WO2021043012A1 - 阻断信令风暴的方法、装置、设备及存储介质 - Google Patents

阻断信令风暴的方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2021043012A1
WO2021043012A1 PCT/CN2020/110662 CN2020110662W WO2021043012A1 WO 2021043012 A1 WO2021043012 A1 WO 2021043012A1 CN 2020110662 W CN2020110662 W CN 2020110662W WO 2021043012 A1 WO2021043012 A1 WO 2021043012A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
signaling
log
blocking
storm
Prior art date
Application number
PCT/CN2020/110662
Other languages
English (en)
French (fr)
Inventor
才宇东
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2022501309A priority Critical patent/JP7268240B2/ja
Priority to EP20861335.6A priority patent/EP3962005A4/en
Priority to CA3143371A priority patent/CA3143371C/en
Publication of WO2021043012A1 publication Critical patent/WO2021043012A1/zh
Priority to US17/572,338 priority patent/US20220131966A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/20—Traffic policing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M1/00—Substation equipment, e.g. for use by subscribers
    • H04M1/57—Arrangements for indicating or recording the number of the calling subscriber at the called subscriber's set
    • H04M1/571—Blocking transmission of caller identification to called party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/142—Network analysis or design using statistical or mathematical methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/12—Avoiding congestion; Recovering from congestion
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2425—Traffic characterised by specific attributes, e.g. priority or QoS for supporting services specification, e.g. SLA
    • H04L47/2433—Allocation of priorities to traffic types
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M1/00—Substation equipment, e.g. for use by subscribers
    • H04M1/57—Arrangements for indicating or recording the number of the calling subscriber at the called subscriber's set
    • H04M1/575—Means for retrieving and displaying personal data about calling party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M3/00—Automatic or semi-automatic exchanges
    • H04M3/42—Systems providing special services or facilities to subscribers
    • H04M3/436—Arrangements for screening incoming calls, i.e. evaluating the characteristics of a call before deciding whether to answer it
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/0289—Congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/069—Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M2250/00—Details of telephonic subscriber devices
    • H04M2250/60—Details of telephonic subscriber devices logging of communication history, e.g. outgoing or incoming calls, missed calls, messages or URLs

