
  • FIG. 27 is a schematic structural diagram of a chip according to an embodiment of the present application.
  • words such as “first” and “second” are used to distinguish the same or similar items having substantially the same functions and functions.
  • the first core network element and the second core network element are only used to distinguish different core network elements, and their sequence is not limited.
  • the words “first”, “second” and the like do not limit the number and execution order, and the words “first” and “second” are not necessarily different.
  • the network architecture and service scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that with the network The evolution of the architecture and the emergence of new business scenarios. The technical solutions provided in the embodiments of the present application are also applicable to similar technical issues.
  • At least one means one or more, and “multiple” means two or more.
  • “And / or” describes the association relationship of related objects, and indicates that there can be three kinds of relationships, for example, A and / or B can represent: the case where A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the related objects are an "or” relationship.
  • “At least one or more of the following” or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one (a), a, b, or c can be expressed as: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • CDMA code division multiple access
  • TDMA time division multiple access
  • FDMA frequency division multiple access
  • OFDMA orthogonal frequency-division multiple access
  • SC-FDMA single carrier frequency division multiple access
  • CDMA2000 can cover the Interim Standard (IS) 2000 (IS-2000), IS-95 and IS-856 standards.
  • the TDMA system can implement wireless technologies such as the Global System for Mobile Communication (GSM).
  • GSM Global System for Mobile Communication
  • OFDMA system can implement e.g. evolved universal UTRA (E-UTRA), ultra mobile broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash OFDMA And other wireless technologies.
  • E-UTRA evolved universal UTRA
  • UMB ultra mobile broadband
  • Wi-Fi IEEE 802.11
  • WiMAX IEEE 802.16
  • UTRA and E-UTRA are UMTS and UMTS evolved versions.
  • 3GPP is a new version of UMTS using E-UTRA in long term evolution (LTE) and various versions based on LTE evolution.
  • LTE long term evolution
  • NR New Radio
  • the communication system may also be applicable to future-oriented communication technologies, and both are applicable to the technical solutions provided in the embodiments of the present application.
  • FIG. 1 is a schematic structural diagram of a communication system to which an information processing method and an information sending method according to an embodiment of the present application are applied.
  • the communication system includes: a user data management network element 101, at least two core network elements (only two core network elements are shown in FIG. 1, for example, the first core network element 102 and The second core network element 103 is taken as an example. It can be understood that in the actual process, there may be more than two core network elements), a data analysis network element 104, and a policy control (PCF) network element 107.
  • PCF policy control
  • the at least two core network elements may be one or more of the control plane network elements of the core network.
  • at least two core network elements may be any two of the session management function (SMF) network elements and access and mobility management function (AMF) network elements.
  • SMS session management function
  • AMF access and mobility management function
  • one or more of the user data management network element 101, the at least two core network network elements, the data analysis network element 104, and the policy control network element 107 may be virtual network elements. Elements can communicate by way of service operations. One or more of the user data management network element 101, the at least two core network elements, the data analysis network element 104, and the policy control network element 107 may be virtual network elements. In another possible implementation manner, one or more of the user data management network element 101, the at least two core network elements, the data analysis network element 104, and the policy control network element 107 may be physical network elements. Elements are connected through existing standardized interfaces.
  • the communication system may further include one or more terminals (for example, two terminals are taken as an example in FIG. 1, and the two terminals are the first terminal 105 and the second terminal 106). .
  • the one or more terminals are connected to the core network element in a wired or wireless manner.
  • the terminals may be distributed throughout the communication network, and each terminal may be static or mobile.
  • At least two core network elements are used to provide data analysis network element 104 with each terminal of a plurality of terminals corresponding to terminal behavior information on at least two core network elements.
  • the first core network element 102 is configured to provide the data analysis network element 104 with terminal behavior information corresponding to the first terminal 105 and the second terminal 106 on the first core network element 102, respectively.
  • the PCF network element 107 is used to send or receive signaling or data with the AF network element or the SMF network element, and may also be used to receive data analysis results from the data analysis network element, such as the type of abnormality of the terminal.
  • control plane network element in the 4G network element may be a mobility management entity (MME).
  • MME mobility management entity
  • the network element corresponding to the data analysis network element 104 may be a network data analysis function (NWDAF) network element.
  • NWDAAF network data analysis function
  • the network element corresponding to the at least two core network network elements may be any two different network elements among the following multiple network elements: for example, a 5G system network function (5G System Function).
  • the at least two core network elements may be any two of an SMF network element and an AMF network element.
  • the user data management network element 101 may be any one of a unified data management (UDM) network element, a user data warehouse (UDR) network element, and a user home server (HSS) network element. .
  • UDM unified data management
  • UDR user data warehouse
  • HSS user home server
  • the first core network element 102 is an AMF network element
  • the second core network element 103 is an SMF network element.
  • the 5G network may further include an application function (AF) network element, a user plane function (UPF), and an access device (for example, an access network (access network, AN)), authentication server function (AUSF) network element, network slice selection function (NSSF) network element, network capability open function (NEF) network element, network warehouse storage Function (network, function, NRF) network element, data network (DN), operation management and maintenance (operation, maintenance, and maintenance (OAM) network element (also referred to as operation management and maintenance network element), etc.
  • AF application function
  • UPF user plane function
  • an access device for example, an access network (access network, AN)
  • AUSF authentication server function
  • NSSF network slice selection function
  • NEF network capability open function
  • NRF network warehouse storage Function
  • DN data network
  • OAM operation management and maintenance
  • OAM operation management and maintenance network element
  • the OAM network element can cover the network elements of the access network and the core network, and data can be collected from these network elements of the access network and the core network, and the OAM network element in the embodiment of the present application can also Collect terminal behavior data corresponding to terminals on each core network element.
  • the terminal communicates with the AMF network element through an N1 interface (referred to as N1).
  • the AMF network element communicates with the SMF network element through the N11 interface (referred to as N11).
  • the SMF network element communicates with one or more UPF network elements through an N4 interface (referred to as N4). Any two UPF network elements in one or more UPF network elements communicate through an N9 interface (referred to as N9 for short).
  • the UPF network element communicates with a data network (DN) through an N6 interface (referred to as N6).
  • the terminal accesses the network through an access device (for example, a RAN device).
  • the access device communicates with the AMF network element through an N2 interface (N2 for short).
  • the SMF network element communicates with the PCF network element through the N7 interface (referred to as N7), and the PCF network element communicates with the AF network element through the N5 interface.
  • the access device communicates with the UPF network element through an N3 interface (referred to as N3). Any two or more AMF network elements communicate through an N14 interface (referred to as N14 for short).
  • the SMF network element communicates with the UDM network element through the N10 interface (referred to as N10).
  • the AMF network element communicates with the AUSF network element through the N12 interface (referred to as N12 for short).
  • the AUSF network element communicates with the UDM network element through the N13 interface (referred to as N13).
  • the AMF network element communicates with the UDM network element through the N8 interface (referred to as N8).
  • the 3rd AF network element and the operator AF belong to the AF network element.
  • the 3rd AF network element such as WeChat service server and Alipay payment service server
  • the operator AF network element for example, proxy-call session control function in IP multimedia system) Call control (P-CSCF) network element
  • P-CSCF proxy-call session control function in IP multimedia system Call control
  • interface names between the various network elements in FIG. 2 are only examples, and the interface names may be other names in specific implementations, which are not specifically limited in this embodiment of the present application.
  • the access device, AF network element, AMF network element, SMF network element, AUSF network element, UDM network element, UPF network element and PCF network element in FIG. 2 are only a name, and the name does not belong to the device itself. Composition limitation. In the 5G network and other networks in the future, the network element corresponding to the access device, AF network element, AMF network element, SMF network element, AUSF network element, UDM network element, UPF network element, and PCF network element may also be other The name is not specifically limited in the embodiment of the present application.
  • the UDM network element may also be replaced with a user home server (HSS), a user subscription database (USD), or a database entity, etc., which will be described collectively here, and will not be described later. .
  • the access device referred to in the embodiment of the present application refers to a device that accesses a core network, and may be, for example, a base station, a broadband network service gateway (BNG), an aggregation switch, and a non-third generation Partner project (3rd generation partnership project, 3GPP) access equipment, etc.
  • the base station may include various forms of base stations, such as: macro base stations, micro base stations (also called small stations), relay stations, access points, and the like.
  • the AMF network element involved in the embodiment of the present application may also be responsible for functions such as registration management, mobility management, and lawful interception, which are not specifically limited in the embodiment of the present application.
  • the SMF network elements involved in the embodiments of the present application are used for session management, including: session establishment, session modification, session release, and Internet Protocol (IP) address allocation of terminals' networks. And management, UPF network element selection and control, legal monitoring and other session-related control functions.
  • session management including: session establishment, session modification, session release, and Internet Protocol (IP) address allocation of terminals' networks.
  • IP Internet Protocol
  • the UPF network elements involved in the embodiments of the present application can also implement a serving gateway (SGW) and a packet data network gateway (packet data). network gateway (PGW).
  • SGW serving gateway
  • PGW packet data network gateway
  • PGW packet data network gateway
  • the UPF network element may also be a software-defined network (SDN) switch, which is not specifically limited in the embodiment of the present application.
  • SDN software-defined network
  • the AUSF network element involved in the embodiment of the present application is used to perform authentication and authentication on the terminal based on user subscription data of the terminal.
  • the UDM network elements involved in the embodiments of the present application are used to store user subscription data.
  • the UDM network element also includes functions such as authentication and authentication, processing user identification, and contract management, which are not specifically limited in this embodiment of the present application.
  • the PCF network elements involved in the embodiments of the present application are also used to provide policy rules and support a unified policy architecture to manage network behaviors and other policy-related functions.
  • the user plane function network element in FIG. 2 may be implemented by one device, or may be implemented by multiple devices, or may be a logical function module in one device, which is not specifically limited in the embodiment of the present application.
  • the SMF network element is used to reassign the UPF network element to the terminal based on the location information of the terminal or the characteristics of the data sent by the terminal or the location information between the UPF network element and the terminal. Newly allocated sessions between UPF network elements, thus improving the reconstructed session can optimize the user plane.
  • the access device is used to provide data services for the terminal, for example, receiving data sent by the terminal, or sending data to the terminal.
  • the access device may be a base station.
  • a base station may be a device that communicates with a user equipment (UE) or other communication site such as a relay station, and the base station may provide communication coverage of a specific physical area.
  • UE user equipment
  • the PCF network element is used to receive service information from the AF network element, generate and distribute QoS parameters corresponding to the service flow based on the service information, and can also be used to receive data analysis results from the NWDAF network element, and take corresponding measures based on the data analysis results, such as Receive the abnormal type of the terminal from the NWDAF network element and shut down the network to service the terminal with one click.
  • the AF network element can be used to provide the UDM network element with terminal behavior information expected by a third party or a service server. Specifically, the AF network element initiates the Nnef_ParameterProvision_Update Request service operation to the NEF network element, and provides the NEF network element with the terminal behavior data expected by the third party or service server of each of the one or more terminals of the terminal.
  • the Nnef_ParameterProvision_Update Request service operation carries the identification information of the terminal and the Transaction reference ID.
  • the Transaction reference ID is used to identify an interaction request between the AF network element and the NEF network element.
  • the NEF network element first determines whether the Nnef_ParameterProvision_Update Request service operation sent by the AF network element is legal. In the case where the NEF network element determines that the Nnef_ParameterProvision_Update Request service operation is legal, the NEF network element sends a Nudm_ParameterProvision_Update Request service operation to the UDM network element and provides the UDM network element with one or more third party or service server terminal behaviors expected by the AF network element information.
  • the Nudm_ParameterProvision_Update Request service operation also carries a NEF reference ID, which is used to identify an interaction request between the NEF network element and the UDM network element.
  • the UDM network element first authenticates whether the request of the AF network element is valid. If the request is valid, the UDM network element first maps the identification information of the terminal (for example, mapping the identification information of the terminal from GPSI to SUPI). Or terminal behavior data expected by multiple third parties or service servers is used as part of the user contract data of each terminal. It also initiates a Nudr_DM_Update Request service operation to the UDR network element, requesting to update and store to the UDR network element the terminal behavior data expected by a third party or service server from one or more terminals of the AF network element.
  • the UDM network element first maps the identification information of the terminal (for example, mapping the identification information of the terminal from GPSI to SUPI). Or terminal behavior data expected by multiple third parties or service servers is used as part of the user contract data of each terminal. It also initiates a Nudr_DM_Update Request service operation to the UDR network element, requesting to update and store to the UDR network element the terminal behavior data expected by a third party or service server from one or more terminal
  • the UDR network element parses or maps GPSI to SUPI, and stores terminal behavior data expected by a third party or service server of one or more terminals of the AF network element as the user subscription data of each of the one or more terminals. .
  • the UDR network element then initiates the Nudm_DM_UpdateResponse service operation to the UDM. If the UDR network element cannot parse or map the GPSI to SUPI, the Nudm_DM_UpdateResponse service operation indicates that the UDM terminal behavior data provision fails and carries the cause value.
  • the UDM network element determines that the request of the AF network element is illegal, the UDM network element initiates the Nudm_ParameterProvision_UpdateResponse service operation to the NEF network element, and indicates in the Nudm_ParameterProvision_UpdateResponse service operation that the provision of terminal behavior data expected by the third party or service server fails, and carries the terminal behavior data expectation, and carries the Reason value.
  • the NEF network element determines that the Nnef_ParameterProvision_Update Request service operation is illegal, the NEF network element initiates the Nnef_ParameterProvision_UpdateResponse service operation to the AF network element, and the Nnef_ParameterProvision_UpdateResponse service operation indicates that the terminal behavior data provision fails and carries the cause value.
  • the DN is used for external networks that provide data services.
  • the NWDAF network element is used to collect terminal behavior information corresponding to a terminal on a different core network element, where the terminal behavior information may include terminal identification information and terminal behavior information. Then, the terminal behavior information corresponding to the terminal on the different core network element is associated with the terminal identification information to obtain the terminal behavior information corresponding to the terminal.
  • the terminal behavior information includes at least terminal behavior information corresponding to terminals on different core network elements.
  • the NWDAF network element is also used to analyze terminal behavior information corresponding to multiple terminals to obtain terminal behavior information expected by the network side. And send the terminal behavior information expected by the network side to the user data management network element.
  • the NWDAF network element is further used to send at least two core network elements to the user data management network element. Identification information or type information of each core network element.
  • the data analysis network element may obtain the terminal behavior information expected by the third party of the terminal or the service server from the AF network element, and then may obtain the terminal behavior information expected by the network side through the above analysis to the terminal expected by the third party or the service server. The behavior information is verified.
  • the data analysis network element finds that the terminal behavior information expected by the third party or the service server is inconsistent with the terminal behavior information expected by the network side, it can update the terminal behavior information expected by the network side as expected by the third party or the service server.
  • Terminal behavior information send the updated terminal behavior information expected by the third party or the service server (that is, the terminal behavior information expected by the network side obtained by the data analysis network element analysis) to the user data management network element to store the contracted data as the terminal It can also warn the user management data network element that the third party or service server expects terminal behavior information to be unreliable.
  • the data analysis network element cannot obtain the terminal behavior information expected by the third party of the terminal or the service server from the AF network element.
  • the user data management network element may verify the terminal behavior information expected by the third party or the service server that obtained the terminal from the AF network element, and when the user data management network element discovers the terminal behavior information expected by the third party or the service server and the network side expectation
  • the user data management network element may update the terminal behavior information expected by the network side to be the terminal behavior information expected by the third party or the service server, and update the terminal behavior information expected by the third party or the service server (i.e.
  • the data analysis network element analysis obtains terminal behavior information expected by the network side) and stores contract data as the terminal.
  • the data analysis network element may also obtain terminal behavior information of the terminal from a terminal, a radio access network (RAN) network element, an OAM network element, or another server.
  • the data analysis network element is used to analyze and obtain the terminal behavior information expected by the network side according to the terminal behavior information of the terminal.
  • Table 1 shows the terminal behavior data related information collected by the NWDAF network element from the 5GC NF or the Radio Access Network (RAN):
  • At least one first type of terminal behavior data on the AMF network element, the SMF network element, the UPF network element, and the RAN network element is terminal behavior data that can be identified or used by the AMF network element or the SMF network element.
  • each first type of data may be subjected to normalization processing, where the normalization processing mainly uses a maximum-minimum normalization method, a Z-Score normalization method, etc.
  • the physical data values of the data types are mapped to a fixed numerical space. This process facilitates on the one hand the speed of model training convergence during the analysis of big data, and on the other hand provides a way of transmitting characteristic data.
  • the identification information of the terminal in the embodiment of the present application may be one or more of the following: an internet protocol address (IP), a subscription permanent identifier (SUPI), and a permanent equipment identifier (permanent equipment identifier) , PEI), generic public subscription identifier (GPSI), international mobile subscriber identifier (IMSI), international mobile equipment identity (IMEI), IP five-tuple (5 -tuple) and mobile station international integrated service digital network number (MSISDN).
  • IP internet protocol address
  • SUPI subscription permanent identifier
  • PEI permanent equipment identifier
  • GPSI generic public subscription identifier
  • IMSI international mobile subscriber identifier
  • IMEI international mobile equipment identity
  • IP five-tuple 5 -tuple
  • MSISDN mobile station international integrated service digital network number
  • Table 2 shows related content of terminal behavior information expected by the network side in the embodiment of the present application.
  • the terminal behavior data expected by the network side of at least one second type of data on the AMF network element is the terminal behavior data expected by the network side that the AMF network element (SMF network element) can recognize or can use.
  • each second type of data in the at least one second type of data may be subjected to a normalization process, where the normalization process may use a maximum-minimum normalization method and a Z-Score normalization
  • the method of mapping maps the physical data values of each data type to a fixed numerical space. This process facilitates on the one hand the speed of model training convergence during the analysis of big data, and on the other hand provides a way of transmitting characteristic data.
  • the first type and the second type in the embodiments of the present application may be the same or different.
  • the first type is various types of terminal behavior data obtained by the data analysis network element from the core network element, the RAN network element, or the terminal
  • the second type is the data analysis network element combining the core network element and the RAN network.
  • the terminal in this application may also be referred to as terminal equipment, user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, A user terminal, a wireless communication device, a user agent, or a user device.
  • UE user equipment
  • the terminal can be a station (STA) in a wireless local area network (WLAN), a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (wireless local loop) , WLL) stations, personal digital processing (PDA) devices, handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, and next-generation communication systems, such as , A terminal device in a fifth-generation (5G) communication network or a terminal in a future evolved public land mobile network (PLMN) network.
  • 5G fifth-generation
  • PLMN future evolved public land mobile network
  • the terminal may also be a wearable device.
  • Wearable devices can also be referred to as wearable smart devices, which are the general name for applying wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes.
  • a wearable device is a device that is worn directly on the body or is integrated into the user's clothing or accessories. Wearable devices are not only a hardware device, but also powerful functions through software support, data interaction, and cloud interaction.
  • Broad-spectrum wearable smart devices include full-featured, large-sized, full or partial functions that do not rely on smart phones, such as smart watches or smart glasses, and only focus on certain types of application functions, and need to cooperate with other devices such as smart phones Use, such as smart bracelets, smart jewelry, etc. for physical signs monitoring.
  • an information processing method in the embodiments of the present application may be executed by a data analysis network element, and may also be executed by a device (for example, a chip) applied to the data analysis network element.
  • a method for transmitting information may be performed by a network element, and may also be performed by a device (for example, a chip) applied to the network element.
  • Another information processing method may be performed by a user data management network element, and may also be performed by a device (for example, a chip) applied to the user data management network element.
  • the following embodiments will be described by taking an information processing method executed by a data analysis network element, an information transmission method executed by a core network element, and another information processing method executed by a user data management network element.
  • FIG. 3 shows a schematic flowchart of interaction between an information processing method and an information sending method according to an embodiment of the present application.
  • the method includes:
  • the data analysis network element obtains terminal behavior information of multiple terminals.
  • the terminal behavior information of the multiple terminals may be terminal behavior information of each terminal among the multiple terminals.
  • the terminal behavior information of a terminal includes identification information of the one terminal and terminal behavior data corresponding to the terminal associated with the terminal identification information.
  • the terminal behavior data can refer to the description in Table 1 above, for example, the terminal's location information, communication start time, communication end time, data packet delay, data packet size, number of data packets, etc., here I won't go into details.
  • S101 may be specifically implemented in the following manner:
  • the data analysis network element obtains terminal behavior information corresponding to at least two core network elements from among at least two core network elements from the at least two core network elements.
  • the data analysis network element obtains terminal behavior information (including terminal identification information and terminal behavior data) corresponding to each terminal of the multiple terminals on each core network element of the at least two core network elements. Then, the data analysis network element correlates terminal behavior data of each terminal on each core network element according to the identification information of each terminal, and obtains terminal behavior information corresponding to each terminal.
  • the terminal behavior information corresponding to a terminal includes at least identification information of the terminal and terminal behavior information corresponding to the terminal on each of the core network elements of the at least two core network elements.
  • the data analysis network element can obtain the terminal behavior corresponding to the terminal 1 on the AMF network element from the AMF network element.
  • Information 1 includes identification information of the terminal 1 and location information (including time and location) on the AMF network element.
  • the data analysis network element may also obtain the terminal behavior information 2 of the terminal 1 on the SMF network element from the SMF network element.
  • the terminal behavior information 2 includes identification information of the terminal 1, communication mode information (communication start time and communication end time) on the SMF network element, and network configuration information (upstream or downstream data packet delay, size, and number). Then the data analysis network element associates the terminal behavior information 1 on the AMF network element and the terminal behavior information 2 on the SMF network element through the identification information of the terminal 1 to obtain the terminal behavior information corresponding to the terminal 1. .
  • the terminal behavior data corresponding to the same terminal on different core network elements may be the same or different.
  • the data analysis network element may also obtain the terminal from the terminal, the wireless access network element, and the application function network element on the terminal itself, the wireless access network element, and the application function network element. Corresponding terminal behavior information.
  • each core network element proposes a need to analyze the above reasons, so that each core network element collects terminal behavior information corresponding to the terminal from the respective network element, as another possible embodiment of this application, as shown in FIG. 4
  • the method provided in the embodiment of the present application further includes:
  • the data analysis network element sends a first request message to each core network element in at least two core network elements (the first core network element and the second core network element are taken as an example in FIG. 4).
  • a request message is used to request terminal behavior information on the core network element corresponding to multiple terminals.
  • the first request message carries filtering information, and the filtering information is used to indicate a range of terminal behavior information of each terminal in the multiple terminals.
  • the filtering information includes one or more of the following information: identification information of the terminal, a network area corresponding to the terminal, a terminal type, and a time window.
  • the filtering information includes the network area and terminal type corresponding to the terminal.
  • the time window is used by the core network element to determine and collect terminal behavior information of the terminal within a specified time period.
  • the time window is from March 1, 2018 to March 8, 2018.
  • the core network element can determine the need to collect terminal behavior information on the core network element corresponding to the terminal from March 1, 2018 to March 8, 2018.
  • the network area is used by the core network element to determine and collect terminal behavior information of the terminal in the specified area.
  • TA tracking area
  • RA routing area
  • RA list routing area
  • the filtering information when the filtering information includes identification information of a terminal, a network area, and a terminal type, the filtering information is used to instruct a core network element to collect terminal identification information indicated by the terminal, and the terminal behavior of the terminal type specified in the specified network area information.
  • the filtering information when the filtering information includes the identification information of the terminal, the network area, and the time window, the filtering information is used to instruct the core network element to collect the terminals indicated by the identification information of the terminals within the specified time window within the specified network area. Behavioral information.
  • At least two core network elements receive the first request message.
  • each of the at least two core network elements receives the first request message.
  • At least two core network elements send terminal behavior information corresponding to multiple terminals on the respective core network element to the data analysis network element according to the first request message.
  • each of the at least two core network elements may send a response message to the data analysis network element for the first request message, and the response message carries multiple terminals corresponding to the respective core network element. Terminal behavior information.
  • a core network element sends to the data analysis network element the terminal behavior information of at least one of the multiple terminals on the core network element.
  • the AMF network element sends terminal behavior information of at least one terminal on the AMF network element to the data analysis network element.
  • the terminal behavior information includes identification information of the terminal and one or more of the following information corresponding to the terminal: identification information of the core network element, location information, communication start time, communication end time, data packet delay, and data packet.
  • identification information of the core network element identification information of the core network element
  • location information location information
  • communication start time communication start time
  • communication end time communication end time
  • data packet delay data packet.
  • the name of the information obtained by the data analysis network element (for example, terminal behavior information) in the embodiment S101 of the present application is only an example, and the name of the terminal behavior information in the specific implementation may be other names, for example, user behavior information
  • the behavior information or the terminal information is not specifically limited in this embodiment of the present application.
  • Those skilled in the art can understand that in an actual process, if one piece of information includes identification information of a terminal and one or more of the foregoing information corresponding to the terminal, it can be understood as terminal behavior information in the embodiment of the present application.
  • the terminal behavior information on the core network element corresponding to multiple terminals reported by a core network element includes identification information of the multiple terminals and terminal behavior data corresponding to each of the multiple terminals.
  • the terminal behavior data may refer to the description in Table 1 above.
  • the terminal behavior information reported by the AMF network element includes identification information of the terminal and one or more of the following information: location information (including time and location).
  • the terminal behavior information reported by the SMF network element includes one or more of the following information: communication start time, communication end time, data packet delay, number of data packets, The packet size.
  • each core network element sends terminal behavior information corresponding to multiple terminals to the respective core network element to the operation management and maintenance network element according to the first request message.
  • the operation management and maintenance network element sends terminal behavior information corresponding to multiple terminals on each core network element to the data analysis network element.
  • S101 in the embodiment of the present application may also be implemented in the following manner:
  • the data analysis network element obtains, from the operation management and maintenance network element, multiple terminals corresponding to each terminal on at least two core network element. Terminal behavior information.
  • the data analysis network element sends a first request message to the operation management and maintenance network element, and the operation management and maintenance network element sends the data analysis network element to the data analysis network element at least two corresponding to each terminal according to the first request message. Terminal behavior information on core network elements.
  • the terminal behavior information on at least two core network elements corresponding to each terminal provided by the operation management and maintenance network element to the data analysis network element may be stored in the operation management and maintenance network element or may be After receiving the first request message, the operation management and maintenance network element obtains the request from at least two core network element.
  • the process of the operation management and maintenance network element requesting terminal behavior information from at least two core network elements can refer to the process in S1012-S1014 above, and the data analysis network element can be replaced with the operation management and maintenance network element. .
  • the data analysis network element determines the terminal behavior information expected by the network side according to the terminal behavior information.
  • the data analysis network element determines the terminal behavior information expected by the network side according to the terminal behavior information of each terminal among the multiple terminals.
  • S102 may be implemented by using the following process:
  • the data analysis network element clusters the terminals corresponding to each sample data in the training data.
  • the clustering process is as follows. As shown in Figure 5, a three-layer deep neural network is used as an example.
  • the terminals are grouped into Q groups of terminals, and multiple terminals of each group have the same terminal behavior data expected by the network side.
  • x 1 is the time from the AMF network element
  • x 2 is the position from the AMF network element
  • x 3 is the communication start time from the SMF network element
  • x 4 is the end of communication from the SMF network element.
  • Time, ..., x M is a first type of data from the SMF network element.
  • B) M is the data dimension of the terminal behavior information in Table 1.
  • y 1 is a stationary instruction
  • y 2 is a terminal movement track
  • y 3 is a periodic communication instruction
  • B) P is the data dimension of the terminal behavior information in Table 1.
  • Q is the number of groupings after clustering multiple terminals. It can also be called that multiple terminals are classified into Q categories, where each group of terminals has the same terminal behavior data expected by the network side, as follows:
  • Each category corresponds to a group of terminals (corresponding to a set of terminal identification information).
  • the terminal behavior feature vector of each category can be used as the user subscription data of all terminals in the terminal set corresponding to this category, that is, the terminal behavior information expected by the network side, as shown in Table 2.
  • the first distance thresholds corresponding to the centroids of each class may be the same or different, which is not limited in the embodiment of the present application.