Definitions

  • This application relates to the field of communication technology, and further relates to the application of artificial intelligence (AI) in the field of communication technology, and in particular to a method, device, device, and storage medium for blocking signaling storms.
  • AI artificial intelligence
  • the related technology performs flow control by setting a central processing unit (CPU) resource occupancy rate threshold/signaling number threshold per unit time in the wireless network device, so as to block the signaling storm.
  • CPU central processing unit
  • this control method is only a systematic protection for signaling overload, and the blocking method for signaling storm is not accurate enough, and the blocking effect is not good.
  • the embodiments of the present application provide a method, device, device, and storage medium for blocking signaling storms to solve the problems provided by related technologies.
  • the technical solutions are as follows:
  • a method for blocking a signaling storm includes: acquiring traffic statistics information, where the traffic statistics information refers to statistics and output information of traffic performance indicators; and performing signaling based on the traffic statistics information.
  • Make storm detection when a signaling storm is detected, obtain a call history record CHR log of at least one user equipment UE, where the CHR log refers to a log file used to record problems that a user has encountered during a call; based on the at least The CHR log of a UE determines the target UE, and the target UE refers to the UE that generated the signaling that caused the signaling storm; signaling blocking is performed on the target UE.
  • Signaling storm detection is performed through traffic statistics information.
  • the target UE that generated the signaling that caused the signaling storm is determined based on the CHR log of the UE, and the target UE is blocked by signaling to be more accurate Block the signaling storm to improve the blocking effect.
  • the performing signaling blocking on the target UE includes: performing false source detection on the target UE to obtain a false source in the target UE, and the false source is Refers to a UE that uses a false address to communicate; a blocking strategy of the first priority is used to block signaling from a false source in the target UE, and a blocking strategy of the second priority is used to block non-signaling sources in the target UE.
  • the false source performs signaling blocking, wherein the first priority is higher than the second priority.
  • the determined target UE it is further confirmed whether it is a false source, and different priorities are used for blocking, which further improves the blocking effect.
  • the detecting the false source of the target UE to obtain the false source in the target UE includes: obtaining the international mobile subscriber identity IMSI of the target UE, based on the target UE Paging the target UE with the IMSI, and determine the false source in the target UE according to the paging result.
  • the traffic statistics information includes one or more of the traffic statistics log of the base station reported by the base station and the traffic statistics log of the core network reported by the core network device;
  • the CHR log of the at least one UE includes one or more of the signaling log of the at least one UE reported by the base station and the signaling log of the at least one UE reported by the core network device.
  • the CHR log of the at least one UE further includes: an alarm log of the at least one UE reported by the flow probe.
  • the determining the target UE based on the CHR log of the at least one UE includes: performing feature extraction on the CHR log of the at least one UE; and obtaining the at least one UE based on the extracted feature analysis
  • the behavior characteristic sequence corresponding to each UE in the at least one UE; the neural network model is used to identify the behavior characteristic sequence corresponding to each UE in the at least one UE; when the abnormal behavior characteristic sequence is identified, the abnormal behavior characteristic sequence is The corresponding UE is used as the target UE, and the neural network model is obtained by training using the behavior characteristic sequence corresponding to the normal UE.
  • the method when the abnormal behavior characteristic sequence is identified, after the UE corresponding to the abnormal behavior characteristic sequence is used as the target UE, the method further includes: when there are multiple target UEs corresponding to the abnormal behavior characteristic sequence, Associate target UEs corresponding to multiple abnormal behavior characteristic sequences.
  • the blocking of the signaling of the target UE includes: processing the information of the signaling storm and the information of the target UE as a security event, so as to be based on the security event
  • the blocking strategy is used to block signaling.
  • a device for blocking a signaling storm includes: an acquisition module for acquiring traffic statistics information, where the traffic statistics information refers to statistics and output information of traffic performance indicators; and a detection module for Signaling storm detection is performed based on the traffic statistics information; the acquisition module is further configured to acquire the call history record CHR log of at least one user equipment UE when a signaling storm is detected, and the CHR log is used for recording A log file of problems that a user has encountered during a call; a determining module, configured to determine a target UE based on the CHR log of the at least one UE, where the target UE refers to the UE that generated the signaling that caused the signaling storm; The disconnection module is used to block the signaling of the target UE.
  • the blocking module is configured to perform false source detection on the target UE to obtain a false source in the target UE, and the false source refers to a false address that uses a false address for communication.
  • the first priority blocking strategy is used to block the signaling of the false source in the target UE
  • the second priority blocking strategy is used to block the signaling of the non-false source in the target UE , Wherein the first priority is higher than the second priority.
  • the blocking module is configured to obtain the International Mobile Subscriber Identity IMSI of the target UE, page the target UE based on the IMSI of the target UE, and determine the target UE based on the paging result. Describe the false source in the target UE.
  • the traffic statistics information includes one or more of the traffic statistics log of the base station reported by the base station and the traffic statistics log of the core network reported by the core network device; the CHR of the at least one UE The log includes one or more of the signaling log of the at least one UE reported by the base station and the signaling log of the at least one UE reported by the core network device.
  • the CHR log of the at least one UE further includes: an alarm log of the at least one UE reported by the flow probe.
  • the determining module is configured to perform feature extraction on the CHR log of the at least one UE; and obtain the behavior feature corresponding to each UE in the at least one UE based on the extracted feature analysis Sequence; the neural network model is used to identify the behavior characteristic sequence corresponding to each UE in the at least one UE; when the abnormal behavior characteristic sequence is identified, the UE corresponding to the abnormal behavior characteristic sequence is used as the target UE, and the nerve The network model is obtained by training using the behavior characteristic sequence corresponding to the normal UE.
  • the determining module is further configured to associate target UEs corresponding to the multiple abnormal behavior characteristic sequences when there are multiple target UEs corresponding to the abnormal behavior characteristic sequences.
  • the blocking module is configured to process the information of the signaling storm and the information of the target UE as a security event, and perform signaling based on the blocking strategy of the security event Blocked.
  • a device for blocking a signaling storm comprising: a memory and at least one processor, the memory stores at least one instruction or program, and the at least one instruction or program is executed by the at least one processor Load and execute to implement any of the methods for blocking signaling storm described above.
  • a computer-readable storage medium is also provided, and at least one instruction or program is stored in the storage medium, and the instruction or program is loaded and executed by a processor to realize the method for blocking a signaling storm as described above. .
  • Another communication device which includes a transceiver, a memory, and a processor.
  • the transceiver, the memory, and the processor communicate with each other through an internal connection path, the memory is used to store instructions or programs, and the processor is used to execute the instructions or programs stored in the memory to control the transceiver to receive signals and control
  • the transceiver sends a signal, and when the processor executes the instruction or program stored in the memory, it causes the processor to execute the method in any one of the foregoing possible implementation manners.
  • the processor, the memory, and the transceiver may communicate through a bus.
  • processors there are one or more processors, and one or more memories.
  • the memory may be integrated with the processor, or the memory and the processor may be provided separately.
  • the memory can be a non-transitory (non-transitory) memory, such as a read only memory (ROM), which can be integrated with the processor on the same chip, or can be set in different On the chip, the embodiment of the present application does not limit the type of the memory and the setting mode of the memory and the processor.
  • ROM read only memory
  • a computer program (product) is provided, the computer program (product) includes: computer program code, when the computer program code is executed by a computer, the computer executes the methods in the above aspects.
  • a chip including a processor, which is used to call and run instructions or programs stored in the memory from a memory, so that a communication device installed with the chip executes the methods in the foregoing aspects.
  • Another chip including: an input interface, an output interface, a processor, and a memory.
  • the input interface, output interface, the processor, and the memory are connected through an internal connection path, and the processor is used to execute all When the code in the memory is executed, the processor is used to execute the methods in the foregoing aspects.
  • FIG. 1 is a schematic diagram of the structure of a communication system provided by an exemplary embodiment of this application;
  • FIG. 2 is a schematic diagram of an implementation environment provided by an exemplary embodiment of this application.
  • FIG. 3 is a flowchart of a method for blocking a signaling storm provided by an exemplary embodiment of this application;
  • FIG. 4 is a schematic diagram of a process of detecting a signaling storm according to an embodiment of the application
  • FIG. 5 is a schematic diagram of a process of determining a target UE provided by an embodiment of the application
  • FIG. 6 is a schematic diagram of a process of associating a UE according to an embodiment of the application.
  • FIG. 7 is a schematic diagram of a process of blocking a signaling storm provided by an embodiment of this application.
  • FIG. 8 is a schematic structural diagram of an apparatus for blocking a signaling storm provided by an embodiment of the application.
  • FIG. 9 is a schematic structural diagram of a device for blocking a signaling storm provided by an embodiment of the application.
  • wireless network equipment such as MME, eNodeB, etc.
  • receives terminal signaling The request exceeds the processing capability of the wireless network equipment for various signaling, which will cause network congestion and cause an avalanche effect, resulting in unavailability of the network. This situation is called a signaling storm.
  • flow control includes, but is not limited to, two control modes, open-loop control and closed-loop control.
  • Control method 1 open loop control
  • the communication system includes user equipment (UE), eNodeB, MME, serving gateway (SGW), and operation support system (operation support system, OSS) Several devices.
  • UE user equipment
  • eNodeB eNodeB
  • MME mobility management Entity
  • SGW serving gateway
  • operation support system operation support system, OSS
  • the eNodeB is a radio base station in a long term evolution (LTE) network of universal mobile communication technology, and is also a network element of the LTE radio access network.
  • the eNodeB includes radio resource management (radio resource management, RRM) functions, internet protocol (IP) header compression and user data stream encryption for interconnection between networks, MME selection when UE attaches, scheduling transmission of paging information, and broadcasting Information scheduling and transmission, as well as setting and providing eNodeB measurement and other functions.
  • RRM radio resource management
  • IP internet protocol
  • the MME is a network element of the LTE network, and the MME, SGW, and public data network gateway (PGW) are collectively referred to as the core network of 4G.
  • MME is the key control node of the 3rd generation partnership project (3rd generation partnership project, 3GPP) protocol LTE access network. It is responsible for the positioning of idle mode UEs and the paging process, including relay. Simply put, MME is responsible for signaling
  • the processing part includes functions such as access control, mobility management, attach and detach, session management, and selection of SGW and PGW.
  • SGW The main functions of SGW include: when switching between eNodeBs, it can be used as a local anchor point and assist in completing the eNodeB reordering function; when switching between 3GPP different access systems, as a mobility anchor point, it also has a reordering function; execution Legal interception function; routing and forwarding of data packets; packet marking at the uplink and downlink transmission layers; in idle state, downlink packet buffering and initiating network-triggered service request functions; used for billing among operators.
  • the OSS system has functions such as operation support and preparation, business realization, business guarantee, and business measurement.
  • the DDoS caused by the UE includes but not limited to the following:
  • UE->eNodeB uplink signaling A large number of UE access air interface signaling will cause eNodeB overload.
  • Uplink signaling between UE->MME Excessive signaling generated by a large number of UEs will cause the MME to be overloaded.
  • the DDoS caused by the UE includes but not limited to the following:
  • Uplink service data of UE->eNodeB A large amount of uplink air interface data generated by UE causes eNodeB to be overloaded.
  • Uplink service data of eNodeB->SGW The excessive data sent by the eNodeB causes the SGW to be overloaded.
  • open-loop control is to perform flow control based on the number of received signaling messages or the amount of service data.
  • open-loop control includes, but is not limited to, based on random access preamble (random access preamble), radio resource control (radio resource control, RRC) connection request (connection request), handover request (handover request), RRC connection re-establishment request (connection reestablishment request), call (Paging), downlink data volume (downlink data volume) for flow control.
  • RRC radio resource control
  • connection request connection request
  • handover request handover request
  • RRC connection re-establishment request connection reestablishment request
  • call Paging
  • downlink data volume downlink data volume
  • flow control can be started through the CPU overload message.
  • the eNodeB is notified through the OVERLOAD START (overload start) message to start flow control, and the number of UE access is limited according to the RRC access reason; when the MME overload is eliminated, the OVERLOAD STOP (overload end) message is notified
  • the eNodeB stops flow control.
  • 3GPP 3rd Generation Partnership Project
  • TS Technical Support
  • random access flow control is to relieve eNodeB overload caused by a large number of UEs random access.
  • a large number of random access messages will increase the system load and cause problems such as system reset.
  • flow control based on random access random access can be rejected according to the CPU threshold to control overload.
  • the initial RRC access message (Connection Request) is the start message of a process, for example, S1HANDOVER REQUEST (handover request) between eNodeB and MME, and X2HANDOVER REQUEST (handover request) between eNodeB and eNodeB.
  • S1HANDOVER REQUEST handover request
  • X2HANDOVER REQUEST handover request
  • flow control can be performed based on the number of requests per second, CPU occupancy rate, message priority, etc., based on the initial RRC access message, thereby performing flow control at the beginning of the signaling process, reducing system load from the source.
  • the Paging message is the initial message of a process. After the Paging message is successfully processed, it will trigger a large number of users to enter the network, which will bring a lot of overhead to the entire system. Therefore, in the case of performing flow control based on Paging messages, flow control can be performed according to the CPU threshold and service priority. In this way, flow control is performed at the beginning of the signaling process, reducing the system load from the source.
  • Control method 2 Closed loop control
  • Closed-loop control refers to flow control based on the CPU occupancy rate.
  • the flow control scheme includes denying the initial access or handover of low-priority services.
  • the embodiment of the present application provides a method for blocking signaling storm.
  • the method performs signaling storm detection based on traffic statistics information. When a signaling storm is detected, it is based on the call history record of the UE.
  • the CHR) log determines the target UE that generated the signaling that caused the signaling storm. After that, by blocking the signaling of the target UE, the signaling storm is blocked more accurately and the blocking effect is improved.
  • the implementation environment includes a radio access network (RAN) and a core network (core). Backhaul.
  • RAN radio access network
  • core core network
  • the RAN provides the connection between the UE and the core network.
  • the purpose of the RAN architecture is to establish a user plane.
  • a signaling plane needs to be established.
  • the 5G base station (gNode) is used to establish a signaling connection with the UE in order to transmit the information.
  • the order is transmitted to the core network and a digital server is established.
  • the RAN includes two logical units: a central unit (CU) and a distributed unit (DU).
  • CU and DU are the internal structure of gNode, which can be deployed in one according to scenarios and requirements. Can be deployed separately.
  • CU has packet data convergence protocol (PDCP) and RRC functions.
  • DU is a newly introduced logical network element for 5G and has L2 and L1 functions.
  • the core network includes access and mobility management network elements (AMF), user plane functions (UPF), unified data management (UDM) and other equipment.
  • AMF access and mobility management network elements
  • UPF user plane functions
  • UDM unified data management
  • the implementation environment also includes three application scenarios, namely resource unit (RU), which provides enhanced mobile broadband (eMBB) and massive machine type communications (mMTC). And ultra-reliable and low latency communication (URLLC).
  • resource unit eMBB
  • mMTC massive machine type communications
  • URLLC ultra-reliable and low latency communication
  • MEC mobile edge computing
  • MEC mobile edge computing
  • the core network can also be connected to the Internet, the Internet of Things (IoT) platform, and the Internet of Vehicles.
  • IoT Internet of Things
  • the implementation environment also includes a cybersecurity intelligence system (CIS).
  • CIS cybersecurity intelligence system
  • a flow probe is also connected between the CIS and the Internet, and the flow probe detects the flow image of the Internet.
  • the CIS can issue an international mobile subscriber identification number (MISI) to the core network, and the core network can issue a temporary mobile subscriber identity (TMSI) to the RAN.
  • MIMI international mobile subscriber identification number
  • TMSI temporary mobile subscriber identity
  • an embodiment of the present application provides a method for blocking a signaling storm.
  • This method takes the process of blocking signaling storms performed by CIS as an example.
  • Base stations and core network equipment can report signaling logs and traffic statistics information to CIS, and flow probes can also report metadata to CIS, such as UE alarms.
  • Log. CIS performs signaling storm detection based on the received data, that is, performs DDoS detection. After detecting the signaling storm, the CIS further determines the target UE that generated the signaling that caused the signaling storm, and blocks the signaling storm by blocking the signaling of the target UE. Referring to FIG. 3, the method includes the following steps 301 to 305.
  • Acquire traffic statistics information which refers to statistics and output information of traffic performance indicators.
  • Traffic statistics information can be applied to user behavior analysis, network trend analysis, capacity planning, fault location, etc.
  • the method provided in the embodiment of the present application first obtains traffic statistics information before blocking the signaling storm.
  • the embodiment of the present application does not limit it.
  • both the base station and the core network device can report traffic statistics information to the CIS, and the CIS can perform signaling storm detection based on the traffic statistics information reported by the base station and the core network device.
  • the traffic statistics information obtained by the CIS includes one or more of the traffic statistics log of the base station reported by the base station and the traffic statistics log of the core network reported by the core network equipment.