  • the terminal behavior information as the communication duration, and take the same first distance threshold corresponding to each class as an example, that is, the first distance threshold is 5 minutes as an example, the communication duration corresponding to terminal 1 is 10 minutes, and the communication duration corresponding to terminal 2 is The communication duration is 20min, the communication duration corresponding to terminal 3 is 14min, the communication duration corresponding to terminal 4 is 12min, the communication duration corresponding to terminal 5 is 18min, the communication duration corresponding to terminal 6 is 21min, and the communication duration corresponding to terminal 7 is 20min.
  • the centroid selected by the data analysis network element is category 1: the communication duration corresponding to terminal 3 is 14 min and category 2: the communication duration corresponding to terminal 5 is 18 min. Then the data analysis network element can determine that the communication duration corresponding to terminal 3 is 14min, the communication duration corresponding to terminal 1 is 10min, and the communication duration corresponding to terminal 4 is 12min, which belongs to category 1, as the expected behavior of the network side corresponding to a group of terminals information. The data analysis network element can determine that the communication duration corresponding to terminal 2 is 20min, the communication duration corresponding to terminal 5 is 18min, the communication duration corresponding to terminal 6 is 21min, and the communication duration corresponding to terminal 7 is 20min, which belongs to category 1 as another group. Terminal behavior information expected by the network side corresponding to the terminal.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of the multiple terminals.
  • the data analysis network element may determine the terminal behavior information expected by the network side corresponding to the Q group terminals according to the terminal behavior data corresponding to multiple terminals.
  • the data analysis network element can send all expected terminal behavior information to the user data management network element / policy control network element (for example, send all Q groups to the user data management network element or policy control network element), or it can send Terminal behavior information expected by the network side corresponding to at least one terminal in the Q group.
  • Q is an integer greater than or equal to 1, and the sum of the number of terminals included in each group of the Q group of terminals is equal to the number of the plurality of terminals.
  • terminals 1 to 20 correspond to a set of terminal behavior information expected by the network side
  • terminals 21 to 62 correspond to a set of terminal behavior information expected by the network side
  • terminals 63 to The terminal 100 corresponds to a set of terminal behavior information expected by the network side.
  • the data analysis network element may select at least one of the three sets as the terminal behavior information expected by the network side determined by the data analysis network element.
  • the terminal behavior information expected by the network side determined by the data analysis network element is the terminal behavior information expected by a group of terminals 1 to 20 corresponding to the network side.
  • the terminal behavior information expected by the network side determined by the data analysis network element is a set of terminal behavior information expected by the network side corresponding to terminal 1 to terminal 20 and a set of terminal behavior information expected by the network side corresponding to terminal 63 to terminal 100.
  • the terminal behavior information expected by the network side includes one or more of the following information:
  • Inactivity indication terminal movement trajectory, periodic communication indication, communication duration, communication cycle, planned communication time, maximum packet transmission delay, maximum packet transmission response time, number of packet buffers, and at least one second type of data.
  • the information name (for example, terminal behavior information expected by the network side) determined by the data analysis network element according to the terminal behavior information in the embodiment S102 of this application is only an example. In an actual process, the data analysis network element is based on
  • the information name determined by the terminal behavior information may also be other names, for example, information expected by the network side, behavior information expected by the network side, or terminal information expected by the network side.
  • a piece of information includes a stationary indication, a terminal movement trajectory, a periodic communication indication, a communication duration, a communication cycle, a planned communication time, a maximum packet transmission delay, and a maximum packet transmission response
  • a piece of information includes a stationary indication, a terminal movement trajectory, a periodic communication indication, a communication duration, a communication cycle, a planned communication time, a maximum packet transmission delay, and a maximum packet transmission response
  • the first type of data in the embodiments of the present application refers to terminal behavior information collected by the data analysis network element from at least one core network element.
  • the second type of data refers to a data type obtained by the data analysis network element based on terminal behavior information (including data of the first type) collected from at least one network element.
  • the data analysis network element can obtain the stationary indication and terminal movement trajectory of the terminal behavior information expected by the network side according to the location information (including time and location) in the terminal behavior data, and can start communication based on the terminal behavior data.
  • the communication end time to obtain the periodic communication instruction, communication duration, communication period, and planned communication time in the terminal behavior information expected by the network side, and the terminal behavior expected by the network side can be obtained according to at least one first type of data in the terminal behavior information.
  • At least one second type of data in the message At least one second type of data in the message.
  • the first type of data belongs to input information of the data analysis network element, that is, terminal behavior information
  • the second type of data belongs to output information of the data analysis network element, that is, terminal behavior information expected by the network side.
  • the data analysis network element sends the terminal behavior information expected by the network to the user data management network element / policy control network element.
  • the user data management network element / policy control network element receives data analysis terminal behavior information expected by the network side sent by the data analysis network element.
  • the user data management network element uses the terminal behavior information expected by the network side as the user subscription data of the terminal.
  • the user data management network element may use the received terminal behavior information expected by the network side as the contract information of each terminal.
  • the policy control network element may further forward the terminal behavior information expected by the network side to the user data management network element.
  • An embodiment of the present application provides an information processing method.
  • the method obtains terminal behavior information of multiple terminals through a data analysis network element, and then determines the terminal behavior information expected by the network side based on the terminal behavior information of the multiple terminals, and expects the network side to expect.
  • the behavior information is sent to the user data management network element / policy control network element. Compared with the behavior information expected by the network side in the prior art, which is provided by the AF network element, this improves the data received by the user data management network element / policy control network element. The credibility of behavior information expected by the network.
  • the method provided in the embodiment of the present application further includes:
  • the data analysis network element sends the first information of the terminal corresponding to the terminal behavior information expected by the network side to the user data management network element.
  • the first information of the terminal corresponding to the terminal behavior information expected by the network side in S105 and the terminal behavior information expected by the network side in S103 may be sent to the user data management network element in the same message, or may be carried in different The message is sent to the user data management network element.
  • the first information of the terminal is used to indicate terminal behavior information expected by the network side corresponding to each terminal.
  • the first information of the terminal may be identification information of the terminal or identification information of the terminal group.
  • the identification information of the terminal group is used to indicate the identification of a group of terminals.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least one group of terminals
  • the terminal behavior information expected by the network side corresponding to each group of terminals in the at least one group corresponds to the first An information list.
  • a first information list of a terminal is used to indicate terminal behavior information expected by a network side corresponding to each terminal of at least one terminal.
  • the user data management network element receives the first information of the terminal corresponding to the terminal behavior information expected by the network side sent by the data analysis network element.
  • the user data management network element may use the terminal behavior information expected by the network side corresponding to each terminal as the subscription information corresponding to the terminal. For example, the user data management network element uses the terminal behavior information expected by the network side corresponding to the terminal 1 as the subscription information corresponding to the terminal 1.
  • the method provided in the embodiment of the present application further includes:
  • the user data management network element / policy control network element sends a second request message to the data analysis network element, where the second request message is used to request terminal behavior information expected by the network side, and the second request message includes identifiers of multiple terminals. information.
  • the data analysis network element determines the terminal behavior information expected by the network side, and then sends the network side The expected terminal behavior information is sent to the user data management network element, or the expected terminal behavior information on the network side is sent to the policy control network element.
  • the data analysis network element may send the terminal behavior information expected by the network side to the policy control network element, so that the policy control network element Send the terminal behavior information expected by the network side to the core network element.
  • the data analysis network element may also send the terminal behavior information expected by the network side to the user data management network element.
  • the second request message includes identification information of each terminal in the multiple terminals.
  • the second request message may be a newly defined message between the user data management network element / policy control network element and the data analysis network element, and may also be an Nnwdaf_EventsSubscription_Subscribe service operation. This embodiment of the present application does not limit this.
  • the second request message further includes at least one of a network area corresponding to the terminal, a time window corresponding to the terminal, and a terminal type.
  • the data analysis network element receives a second request message sent by the user data management network element / policy control network element.
  • the second request message may further carry the foregoing filtering information.
  • a terminal behavior vector (y k1 , y k2 , y k3 , ..., y kP ) expected by a network side can be divided into terminal's mobility management (MM) according to the corresponding core network element.
  • MM terminal's mobility management
  • Class or session management (SM) class behavior vectors can be divided into two types of terminal behavior vectors according to Table 1 (y k1 , y k2 , y k3 , ..., y kP ) according to AMF and SMF.
  • the terminal behavior sub-vector of the MM or SM class in each category can be used as the behavior characteristic information of the MM or SM class of all terminals in the terminal set corresponding to this category.
  • each MM class or SM class feature vector corresponds to a distance threshold.
  • the core network The network element may determine that the MM-type behavior sample data of the new terminal does not belong to the category corresponding to the MM-type feature vector.
  • the core network element may determine that the SM-type behavior sample data of the new terminal does not belong to the SM-type feature The category corresponding to the vector.
  • the embodiment of the present application does not limit the first distance threshold, the second distance threshold, and the third distance threshold, and may be set according to requirements.
  • the terminal behavior information expected by the network side includes the terminal behavior information expected by the network side corresponding to at least two core network element, so that the data analysis network element may further obtain the terminal behavior expected by the network side.
  • the information is classified to determine terminal behavior information expected by the network side corresponding to each core network element. Based on this, as shown in FIG. 8, the method provided in the embodiment of the present application further includes:
  • the data analysis network element sends at least one of identification information and type information of each core network element among the at least two core network elements to the user data management network element / policy control network element.
  • the identification information of the core network element is used to indicate the core network element corresponding to each of the terminal behavior information expected by the network side among the plurality of terminal behavior information expected by the network side included in the terminal behavior information expected by the network side.
  • the type information of the core network element is used to indicate the type of core network element type corresponding to each of the terminal behavior information expected by the network side among the plurality of terminal behavior information expected by the network side.
  • SM type is used to indicate the type of core network element type corresponding to each of the terminal behavior information expected by the network side among the plurality of terminal behavior information expected by the network side.
  • the core network element of the MM type may be an AMF network element
  • the network element of the SM type may be an SMF network element.
  • the method provided in this embodiment of the present application further includes: the data analysis network element determines each of the terminal behavior information expected by the network side according to the identification information of the core network element included in the behavior information of each terminal. Terminal behavior information expected by the network side corresponding to the core network element.
  • the user data management network element / policy control network element receives at least one of identification information and type information of each core network element among the at least two core network elements sent by the data analysis network element.
  • the user data management network element / policy control network element can determine the core network network element corresponding to the received terminal behavior information expected by the network side.
  • the method provided in the embodiment of the present application further includes: a user data management network element / policy control network element according to at least one of identification information and type information of each core network element Send each core network element the terminal behavior information expected by the corresponding network side.
  • the user data management network element / policy control network element sends the terminal behavior information expected by the network side corresponding to the AMF network element To the AMF network element.
  • the user data management network element may send the terminal behavior information expected by the corresponding network side to each core network element in the following process.
  • the user data management network element when it determines that the AMF network element requests the terminal to register in the 5G network, it sends the AMF network element the terminal behavior information expected by the network side corresponding to the AMF network element. Specifically, the terminal sends a registration request (Registration Request) to the AMF network element, where the registration request carries identification information of the terminal, and the registration request is used to request registration of the terminal corresponding to the identification information of the terminal to the 5G network.
  • the AMF network element sends a Nudm_SDM_Get service operation to the user data management network element.
  • the Nudm_SDM_Get service operation carries identification information of the terminal.
  • the user data management network element sends the terminal behavior information expected by the MM network side corresponding to the terminal identification information to the AMF network element.
  • the AMF network element sends a Registration to the terminal.
  • the user data management network element sends an expected terminal behavior corresponding to the SMF network element to the SMF network element during the SMF network element request to establish a Protocol Data Unit (PDU) session for the terminal.
  • the terminal sends a session establishment request (PDU Session Establishment Request) to the SMF network element through the AMF network element, where the session establishment request carries identification information of the terminal.
  • the SMF network element sends a Nudm_SDM_Get service operation to the user data management network element.
  • the Nudm_SDM_Get service operation carries identification information of the terminal.
  • the UDM network element sends the terminal behavior information expected by the session management network side corresponding to the terminal identification information to the SMF network element.
  • the SMF network element sends the PDU Session EstablishmentAccept to the terminal through the AMF network element.
  • the method provided in this embodiment of the present application further includes:
  • the data analysis network element determines the abnormal type of the terminal according to the terminal behavior information expected by the network side.
  • S111 in the embodiment of the present application may be implemented in the following manner:
  • the core network element obtains new terminal behavior information (for details, refer to the description in Table 1).
  • the multiple terminals used to obtain the terminal behavior information expected by the network side in this application are the first terminal, and the new terminal may be the second terminal. If the core network element determines that the terminal behavior information of the second terminal does not match the terminal behavior information expected by the network side received by the core network element, that is, the vector composed of the second terminal behavior information and the terminal behavior expected by the network side If the distance of the vector exceeds the set threshold, the core network element determines that the second terminal is abnormal. Therefore, the core network element sends the terminal behavior information of the second terminal to the core network element to the data analysis network element.
  • the core network element sends the identification information of the second terminal to another core network element to notify the other core network element to send the data analysis network element that the second terminal corresponds to the terminal behavior on the other core network element information.
  • the core network element may periodically report the terminal behavior information corresponding to the second terminal to the data analysis network element according to a preset period.
  • Step 2 The data analysis network element obtains terminal behavior information corresponding to the second terminal sent by at least two core network network elements (taking the SMF network element and the AMF network element as examples) on the SMF network element and the AMF network element, respectively.
  • Step 3 The data analysis network element obtains terminal behavior data of a single abnormal terminal according to the identification information of the first terminal. After accumulating a certain number of abnormal terminal behavior data, the data analysis network element further analyzes the abnormal terminal behavior data. If most or all of the abnormal terminal behavior data is found to be grouped into one category, the data analysis network element considers these terminals Exception type.
  • the exception type can be one or more of the following: (1), being used by mistake; (2), being hijacked; (3), a new type of terminal.
  • the data analysis network element sends alarm information to the policy control network element, where the alarm information is used to indicate an abnormal type of the terminal.
  • the policy control network element receives the alarm information sent by the data analysis network element. Then, the policy control network element can take further measures on the abnormal terminal, such as one-click shutdown, that is, stopping the network from serving the abnormal terminal.
  • FIG. 10 shows a specific embodiment of an information processing method provided by an embodiment of the present application.
  • the method includes:
  • the UDM network element sends a first service operation to the NWDAF network element, and the first service operation is used to subscribe to terminal behavior data information expected by a network side of the terminal.
  • the first service operation may be a Nnwdaf_EventsSubscription_Subscribe service operation.
  • the NWDAF network element sends a second service operation to the AMF network element and the SMF network element, respectively, and the second service operation is used to subscribe the terminal behavior information corresponding to the terminal on the AMF network element and the SMF network element, respectively.
  • the second service operation is the Nnf_UEBehavioralDataCollectionSubscription_Subscribe service operation.
  • the AMF network element reports the terminal behavior information on the AMF network element corresponding to the terminal to the NWDAF network element.
  • the SMF network element reports the terminal behavior information on the SMF network element corresponding to the terminal to the NWDAF network element.
  • the NWDAF network element determines the terminal behavior information expected by the network side according to the terminal behavior information on the AMF network element corresponding to the terminal and the terminal behavior information on the SMF network element corresponding to the terminal.
  • the NWDAF network element sends a third service operation to the UDM network element, and the third service operation carries terminal behavior information expected by the network side.
  • the third service operation may be a Nnwdaf_EventsSubscription_Notify service operation.
  • FIG. 11 shows a specific embodiment of another information processing method provided by an embodiment of the present application.
  • the embodiment shown in FIG. 11 is different from that shown in FIG. 10 in that:
  • the first service operation is sent by the UDM network element to the NWDAF network element in S201, and the first service operation is sent by the PCF network element to the NWDAF network element in S301 of FIG.
  • the content of the remaining steps 302-305 may correspond to the content of S202-S205, and will not be repeated here.
  • the solution shown in FIG. 11 after S305 also includes:
  • the NWDAF network element determines the terminal behavior information expected by the AMF network element from the terminal behavior information expected by the network side and the terminal behavior information expected by the network side corresponding to the SMF network element.
  • the NWDAF network element sends a third service operation to the PCF network element.
  • the third service operation includes the terminal behavior information expected by the network side corresponding to the AMF network element and the terminal behavior information expected by the network side corresponding to the SMF network element.
  • the third service operation may be a Nnwdaf_EventsSubscription_Notify service operation.
  • the PCF network element initiates a fourth service operation to the AMF network element or the SMF network element, and the fourth service operation is used to send the terminal behavior information expected by the network side corresponding to the AMF network element to the AMF network element, and the SMF network element The terminal behavior information expected by the network side corresponding to the element is sent to the SMF network element.
  • the fourth service operation may be an Npcf_UEExpectedBehavioralInfo_Notify service operation.
  • the PCF network element may distribute the terminal behavior data information expected by the MM type network side corresponding to each category to the AMF network element, and distribute the terminal behavior data information expected by the SM type network side corresponding to each category to the SMF network element.
  • the AMF network element obtains MM-type terminal behavior information of the first terminal (see Table 2), where the first terminal is any one of a plurality of terminals.
  • the AMF network element determines that the MM type terminal behavior information of the first terminal does not match the MM type network side expected terminal behavior information corresponding to the terminal sent by the NWDAF network element to the AMF network element, then determine that the first terminal is abnormal.
  • the AMF network element sends the MM-type terminal behavior information corresponding to the first terminal to the NWDAF network element.
  • the AMF network element sends the identification information corresponding to the first terminal to the SMF network element, and the information of the first terminal is used to instruct the SMF network element to report to the NWDAF network element the MM-type terminal behavior corresponding to the first terminal on the SMF network element. information. It can be understood that after receiving the identification information corresponding to the first terminal, the SMF network element reports the MM-type terminal behavior information corresponding to the first terminal on the SMF network element to the NWDAF network element.
  • the NWDAF network element summarizes the MM type terminal behavior information from the AMF network element and the SM type terminal behavior information from the SMF network element of the first terminal, and determines the abnormal type of the first terminal.
  • the NWDAF network element sends the abnormal type of the first terminal to the PCF network element.
  • the AMF network element in the above S310-S311 may also be replaced by an SMF network element.
  • the identification information corresponding to the first terminal in S312 will be sent by the SMF network element to the AMF network element.
  • FIG. 12 shows a specific flowchart of an information processing method provided by an embodiment of the present application.
  • S401-S406 can refer to the specific content in the above S301-S306, S416
  • the NWDAF network element sends a fifth service operation to the UDM network element.
  • the fifth service operation includes: terminal behavior information expected by the network side corresponding to the AMF network element and terminal behavior information expected by the network side corresponding to the SMF network element.
  • the fifth service operation may be a Nnwdaf_EventsSubscription_Notify service operation.
  • the terminal sends a Registration Request (Registration Request) message to the AMF network element.
  • the Registration Request message includes identification information of the terminal.
  • the Registration Request message is used to request registration of a terminal corresponding to the terminal's identification information to the 5G network.
  • the AMF network element sends a sixth service operation to the UDM network element, where the sixth service operation includes identification information of the terminal.
  • the sixth service operation may be a Nudm_SDM_Get service operation.
  • the UDM network element sends the terminal behavior information expected by the MM network side corresponding to the terminal identification information to the AMF network element.
  • the AMF network element sends a Registration and Accept message to the terminal.
  • the terminal sends a PDU Session Establishment Request (Session Establishment Request) message to the SMF network element, and the PDU Session Establishment Request message carries identification information of the terminal.
  • PDU Session Establishment Request Session Establishment Request
  • the terminal may send a PDU Session Establishment Request message to the SMF network element through the AMF network element.
  • the SMF network element sends a seventh service operation to the UDM network element, and the seventh service operation includes identification information of the terminal.
  • the seventh service operation may be a Nudm_SDM_Get service operation.
  • the UDM network element sends the terminal behavior information expected by the SM network side corresponding to the terminal identification information to the SMF network element.
  • the SMF network element sends a PDU session establishment acceptance (Session Establishment Accept) message to the terminal through the AMF network element.
  • PDU session establishment acceptance Session Establishment Accept
  • FIG. 13 is a schematic flowchart of a method for determining terminal abnormality information provided by an embodiment of the present application. The method includes:
  • the first network element determines that the terminal is abnormal.
  • the first network element may be the first core network element, the user data management network element 101, or the policy control network element 107 in the communication system shown in FIG.
  • the first network element may also be a user plane network element.
  • the first core network element may be a session management network element or a mobility management network element.
  • the terminal may refer to one terminal or multiple terminals or a group of terminals, which will not be described in detail below.
  • S501 in the embodiment of the present application may be implemented in the following manner:
  • the first network element is based on the terminal behavior information (Expected UE UE behavior information) expected by the terminal on the network side of the first network element and the terminal is in The terminal behavior information on the first network element determines that the terminal is abnormal.
  • Step 501 may be specifically implemented in the following manner: If the terminal behavior information expected by the network side of the terminal on the first network element does not match the terminal behavior information of the terminal on the first network element, the first network element determines that the terminal is abnormal.
  • the first network element may obtain, from the user data management network element, terminal behavior information expected by the terminal on the network side of the first network element (for example, see Table 2).
  • the user data management network element may obtain the terminal behavior information expected by the network side from the data analysis network element, or may obtain the terminal behavior information expected by the network side from the application function network element.
  • the specific process for the user data management network element to obtain the terminal behavior information expected by the network side can refer to the first embodiment, which will not be repeated here.
  • the terminal behavior information expected by the terminal on the network side of the first network element may be understood as the behavior characteristic information of the terminal.
  • the terminal behavior information of the terminal on the first network element may include identification information of the terminal and behavior data of the terminal on the first network element (for exemplary information, see Table 1).
  • the terminal behavior information of the terminal on the first network element refers to the terminal behavior data collected on the first network element.
  • terminal behavior data can also be shown in Table 3:
  • the first network element sends instruction information to the data analysis network element.
  • the indication information is used to indicate that the terminal is abnormal.
  • the data analysis network element may be the data analysis network element 104 shown in FIG. 1.
  • the data analysis network element may be an NWDAF network element.
  • S502 may be implemented in the following manner:
  • the first network element may send a Nnf_EventExposure_Notify service operation that carries indication information to the data analysis network element.
  • nf is the name of the first network element.
  • the service operation may be Namf_EventExposure_Notify.
  • the service operation may be Nsmf_EventExposure_Notify.
  • the first network element may separately send other messages or service operations carrying the indication information to the data analysis network element, such as a terminal abnormal notification message or a Nnf_UEAbnormal_Notify service operation.
  • the data analysis network element receives instruction information from the first network element.
  • the data analysis network element obtains terminal behavior information of the terminal on the second network element according to the instruction information.
  • the data analysis network element in S504 may obtain terminal behavior information of the terminal on one or more second network elements.
  • the terminal behavior information of the terminal on one or more second network elements may be the same or different.
  • the data analysis network element can obtain the terminal behavior information of the terminal on the policy control network element and the terminal behavior of the terminal on the session management network element.
  • Information 2 the terminal behavior information 1 of the terminal on the policy control network element and the terminal behavior information 2 of the terminal on the session management network element may be different.
  • the one or more second network elements may include a first network element, and of course, the one or more second network elements may not include the first network element, which is not limited in this embodiment of the present application.
  • the data analysis network element may remove the first network element from the first network element that triggers it to determine terminal abnormality information and the one or more second network elements.
  • the network element other than the network element obtains the behavior information of the terminal.
  • the first network element is a mobile management network element
  • the one or more second network elements may include a mobile management network element and a session management network element, that is, the mobile management network element triggers a data analysis network element to obtain terminal abnormality information.
  • the data analysis network element may obtain terminal behavior information from the mobile management network element and the session management network element.
  • the data analysis network element may obtain terminal behavior information from other network elements that trigger it to determine terminal abnormality information.
  • the first network element is a mobile management network element
  • one or more second network elements include a policy control network element and a session management network element.
  • the data analysis network element may obtain terminal behavior information from the policy control network element or the session management network element. .
  • the data analysis network element may associate the terminal behavior information of the terminal on one or more second network elements.
  • the abnormal information of the terminal is determined based on the terminal behavior information obtained after the association.
  • the data analysis network element if the data analysis network element obtains terminal behavior information of the terminal on at least two second network elements, the data analysis network element needs to associate the terminal on at least two second network elements according to the terminal identification information. Terminal behavior information to get the complete terminal behavior information.
  • the data analysis network element may also associate terminal behavior information of one terminal on at least two network elements according to area information, time information, and terminal type information. The process of the data analysis network element associating the terminal behavior information of one terminal on at least two second network elements is described in detail at S1011 in the first embodiment, and is not repeated here.
  • the data analysis network element determines abnormal information of the terminal according to the terminal behavior information.
  • the abnormality information of the terminal includes one or more of the following information corresponding to the terminal: identification information of the terminal, an abnormality type, an abnormality identification, and an abnormality level.
  • the abnormality identifier is used to identify the abnormality type
  • the abnormality level is used to indicate the degree or size of the abnormality type.
  • the method provided in the embodiment of the present application further includes:
  • the first network element sends one or more of the following information corresponding to the terminal to the data analysis network element: identification information of the terminal, network area, terminal type, time information, and terminal behavior information on the first network element.
  • the role of the terminal identification information, network area, terminal type, time information, and terminal behavior information on the first network element are shown in Table 4.
  • the information sent by the first network element in S506 to the data analysis network element may be referred to as terminal-related information.
  • the information related to the terminal may be sent to the data analysis network element by the first network element and the indication information in the same message (for example, Nnf_EventExposure_Notify service operation). This can save signaling overhead.
  • the terminal-related information may also be sent by the first network element and the indication information to the data analysis network element through different messages.
  • the data analysis network element subscribes the terminal behavior information to the first network element, and then the first network element sends the terminal behavior information to the data.
  • the specific steps are the same as S504.
  • the data analysis network element receives one or more of the following information corresponding to the terminal from the first network element: identification information of the terminal, network area, terminal type, time information, and terminal behavior information on the first network element.
  • terminal behavior data on the first network element For specific information about the terminal's identification information, network area, terminal type, and time information, and the terminal behavior data on the first network element, reference may be made to the foregoing related description, and details are not described herein again.
  • S504 can be implemented in the following manner:
  • the data analysis network element obtains terminal behavior information of one or more terminals on the second network element according to any one or more of the information received in S507.
  • terminal identification information may indicate one or more terminals (see Table 4).
  • terminal behavior data reference may be made to the description in Tables 1 and 3 above, and details are not described herein again.
  • the terminal-related information received by the data analysis network element through S507 may be used singly or in combination.
  • S504 in the embodiment of the present application may be specifically implemented in the following manners:
  • the data analysis network element sends a request message to the second network element, so that the second network element receives the request message from the data analysis network element.
  • the request message is used to request terminal behavior information of the terminal on the second network element.
  • the request message may be a Nnf_EventExposure_Subscribe service operation, that is, the data analysis network element subscribes data to the second network element.
  • the request message may further include one or more of the following information corresponding to the terminal: terminal identification, network area, terminal type, and time information. See Table 4 for specific information. This information is used to collect terminal behavior information of the terminal on the second network element from the second network element, see Tables 1 and 3.