  • the traffic log of the base station and the traffic log of the core network include, but are not limited to, the total number of online UEs, the number of UEs in each state, and so on.
  • the traffic statistics logs reported by the base station and core network equipment are log feature fields selected from different protocols. For example, CPU occupancy rate, signaling flow count, number of attachment requests, number of service requests, signaling frequency, and number of access UEs, etc., are not limited by the content of the system log in this embodiment of the application.
  • the embodiment of the present application does not limit the timing of reporting traffic statistics information by the base station and the core network device, and it may be reported periodically or in real time.
  • the CIS After the CIS obtains the traffic statistics information, it can perform signaling storm detection in real time, or it can perform periodic detection.
  • the method provided in the embodiment of the present application supports the preprocessing of the traffic statistics information when performing signaling storm detection based on the traffic statistics information. Afterwards, signaling storm detection is performed based on the preprocessed data.
  • preprocessing includes, but is not limited to, format conversion, character conversion, field simplification and other processing. For example, the processed data is shown in Table 1 below.
  • the preprocessed data includes the CPU load value, the number of signaling procedures, the packet count of signaling procedures, the total number of online UEs, the number of UEs in each state, the count of authentication procedures, and the number of successful authentications.
  • the description of each data is detailed in Table 1 above.
  • HSS is the main user database supporting IMS network entities used to process calls/sessions.
  • the HSS contains user profiles, performs user authentication and authorization, and can provide information about the user's physical location.
  • performing signaling storm detection based on traffic statistics information includes, but is not limited to: performing signaling storm detection based on traffic statistics information using isolated forests and timing prediction. Exemplarily, if the data is preprocessed, based on the preprocessed data, the isolated forest and time series prediction are used for signaling storm detection.
  • isolation forest is a fast anomaly detection method with linear time complexity and high accuracy, and it can be used for attack detection in network security.
  • iForest is suitable for continuous numerical data anomaly detection. Anomalies are defined as "more likely to be separated"-can be understood as sparsely distributed and far away from high-density groups point. To explain with statistics, in the data space, sparsely distributed areas indicate that the probability of data occurring in this area is very low, so the data falling in these areas can be considered abnormal.
  • an abnormal network element and a normal network element are determined after an isolated forest is used to perform anomaly detection based on the traffic statistics information.
  • the abnormal network element is the network element that is attacked by the signaling storm.
  • the CPU occupancy rate is 50%
  • the attachment request (attatch REQ) in the signaling flow count is ⁇ 10000
  • the service request (Service request) is ⁇ 8000
  • the signaling frequency is ⁇ 100000.
  • the number of access UEs is less than 50.
  • the attachment requests (attatch REQ) in the signaling flow count > 100,000
  • the signaling frequency > 1,000,000.
  • the CHR log refers to a log file used to record problems that a user has during a call.
  • the CHR log is used to record the problems that the user has during the call, and can be used to locate the cause of the failure.
  • the content in the CHR log includes, but is not limited to, one or more types of information such as UE access time, access duration, process count, process packet count, and signaling process sequence.
  • the method provided by the embodiment of the present application locates the target UE that generates the signaling that causes the signaling storm based on the CHR log. Therefore, when a signaling storm is detected, the CHR log of the UE is acquired.
  • the embodiment of the present application does not limit the number of UEs.
  • the embodiment of the present application does not limit it. For example, as shown in FIG.
  • the base station and the core network device may report the CHR log of the UE to the CIS, and the number of the UE includes at least one.
  • the CHR log of at least one UE includes one or more of the signaling log of at least one UE reported by the core network device and the signaling log of at least one UE reported by the core network device.
  • the flow probe may report the alarm log of the UE to the CIS.
  • the CHR log of at least one UE acquired by the CIS further includes: an alarm log of at least one UE reported by the flow probe.
  • a target UE based on the CHR log of at least one UE, where the target UE refers to a UE that generates signaling that causes a signaling storm.
  • determining the target UE based on the CHR log of at least one UE includes: performing feature extraction on the CHR log of the at least one UE; based on the extracted feature
  • the behavior characteristic sequence corresponding to each UE in at least one UE is obtained by analysis; the neural network model is used to identify the behavior characteristic sequence corresponding to each UE in the at least one UE; when the abnormal behavior characteristic sequence is identified, the abnormal behavior characteristic sequence is identified.
  • the UE corresponding to the behavior feature sequence is used as the target UE, and the neural network model is obtained by training using the behavior feature sequence corresponding to the normal UE.
  • the method further includes acquiring a neural network model for identifying the behavior characteristic sequence of the UE.
  • This embodiment of the application is not correct for acquiring the neural network.
  • the process of the model and the type of neural network model are limited. Exemplarily, as shown in FIG. 5, taking the CHR log obtained by the CIS as an example, the CHR log records related information of the user in the form of a log file. Through feature extraction of the CHR log, features such as access time, access duration, process count, process packet count, signaling process sequence, and UE bandwidth can be obtained.
  • the initial neural network model can be trained based on the features extracted from the CHR log acquired in the historical time period.
  • the length of the historical time period can be set based on scenarios or experience.
  • the embodiment of the present application does not limit the length of the historical time period. For example, take a historical period of one week as an example.
  • the initial neural network model learns the behavior feature sequence of the normal UE in the reference time period.
  • the reference duration can be set based on scenarios or experience. For example, taking the reference duration of 5 minutes as an example, the process of learning the normal UE signaling procedure can be trained offline.
  • the initial neural network model may be a hidden markov model (HMM).
  • HMM The basic idea of HMM is to establish a UE signaling flow sequence state machine by learning a large number of normal UE signaling flow sequences, and to identify abnormal UEs by calculating the state transition probability.
  • the sequence state machine includes several states: sequence abnormality, grouping technology abnormality, time behavior abnormality and process technology abnormality.
  • the HMM When detecting a signaling storm, after acquiring the CHR log, perform feature extraction on the CHR log of at least one UE, and obtain a behavior feature sequence corresponding to each UE in the at least one UE based on the extracted feature analysis. By inputting the analyzed behavior feature sequence of each UE into the trained neural network model, online detection is performed based on the neural network model.
  • the HMM identifies whether the UE's behavior characteristic sequence is normal, so as to determine whether the UE is a normal UE or a malicious UE.
  • the malicious UE is the UE that generates the signaling that causes the signaling storm, that is, the target UE.
  • a UE whose behavior characteristic sequence meets the normal procedure is a normal UE
  • a UE whose behavior characteristic sequence does not satisfy the normal procedure is a malicious UE.
  • the behavior characteristic sequence corresponding to the UE is service request(12:00:14)-->service request(12:00:15)-->CN init detach(12:03:15) -->service request(12:03:20)
  • the behavior characteristic sequence corresponding to the UE is attach(12:05:06)-->TAU(12:05:07)-->TAU(12:05:07)-->TAU(12:05:08)- ->attach(12:05:10)-->detach(12:05:15)-->TAU(12:05:33)-->detach(12:05:44), this behavior characteristic is shown in Within 5 minutes, the UE frequently attaches and detaches. Therefore, it is the abnormal behavior characteristic sequence corresponding to the abnormal UE.
  • the abnormal UE security event can be further determined subsequently, for example, a malicious UE value-added service service, and the security event is pushed to the terminal.
  • the method further includes: when there are multiple target UEs corresponding to the abnormal behavior characteristic sequence, comparing the multiple abnormal behavior characteristic sequences The corresponding target UE is associated.
  • the identified characteristics of the target UE are the content of the abnormal UE group portrait in Figure 6, including the abnormal UE access time, access time, process count, and process group count And signaling flow sequence.
  • the key characteristics of the core network signaling DDoS attack attacked by the signaling storm include the increase in the number of access UEs, the increase in the process count, the increase in the process packet count, and the proportion of the process packet count. Profiles and key features of core network signaling DDoS attacks can get the features of malicious UE signaling.
  • the malicious UE is determined based on the abnormal UE group profile and the key characteristics of the core network signaling DDoS attack, so as to obtain the IMSI of the malicious UE on the signaling plane.
  • the IP of the alarmed UE can be determined.
  • the CHR records the relationship between IP and IMIS.
  • Query the IP and IMSI in the C&C ie, CC UE IP query obtains the malicious UE IMSI
  • the IMSI of the malicious UE is determined by associating the IMSI of the malicious UE on the signaling plane with the IMSI of the C&C malicious UE on the data plane.
  • Figure 6 only takes the alarm information of the UE reported by the flow probe as an example. If the CIS does not obtain the alarm information of the UE reported by the flow probe, the second step in Figure 6 can be omitted. Instead, the first and second steps are directly used to determine the IMSI of the malicious UE.
  • blocking the signaling of the target UE includes: processing the information of the signaling storm and the information of the target UE as a security event, and blocking the signaling with a blocking strategy based on the security event.
  • the embodiment of this application does not limit the blocking strategy of the security event.
  • the encapsulated security event is pushed, so that after the operation and maintenance monitoring personnel monitor the security event, manually issue the blocking command to the security event involved
  • the target UE performs signaling blocking.
  • the blocking interface of the core network may also be called.
  • the blocking interface may be as shown in the interface 6 in FIG. 2, and the IMSI is issued to the core network by calling the interface 6 of the core network for blocking.
  • the core network issues the TMSI of the target UE that generates the signaling storm to the radio for air interface blocking.
  • blocking the signaling of the target UE includes: detecting the false source of the target UE to obtain the false source in the target UE.
  • the false source refers to the UE that uses the false address to communicate; the first priority is used.
  • the blocking strategy blocks the signaling of the false sources in the target UE, and uses the second priority blocking strategy to block the signaling of non-false sources in the target UE; the first priority is higher than the second priority level.
  • performing false source detection on the target UE to obtain the false source in the target UE includes: obtaining the IMSI of the target UE, paging the target UE based on the IMSI of the target UE, and according to the paging result Determine the false source in the target UE. For example, if the target UE is paged based on the IMSI of the target UE, if the paging result is a successful paging, the target UE is a non-fake source, and if the paging result is a paging failure, the target UE is a false source.
  • the method provided by the embodiments of the present application performs signaling storm detection through traffic statistics information.
  • the target UE that generated the signaling that caused the signaling storm is determined based on the CHR log of the UE, and Signal blocking is performed on the target UE to more accurately block the signaling storm and improve the blocking effect.
  • the determined target UE it is further confirmed whether it is a false source, and different priorities are used for blocking, which further improves the blocking effect.
  • the process of blocking the signaling storm includes steps 71-76.
  • CIS obtains traffic statistics/CHR logs, and preprocesses the data in the conversation statistics/CHR logs. Get the input data needed to detect DDoS.
  • 72. Use the neural network model to perform DDoS detection, and obtain the DDoS detection result, that is, monitor whether a signaling storm occurs.
  • 73. When a signaling storm is detected, perform correlation analysis on the UE based on the signaling characteristics of the signaling storm and the CHR log of the UE, and determine the target UE that generated the signaling that caused the signaling storm, that is, the malicious UE.
  • the false source of the malicious UE may be further detected to determine the false source of the malicious UE.
  • 74. Process the information of the signaling storm and the information of the malicious UE as a DDoS security event, and block the signaling based on a security event-based blocking strategy. For example, 75, the core network linkage interface is automatically called to perform the blocking operation, or, 76, the security event is pushed to the operation and maintenance monitoring terminal by means of event notification, and the operation and maintenance monitoring personnel manually call the core network linkage interface to perform the blocking operation. So as to block the signaling storm.
  • the embodiment of the present application only uses the system shown in FIG. 2 as an example to describe the method for blocking signaling storm provided by the embodiment of the present application, but does not apply to the method provided by the embodiment of the present application.
  • the scene is limited.
  • the protocol involved in the system shown in FIG. 2 it can also be applied to the interaction of other protocols.
  • the protocol involved in the method provided in the embodiment of the present application can be flexibly extended.
  • An embodiment of the present application also provides a device for blocking a signaling storm.
  • the device for blocking a signaling storm includes: an acquisition module 801, a detection module 802, a determination module 803, and a blocking module 804.
  • the acquiring module 801 is used to acquire traffic statistics information, which refers to statistics and output information of traffic performance indicators.
  • the detection module 802 is configured to perform signaling storm detection based on traffic statistics information.
  • the obtaining module 801 is also used for obtaining a call history record CHR log of at least one user equipment UE when a signaling storm is detected.
  • the CHR log refers to a log file used to record problems that a user has encountered during a call.
  • the determining module 803 is configured to determine a target UE based on the CHR log of at least one UE, and the target UE refers to a UE that generates a signaling that causes a signaling storm.
  • the blocking module 804 is used to block the signaling of the target UE.
  • the blocking module 804 is used to detect the false source of the target UE to obtain the false source in the target UE.
  • the false source refers to the UE that uses the false address to communicate; the first priority is adopted.
  • the blocking strategy of the target UE is used to block the signaling of the false source in the target UE, and the second priority blocking strategy is used to block the signaling of the non-false source in the target UE; where the first priority is higher than the second priority.
  • the blocking module 804 is used to obtain the International Mobile Subscriber Identity (IMSI) of the target UE, to page the target UE based on the IMSI of the target UE, and to determine the false source in the target UE according to the paging result .
  • IMSI International Mobile Subscriber Identity
  • the traffic statistics information includes one or more of the traffic statistics log of the base station reported by the base station and the traffic statistics log of the core network reported by the core network device;
  • the CHR log of the at least one UE includes One or more of the signaling log of the at least one UE reported by the base station and the signaling log of the at least one UE reported by the core network device.
  • the CHR log of at least one UE further includes: an alarm log of at least one UE reported by the flow probe.
  • the determining module 803 is further configured to perform feature extraction on the CHR log of at least one UE; obtain the behavior feature sequence corresponding to each UE in the at least one UE based on the extracted feature analysis;
  • the network model identifies the behavior characteristic sequence corresponding to each UE in at least one UE; when the abnormal behavior characteristic sequence is identified, the UE corresponding to the abnormal behavior characteristic sequence is used as the target UE, and the neural network model adopts the behavior corresponding to the normal UE
  • the feature sequence is obtained through training.
  • the determining module 803 is further configured to associate the target UEs corresponding to the multiple abnormal behavior characteristic sequences when there are multiple target UEs corresponding to the abnormal behavior characteristic sequences.
  • the blocking module 804 is configured to process the information of the signaling storm and the information of the target UE as a security event, and perform signaling blocking with a blocking strategy based on the security event.
  • the device provided by the embodiment of the present application performs signaling storm detection based on traffic statistics information.
  • the target UE that generated the signaling that caused the signaling storm is determined based on the CHR log of the UE. Make blocking, so as to block the signaling storm more accurately and improve the blocking effect.
  • the determined target UE it is further confirmed whether it is a false source, and different priorities are used for blocking, which further improves the blocking effect.
  • an embodiment of the present application also provides a device 900 for blocking signaling storm.
  • the device 900 for blocking signaling storm shown in FIG. 9 is used to perform operations involved in the foregoing method for blocking signaling storm.
  • the device 900 for blocking a signaling storm includes a memory 901, a processor 902, and an interface 903, and the memory 901, the processor 902, and the interface 903 are connected by a bus 904.
  • At least one instruction is stored in the memory 901, and at least one instruction is loaded and executed by the processor 902, so as to implement any one of the foregoing methods for blocking a signaling storm.
  • the interface 903 is used to communicate with other devices in the network.
  • the interface 903 may be implemented in a wireless or wired manner.
  • the interface 903 may be a network card.
  • FIG. 9 only shows a simplified design of the device 900 for blocking a signaling storm.
  • the device that blocks the signaling storm can include any number of interfaces, processors, or memories.
  • the above-mentioned processor may be a central processing unit (CPU), other general-purpose processors, digital signal processing (DSP), application specific integrated circuit (ASIC), Field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor may be a microprocessor or any conventional processor. It is worth noting that the processor may be a processor that supports an advanced reduced instruction set machine (advanced RISC machines, ARM) architecture.
  • the foregoing memory may include a read-only memory and a random access memory, and provide instructions and data to the processor.
  • the memory may also include non-volatile random access memory.
  • the memory can also store device type information.
  • the memory can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memory, wherein the non-volatile memory can be a read-only memory (read-only memory, ROM) , Programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically erasable programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM), which is used as an external cache. By way of exemplary but not limiting illustration, many forms of RAM are available.
  • static random access memory static random access memory
  • dynamic random access memory dynamic random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access Memory double data date SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM
  • a computer-readable storage medium is also provided, and at least one instruction is stored in the storage medium, and the instruction is loaded and executed by a processor to implement the method for blocking a signaling storm as described in any of the above method embodiments.
  • This application provides a computer program.
  • the computer program When the computer program is executed by a computer, it can cause a processor or computer to execute various operations and/or procedures corresponding to the foregoing method embodiments.
  • the computer may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium, (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk).

Landscapes

  • Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Physics (AREA)
  • Mathematical Analysis (AREA)
  • General Physics & Mathematics (AREA)
  • Algebra (AREA)
  • Physics & Mathematics (AREA)
  • Pure & Applied Mathematics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种阻断信令风暴的方法、装置、设备及存储介质，属于网络技术领域。方法包括：获取话统信息，话统信息是指话务性能指标的统计及输出信息；基于话统信息进行信令风暴检测；当检测到信令风暴时，获取至少一个用户设备UE的呼叫历史记录CHR日志，CHR日志是指用于记录用户在呼叫过程中出现的问题的日志文件；基于至少一个UE的CHR日志确定目标UE，目标UE是指产生导致信令风暴的信令的UE；对目标UE进行信令阻断。通过话统信息进行信令风暴检测，当检测到信令风暴时，基于UE的CHR日志确定产生导致信令风暴的信令的目标UE，通过对目标UE进行信令阻断，以此更加准确地阻断信令风暴，提高阻断效果。

Description

阻断信令风暴的方法、装置、设备及存储介质
本申请要求于2019年9月3日提交中国国家知识产权局、申请号为201910829015.1、申请名称为“阻断信令风暴的方法、装置、设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，进一步涉及人工智能(Artificial Intelligence，AI)在通信技术领域中的应用，特别涉及一种阻断信令风暴的方法、装置、设备及存储介质。
背景技术
随着终端比例大、数据业务大幅提升、业务需求越来越多样化，带来时延短、速度快、流量大等特点。如果无线网络设备(例如移动管理节点功能(mobility management entity function，MME)，演进基站(evolved NodeB，eNodeB)等)收到的终端信令请求数目超过了无线网络设备对于各项信令的处理能力，将引发网络拥塞以至于产生雪崩效应，导致网络不可用，该种情况称为信令风暴。
相关技术通过在无线网络设备中设置中央处理器(Central Processing Unit，CPU)资源占用率阈值/单位时间的信令数目阈值来进行流量控制，以实现对信令风暴进行阻断。然而，该种控制方式只是对信令过载进行系统保护，对信令风暴的阻断方式不够精准，阻断效果不佳。
发明内容
本申请实施例提供了一种阻断信令风暴的方法、装置、设备及存储介质，以解决相关技术提供的问题，技术方案如下：
一方面，提供了一种阻断信令风暴的方法，所述方法包括：获取话统信息，所述话统信息是指话务性能指标的统计及输出信息；基于所述话统信息进行信令风暴检测；当检测到信令风暴时，获取至少一个用户设备UE的呼叫历史记录CHR日志，所述CHR日志是指用于记录用户在呼叫过程中出现的问题的日志文件；基于所述至少一个UE的CHR日志确定目标UE，所述目标UE是指产生导致所述信令风暴的信令的UE；对所述目标UE进行信令阻断。
通过话统信息进行信令风暴检测，当检测到信令风暴时，基于UE的CHR日志确定产生导致信令风暴的信令的目标UE，通过对目标UE进行信令阻断，以此更加准确地阻断信令风暴，提高阻断效果。
在一种示例性实施例中，所述对所述目标UE进行信令阻断，包括：对所述目标UE进行虚假源探测，得出所述目标UE中的虚假源，所述虚假源是指采用虚假地址进行通信的UE；采用第一优先级的阻断策略对所述目标UE中的虚假源进行信令阻断，采用第二优先级的阻断策略对所述目标UE中的非虚假源进行信令阻断，其中，所述第一优先级高于所 述第二优先级。
针对确定出的目标UE，进一步确认是否为虚假源，以采用不同优先级进行阻断，进一步提升了阻断效果。
在一种示例性实施例中，所述对所述目标UE进行虚假源探测，得出所述目标UE中的虚假源，包括：获取目标UE的国际移动用户识别码IMSI，基于所述目标UE的IMSI对所述目标UE进行寻呼，根据寻呼结果确定所述目标UE中的虚假源。
在一种示例性实施例中，所述话统信息包括基站上报的所述基站的话统日志及核心网设备上报的核心网的话统日志中的一种或多种；
所述至少一个UE的CHR日志包括所述基站上报的所述至少一个UE的信令日志和所述核心网设备上报的所述至少一个UE的信令日志中的一种或多种。
在一种示例性实施例中，所述至少一个UE的CHR日志还包括：流探针上报的所述至少一个UE的告警日志。
在一种示例性实施例中，所述基于所述至少一个UE的CHR日志确定目标UE，包括：对所述至少一个UE的CHR日志进行特征提取；基于提取的特征分析得到所述至少一个UE中的每个UE分别对应的行为特征序列；采用神经网络模型对所述至少一个UE中的每个UE分别对应的行为特征序列进行识别；当识别出异常行为特征序列时，将异常行为特征序列对应的UE作为目标UE，所述神经网络模型采用正常UE对应的行为特征序列进行训练得到。
在一种示例性实施例中，所述当识别出异常行为特征序列时，将异常行为特征序列对应的UE作为目标UE之后，还包括：当存在多个异常行为特征序列对应的目标UE时，对多个异常行为特征序列对应的目标UE进行关联。
在一种示例性实施例中，所述对所述目标UE进行信令阻断，包括：将所述信令风暴的信息及所述目标UE的信息处理为安全事件，以基于所述安全事件的阻断策略进行信令阻断。
还提供了一种阻断信令风暴的装置，所述装置包括：获取模块，用于获取话统信息，所述话统信息是指话务性能指标的统计及输出信息；检测模块，用于基于所述话统信息进行信令风暴检测；所述获取模块，还用于当检测到信令风暴时，获取至少一个用户设备UE的呼叫历史记录CHR日志，所述CHR日志是指用于记录用户在呼叫过程中出现的问题的日志文件；确定模块，用于基于所述至少一个UE的CHR日志确定目标UE，所述目标UE是指产生导致所述信令风暴的信令的UE；阻断模块，用于对所述目标UE进行信令阻断。
在一种示例性实施例中，所述阻断模块，用于对所述目标UE进行虚假源探测，得出所述目标UE中的虚假源，所述虚假源是指采用虚假地址进行通信的UE；采用第一优先级的阻断策略对所述目标UE中的虚假源进行信令阻断，采用第二优先级的阻断策略对所述目标UE中的非虚假源进行信令阻断，其中，所述第一优先级高于所述第二优先级。
在一种示例性实施例中，所述阻断模块，用于获取目标UE的国际移动用户识别码IMSI，基于所述目标UE的IMSI对所述目标UE进行寻呼，根据寻呼结果确定所述目标UE中的虚假源。
在一种示例性实施例中，所述话统信息包括基站上报的所述基站的话统日志及核心网设备上报的核心网的话统日志中的一种或多种；所述至少一个UE的CHR日志包括所述基站上报的所述至少一个UE的信令日志和所述核心网设备上报的所述至少一个UE的信令日 志中的一种或多种。
在一种示例性实施例中，所述至少一个UE的CHR日志还包括：流探针上报的所述至少一个UE的告警日志。
在一种示例性实施例中，所述确定模块，用于对所述至少一个UE的CHR日志进行特征提取；基于提取的特征分析得到所述至少一个UE中的每个UE分别对应的行为特征序列；采用神经网络模型对所述至少一个UE中的每个UE分别对应的行为特征序列进行识别；当识别出异常行为特征序列时，将异常行为特征序列对应的UE作为目标UE，所述神经网络模型采用正常UE对应的行为特征序列进行训练得到。
在一种示例性实施例中，所述确定模块，还用于当存在多个异常行为特征序列对应的目标UE时，对所述多个异常行为特征序列对应的目标UE进行关联。
在一种示例性实施例中，所述阻断模块，用于将所述信令风暴的信息及所述目标UE的信息处理为安全事件，以基于所述安全事件的阻断策略进行信令阻断。
还提供一种阻断信令风暴的设备，所述设备包括：存储器及至少一个处理器，所述存储器中存储有至少一条指令或程序，所述至少一条指令或程序由所述至少一个处理器加载并执行，以实现上述任一所述的阻断信令风暴的方法。
还提供了一种计算机可读存储介质，所述存储介质中存储有至少一条指令或程序，所述指令或程序由处理器加载并执行以实现如上任一所述的阻断信令风暴的方法。
提供了另一种通信装置，该装置包括：收发器、存储器和处理器。其中，该收发器、该存储器和该处理器通过内部连接通路互相通信，该存储器用于存储指令或程序，该处理器用于执行该存储器存储的指令或程序，以控制收发器接收信号，并控制收发器发送信号，并且当该处理器执行该存储器存储的指令或程序时，使得该处理器执行上述任一种可能的实施方式中的方法。在一种实施例中，处理器和存储器、收发器之间可通过总线通信。
作为一种示例性实施例，所述处理器为一个或多个，所述存储器为一个或多个。
作为一种示例性实施例，所述存储器可以与所述处理器集成在一起，或者所述存储器与处理器分离设置。
在具体实现过程中，存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
提供了一种计算机程序(产品)，所述计算机程序(产品)包括：计算机程序代码，当所述计算机程序代码被计算机运行时，使得所述计算机执行上述各方面中的方法。
提供了一种芯片，包括处理器，用于从存储器中调用并运行所述存储器中存储的指令或程序，使得安装有所述芯片的通信设备执行上述各方面中的方法。
提供另一种芯片，包括：输入接口、输出接口、处理器和存储器，所述输入接口、输出接口、所述处理器以及所述存储器之间通过内部连接通路相连，所述处理器用于执行所述存储器中的代码，当所述代码被执行时，所述处理器用于执行上述各方面中的方法。
附图说明
图1为本申请示例性实施例提供的通信系统结构示意图；
图2为本申请示例性实施例提供的实施环境示意图；
图3为本申请示例性实施例提供的阻断信令风暴的方法流程图；
图4为本申请实施例提供的检测信令风暴的过程示意图；
图5为本申请实施例提供的确定目标UE的过程示意图；
图6为本申请实施例提供的关联UE的过程示意图；
图7为本申请实施例提供的阻断信令风暴的过程示意图；
图8为本申请实施例提供的阻断信令风暴的装置结构示意图；
图9为本申请实施例提供的阻断信令风暴的设备的结构示意图。
具体实施方式
本申请的实施方式部分使用的术语仅用于对本申请的具体实施例进行解释，而非旨在限定本申请。
随着终端比例大、数据业务大幅提升、业务需求越来越多样化，带来时延短、速度快、流量大等特点，如果无线网络设备(例如MME，eNodeB等)收到的终端信令请求超过了无线网络设备对于各项信令的处理能力，将引发网络拥塞以至于产生雪崩效应，导致网络不可用，该种情况称为信令风暴。
相关技术中，为了降低可能的信令风暴对用户的正常业务造成影响，通过在无线网络设备中设置CPU资源占用率阈值/单位时间的信令数目阈值，对CPU占用率、单位时间收到的信令消息数或业务数据量进行统计，基于统计数据与设置的CPU资源占用率阈值/单位时间的信令数目阈值来判断是否触发流量控制。其中，流量控制包括但不限于开环控制和闭环控制两种控制方式。
控制方式一：开环控制
以图1所示的通信系统为例进行说明，在该通信系统中，包括用户设备(user equipment，UE)、eNodeB、MME、服务网关(serving gateway，SGW)和操作支撑系统(operation support system，OSS)几种设备。
eNodeB是通用移动通信技术的长期演进(long term rvolution，LTE)网络中的无线基站，也是LTE无线接入网的网元。eNodeB包括无线资源管理(radio resource management，RRM)功能、网络之间互连的协议(internet protocol，IP)头压缩及用户数据流加密、UE附着时的MME选择、寻呼信息的调度传输、广播信息的调度传输以及设置和提供eNodeB的测量等功能。
MME是LTE网络的网元，MME和SGW以及公用数据网网关(public data network gateway，PGW)一起被称作4G的核心网。MME是第三代合作伙伴计划(3rd generation partnership project，3GPP)协议LTE接入网络的关键控制节点，它负责空闲模式的UE的定位，传呼过程，包括中继，简单的说MME是负责信令处理部分，包括接入控制、移动性管理、附着与去附着、会话管理和SGW与PGW的选择等功能。
SGW的主要功能包括：进行eNodeB间切换时，可以作为本地锚定点，并协助完成eNodeB的重排序功能；在3GPP不同接入系统间切换时，作为移动性锚点，同样具有重排序功能；执行合法侦听功能；进行数据包的路由和前转；在上行和下行传输层进行分组标记；空闲 状态下，下行分组缓冲和发起网络触发的服务请求功能；用于运营商间的计费等。
OSS系统具有运营支持和准备、业务实现、业务保障、业务计量等功能。
此外，UE和eNodeB之间具有Uu接口；eNodeB与MME之间具有控制面接口，通常称为：S1-C；eNodeB与SGW之间具有用户面接口，通常称为S1-U。该图1所示的通信系统中，针对控制面数据流过载，由UE引起DDoS的情况，包括但不限于如下几种：
1、UE->eNodeB的上行信令：大量UE产生的接入空口信令会导致eNodeB过载。
2、eNodeB->MME的上行信令：eNodeB发送过量的信令会导致MME过载。
3、MME->eNodeB的下行信令：MME下发过量的信令会导致eNodeB过载。