  • the data analysis network element receives a response message from the second network element.
  • the response message includes terminal behavior information of the terminal on the second network element.
  • the response message may be a Nnf_EventExposure_Notify service operation.
  • the terminal behavior information includes any one or more of the following information: identification information of the second network element, location information, communication start time, communication end time, data packet delay, number of data packets, and data packet size And at least one first type of data on the second network element by the one or more terminals.
  • the terminal behavior information is shown in Tables 1 and 3.
  • the data analysis network element in S505, if the first network element sends the terminal behavior information of the terminal on the first network element to the data analysis network element. Then, the data analysis network element in S5041 does not need to subscribe the terminal behavior information of the terminal on the first network element to the first network element. At this time, the data analysis network element needs to correlate the terminal behavior information of the terminal on the first network element and the second network element according to the terminal identification information to obtain complete terminal behavior information of the terminal. In addition to the terminal identification information, the data analysis network element may also associate terminal behavior information on at least two network elements according to area information, time information, and terminal type information.
  • S505 in the embodiment of the present application may be specifically implemented in the following manner:
  • the data analysis network element determines the abnormal information of the terminal according to the terminal behavior information and the terminal behavior information expected by the network side of the terminal.
  • S505 in the embodiment of the present application may be specifically implemented in the following manner:
  • the data analysis network element The terminal behavior information, the terminal behavior information of the terminal on the second network element, and the terminal behavior information expected by the network side of the terminal determine the abnormality information of the terminal.
  • the terminal behavior information expected by the network side of the terminal may be stored in the data analysis network element in advance. If the data analysis network element obtains the terminal behavior information, the data analysis network element does not have the terminal behavior expected by the network side of the terminal Information, in an optional embodiment, continuing to combine with FIG. 14, before S505 provided in the embodiment of the present application, the method provided in the embodiment of the present application further includes:
  • the application function network element sends the terminal behavior information expected by the network side of the terminal to the data analysis network element.
  • the method provided in the embodiment of the present application further includes: the data analysis network element requests the application function network element for behavior characteristic data of one or more terminals.
  • the method provided in the embodiment of the present application further includes: the data analysis network element requests the application function network element's behavior characteristic data from the application function network element through the network capability open function network element.
  • the data analysis network element obtains, from the application function network element, terminal behavior information expected by the network side of the terminal.
  • the method provided in the embodiment of the present application further includes: the data analysis network element obtains the terminal behavior information expected by the network side of the terminal from the application function network element through the network capability open function network element.
  • the method provided in this embodiment of the present application further includes:
  • the data analysis network element sends abnormal information to the third network element. Among them, the abnormal information is used for policy control of the terminal.
  • the third network element may be an AF network element or a policy control network element.
  • the third network element is an AF network element as an example.
  • the third network element receives abnormal information from the data analysis network element.
  • FIG. 15 shows a method for determining terminal abnormality information provided by an embodiment of the present application.
  • the method includes:
  • the data analysis network element sends a first request message to the first network element.
  • the first request message is used to request terminal behavior information of the abnormal terminal on the first network element.
  • the first network element may be any one of a session management network element, a policy control network element, a user data management network element, a policy control network element, a user plane network element, or a mobility management network element.
  • the first request message may carry a first indication.
  • the first instruction is used to instruct the first network element to report terminal behavior information of the abnormal terminal on the first network element.
  • the first request message itself has a meaning for requesting terminal behavior information of the abnormal terminal on the first network element.
  • the first request message may be Nsmf_EventExposure_Subscribe.
  • the first instruction includes: an event ID (Event ID) and event filtering information (Event Filter).
  • Event ID can be used to indicate abnormal terminal behavior information, and the Event Filter does not make any special provisions.
  • the first network element can compare the terminal behavior information of the terminal on the first network element with the terminal behavior information expected by the network side of the terminal on the first network element according to the Event ID. If a mismatch is found, the terminal further reports the terminal behavior. The terminal behavior information on the first network element is given to the data analysis network element.
  • Event ID can be used to indicate terminal behavior information (UE behavior information)
  • Event Filter can include indication information (for example, pre-check indicator).
  • the instruction information is used to instruct the first network element to compare the terminal behavior information of the terminal on the first network element with the terminal behavior information expected by the terminal on the network side of the first network element. If a mismatch is found, the terminal is further reported to the terminal. The terminal behavior information on the first network element is given to the data analysis network element.
  • the first network element In response to the first request message, the first network element sends a first response message to the data analysis network element.
  • the first response message includes identification information of one or more terminals, and terminal behavior information of each terminal of the one or more terminals on the first network element.
  • the first network element may perform step 501 to determine that there is an abnormal termination on the first network element. Or determine abnormal terminal behavior information.
  • the data analysis network element requests the second network element for terminal behavior information of the one or more terminals on the second network element according to the identification information of the one or more terminals.
  • S603 may be implemented in the following manner:
  • the data analysis network element sends a second request message to the second network element, so that the second network element receives the second request message from the data analysis network element.
  • the second request message is used to request terminal behavior information of the one or more terminals on the second network element.
  • the second network element sends a second response message to the data analysis network element, so that the data analysis network element receives the second response message.
  • the second response message includes terminal behavior information of one or more terminals on the second network element.
  • the second request message may carry a first field, where the first field is used to request terminal behavior information of the one or more terminals on the second network element.
  • the second request message itself has a meaning of requesting the second network element for terminal behavior information of the one or more terminals on the second network element.
  • the second request message may include identification information of one or more terminals.
  • the data analysis network element is based on the terminal behavior information of the one or more terminals on the first network element, the terminal behavior information of the one or more terminals on the second network element, and the terminal expected by the network side of the one or more terminals. Behavioral information, identifying abnormal information.
  • the method provided in the embodiment of the present application further includes: S605 and S606.
  • S605 and S606 are the same as those described in S510 and S511 in the second embodiment, and details are not described herein again.
  • the first network element triggers the data analysis network element to obtain the terminal behavior information of the terminal through the instruction information.
  • the data analysis network element can determine the abnormality information of the terminal according to the terminal behavior information of the terminal obtained from the second network element.
  • the data analysis network element after the data analysis network element actively subscribes the abnormal terminal information to the first network element, and then obtains the identification information of the abnormal terminal and the terminal behavior information on the first network element, the data analysis network element starts from the second network element.
  • the network element obtains terminal behavior information of the abnormal terminal on the second network element according to the identification information of the abnormal terminal.
  • the abnormality information of the terminal is obtained by analyzing the terminal behavior information of the abnormal terminal on the first network element and the terminal behavior information of the abnormal terminal on the second network element.
  • each network element such as an information processing device and an information sending device, includes a hardware structure and / or a software module corresponding to each function.
  • this application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is performed by hardware or computer software-driven hardware depends on the specific application and design constraints of the technical solution. A professional technician can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
  • the functional units may be divided according to the method examples described above.
  • each functional unit may be divided corresponding to each function, or two or more functions may be integrated into one processing unit.
  • the above integrated unit may be implemented in the form of hardware or in the form of software functional unit. It should be noted that the division of units in the embodiments of the present application is schematic, and is only a logical function division. There may be another division manner in actual implementation.
  • FIG. 16 shows a possible structure diagram of an information processing device involved in the foregoing embodiment.
  • the information processing device may be a data analysis network element, or may be applied to data. Analyze the chip in the network element.
  • the information processing apparatus includes: an obtaining unit 201, a determining unit 202, and a sending unit 203.
  • the obtaining unit 201 is configured to support the information processing apparatus to execute S101 and S1011 in the foregoing embodiment.
  • the determining unit 202 is configured to support the information processing apparatus to execute S102, S111, and S112 in the foregoing embodiment.
  • the sending unit 103 is configured to support the information processing apparatus to execute S103, S1012, S105, and S109 in the foregoing embodiment.
  • the information processing apparatus may further include: a receiving unit 204, configured to support the information processing apparatus to execute S108 in the foregoing embodiment. All relevant content of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.
  • FIG. 17 shows a schematic diagram of a possible logical structure of the information processing device involved in the foregoing embodiment, and the information processing device may be a data analysis network element in the foregoing embodiment, or Chips used in data analysis network elements.
  • the information processing apparatus includes a processing module 212 and a communication module 213.
  • the processing module 212 is configured to control and manage the actions of the information processing device.
  • the processing module 212 is configured to perform the steps of performing message or data processing on the information processing device side.
  • the information processing device is supported to execute S102 and S111, S112, S102, S111, and S112.
  • the communication module 213 is used to support the information processing device to execute S103, S1012, S105, S108, and S109 in the above embodiments. And / or other processes performed by the information processing apparatus for the techniques described herein.
  • the information processing apparatus may further include a storage module 211 for storing program code and data of the information processing apparatus.
  • the processing module 212 may be a processor or a controller, for example, it may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, Hardware components or any combination thereof. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure.
  • the processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on.
  • the communication module 213 may be a transceiver, a transceiver circuit, or a communication interface.
  • the storage module 211 may be a memory.
  • the processing module 212 is the processor 220
  • the communication module 213 is the communication interface 230 or the transceiver
  • the storage module 211 is the memory 240
  • the information processing apparatus involved in this application may be the device shown in FIG. 18.
  • the communication interface 230, one or more (including two) processors 220, and the memory 240 are connected to each other through the bus 210.
  • the bus 210 may be a PCI bus, an EISA bus, or the like.
  • the bus 210 may be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 18, but it does not mean that there is only one bus or one type of bus.
  • the memory 240 is configured to store program code and data of the information processing apparatus.
  • the communication interface 230 is used for supporting the information processing apparatus to communicate with other devices (for example, the information transmitting apparatus). For example, the supporting information processing apparatus executes S1012, S105, S108, and S109.
  • the processor 220 is configured to support the information processing device to execute the program code and data stored in the memory 240 to implement S102 and S111, S112, S102, S111, and S112 provided in the present application.
  • FIG. 19 shows a possible structural schematic diagram of the information sending device involved in the foregoing embodiment.
  • the information sending device may be a core network element or a core network device. Meta chip.
  • the information sending apparatus includes a receiving unit 301 and a sending unit 302.
  • the receiving unit 301 is used to support the information sending apparatus to execute S1013 in the above embodiment
  • the sending unit 302 is used to support the information sending apparatus to execute S1014 in the above embodiment. All relevant content of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.
  • FIG. 20 shows a schematic diagram of a possible logical structure of the information sending device involved in the foregoing embodiment, and the information sending device may be a core network element in the foregoing embodiment, or Chips used in core network elements.
  • the information sending apparatus includes a processing module 312 and a communication module 313.
  • the processing module 312 is configured to control and manage the actions of the information sending device.
  • the processing module 312 is configured to perform steps of performing message or data processing on the information sending device side.
  • the communication module 313 is configured to support the information transmitting device to execute S1014 and S1013 in the foregoing embodiment. And / or other processes performed by the information transmitting device for the techniques described herein.
  • the information sending device may further include a storage module 311 for storing program code and data of the information sending device.
  • the processing module 312 may be a processor or a controller, for example, it may be a central processing unit, a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, Hardware components or any combination thereof. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure.
  • the processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on.
  • the communication module 313 may be a transceiver, a transceiver circuit, or a communication interface.
  • the storage module 311 may be a memory.
  • the processing module 312 is the processor 320
  • the communication module 313 is the communication interface 330 or the transceiver
  • the storage module 311 is the memory 340
  • the information sending device involved in this application may be the device shown in FIG. 21.
  • the communication interface 330, one or more (including two) processors 320, and the memory 340 are connected to each other through a bus 310.
  • the bus 310 may be a PCI bus, an EISA bus, or the like.
  • the bus 310 may be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only a thick line is used in FIG. 21, but it does not mean that there is only one bus or one type of bus.
  • the memory 340 is configured to store program code and data of the information sending device.
  • the communication interface 330 is used to support the information sending device to communicate with other devices (for example, terminals), and the processor 320 is used to support the information sending device to execute the program code and data stored in the memory 340 to implement S1013 and S1014 provided in this application.
  • FIG. 22 shows a possible structure diagram of the information processing apparatus involved in the foregoing embodiment.
  • the information processing apparatus may be a user data management network element, or may be applied to user data. Manage chips in network elements.
  • the information processing apparatus includes a receiving unit 401 and a processing unit 402.
  • the receiving unit 401 is configured to support the information processing apparatus to execute S104, S106, and S110 in the foregoing embodiment.
  • the processing unit 402 is configured to support the information processing apparatus to execute S104-1 in the foregoing embodiment.
  • the information processing apparatus may further include: a sending unit 403 configured to support the information processing apparatus to execute S107 in the foregoing embodiment. All relevant content of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.
  • the information processing device shown in FIG. 22 may also be a policy control network element or a chip in the policy control network element.
  • the processes performed by each unit in the information processing device refer to the above description, and are not described here. More details. The difference is that the receiving unit 401 may not be used to execute S106, but used to execute S113. At this time, the processing unit 402 may not execute the above S104-1, but may perform determining the terminal behavior information expected by the network side corresponding to each core network element in the terminal behavior information expected by the network side.
  • FIG. 23 shows a schematic diagram of a possible logical structure of the information processing apparatus involved in the foregoing embodiment, and the information processing apparatus may be a user data management network element in the foregoing embodiment. Or a chip applied to a user data management network element.
  • the information processing apparatus includes a processing module 412 and a communication module 413.
  • the processing module 412 is configured to control and manage the actions of the information processing device.
  • the processing module 412 is configured to perform steps of performing message or data processing on the information processing device side, for example, S104-1.