4、eNodeB<->eNodeB之间的信令：eNodeB之间过量的信令或数据导致对端eNodeB过载。
5、UE->MME之间的上行信令：大量UE产生的过量的信令会导致MME过载。
针对用户面数据流过载，由UE引起DDoS的情况，包括但不限于如下几种：
1、UE->eNodeB的上行业务数据：大量UE产生的上行空口数据导致eNodeB过载。
2、eNodeB->SGW的上行业务数据：eNodeB发送过量的数据导致SGW过载。
3、SGW->eNodeB的下行业务数据：SGW下发过量的数据导致eNodeB过载。
4、eNodeB<->eNodeB之间的业务数据：eNodeB之间过量的信令或数据导致对端eNodeB过载。
针对上述的过载情况，开环控制即基于收到的信令消息数或业务数据量进行流量控制。示例性地，开环控制包括但不限于基于随机接入前导(random access preamble)、无线资源控制(radio resource control，RRC)连接请求(connection request)、切换请求(handover request)、RRC连接重建请求(connection reestablishment request)、呼叫(Paging)、下行数据量(downlink data volume)进行流量控制。例如，以如下几种开环控制的情况进行举例说明：
MME过载流量控制
该种基于MME过载进行流量控制的情况下，可以通过CPU过载消息启动流量控制。示例性地，当MME发生过载时，通过OVERLOAD START(过载启动)消息通知eNodeB启动流量控制，按照RRC接入原因限制UE接入数量；当MME过载消除后，通过OVERLOAD STOP(过载结束)消息通知eNodeB停止流量控制。协议相关原理请参考第三代合作伙伴计划(3rd generation partnership project，3GPP)技术支持(Technical support，TS)36.413(R9/R10)。
随机接入流量控制
随机接入流量控制目的是缓解大量UE随机接入而引起eNodeB过载。大量的随机接入消息会使系统负载变高，从而导致系统复位等问题，该种基于随机接入进行流量控制的情况下，可根据CPU阈值做随机接入的拒绝来控制过载。
初始RRC接入消息流量控制
初始RRC接入消息(Connection Request)是一个流程的起始消息，例如，eNodeB与MME之间的S1HANDOVER REQUEST(切换请求)，eNodeB与eNodeB之间的X2HANDOVER REQUEST(切换请求)。该种基于初始RRC接入消息进行流量控制的情况下，初始接入消息成功处理后会触发后续一系列的相关处理，对整个系统带来大量开销。因此，可以基于初始RRC接入消息通过每秒请求数，CPU占用率，消息优先级等进行流量控制，从而在信令流程起 始阶段进行流量控制，从源头减少系统负载。
Paging流量控制
Paging消息是一个流程的起始消息，Paging消息成功处理后会触发大量的用户入网，对整个系统带来大量开销。因此，该种基于Paging消息进行流量控制的情况下，可以根据CPU阈值及业务优先级进行流量控制。从而在信令流程起始阶段进行流量控制，从源头减少系统负载。
控制方式二：闭环控制
闭环控制即基于CPU占用率进行流量控制，该流量控制方案包括拒绝低优先级业务的初始接入或切换。
不难看出，上述几种控制方式均是采用CPU/信令阈值来对信令过载进行系统保护。然而，第五代移动通信系统(fifth-generation，5G)中基站部署密度高、海量机器类通信(massive machine type communications，mMTC)场景下UE海量接入、超可靠低时延(ultra-reliable and low latency communications，uRLLC)场景下业务高可用性，黑客容易控制大量UE组成僵尸网络。由于僵尸网络会持续占用网元资源，对运营商网络进行信令分布式拒绝服务攻击(distributed denial of service attack，DDoS)。对于因DDoS产生的信令风暴，上述控制方式并不支持对DDoS的检测，对信令风暴的阻断方式也不够精准，阻断效果不佳。
对此，本申请实施例提供了一种阻断信令风暴的方法，该方法基于话统信息进行信令风暴检测，当检测到信令风暴时，基于UE的呼叫历史记录(call history record，CHR)日志确定产生导致信令风暴的信令的目标UE。之后，通过对目标UE进行信令阻断，以此更加准确地阻断信令风暴，提高阻断效果。以该阻断信令风暴的方法应用于图2所示的实施环境为例，该实施环境包括无线接入网(radio access network，RAN)和核心网(core)，核心网和RAN之间具有回路线路(backhaul)。
RAN提供UE和核心网之间的连接，RAN架构的目的是建立用户面，为了建立用户面需要建立信令面，而5G基站(gNode)在其中用于与UE建立一个信令连接，将信令传输给核心网，建立数字服务器。如图2所示，RAN包括中心单元(centralized unit，CU)和分布式单元(distributed unit，DU)两个逻辑单元，CU和DU是gNode的内部结构，根据场景和需求可以合一部署、也可以分开部署。CU具备分组数据汇聚协议(packet data convergence protocol，PDCP)和RRC功能，DU是5G新引入的逻辑网元，具备L2和L1功能。
核心网包括接入和移动性管理网元(access and mobility management function，AMF)、用户平面功能(user plane function，UPF)、统一数据管理(unified data management，UDM)等设备。
如图2所示，该实施环境还包括三种应用场景，分别为资源单元(resource unit，RU)，提供增强移动宽带(enhanced mobile broadband，eMBB)、大物联业务(massive machine type communications，mMTC)和超可靠低延迟通信(ultra-reliable and low latency communication，URLLC)。基于5G演进的架构，还具有将移动接入网与互联网业务深度融合的一种移动边缘计算(mobile edge computing，MEC)技术。MEC一方面可以改善用户体验，节省带宽资源，另一方面通过将计算能力下沉到移动边缘节点，提供第三方应用集成，为移动边缘入口的服务创新提供了无限可能。此外，核心网还可以与互联网 (internet)、物联网(internet of things，IoT)平台和车联网连接。
如图2所示，该实施环境中还包括网络智能安全系统(cybersecurity intelligence system，CIS)，CIS与互联网之间还连接有流探针，流探针探测互联网的流量映像。CIS可以向核心网下发国际移动用户识别码(international mobile subscriber identification number，MISI)，核心网可以向RAN下发临时移动用户标识(temporary mobile subscriber identity，TMSI)。
以图2所示的实施环境为例，本申请实施例提供了一种阻断信令风暴的方法。该方法以CIS执行阻断信令风暴的过程为例，基站和核心网设备可以向CIS上报信令日志和话统信息，流探针也可以向CIS上报元数据(metadata)，例如UE的告警日志。CIS基于收到的数据进行信令风暴检测，即进行DDoS检测。CIS在检测到信令风暴后，进一步确定产生导致信令风暴的信令的目标UE，通过对目标UE进行信令阻断，从而实现阻断信令风暴。参见图3，该方法包括如下步骤301至305。
301，获取话统信息，话统信息是指话务性能指标的统计及输出信息。
话统信息可应用于用户行为分析、网络的趋势分析、容量规划、故障定位等方面。本申请实施例提供的方法在阻断信令风暴之前，先获取话统信息。关于获取话统信息的方法，本申请实施例不加以限定。示例性地，如图2所示，基站和核心网设备均可以向CIS上报话统信息，CIS可基于基站和核心网设备上报的话统信息进行信令风暴检测。则CIS获取到的话统信息包括基站上报的基站的话统日志和核心网设备上报的核心网的话统日志中的一种或多种。
其中，基站的话统日志和核心网的话统日志包括但不限于在线UE总数、各状态下UE数量等。此外，由于基站使用的是RRC协议，核心网使用的是NAS协议，因而基站和核心网设备上报的话统日志是从不同协议中选取的日志特征字段。例如，CPU占用率、信令流程计数、附着请求数量、服务请求数量、信令频率及接入UE数等，本申请实施例不对话统日志的内容进行限定。
此外，本申请实施例不对基站和核心网设备上报话统信息的时机进行限定，可以周期性上报，也可以实时上报。CIS获取到话统信息后，可以实时进行信令风暴检测，也可以进行周期性检测。
302，基于话统信息进行信令风暴检测。
在示例性实施例中，由于CIS获取到的话统信息包含的内容较多，本申请实施例提供的方法在基于话统信息进行信令风暴检测时，支持先对话统信息进行预处理。之后基于预处理后的数据进行信令风暴检测。关于预处理方式，本申请实施例不进行限定。示例性地，预处理包括但不限于格式转换，字符转换，字段精简等处理。例如，处理后的数据如下面的表1所示。
表1
Figure PCTCN2020110662-appb-000001
Figure PCTCN2020110662-appb-000002
表1中，预处理后的数据包括CPU负载值、信令流程数量、信令流程分组计数、在线UE总数、各状态下UE数量、鉴权流程计数和鉴权成功数。各个数据的说明详见上面的表1。其中，HSS是支持用于处理调用/会话的IMS网络实体的主要用户数据库，该HSS包含用户配置文件，执行用户的身份验证和授权，并可提供有关用户物理位置的信息。
在一种示例性实施例中，基于话统信息进行信令风暴检测，包括但不限于：基于话统信息采用孤立森林和时序预测进行信令风暴检测。示例性地，如果对数据进行了预处理，则基于预处理后的数据，采用孤立森林和时序预测进行信令风暴检测。
其中，孤立森林(isolation forest，iForest)是一种快速异常检测方法，具有线性时间复杂度和高精准度，其可以用于网络安全中的攻击检测。iForest适用于连续数据(continuous numerical data)的异常检测，将异常定义为“容易被孤立的离群点(more likely to be separated)”——可以理解为分布稀疏且离密度高的群体较远的点。用统计学来解释，在数据空间里面，分布稀疏的区域表示数据发生在此区域的概率很低，因而可以认为落在这些区域里的数据是异常的。示例性地，如图4所示，基于话统信息采用孤立森林进行异常检测后，确定异常网元和正常网元。异常网元即被信令风暴攻击的网元。例如图4中所示，对于正常网元，CPU占用率为50％，信令流程计数中的附着请求(attatch REQ)<10000条，服务请求(Service request)<8000条，信令频率<100000条，接入UE数<50个。而由于信令风暴，异常网元的CPU占用率达到90％，信令流程计数中的附着请求(attatch REQ)>100000条，服务请求(Service request)>80000条，信令频率>1000000条，接入UE数>200个。
303，当检测到信令风暴时，获取至少一个UE的CHR日志，CHR日志是指用于记录用户在呼叫过程中出现的问题的日志文件。
CHR日志用于记录用户在呼叫过程中出现的问题，可以用于定位故障原因。示例性地，CHR日志中的内容包括但不限于UE的接入时间、接入时长、流程计数、流程分组计数及信令流程序列等一种或多种信息。本申请实施例提供的方法基于CHR日志来定位产生导致信令风暴的信令的目标UE。因此，在检测到信令风暴时，获取UE的CHR日志，本申请实施例不对UE的数量进行限定。关于获取UE的CHR日志的方式，本申请实施例也不进行限定。例如，如图2所示，基站和核心网设备可以向CIS上报UE的CHR日志，该UE的数量包括至少一个。示例性地，至少一个UE的CHR日志包括核心网设备上报的至少一个UE的信令日志和核心网设备上报的至少一个UE的信令日志中的一种或多种。
此外，在示例性实施例中，流探针可以向CIS上报UE的告警日志。在一种示例性实施例中，CIS获取到的至少一个UE的CHR日志还包括：流探针上报的至少一个UE的告警日志。
304，基于至少一个UE的CHR日志确定目标UE，该目标UE是指产生导致信令风暴的信令的UE。
在示例性实施例中，当检测到网元被攻击，检测到信令风暴时，基于至少一个UE的CHR日志确定目标UE，包括：对至少一个UE的CHR日志进行特征提取；基于提取的特征分析得到至少一个UE中的每个UE分别对应的行为特征序列；采用神经网络模型对至少一个UE中的每个UE分别对应的行为特征序列进行识别；当识别出异常行为特征序列时，将异常行为特征序列对应的UE作为目标UE，神经网络模型采用正常UE对应的行为特征序列进行训练得到。
其中，采用神经网络模型对至少一个UE中的每个UE分别对应的行为特征序列进行识别之前，还包括获取用于识别UE的行为特征序列的神经网络模型，本申请实施例不对获取该神经网络模型的过程及神经网络模型的类型进行限定。示例性地，如图5所示，以CIS获取到CHR日志为例，该CHR日志以日志文件的方式记录用户的相关信息。通过对该CHR日志进行特征提取，可以得到接入时间、接入时长、流程计数、流程分组计数、信令流程序列和UE的带宽大小等特征。
基于历史时间段内获取的CHR日志中提取的特征可训练初始神经网络模型，历史时间段的长短可以基于场景或经验设置，本申请实施例不对历史时间段的长短进行限定。例如，以历史时间段为历史一周为例。通过对历史一周内的CHR日志提取特征，输入至初始神经网络模型，由该初始神经网络模型学习正常UE在参考时长内的行为特征序列。参考时长可以基于场景或经验设置，例如，以参考时长为5分钟为例，学习正常UE信令流程的过程可离线训练。示例性地，初始神经网络模型可以是隐含马尔柯夫模型(hidden markov model，HMM)。HMM的基本思想是通过学习大量正常UE的信令流程序列建立UE信令流程序列状态机，通过计算状态转换概率识别异常UE。其中，序列状态机包括序列异常、分组技术异常、时间行为异常和流程技术异常几种状态。
在检测信令风暴时，获取CHR日志后，对至少一个UE的CHR日志进行特征提取，基于提取的特征分析得到至少一个UE中的每个UE分别对应的行为特征序列。通过将分析得到的每个UE的行为特征序列输入至训练好的神经网络模型中，基于神经网络模型进行在线检测。以HMM为例，由HMM识别该UE的行为特征序列是否正常，从而确定该UE为正常UE还是恶意UE，恶意UE即产生导致信令风暴的信令的UE，也即目标UE。示例性地，行为特征序列满足正常流程的UE为正常UE，行为特征序列不满足正常流程的UE为恶意UE。例如，在5分钟时长内，如果UE对应的行为特征序列为service request(12:00:14)-->service request(12:00:15)-->CN init detach(12:03:15)-->service request(12:03:20)，则为正常UE对应的行为特征序列。如果UE对应的行为特征序列为attach(12:05:06)-->TAU(12:05:07)-->TAU(12:05:07)-->TAU(12:05:08)-->attach(12:05:10)-->detach(12:05:15)-->TAU(12:05:33)-->detach(12:05:44)，这一行为特征显示在5分钟内，该UE频繁附着和去附着，因此，为异常UE对应的异常行为特征序列。
当检测到异常UE对应的异常行为特征序列后，后续可进一步确定异常UE安全事件， 例如是恶意UE增值业务服务，则将该安全事件推送至终端。
示例性地，当识别出异常行为特征序列时，将异常行为特征序列对应的UE作为目标UE之后，还包括：当存在多个异常行为特征序列对应的目标UE时，对多个异常行为特征序列对应的目标UE进行关联。
如图6所示，当检测到信令风暴时，确定出的目标UE的特征即图6中异常UE群体画像的内容，包括异常UE的接入时间、接入时长、流程计数、流程分组计数和信令流程序列。而检测到信令风暴时，被信令风暴攻击的核心网信令DDoS攻击关键特征包括接入UE数量增量、流程计数增量、流程分组计数增量和流程分组计数比例，根据异常UE群体画像和核心网信令DDoS攻击关键特征可以得到恶意UE信令面特征。通过基于异常UE群体画像和核心网信令DDoS攻击关键特征进行恶意UE判定，从而得到信令面恶意UE的IMSI。此外，基于流探针上报的告警日志可以确定告警的UE的IP，在得到信令面恶意UE的IMSI之后，CHR记录了IP与IMIS的关系，基于控制与命令(C&C)流量检测结果，通过C&C中的IP与IMSI查询(即CC UE IP查询得到恶意UE IMSI)，得到数据面C&C恶意UE的IMSI。通过将信令面恶意UE的IMSI和数据面C&C恶意UE的IMSI进行关联，从而确定恶意UE的IMSI。
需要说明的是，图6仅以流探针上报了UE的告警信息为例，在CIS未获取到流探针上报的UE的告警信息的情况下，可以省略执行图6中的第二步，而直接采用第一步和第二步确定恶意UE的IMSI。
305，对目标UE进行信令阻断。
在一种示例性实施例中，对目标UE进行信令阻断，包括：将信令风暴的信息及目标UE的信息处理为安全事件，以基于安全事件的阻断策略进行信令阻断。
本申请实施例不对安全事件的阻断策略进行过限定，例如，将封装的安全事件进行推送，使得运维监控人员监控到此安全事件后，通过手动下发阻断命令对该安全事件涉及的目标UE进行信令阻断。
在另一种示例性实施例中，还可以调用核心网的阻断接口，该阻断接口可以如图2中的接口6所示，通过调用核心网的接口6向核心网下发IMSI进行阻断。核心网根据IMSI和TMSI的关系，将产生信令风暴的目标UE的TMSI下发给无线进行空口阻断。
此外，不同安全事件可以有不同的阻断策略。由于发生信令风暴的目标UE有可能是用于DDoS的虚假源，该类目标UE的阻断优先级需要更高。对此，本申请实施例包括对不同类型的目标UE采用不同的阻断优先级进行阻断。示例性地，对目标UE进行信令阻断，包括：对目标UE进行虚假源探测，得出目标UE中的虚假源，虚假源是指采用虚假地址进行通信的UE；采用第一优先级的阻断策略对目标UE中的虚假源进行信令阻断，采用第二优先级的阻断策略对目标UE中的非虚假源进行信令阻断；其中，第一优先级高于第二优先级。
在一种示例性实施例中，对目标UE进行虚假源探测，得出目标UE中的虚假源，包括：获取目标UE的IMSI，基于目标UE的IMSI对目标UE进行寻呼，根据寻呼结果确定目标UE中的虚假源。例如，如果基于目标UE的IMSI对目标UE进行寻呼，如果寻呼结果为寻呼成功，则目标UE为非虚假源，如果寻呼结果为寻呼失败，则目标UE为虚假源。
综上所述，本申请实施例提供的方法，通过话统信息进行信令风暴检测，当检测到信令风暴时，基于UE的CHR日志确定产生导致信令风暴的信令的目标UE，通过对目标UE进 行信令阻断，以此更加准确地阻断信令风暴，提高阻断效果。此外，针对确定出的目标UE，进一步确认是否为虚假源，以采用不同优先级进行阻断，进一步提升了阻断效果。
上述阻断信令风暴的过程可参见图7。如图7所示，以CIS为执行主体为例，该阻断信令风暴的过程包括步骤71-76。71，CIS获取话统/CHR日志，对话统/CHR日志中的数据进行预处理，得到检测DDoS需要的输入数据。72，采用神经网络模型进行DDoS检测，得到DDoS检测结果，即监测是否产生信令风暴。73，当检测到信令风暴时，基于信令风暴的信令特征及UE的CHR日志对UE进行关联分析，确定产生导致信令风暴的信令的目标UE，即恶意UE。此外，示例性地，还可进一步通过对恶意UE进行虚假源探测，确定出恶意UE中的虚假源。74，将信令风暴的信息及恶意UE的信息处理为DDoS安全事件，以基于安全事件的阻断策略进行信令阻断。例如，75，自动调用核心网联动接口执行阻断操作，或者，76，采用事件通报的方式将安全事件推送至运维监控端，由运维监测人员手动调用核心网联动接口执行阻断操作，从而阻断信令风暴。
需要说明的是，本申请实施例仅以图2所示的系统为例，对本申请实施例提供的阻断信令风暴的方法进行的说明，但并不对本申请实施例提供的方法所应用的场景进行限定。除了图2所示的系统，以及图2所示的系统中所涉及的协议外，还可以应用于其他协议的交互上。也就是说，本申请实施例提供的方法所涉及的协议可以灵活的扩展。
本申请实施例还提供了一种阻断信令风暴的装置，参见图8，该阻断信令风暴的装置包括：获取模块801、检测模块802、确定模块803和阻断模块804。
获取模块801，用于获取话统信息，话统信息是指话务性能指标的统计及输出信息。
检测模块802，用于基于话统信息进行信令风暴检测。
获取模块801，还用于当检测到信令风暴时，获取至少一个用户设备UE的呼叫历史记录CHR日志，CHR日志是指用于记录用户在呼叫过程中出现的问题的日志文件。
确定模块803，用于基于至少一个UE的CHR日志确定目标UE，目标UE是指产生导致信令风暴的信令的UE。
阻断模块804，用于对目标UE进行信令阻断。
在一种示例性实施例中，阻断模块804，用于对目标UE进行虚假源探测，得出目标UE中的虚假源，虚假源是指采用虚假地址进行通信的UE；采用第一优先级的阻断策略对目标UE中的虚假源进行信令阻断，采用第二优先级的阻断策略对目标UE中的非虚假源进行信令阻断；其中，第一优先级高于第二优先级。
在一种示例性实施例中，阻断模块804，用于获取目标UE的国际移动用户识别码IMSI，基于目标UE的IMSI对目标UE进行寻呼，根据寻呼结果确定目标UE中的虚假源。
在一种示例性实施例中，话统信息包括基站上报的所述基站的话统日志及核心网设备上报的核心网的话统日志中的一种或多种；所述至少一个UE的CHR日志包括所述基站上报的所述至少一个UE的信令日志和所述核心网设备上报的所述至少一个UE的信令日志中的一种或多种。
在一种示例性实施例中，至少一个UE的CHR日志还包括：流探针上报的至少一个UE的告警日志。
在一种示例性实施例中，确定模块803，还用于对至少一个UE的CHR日志进行特征提取；基于提取的特征分析得到至少一个UE中的每个UE分别对应的行为特征序列；采用神经网络模型对至少一个UE中的每个UE分别对应的行为特征序列进行识别；当识别出异常 行为特征序列时，将异常行为特征序列对应的UE作为目标UE，神经网络模型采用正常UE对应的行为特征序列进行训练得到。
在一种示例性实施例中，确定模块803，还用于当存在多个异常行为特征序列对应的目标UE时，对多个异常行为特征序列对应的目标UE进行关联。
在一种示例性实施例中，阻断模块804，用于将信令风暴的信息及目标UE的信息处理为安全事件，以基于安全事件的阻断策略进行信令阻断。
本申请实施例提供的装置，通过话统信息进行信令风暴检测，当检测到信令风暴时，基于UE的CHR日志确定产生导致信令风暴的信令的目标UE，通过对目标UE进行信令阻断，以此更加准确地阻断信令风暴，提高阻断效果。
此外，针对确定出的目标UE，进一步确认是否为虚假源，以采用不同优先级进行阻断，进一步提升了阻断效果。
应理解的是，上述图8提供的装置在实现其功能时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将设备的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的装置与方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
参见图9，本申请实施例还提供一种阻断信令风暴的设备900，图9所示的阻断信令风暴的设备900用于执行上述阻断信令风暴的方法所涉及的操作。该阻断信令风暴的设备900包括：存储器901、处理器902及接口903，存储器901、处理器902及接口903之间通过总线904连接。
其中，存储器901中存储有至少一条指令，至少一条指令由处理器902加载并执行，以实现上述任一所述的阻断信令风暴的方法。
接口903用于与网络中的其他设备进行通信，该接口903可以通过无线或有线的方式实现，示例性地，该接口903可以是网卡。
应理解的是，图9仅仅示出了阻断信令风暴的设备900的简化设计。在实际应用中，阻断信令风暴的设备可以包含任意数量的接口，处理器或者存储器。此外，上述处理器可以是中央处理器(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processing，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field－programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者是任何常规的处理器等。值得说明的是，处理器可以是支持进阶精简指令集机器(advanced RISC machines，ARM)架构的处理器。
进一步地，在一种可选的实施例中，上述存储器可以包括只读存储器和随机存取存储器，并向处理器提供指令和数据。存储器还可以包括非易失性随机存取存储器。例如，存储器还可以存储设备类型的信息。
该存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者，其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、 电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用。例如，静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic random access memory，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data date SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
应理解的是，上述图9提供的设备在实现其功能时，具体实现过程详见方法实施例，这里不再赘述。
还提供了一种计算机可读存储介质，存储介质中存储有至少一条指令，指令由处理器加载并执行以实现如上任一方法实施例所述的阻断信令风暴的方法。
本申请提供了一种计算机程序，当计算机程序被计算机执行时，可以使得处理器或计算机执行上述方法实施例中对应的各个操作和/或流程。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk)等。
以上所述仅为本申请的实施例，并不用以限制本申请，凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (18)