  • the communication module 413 is configured to support the information processing apparatus to execute S104, S106, S107, and S110 in the foregoing embodiment. And / or other processes performed by the information processing apparatus for the techniques described herein.
  • the information processing apparatus may further include a storage module 411 for storing program code and data of the information processing apparatus.
  • the steps performed by each module in the information processing device can refer to the above description, and are not repeated here.
  • the communication module 413 may not be used to execute S106, but used to execute S113.
  • the processing module 412 may not execute the above S104-1, but may perform determining the terminal behavior information expected by the network side corresponding to each core network element among the terminal behavior information expected by the network side.
  • the processing module 412 may be a processor or a controller.
  • the processing module 412 may be a central processing unit, a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, Hardware components or any combination thereof. It may implement or execute various exemplary logical blocks, modules, and circuits described in connection with the present disclosure.
  • the processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on.
  • the communication module 413 may be a transceiver, a transceiver circuit, or a communication interface.
  • the storage module 411 may be a memory.
  • the processing module 412 is a processor 420
  • the communication module 413 is a communication interface 430 or a transceiver
  • the storage module 411 is a memory 440
  • the information processing apparatus involved in this application may be the device shown in FIG. 24.
  • the communication interface 430, one or more (including two) processors 420, and the memory 440 are connected to each other through a bus 410.
  • the bus 410 may be a PCI bus, an EISA bus, or the like.
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 24, but it does not mean that there is only one bus or one type of bus.
  • the memory 440 is configured to store program code and data of the information processing apparatus.
  • the communication interface 430 is used to support the information processing apparatus to communicate with other devices (for example, an information sending apparatus), and the processor 420 is used to support the information processing apparatus to execute the program code and data stored in the memory 440 to implement S104 provided in this application, S104-1, S106, S107, and S110.
  • FIG. 25 shows a possible logical structure diagram of a device for determining terminal abnormality information involved in the foregoing embodiment.
  • the device for determining terminal abnormality information may be a data analysis network in the foregoing embodiment. Or a chip used in a data analysis network element.
  • the device for determining terminal abnormality information includes a receiving unit 501 and a processing unit 502.
  • the receiving unit 501 is configured to support a data analysis network element to perform S503 and S504 in the foregoing embodiment.
  • the processing unit 502 is configured to support the data analysis network element to execute S505 in the foregoing embodiment.
  • the receiving unit 501 is further configured to support the data analysis network element to execute S507, S5042, and S509 in the foregoing embodiment.
  • the apparatus for determining abnormality information of a terminal may further include: a sending unit 503, configured to support a data analysis network element to execute S5041 and S510 in the foregoing embodiment. That is, when the apparatus shown in FIG. 25 is used to implement the steps of the data analysis network element in the second embodiment, the sending unit 503 is an optional unit.
  • the apparatus for determining terminal abnormality information shown in FIG. 25 may further include: a storage unit, configured to store an instruction or a program.
  • the sending unit 503 and the receiving unit 501 may correspond to the communication interface 230.
  • the processing unit 502 may correspond to the processor 220.
  • the storage unit may correspond to the memory 240.
  • the communication interface 230 is configured to support the device for determining terminal abnormality information shown in FIG. 18 to execute S503 and S504 in the foregoing embodiment.
  • the processor 220 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S505 in the foregoing embodiment.
  • the communication interface 230 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S507, S5042, and S509 in the foregoing embodiment. In an optional implementation, the communication interface 230 is further configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S5041 and S510 in the foregoing embodiment.
  • FIG. 26 shows a possible logical structure diagram of a device for determining terminal abnormality information involved in the foregoing embodiment
  • the device for determining terminal abnormality information may be a data analysis network element in the foregoing embodiment.
  • a chip applied to a data analysis network element or the device for determining abnormality information of the terminal may be the first network element in the foregoing embodiment or a chip applied to the first network element.
  • the device for determining terminal abnormality information includes a processing unit 601 and a sending unit 602.
  • the sending unit 602 is configured to support a data analysis network element to perform S601 and S603 in the foregoing embodiment.
  • the processing unit 601 is configured to support the data analysis network element to execute S604 in the foregoing embodiment.
  • the sending unit 602 is further configured to support the data analysis network element to execute S605 in the foregoing embodiment.
  • the device shown in FIG. 26 is the first network element in the foregoing embodiment or a chip applied to the first network element as an example.
  • the processing unit 601 is configured to support the first network element to perform S501 in the foregoing embodiment.
  • the sending unit 602 is configured to support the first network element to perform S502 in the foregoing embodiment.
  • the sending unit 602 is further configured to support the first network element to perform S506 in the foregoing embodiment.
  • the apparatus shown in FIG. 26 may further include a storage unit for storing instructions or programs.
  • the sending unit 602 may correspond to the communication interface 230.
  • the processing unit 602 may correspond to the processor 220.
  • the storage unit may correspond to the memory 240.
  • the communication interface 230 is configured to support the device for determining terminal abnormality information shown in FIG. 18 to execute S601, S603, and S605 in the foregoing embodiment.
  • the processor 220 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S604 in the foregoing embodiment.
  • the processor 220 is configured to support the determining device for terminal abnormality information shown in FIG. 18 to execute S501 in the foregoing embodiment.
  • the communication interface 230 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S502 in the foregoing embodiment.
  • the communication interface 230 is configured to support the apparatus for determining terminal abnormality information shown in FIG. 18 to execute S506 in the foregoing embodiment.
  • An embodiment of the present application provides a communication device.
  • the communication device includes one or more modules, and is configured to implement the method in steps 601 to 606.
  • the one or more modules may be the same as those in steps 601 to 606.
  • the steps of the method correspond.
  • each step in the method performed by the first network element includes a unit or module in the first network element that executes each step in the method.
  • Each step in the method performed by the data analysis network element includes a unit or module in the data analysis network element that performs each step in the method.
  • a module that controls or processes an operation of the information transmission device may be referred to as a processing module.
  • a module that executes steps for performing message or data processing on the information transmission device side may be referred to as a communication module.
  • FIG. 27 is a schematic structural diagram of a chip 150 according to an embodiment of the present invention.
  • the chip 150 includes one or more (including two) processors 1510 and an interface circuit 1530.
  • the chip 150 further includes a memory 1540.
  • the memory 1540 may include a read-only memory and a random access memory, and provide operation instructions and data to the processor 1510.
  • a part of the memory 1540 may further include a non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 1540 stores the following elements, executable modules or data structures, or their subsets, or their extended sets:
  • a corresponding operation is performed by calling an operation instruction stored in the memory 1540 (the operation instruction may be stored in an operating system).
  • a possible implementation manner is: a data analysis network element, a user data management network element, and a core network network element.
  • the chips used are similar in structure, and different devices can use different chips to achieve their respective functions.
  • the processor 1510 controls operations of the data analysis network element, the user data management network element, and the core network network element.
  • the processor 1510 may also be referred to as a central processing unit (CPU).
  • the memory 1540 may include a read-only memory and a random access memory, and provide instructions and data to the processor 1510.
  • a part of the memory 1540 may further include a non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 1540, the interface circuit 1530, and the memory 1540 are coupled through a bus system 1520.
  • the bus system 1520 may include a power bus, a control bus, and a status signal bus in addition to a data bus. However, for the sake of clarity, various buses are marked as the bus system 1520 in FIG. 27.
  • the method disclosed in the foregoing embodiment of the present invention may be applied to the processor 1510, or implemented by the processor 1510.
  • the processor 1510 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 1510 or an instruction in the form of software.
  • the above-mentioned processor 1510 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or Other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field-programmable gate array
  • Various methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or executed.
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the steps of the method disclosed in combination with the embodiments of the present invention may be directly implemented by a hardware decoding processor, or may be performed by using a combination of hardware and software modules in the decoding processor.
  • the software module may be located in a mature storage medium in the field, such as a random memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, and the like.
  • the storage medium is located in the memory 1540, and the processor 1510 reads the information in the memory 1540 and completes the steps of the foregoing method in combination with its hardware.
  • the interface circuit 1530 is configured to execute the embodiments shown in FIG. 3, FIG. 4, FIG. 6, FIG. 7, FIG. 8, FIG. 9, FIG. 10, FIG. 11 and FIG. 12, FIG. 13, FIG. The steps of receiving and sending the data analysis network element, user data management network element, and core network network element in.
  • the processor 1510 is configured to perform data analysis in the embodiments shown in FIG. 3, FIG. 4, FIG. 6, FIG. 7, FIG. 8, FIG. 9, FIG. 10, FIG. 11, and FIG. 13, FIG. 14, FIG. Network element, user data management network element and core network network element processing steps.
  • the instructions stored in the memory for execution by the processor may be implemented in the form of a computer program product.
  • the computer program product may be written in the memory in advance, or may be downloaded and installed in the memory in the form of software.
  • a computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server, or data center via a wired (e.g., Coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) transmission to another website site, computer, server or data center.
  • a wired e.g., Coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server, a data center, and the like that includes one or more available mediums integrated.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • a computer-readable storage medium is provided, and instructions are stored in the computer-readable storage medium.
  • the data analysis network element or a chip applied to the data analysis network element executes S102 and S111, S112, S103, S1012, S105, S108, S109. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.
  • a computer-readable storage medium stores instructions.
  • the core network element or a chip applied to the core network element executes S1014 in the embodiment. And S1013. And / or other processes performed by the core network element or a chip applied in the core network element for the techniques described herein.
  • a computer-readable storage medium stores instructions.
  • the user data management network element or a chip applied to the user data management network element executes the embodiments. S104-1, S104, S106, S107, and S110. And / or other processes for the techniques described herein performed by a user data management network element or a chip applied in a user data management network element.
  • a computer-readable storage medium stores instructions.
  • the data analysis network element or a chip applied to the data analysis network element executes S503 in the embodiment.
  • a computer-readable storage medium stores instructions, and when the instructions are executed, the data analysis network element or a chip applied to the data analysis network element executes S601 in the embodiment. , S603, S604, and S605. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.
  • a computer-readable storage medium stores instructions.
  • the first network element or a chip applied to the first network element executes S501 in the embodiment. , S502, S506. And / or other processes performed by the first network element or a chip applied in the first network element for the techniques described herein.
  • the foregoing readable storage medium may include: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk, or an optical disk.
  • a computer program product including instructions.
  • the computer program product stores instructions.
  • the data analysis network element or a chip applied to the data analysis network element executes S102 and S111 in the embodiment. , S112, S103, S1012, S105, S108, S109. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.
  • a computer program product including instructions.
  • the computer program product stores instructions.
  • the core network element or a chip applied to the core network element executes S1014 and S1014 in the embodiment. S1013. And / or other processes performed by the core network element or a chip applied in the core network element for the techniques described herein.
  • a computer program product including instructions.
  • the computer program product stores instructions.
  • the user data management network element or a chip applied to the user data management network element executes the instructions in the embodiment.
  • a computer program product including instructions is provided.
  • the data analysis network element or a chip applied to the data analysis network element executes S503 and S504, S505, S507, S5042, S509, S5041, S510. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.
  • a computer program product including instructions.
  • the computer program product stores instructions.
  • the data analysis network element or a chip applied to the data analysis network element executes S601, S603, S604, and S605. And / or other processes performed by the data analysis network element or a chip applied in the data analysis network element for the techniques described herein.
  • a computer program product including instructions.
  • the computer program product stores instructions.
  • the first network element or a chip applied to the first network element executes S501, S502, S506. And / or other processes performed by the first network element or a chip applied in the first network element for the techniques described herein.
  • a chip is provided.
  • the chip is used in a data analysis network element.
  • the chip includes one or more (including two) processors and interface circuits, and the interface circuit and the one or more (including two) processors.
  • the processors are interconnected through lines, and the processors are used to execute instructions to execute S102, S111, S112, S103, S1012, S105, S108, and S109 in the embodiment. And / or other processes performed by the data analysis network element for the techniques described herein.
  • a chip is provided.
  • the chip is used in a core network element.
  • the chip includes one or more processors (including two) and an interface circuit.
  • the interface circuit and the one or two processors (including two) ) The processors are interconnected through lines, and the processors are used to run instructions to execute S1014 and S1013 in the embodiments. And / or other processes performed by the core network elements for the techniques described herein.
  • a chip is provided, and the chip is applied to a user data management network element.
  • the chip includes one or more (including two) processors and an interface circuit.
  • the interface circuit and the one or more (including two) processors are interconnected through a line.
  • the processor is used to run instructions to execute the implementation in the embodiment. S104-1, S104, S106, S107, and S110 in the example. And / or other processes performed by the user data management network element for the techniques described herein.
  • a chip is provided, and the chip is applied to a data analysis network element.
  • the chip includes: one or more (including two) processors and an interface circuit, the interface circuit and the one or more (including two) processors are interconnected through a line, and the processor is used to run instructions to execute the embodiments S503, S504, S505, S507, S5042, S509, S5041, S510.
  • a chip is provided, and the chip is applied to a data analysis network element.
  • the chip includes: one or more (including two) processors and an interface circuit, the interface circuit and the one or more (including two) processors are interconnected through a line, and the processor is used to run instructions to execute the embodiments S601, S603, S604, and S605.
  • a chip is provided.
  • the chip is applied to a first network element, and the chip includes: one or more (including two) processors and an interface circuit, and the interface circuit and the one or more (including two) processors (2)
  • the processors are interconnected through lines, and the processors are used to run instructions to execute S501, S502, and S506 in the embodiment.
  • the present application also provides a communication system including the information processing device shown in FIGS. 16 to 18, the information sending device shown in FIGS. 19 to 21, and the information processing shown in FIGS. 22 to 24. Device.
  • the present application also provides a communication system including: a device for determining terminal abnormality information shown in FIG. 25 as a data analysis network element, and a device for determining terminal abnormality information shown in FIG. 26 as a first network element.
  • a communication system including: a device for determining terminal abnormality information shown in FIG. 25 as a data analysis network element, and a device for determining terminal abnormality information shown in FIG. 26 as a first network element.
  • the specific steps performed by the data analysis network element and the first network element in the system may refer to the specific descriptions in FIG. 25 and FIG. 26, and are not repeated here.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • a software program it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions according to the embodiments of the present application are generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server, or data center via a wired (for example, Coaxial cable, optical fiber, digital subscriber line (DSL), or wireless (such as infrared, wireless, microwave, etc.) for transmission to another website site, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device including one or more servers, data centers, and the like that can be integrated with the medium.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (solid state disk (SSD)), and the like.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a DVD
  • a semiconductor medium for example, a solid state disk (solid state disk (SSD)