  1. 一种阻断信令风暴的方法，其特征在于，所述方法包括：
    获取话统信息，所述话统信息是指话务性能指标的统计信息；
    基于所述话统信息进行信令风暴检测；
    当检测到信令风暴时，获取至少一个用户设备UE的呼叫历史记录CHR日志，所述CHR日志是指用于记录用户在呼叫过程中出现的问题的日志文件；
    基于所述至少一个UE的CHR日志确定目标UE，所述目标UE是指产生导致所述信令风暴的信令的UE；
    对所述目标UE进行信令阻断。
  2. 根据权利要求1所述的方法，其特征在于，所述对所述目标UE进行信令阻断，包括：
    对所述目标UE进行虚假源探测，得出所述目标UE中的虚假源，所述虚假源是指采用虚假地址进行通信的UE；
    采用第一优先级的阻断策略对所述目标UE中的虚假源进行信令阻断，采用第二优先级的阻断策略对所述目标UE中的非虚假源进行信令阻断，其中，所述第一优先级高于所述第二优先级。
  3. 根据权利要求2所述的方法，其特征在于，所述对所述目标UE进行虚假源探测，得出所述目标UE中的虚假源，包括：
    获取目标UE的国际移动用户识别码IMSI，基于所述目标UE的IMSI对所述目标UE进行寻呼，根据寻呼结果确定所述目标UE中的虚假源。
  4. 根据权利要求1-3中任一所述的方法，其特征在于，所述话统信息包括基站上报的所述基站的话统日志及核心网设备上报的核心网的话统日志中的一种或多种；
    所述至少一个UE的CHR日志包括所述基站上报的所述至少一个UE的信令日志和所述核心网设备上报的所述至少一个UE的信令日志中的一种或多种。
  5. 根据权利要求4所述的方法，其特征在于，所述至少一个UE的CHR日志还包括：流探针上报的所述至少一个UE的告警日志。
  6. 根据权利要求1-5中任一所述的方法，其特征在于，所述基于所述至少一个UE的CHR日志确定目标UE，包括：
    对所述至少一个UE的CHR日志进行特征提取；
    基于提取的特征分析得到所述至少一个UE中的每个UE分别对应的行为特征序列；
    采用神经网络模型对所述至少一个UE中的每个UE分别对应的行为特征序列进行识别；
    当识别出异常行为特征序列时，将异常行为特征序列对应的UE作为目标UE，所述神经网络模型采用正常UE对应的行为特征序列进行训练得到。
  7. 根据权利要求6所述的方法，其特征在于，所述当识别出异常行为特征序列时，将异常行为特征序列对应的UE作为目标UE之后，还包括：
    当存在多个异常行为特征序列对应的目标UE时，对所述多个异常行为特征序列对应的目标UE进行关联。
  8. 根据权利要求1-7中任一所述的方法，其特征在于，所述对所述目标UE进行信令阻断，包括：
    将所述信令风暴的信息及所述目标UE的信息处理为安全事件，以基于所述安全事件的阻断策略进行信令阻断。
  9. 一种阻断信令风暴的装置，其特征在于，所述装置包括：
    获取模块，用于获取话统信息，所述话统信息是指话务性能指标的统计及输出信息；
    检测模块，用于基于所述话统信息进行信令风暴检测；
    所述获取模块，还用于当检测到信令风暴时，获取至少一个用户设备UE的呼叫历史记录CHR日志，所述CHR日志是指用于记录用户在呼叫过程中出现的问题的日志文件；
    确定模块，用于基于所述至少一个UE的CHR日志确定目标UE，所述目标UE是指产生导致所述信令风暴的信令的UE；
    阻断模块，用于对所述目标UE进行信令阻断。
  10. 根据权利要求9所述的装置，其特征在于，所述阻断模块，用于对所述目标UE进行虚假源探测，得出所述目标UE中的虚假源，所述虚假源是指采用虚假地址进行通信的UE；采用第一优先级的阻断策略对所述目标UE中的虚假源进行信令阻断，采用第二优先级的阻断策略对所述目标UE中的非虚假源进行信令阻断，其中，所述第一优先级高于所述第二优先级。
  11. 根据权利要求10所述的装置，其特征在于，所述阻断模块，用于获取目标UE的国际移动用户识别码IMSI，基于所述目标UE的IMSI对所述目标UE进行寻呼，根据寻呼结果确定所述目标UE中的虚假源。
  12. 根据权利要求9-11中任一所述的装置，其特征在于，所述话统信息包括基站上报的所述基站的话统日志及核心网设备上报的核心网的话统日志中的一种或多种；
    所述至少一个UE的CHR日志包括所述基站上报的所述至少一个UE的信令日志和所述核心网设备上报的所述至少一个UE的信令日志中的一种或多种。
  13. 根据权利要求12所述的装置，其特征在于，所述至少一个UE的CHR日志还包括：流探针上报的所述至少一个UE的告警日志。
  14. 根据权利要求9-13中任一所述的装置，其特征在于，所述确定模块，用于对所述至少一个UE的CHR日志进行特征提取；基于提取的特征分析得到所述至少一个UE中的 每个UE分别对应的行为特征序列；采用神经网络模型对所述至少一个UE中的每个UE分别对应的行为特征序列进行识别；当识别出异常行为特征序列时，将异常行为特征序列对应的UE作为目标UE，所述神经网络模型采用正常UE对应的行为特征序列进行训练得到。
  15. 根据权利要求14所述的装置，其特征在于，所述确定模块，还用于当存在多个异常行为特征序列对应的目标UE时，对所述多个异常行为特征序列对应的目标UE进行关联。
  16. 根据权利要求9-15中任一所述的装置，其特征在于，所述阻断模块，用于将所述信令风暴的信息及所述目标UE的信息处理为安全事件，以基于所述安全事件的阻断策略进行信令阻断。
  17. 一种阻断信令风暴的设备，其特征在于，所述设备包括：
    存储器及至少一个处理器，所述存储器中存储有至少一条指令，所述至少一条指令被所述至少一个处理器加载并执行，以实现权利要求1-8中任一所述的阻断信令风暴的方法。
  18. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条指令，所述指令由处理器加载并执行以实现如权利要求1-8中任一所述的阻断信令风暴的方法。
PCT/CN2020/110662 2019-09-03 2020-08-22 阻断信令风暴的方法、装置、设备及存储介质 WO2021043012A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2022501309A JP7268240B2 (ja) 2019-09-03 2020-08-22 シグナリングストームブロッキング方法、装置、およびデバイス、ならびに記憶媒体
EP20861335.6A EP3962005A4 (en) 2019-09-03 2020-08-22 METHOD, APPARATUS AND DEVICE FOR BLOCKING A SIGNAL TOWER AND STORAGE MEDIA
CA3143371A CA3143371C (en) 2019-09-03 2020-08-22 Signaling storm blocking method, apparatus, and device, and storage medium
US17/572,338 US20220131966A1 (en) 2019-09-03 2022-01-10 Signaling storm blocking method, apparatus, and device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910829015.1A CN112448894B (zh) 2019-09-03 2019-09-03 阻断信令风暴的方法、装置、设备及存储介质
CN201910829015.1 2019-09-03