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention se rapporte au domaine technique des communications, et des modes de réalisation de la présente invention concernent un procédé et un dispositif de traitement d'informations destinés à être utilisés pour fournir des informations comportementales de terminal attendues d'un côté réseau ayant une crédibilité élevée. La solution comprend les étapes suivantes : un élément de réseau d'analyse de données acquiert des informations comportementales de terminal d'une pluralité de terminaux ; l'élément de réseau d'analyse de données détermine les informations comportementales de terminal attendues du côté réseau selon les informations comportementales de terminal ; et l'élément de réseau d'analyse de données envoie les informations comportementales de terminal attendues du côté réseau à un élément de réseau de gestion de données d'utilisateur. L'élément de réseau d'analyse de données étant un élément de réseau géré par un opérateur, la crédibilité des informations comportementales de terminal attendues du côté réseau est supérieure et plus véritable que celle des informations comportementales de terminal attendues d'un tiers fournies par un élément de réseau de fonction d'application ou un serveur de service dans l'état de la technique.
PCT/CN2019/091795 2018-06-26 2019-06-18 Dispositif et procédé de traitement d'informations WO2020001336A1 (fr)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP19827133.0A EP3813304A4 (fr) 2018-06-26 2019-06-18 Dispositif et procédé de traitement d'informations
BR112020026636-1A BR112020026636A2 (pt) 2018-06-26 2019-06-18 Aparelho e método de processamento de informações
US17/131,127 US11595810B2 (en) 2018-06-26 2020-12-22 Information processing method and apparatus
US18/148,013 US20230133980A1 (en) 2018-06-26 2022-12-29 Information Processing Method and Apparatus

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201810705963.X 2018-06-26
CN201810705963 2018-06-26
CN201910143741.8A CN110650034B (zh) 2018-06-26 2019-02-25 一种信息处理方法及装置
CN201910143741.8 2019-02-25

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/131,127 Continuation US11595810B2 (en) 2018-06-26 2020-12-22 Information processing method and apparatus

Publications (1)

Publication Number Publication Date
WO2020001336A1 true WO2020001336A1 (fr) 2020-01-02

Family

ID=68986087

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/091795 WO2020001336A1 (fr) 2018-06-26 2019-06-18 Dispositif et procédé de traitement d'informations

Country Status (1)

Country Link
WO (1) WO2020001336A1 (fr)

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112272169A (zh) * 2020-10-16 2021-01-26 中国联合网络通信集团有限公司 一种用户身份的确定方法及装置
CN113271541A (zh) * 2020-02-17 2021-08-17 大唐移动通信设备有限公司 终端行为数据的获取方法、发送方法、装置及网络设备
CN113573228A (zh) * 2020-04-09 2021-10-29 中国移动通信有限公司研究院 终端移动性的监测方法及设备
CN113709776A (zh) * 2020-05-22 2021-11-26 华为技术有限公司 一种通信方法、装置及系统
EP3955695A1 (fr) * 2020-08-13 2022-02-16 Samsung Electronics Co., Ltd. Procédé et appareil de réglage de valeur de temporisateur dans un réseau
CN114125812A (zh) * 2021-11-12 2022-03-01 中国联合网络通信集团有限公司 一种数据同步方法、装置、服务器及存储介质
CN114531681A (zh) * 2020-10-30 2022-05-24 华为技术有限公司 一种异常终端控制方法及装置
CN115004635A (zh) * 2020-01-07 2022-09-02 华为技术有限公司 签约信息获取方法及装置

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104170419A (zh) * 2012-03-23 2014-11-26 日本电气株式会社 订户服务器、监视服务器、移动终端、与之相关的方法和计算机可读介质

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104170419A (zh) * 2012-03-23 2014-11-26 日本电气株式会社 订户服务器、监视服务器、移动终端、与之相关的方法和计算机可读介质

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
HUAWEI ET AL: "Update on Key Issue Description", SA WG2 MEETING #127 S2-183632, vol. SA WG2, 10 April 2018 (2018-04-10), Sanya, China, pages 1 - 3, XP051437933 *
NOKIA: "23.791: Update to General Framework", SA WG2 MEETING #127B S2-185125, vol. SA WG2, 22 May 2018 (2018-05-22), pages 1 - 3, XP051535654 *
See also references of EP3813304A4

Cited By (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115004635A (zh) * 2020-01-07 2022-09-02 华为技术有限公司 签约信息获取方法及装置
CN113271541B (zh) * 2020-02-17 2022-08-23 大唐移动通信设备有限公司 终端行为数据的获取方法、发送方法、装置及网络设备
CN113271541A (zh) * 2020-02-17 2021-08-17 大唐移动通信设备有限公司 终端行为数据的获取方法、发送方法、装置及网络设备
WO2021164562A1 (fr) * 2020-02-17 2021-08-26 大唐移动通信设备有限公司 Procédé et appareil d'obtention de données comportementales de terminal, procédé et appareil d'envoi de données comportementales de terminal, et dispositif réseau
EP4109933A4 (fr) * 2020-02-17 2023-08-02 Datang Mobile Communications Equipment Co., Ltd. Procédé et appareil d'obtention de données comportementales de terminal, procédé et appareil d'envoi de données comportementales de terminal, et dispositif réseau
CN113573228A (zh) * 2020-04-09 2021-10-29 中国移动通信有限公司研究院 终端移动性的监测方法及设备
CN113709776A (zh) * 2020-05-22 2021-11-26 华为技术有限公司 一种通信方法、装置及系统
CN113709776B (zh) * 2020-05-22 2023-11-03 华为技术有限公司 一种通信方法、装置及系统
US11991049B2 (en) 2020-05-22 2024-05-21 Huawei Technologies Co., Ltd. Communication method, apparatus, and system
EP3955695A1 (fr) * 2020-08-13 2022-02-16 Samsung Electronics Co., Ltd. Procédé et appareil de réglage de valeur de temporisateur dans un réseau
US11638322B2 (en) 2020-08-13 2023-04-25 Samsung Electronics Co., Ltd. Method and apparatus for setting timer value in network
US11903076B2 (en) 2020-08-13 2024-02-13 Samsung Electronics Co., Ltd. Method and apparatus for setting timer value in network
CN112272169B (zh) * 2020-10-16 2023-06-02 中国联合网络通信集团有限公司 一种用户身份的确定方法及装置
CN112272169A (zh) * 2020-10-16 2021-01-26 中国联合网络通信集团有限公司 一种用户身份的确定方法及装置
CN114531681A (zh) * 2020-10-30 2022-05-24 华为技术有限公司 一种异常终端控制方法及装置
CN114125812A (zh) * 2021-11-12 2022-03-01 中国联合网络通信集团有限公司 一种数据同步方法、装置、服务器及存储介质
CN114125812B (zh) * 2021-11-12 2023-07-18 中国联合网络通信集团有限公司 一种数据同步方法、装置、服务器及存储介质

Similar Documents

Publication Publication Date Title
WO2020001336A1 (fr) Dispositif et procédé de traitement d'informations
CN110650034B (zh) 一种信息处理方法及装置
EP3755048B1 (fr) Procédé de traitement de données, et procédé et appareil de transmission de données
WO2020207178A1 (fr) Procédé, appareil et système de traitement de données d'itinérance
WO2020200037A1 (fr) Procédé, dispositif et système de traitement de données
CN110972092B (zh) 本地局域网通信方法、设备及系统
WO2020224463A1 (fr) Procédé et appareil d'analyse de données
WO2020048469A1 (fr) Procédé et appareil de communication
WO2022033115A1 (fr) Procédé de communication et appareil de communication
US11133946B2 (en) Systems and methods for selective provisioning of a charging function in a wireless network
US20160057291A1 (en) Enabling monitoring and reporting for dynamic policy enforcement in multi-operator wholesale networks
JP2023536969A (ja) 通信方法、デバイス、およびシステム
US20220312163A1 (en) Method and apparatus for event monitoring
WO2020224509A1 (fr) Procédé, dispositif et système pour traiter des informations de terminal
WO2021062793A1 (fr) Procédé, dispositif et système de communication et support de stockage
US20230262418A1 (en) Method and apparatus for location service
WO2016074224A1 (fr) Procédé et appareil pour sélectionner une fonction de règles de politique et de facturation
KR20130060967A (ko) ＬＴＥ 가입자 Ｍｕｌｔｉｐｌｅ ＰＤＮ 기반 ＯＤＢ 적용을 통한 데이터서비스 방법
US20200177512A1 (en) Network architecture with control plane node
RU2785151C2 (ru) Способ обработки информации и устройство
WO2022012674A1 (fr) Procédé et appareil de surveillance d'événements
WO2023213226A1 (fr) Procédé et appareil d'autorisation
WO2023143385A1 (fr) Procédé et appareil de formation de groupe fondé sur la localisation
US11647379B2 (en) Methods and apparatuses for exposure of monitoring event
US20240129774A1 (en) Systems and methods for analytics and information sharing between a radio access network and a core network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19827133

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112020026636

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2019827133

Country of ref document: EP

Effective date: 20210125

ENP Entry into the national phase

Ref document number: 112020026636

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20201223