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/572,338 Continuation US20220131966A1 (en) 2019-09-03 2022-01-10 Signaling storm blocking method, apparatus, and device, and storage medium

Publications (1)

Publication Number Publication Date
WO2021043012A1 true WO2021043012A1 (zh) 2021-03-11

Family

ID=74734006

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/110662 WO2021043012A1 (zh) 2019-09-03 2020-08-22 阻断信令风暴的方法、装置、设备及存储介质

Country Status (6)

Country Link
US (1) US20220131966A1 (zh)
EP (1) EP3962005A4 (zh)
JP (1) JP7268240B2 (zh)
CN (1) CN112448894B (zh)
CA (1) CA3143371C (zh)
WO (1) WO2021043012A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113938414A (zh) * 2021-11-11 2022-01-14 杭州和利时自动化有限公司 一种网络风暴处理方法、系统、设备及计算机存储介质
CN115835211A (zh) * 2022-12-13 2023-03-21 武汉博易讯信息科技有限公司 一种5g信令攻击检测系统

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11588850B2 (en) * 2020-04-13 2023-02-21 At&T Intellectual Property I, L.P. Security techniques for 5G and next generation radio access networks
US11653229B2 (en) * 2021-02-26 2023-05-16 At&T Intellectual Property I, L.P. Correlating radio access network messages of aggressive mobile devices
US20220286853A1 (en) * 2021-03-03 2022-09-08 At&T Intellectual Property I, L.P. Mobility management for aggressive devices
CN115150034B (zh) * 2021-03-15 2024-05-03 中国移动通信集团福建有限公司 一种信令风暴的预警方法、装置及电子设备
US11653234B2 (en) 2021-03-16 2023-05-16 At&T Intellectual Property I, L.P. Clustering cell sites according to signaling behavior
CN114339767B (zh) * 2021-12-30 2024-04-05 恒安嘉新（北京）科技股份公司 一种信令检测方法、装置、电子设备及存储介质
CN114363947B (zh) * 2021-12-31 2023-09-22 紫光展锐(重庆)科技有限公司 日志分析方法及相关装置
CN118215069B (zh) * 2024-05-20 2024-09-03 中国电信股份有限公司 信息预测方法及装置、计算机程序产品、电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101925083A (zh) * 2009-06-09 2010-12-22 中兴通讯股份有限公司 一种呼叫过程分析系统及方法
CN104301939A (zh) * 2013-07-19 2015-01-21 中国移动通信集团广东有限公司 一种控制方法、装置及网络侧设备
CN105722139A (zh) * 2014-12-04 2016-06-29 中国移动通信集团上海有限公司 一种基于pcc架构的信令风暴管理方法和装置
CN107959944A (zh) * 2016-10-18 2018-04-24 诺基亚通信公司 无线网络中的信令异常的检测和减轻
EP3337129A1 (en) * 2016-12-19 2018-06-20 Verisign, Inc. Dynamic allocation of a signal receiver for dissemination of threat information

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050060576A1 (en) * 2003-09-15 2005-03-17 Kime Gregory C. Method, apparatus and system for detection of and reaction to rogue access points
US20060230450A1 (en) * 2005-03-31 2006-10-12 Tian Bu Methods and devices for defending a 3G wireless network against a signaling attack
US8965334B2 (en) * 2005-12-19 2015-02-24 Alcatel Lucent Methods and devices for defending a 3G wireless network against malicious attacks
US9219744B2 (en) * 2010-12-08 2015-12-22 At&T Intellectual Property I, L.P. Mobile botnet mitigation
CN103138963B (zh) * 2011-11-25 2016-08-03 华为技术有限公司 一种基于用户感知的网络问题定位方法及装置
CN103490849A (zh) * 2012-06-13 2014-01-01 华为技术有限公司 分析信令流量的方法及装置
US8918086B2 (en) * 2012-11-29 2014-12-23 Maqsood A. Thange Telecommunications addressing system and method
CN102984077B (zh) * 2012-12-04 2015-09-16 中国联合网络通信集团有限公司 网络拥塞的控制方法及系统
CN104684020A (zh) * 2013-11-28 2015-06-03 中兴通讯股份有限公司 一种信令拥塞的处理方法、装置、基站及系统
US10142355B2 (en) * 2015-09-18 2018-11-27 Telus Communications Inc. Protection of telecommunications networks
EP3427437A4 (en) * 2016-03-10 2019-10-23 Telefonaktiebolaget LM Ericsson (PUBL) DDOS DEFENSE IN A PACKAGED NETWORK
CN108199978B (zh) * 2016-12-08 2021-06-25 中国移动通信集团四川有限公司 一种信令风暴的抑制方法和装置
CN109392007A (zh) * 2017-08-10 2019-02-26 中国电信股份有限公司 用于解决随选网络信令风暴的方法、装置和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101925083A (zh) * 2009-06-09 2010-12-22 中兴通讯股份有限公司 一种呼叫过程分析系统及方法
CN104301939A (zh) * 2013-07-19 2015-01-21 中国移动通信集团广东有限公司 一种控制方法、装置及网络侧设备
CN105722139A (zh) * 2014-12-04 2016-06-29 中国移动通信集团上海有限公司 一种基于pcc架构的信令风暴管理方法和装置
CN107959944A (zh) * 2016-10-18 2018-04-24 诺基亚通信公司 无线网络中的信令异常的检测和减轻
EP3337129A1 (en) * 2016-12-19 2018-06-20 Verisign, Inc. Dynamic allocation of a signal receiver for dissemination of threat information

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3962005A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113938414A (zh) * 2021-11-11 2022-01-14 杭州和利时自动化有限公司 一种网络风暴处理方法、系统、设备及计算机存储介质
CN113938414B (zh) * 2021-11-11 2023-09-12 杭州和利时自动化有限公司 一种网络风暴处理方法、系统、设备及计算机存储介质
CN115835211A (zh) * 2022-12-13 2023-03-21 武汉博易讯信息科技有限公司 一种5g信令攻击检测系统
CN115835211B (zh) * 2022-12-13 2024-03-12 武汉博易讯信息科技有限公司 一种5g信令攻击检测系统

Also Published As

Publication number Publication date
CA3143371A1 (en) 2021-03-11
CA3143371C (en) 2024-01-23
JP7268240B2 (ja) 2023-05-02
CN112448894A (zh) 2021-03-05
JP2022539901A (ja) 2022-09-13
US20220131966A1 (en) 2022-04-28
EP3962005A1 (en) 2022-03-02
CN112448894B (zh) 2022-08-19
EP3962005A4 (en) 2022-07-06

Similar Documents

Publication Publication Date Title
WO2021043012A1 (zh) 阻断信令风暴的方法、装置、设备及存储介质
US11463918B2 (en) Data processing method and apparatus, and data sending method and apparatus
US11206541B2 (en) Method and device for managing and controlling terminal UE
EP3972327A1 (en) Network performance reporting method and apparatus
EP3488577B1 (en) Node and method for detecting that a wireless device has been communicating with a non-legitimate device
CN113206814B (zh) 一种网络事件处理方法、装置及可读存储介质
US20210250811A1 (en) Method for controlling connection between terminal and network, and related apparatus
US20220256396A1 (en) Congestion control method and apparatus
EP3761590B1 (en) Method for controlling terminal to access network, and network element
US10756987B2 (en) Technique for handling service level related performance data for roaming user terminals
US20220060903A1 (en) Terminal information processing method and apparatus, and system
WO2020242368A1 (en) Network node, communication device and method for measurement reporting
US20240224098A1 (en) Network verification method and apparatus
Xenakis et al. An advanced persistent threat in 3G networks: Attacking the home network from roaming networks
CN110582053B (zh) 伪基站定位方法及装置
US12052792B2 (en) Passive mode transition for user equipment based on control plane monitoring
CN111480365A (zh) 调节通信终端对通信网络的访问
US20230156579A1 (en) Detecting ue ping-ponging between different network nodes
KR20190098049A (ko) 대규모 연결성을 지원하는 이동 통신 네트워크에서의 과부하 처리 방법 및 장치
Sørseth Location disclosure in lte networks by using imsi catcher
US20240121678A1 (en) Distributed machine learning solution for rogue base station detection
WO2022174780A1 (zh) DDoS攻击检测的方法和装置
RU2787887C2 (ru) Способ и устройство обработки данных и способ и устройство отправки данных
CN118803767A (zh) 安全防护方法、安全防护系统、设备、存储介质及产品

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20861335

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020861335

Country of ref document: EP

Effective date: 20211126

ENP Entry into the national phase

Ref document number: 3143371

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2022501309

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE