WO2021232847A1 - 网络攻击检测控制方法、装置、基站及计算机存储介质 - Google Patents

网络攻击检测控制方法、装置、基站及计算机存储介质 Download PDF

Info

Publication number
WO2021232847A1
WO2021232847A1 PCT/CN2021/074151 CN2021074151W WO2021232847A1 WO 2021232847 A1 WO2021232847 A1 WO 2021232847A1 CN 2021074151 W CN2021074151 W CN 2021074151W WO 2021232847 A1 WO2021232847 A1 WO 2021232847A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
real
access
joint probability
network attack
Prior art date
Application number
PCT/CN2021/074151
Other languages
English (en)
French (fr)
Inventor
葛冉浩
吴风云
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2021232847A1 publication Critical patent/WO2021232847A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection

Definitions

  • the embodiments of the present invention relate to the field of communications, specifically, to but not limited to a network attack detection and control method, device, base station, and computer storage medium.
  • Narrow Band Internet of Things is a cellular-based narrow-band Internet of Things technology that supports the cellular data connection of low-power devices over a wide area network. It is also called a low-power wide area network (LPWAN).
  • LPWAN low-power wide area network
  • the application of NB-IoT technology in the Internet of Things is becoming more and more widespread. Due to its massive access to end users, numerous services, it faces many network security issues.
  • the real NB-IoT terminal resides in a suitable cell through the cell search process according to the frequency band and working mode it supports.
  • the terminal When the terminal needs to send uplink data, it will initiate a random access process to obtain uplink authorization.
  • the terminal will obtain two RSRP (Reference Signal Receiving Power) thresholds and the cell’s narrow-band Physical Random Access Channel (NPRACH) configuration from the SIB2-NB system information Information, and then compare the RSRP measurement value with the two thresholds to determine the coverage level, and select the appropriate NPRACH resource on the determined coverage level to initiate a random access preamble (Random Access Preamble, hereinafter referred to as Preamble), and then correctly Receive random access response (Random Access Response, RAR) and send Msg3 to complete the subsequent random access process.
  • RSRP Reference Signal Receiving Power
  • Preamble Random Access Preamble
  • RAR Receive random access response
  • NPRACH resource information is delivered through broadcast information
  • a malicious NB-IoT terminal when a malicious NB-IoT terminal always sends a preamble on the NPRACH channel, it does not respond to the random access response made by the NB-IoT base station.
  • Related standard protocols as long as the terminal sends the Preamble on the NPRACH resource, the base station will respond to it with RAR according to the current air interface resource situation.
  • NPDCCH Narrow-band Physical Downlink Shared Channel
  • NPUSCH Narrow-band Physical Uplink Shared Channel
  • a real terminal in an idle state when there is uplink data to be sent or a paging message is received, a random access request will be initiated.
  • a large number of uplink and downlink air interface resources are occupied, leading to waste of channel resources and increasing the probability of false NPRACH detection of the base station, and aggravating the shortage of air interface resources.
  • the real NPRACH false detection is caused by the noise of the wireless environment, the interference of the business on the NPUSCH of this cell to the NPRACH on the adjacent subcarriers, the business interference of the adjacent cells, and the interference of the same-frequency networking. These will cause interference to the NPRACH, and also It will cause false detection of NPRACH.
  • the NPRACH detection algorithm can only filter out external interference noise that does not have a specific rule, and it is basically impossible to filter this kind of non-external interference.
  • real terminal scheduling delays or even unable to access for a long time which increases the service delay of the terminal, and also greatly wastes the battery power of the real terminal.
  • the network attack detection and control method, device, and computer storage medium provided by the embodiments of the present invention are intended to solve one of the related technical problems at least to a certain extent, including in some cases, the NB-IoT terminal maliciously initiates an NPrach network attack, and resources are A large number of occupancy causes the problem of congestion in the NB-IoT cell access network.
  • the embodiment of the present invention provides a network attack detection and control method, which includes: when the access network is abnormal, obtaining the location information and real-time characteristic parameters of each terminal that initiates the access request; Set the joint probability density and the real-time characteristic parameters to determine the number of matching items for each terminal that does not meet the joint decision condition corresponding to the preset joint probability density; Detecting, controlling the access request of each terminal according to the detection result.
  • the embodiment of the present invention also provides a network attack detection and control device, including: an acquisition module, used to obtain the location information and real-time characteristic parameters of each terminal that initiates an access request; And the real-time feature parameter to determine the number of matching items that each terminal does not meet the joint decision condition corresponding to the preset joint probability density; the detection control module is used to determine the number of matching items according to the number of matching items and the The location information detects each terminal, and controls the access request of each terminal according to the detection result.
  • a network attack detection and control device including: an acquisition module, used to obtain the location information and real-time characteristic parameters of each terminal that initiates an access request; And the real-time feature parameter to determine the number of matching items that each terminal does not meet the joint decision condition corresponding to the preset joint probability density; the detection control module is used to determine the number of matching items according to the number of matching items and the The location information detects each terminal, and controls the access request of each terminal according to the detection result.
  • An embodiment of the present invention also provides a base station, the base station includes a processor, a memory, and a communication bus; wherein, the communication bus is used to implement connection and communication between the processor and the memory; the processor is used to execute storage in the memory One or more programs to implement the steps of the network attack detection and control method described above.
  • the embodiment of the present invention also provides a computer storage medium storing one or more programs, wherein the one or more programs can be executed by one or more processors to implement the above-mentioned network attack detection and control method A step of.
  • FIG. 1 is a flowchart of network attack detection and control provided by Embodiment 1 of the present invention
  • Embodiment 2 is a flowchart of preliminary detection and judgment of a terminal based on location information provided by Embodiment 1 of the present invention
  • FIG. 3 is a flowchart of network attack detection and control provided by Embodiment 2 of the present invention.
  • FIG. 4 is a structural block diagram of a network attack detection device provided by Embodiment 3 of the present invention.
  • FIG. 5 is a functional flowchart of the positioning module of the network attack detection device provided by the third embodiment of the present invention.
  • FIG. 6 is a functional flowchart of the joint decision condition module of the network attack detection device provided by the third embodiment of the present invention.
  • FIG. 7 is a functional flowchart of the scheduling module of the network attack detection device provided in the third embodiment of the present invention.
  • FIG. 8 is a functional flowchart of the notification module of the network attack detection device provided by the third embodiment of the present invention.
  • FIG. 9 is a structural block diagram of a base station provided in Embodiment 4 of the present invention.
  • a real terminal in an idle state when there is uplink data to be sent or a paging message is received, a random access request will be initiated.
  • a large number of uplink and downlink air interface resources are occupied, leading to waste of channel resources and increasing the probability of false NPRACH detection of the base station, and aggravating the shortage of air interface resources.
  • the real NPRACH false detection is caused by the noise of the wireless environment, the interference of the business on the NPUSCH of this cell to the NPRACH on the adjacent subcarriers, the business interference of the adjacent cells, and the interference of the same-frequency networking. These will cause interference to the NPRACH, and also It will cause false detection of NPRACH.
  • an embodiment of the present invention provides a network attack detection and control method.
  • the network attack detection and control method includes:
  • S101 When the access network is abnormal, obtain the location information and real-time characteristic parameters of each terminal that initiates the access request.
  • the base station when the base station detects that the access network is abnormal, it acquires the location information and real-time characteristic parameters of each terminal that initiates the access request. The base station must first determine whether the access network is abnormal. In one embodiment, when the access If the access performance parameter value of the network is less than the preset threshold, it is determined that the access network is abnormal; the access performance parameter value includes but not limited to the true access ratio, channel resource utilization and false detection probability; for example, according to the access When the ratio of the actual access times is less than the preset threshold, the access network is determined to be abnormal; for example, the NB-IoT base station detects the NPRACH access times and the actual completed access times In contrast, the base station self-check system finds that the proportion of real access is less than a certain threshold (such as about 70%).
  • a certain threshold such as about 70%
  • the system judges that the false detection rate of NPRACH is too high.
  • the location information of each terminal that initiated the access request can be obtained.
  • real-time characteristic parameters among them, when the real access ratio is lower than the threshold of 30%, it is roughly judged that it may be an access attack initiated by a malicious terminal.
  • the access network when the channel resource utilization rate or the false detection probability is lower than the preset threshold, it is determined that the access network is abnormal.
  • it is also determined according to at least two parameters among the true access ratio, the resource utilization rate and the false detection probability. Whether the access network is abnormal, for example, when the access performance ratio is less than 70% and the channel resource utilization rate is less than 50%, it is determined that the access network is abnormal.
  • the terminal sends the Preamble on the Nprach resource, and then initiates an access request to obtain the real-time characteristic parameters of each terminal.
  • the base station collects the real-time characteristic parameters of the terminal.
  • the real-time characteristic parameters include but are not limited to TA, frequency offset, and Signal-to-noise ratio (Sinr); and to obtain the location information of each terminal in the access request, the base station may actively measure and locate the location of the terminal, or the terminal may actively report the location information.
  • the base station recognizes the distance by measuring the terminal TA (Timing Advance, TA), and then uses the triangulation method with the neighboring cell to co-locate the terminal position; in one embodiment, the base station informs the serving cell and the neighboring cell to initiate a positioning measurement instruction through a high-level network element.
  • the terminal sends uplink information on the NPRACH channel, and the serving cell and neighboring cells measure the time difference between the uplink signal of the terminal to reach the antenna ports of different base stations to locate the specific location of the terminal.
  • the terminal may also actively report location information, and the base station obtains the location information of each terminal; for example, each terminal carries the location information of each terminal when initiating an access request, and the base station receives the location information of each terminal.
  • S102 Determine the number of matching items that each terminal does not meet the joint decision condition corresponding to the preset joint probability density according to the preset joint probability density formed by the combination of the real characteristic parameters and the real-time characteristic parameters.
  • the real-time characteristic parameters of each terminal are acquired, combined with the preset joint joint probability density, to determine whether each terminal meets the corresponding decision condition, where the preset joint probability density is determined by the real terminal (that is, the non-malicious terminal)
  • the real feature parameters are jointly formed.
  • the preset joint probability density can be pre-stored by the base station.
  • the base station stores a variety of joint probability density spectra obtained by long-term collection of real terminal feature parameters and statistical learning; it can also be the base station based on the current launch A variety of joint probability density spectra calculated from the real characteristic parameters of the real terminal that responds to the request and responds.
  • the base station counts the probability that the true characteristic parameters of the real terminal fall within the segment interval, and calculates a variety of preset joint probability density spectra; characteristic parameters such as TA, frequency offset, and signal-to-noise ratio (Sinr) are determined by cell Calculate the probability of real NPRACH access TA, Sinr and frequency offset falling into the segment interval by coverage level, learn the joint probability spectrum density of the real access terminal, and form different joint probability densities for multiple combinations of different characteristic parameters of the terminal Spectrum, such as TA, frequency offset joint probability spectrum, frequency offset, Sinr joint probability spectrum and TA, frequency offset, Sinr joint probability spectrum. It is understandable that the base station maintains an interval allocation table for different characteristic parameters TA, Sinr, and frequency offset.
  • the cell coverage level for different characteristic parameters, count the number of times that the period falls within the interval range. It is a configurable parameter in the background; within the statistical period, the probability that the terminal access TA, Sinr and the frequency offset fall in each interval; that is, the number of times falling in each interval divided by the total number of times in the statistical period, Represents the jth coverage level (for example, three coverage levels, CEL0, CEL1, CEL2, then j ⁇ 3), the i-th interval measures the probability density value of the TA estimated value distribution statistics table reported by the successful access terminal within a unit time; Represents the j-th coverage level, and the probability density value of the distribution statistics table of the frequency offset estimated value reported by the successfully accessed users in the i-th interval is measured and statistically per unit time; Represents the j-th coverage level, the i-th interval measures the probability density value of the Sinr estimation value distribution statistics table reported by the successful access user within a unit time; for different characteristic parameters, the probability density of each interval is
  • the step S102 includes but is not limited to: calculating each joint probability of each real-time feature parameter combination of the terminal, the joint probability includes at least three types, and comparing each joint probability with a corresponding preset joint probability density spectrum , To determine the number of matching items that each terminal does not meet the joint decision condition.
  • the real-time characteristic parameters are TA, Sinr, and frequency offset
  • the preset joint probability density spectrum is the second Joint probability spectrum, second Joint probability spectrum and second Joint probability spectrum, respectively compare each first joint probability with each second joint probability spectrum, assuming that the first The joint probability does not meet the corresponding judgment conditions, first The joint probability meets the corresponding judgment conditions and the first If the joint probability meets the corresponding judgment condition, it is determined that the number of matching items that do not meet the joint judgment condition is 2; of course, when all are met, the number of matching items is 0.
  • the preset joint probability density spectrum is calculated by calculating the probability that the true characteristic parameters of the real terminal fall into the segment interval, in the embodiment of the present invention, when the joint probability falls within the corresponding preset joint probability density
  • the preset low probability interval of the spectrum determines that the joint decision condition is not met, for example, the first The joint probability falls into the 30% probability area lower than the preset joint probability density, and the first The joint probability does not meet the judgment condition; the preset low probability interval can be different according to the number of real terminals counted by intelligent, and it can also be flexibly adjusted according to the actual situation.
  • step S102 it further includes preliminary detection and judgment on whether the terminal maliciously initiates an NPRACH network attack based on the location information of the terminal, as shown in Figure 2:
  • S201 According to the location information of the terminal, determine that the terminal initiates an access request in the same location area;
  • the terminal initiates an access request in the same location area, if so, the number of times of initiating access is further determined, and if so, the terminal is regarded as a suspicious terminal.
  • the same location area can be the same location, or a location and a location near the location, such as a circular location area with a location point as the center and a radius of 1000 meters. That is, due to the characteristics of the Internet of Things, most terminals are likely to only send data once a month, so the terminal in the same location area that frequently initiates access requests is regarded as a suspicious terminal, thereby reducing the scheduling priority of the terminal at that location, and not being in the same location Terminals that frequently initiate access requests are initially regarded as real terminals.
  • the terminal is further detected and judged according to the number of matching items that do not meet the joint judgment condition, which can be divided into the following three situations:
  • Case 1 When a terminal is determined to be a suspicious terminal based on the location information and the number of matching items is determined to be 0, the suspicious terminal is regarded as a real terminal; after the location information and the number of times the access request is initiated, a terminal is determined to be a suspicious terminal, but When all the suspicious terminals meet the judgment conditions, it means that the terminal is misjudged as a suspicious terminal. At this time, the suspicious terminal is regarded as a real terminal, and the scheduling priority of the real terminal is restored. Of course, when it is determined based on the location information that a certain terminal is initially a real terminal, and the number of matching items is 0, then the terminal is a real terminal.
  • Case 2 The terminal with the number of matching items equal to 1 is regarded as the suspicious terminal; in one embodiment, whether a certain terminal is determined as a non-suspicious terminal or a suspicious terminal regardless of the location information and the number of initiating access requests, the number of matching items One terminal is judged to be a suspicious terminal, and the priority of the suspicious terminal is lowered. It is worth noting that if the suspicious terminal has already lowered the scheduling priority according to the location information, there is no need to lower the priority again. Of course, in other embodiments On the basis of the lowered priority, it is also possible to continue to lower the scheduling priority.
  • the suspicious terminal when a terminal is determined to be a suspicious terminal according to the location information, and the number of matching items is determined to be equal to 1, the suspicious terminal is determined to be a malicious terminal, thereby restricting access requests of the malicious terminal.
  • Case 3 The terminal with the number of matching items greater than or equal to 2 is regarded as a malicious terminal; that is, whether a terminal is determined to be a non-suspect terminal or a suspicious terminal through the location information and the number of times of initiating access requests, for the number of matching items greater than or equal to 2 The terminal judges it as a malicious terminal, thereby restricting the access request of the malicious terminal.
  • the access request when the detection determines that the terminal is a malicious terminal, the access request may be directly restricted within a period of time.
  • the restricted period of time may be flexibly adjusted according to the current resource remaining rate. For example, when the resource remaining rate is high, the limit If the time is shorter and the resource remaining rate is low, the time limit is longer. It is also possible to determine the limited time length of a terminal based on the location information of a terminal and the number of matching items.
  • the limited time period of the terminal is A
  • the limited time period of the terminal is B (A>B).
  • a preset scheduling rule is used to schedule the access request of the suspicious terminal;
  • the preset scheduling rule includes but not limited to round-robin scheduling, random scheduling, and interval scheduling, where round-robin scheduling means that the base station follows The scheduling priority is followed by scheduling access requests.
  • the random scheduling is for the base station to randomly select the suspicious terminal for scheduling.
  • the interval scheduling is for the base station to schedule with one scheduling priority for each interval, or the base station is scheduled for each interval of idle time.
  • the notification includes but is not limited to a message notification, so that the background management system sends an alarm message , Notify the background management personnel to pay attention; in some embodiments, when the serving cell status is identified as a bad cell, the base station can broadcast to notify each terminal, and then the real terminal can reduce the access request to the base station according to the actual situation.
  • the network attack detection and control method provided by the embodiment of the present invention uses real-time measured terminal characteristic parameter information, combined with the long-term collection of real terminal characteristic parameters stored in the base station, and performs statistical learning to obtain multiple joint probability density spectra, using positioning algorithms and Joint probability density detection intelligently judges whether a terminal is a malicious terminal or a suspicious terminal. For a malicious terminal, it directly restricts its access request, and the suspicious terminal reduces its scheduling priority.
  • It uses round-robin, random or interval scheduling algorithms to perform partial selection scheduling , To minimize the misjudgment rate of real terminals; Compared with some situations, it can filter out TA, false detections with frequency offset outside the filter range, and also filter TA, false detections within the frequency offset range, and malicious terminals Initiating the NPRACH network attack, which effectively controls the congestion problem of the base station access network. In the case of a malicious terminal launching the NPRACH network attack, the access probability of the real terminal is increased, the service delay is shortened, and the network quality is improved.
  • the embodiment of the present invention uses a more specific example to describe the network attack detection and control method.
  • the network attack detection and control method includes:
  • the base station self-check system finds that the real access ratio is less than a certain threshold. For example, when the real access ratio is less than 40 % Threshold value, a rough judgment may be an access attack initiated by a malicious terminal, and it is determined that the access network is abnormal.
  • S302 Acquire location information of each terminal that initiates the access request.
  • the base station side recognizes the distance by measuring the terminal TA, and then uses a triangulation method with neighboring cells to co-locate the terminal location; in some embodiments, the location information of each terminal can also be extracted from the access request.
  • S303 According to the location information of the terminal, it is determined that the terminal initiates an access request in the same location area.
  • S305 Determine the number of matching items that each terminal does not meet the joint decision condition corresponding to the preset joint probability density according to the preset joint probability density formed by the combination of the real characteristic parameters and the real-time characteristic parameters.
  • the base station collects different real characteristic parameters of real terminals for a long time, and continuously statistically learns the joint probability density spectrum of multiple combinations.
  • the real characteristic parameters include terminal TA and frequency. Offset and Sinr; by collecting the real-time measurement parameters of the terminal, the real-time measurement parameters also include the terminal TA, frequency offset and Sinr, calculate the joint probability of different real-time feature parameter combinations, and perform it with the multiple joint probability density spectra obtained by statistical learning of the base station In comparison, for the terminals falling in the preset low probability interval that do not meet the joint decision condition, the number of matching items is recorded at the same time, that is, the number of items for which the corresponding terminal does not meet the joint decision condition.
  • S306 Determine the type of each terminal based on the location information and the number of matching items, and control the access request of each terminal.
  • a terminal with two or more matching items will be judged as a malicious terminal; when a terminal with only one matching item, and the current terminal has been misjudged as a suspicious terminal before, it will be judged as a malicious terminal; The number is 0, and it is determined that the current terminal was misjudged as a suspicious terminal before, then it is judged to be a real terminal and its scheduling priority is restored.
  • the embodiment of the present invention also provides a network attack detection and control device, which is used to implement the network attack detection and control method in the foregoing embodiments, as shown in FIG. 4, wherein the network attack detection and control device includes: an acquisition module 401, a joint The judgment condition module 402 and the detection control module 403.
  • the obtaining module 401 is configured to obtain location information and real-time characteristic parameters of each terminal that initiates an access request;
  • the joint decision condition module 402 is configured to determine the number of matching items corresponding to the joint decision condition for each terminal that does not meet the preset joint probability density according to the preset joint probability density jointly formed by the real feature parameters and the real-time feature parameters;
  • the detection control module 403 is used for detecting each terminal according to the number of matching items and location information, and controlling the access request of each terminal according to the detection result.
  • the acquisition module 401 includes a positioning module, which is used to locate the specific location of the terminal, and calculate the preamble frequency of the terminal in the same location area by statistical calculation.
  • the predetermined threshold is exceeded, the scheduling priority of the terminal at the location is reduced, Prioritize scheduling of terminals in other locations and make records.
  • the functional flow of the positioning module is as follows:
  • S501 Determine the access network to be abnormal according to the NPRACH access performance parameters, resource utilization, and false detection probability, and notify the serving cell and neighboring cells to initiate a positioning measurement instruction through a high-level network element.
  • the NB-IoT terminal sends uplink information on the NPRACH channel.
  • the serving cell and the neighboring cell measure the time difference between the uplink signal of the terminal to reach the antenna ports of different base stations, and locate the specific location of the terminal.
  • S504 Judgment condition, the serving cell counts the number of access initiated by the terminal at the same location, and judges whether it exceeds a predetermined threshold. If it exceeds the predetermined threshold, the terminal that does not meet the judgment condition directly enters the joint judgment condition module 402 for a second judgment.
  • S505 The terminal that meets the judgment condition marks the terminal at the location as a suspicious terminal, makes a record, and sends it to the scheduling module in the detection control module 403 for processing;
  • the joint decision condition module 402 can further determine the suspicious terminal on the basis of the positioning module, and can also be used to deal with those terminals that cannot be located and the misjudgment of real terminals. As shown in FIG. 6, the The functional flow of the joint judgment condition module 402 is as follows:
  • S601 Acquire context, and collect statistics and information of terminals accessed by the serving cell.
  • S602 According to the massive amount of real terminal on-site NPRACH access information, continuous and continuous statistical learning, count the probability of real NPRACH access TA, Sinr and frequency offset falling into the segment interval according to the coverage level of subdivisions, and calculate its preset joint probability density spectrum.
  • S603 According to the real-time measurement value of the terminal, whether the joint probability spectrum density spectrum decision of the intelligent statistical learning of the joint base station meets the decision threshold.
  • the real-time measurement parameters of the terminal By collecting the real-time measurement parameters of the terminal, calculating the joint probability of its different characteristic parameter combinations, and comparing it with the multiple joint probability density spectra obtained by the statistical learning of the base station, for the terminal whose joint probability falls in the low probability interval of the joint probability density spectrum does not match Joint decision condition; in the embodiment of the present invention, access that does not meet the joint probability threshold is regarded as a false check, and the current false check probability is counted at the same time, and then the NPRACH detection threshold is automatically adjusted according to the false check probability, for example, the false check probability is relative to If it is larger than before, the NPRACH detection threshold is increased.
  • S605 For a terminal that does not meet the judgment threshold, it is considered that there is a malicious terminal launching a network attack on the base station, and it is sent to the scheduling algorithm module in the detection control module 403 for next processing.
  • the detection control module 403 includes a scheduling module. As shown in FIG. 7, the functional flow of the scheduling module is as follows:
  • S701 Acquire context, and collect statistics on various detection result data of the access terminal of the serving cell.
  • S704 For the suspicious terminal, adjust the scheduling priority, send it to the low-priority scheduling queue, and send it to the next-level scheduler for further processing;
  • S705 Secondary scheduler, scheduling suspicious terminals with lowered priority; adopting different scheduling algorithms to optimize terminal scheduling, these algorithms include but not limited to round-robin scheduling algorithm, random scheduling algorithm, interval scheduling algorithm, etc., in order to maximize guarantee The real terminal is scheduled to ensure the success rate of the business.
  • the network attack detection and control device further includes a notification module, which is used to automatically notify the background management system when a malicious attack occurs; as shown in FIG. 8, the process of the notification module is as follows:
  • S802 Receive the abnormal message of the corresponding cell, mark the status of the serving cell as a bad cell, and notify the background management system, and the background management system receives the abnormal message, sends out an alarm message, and informs the background management personnel to pay attention.
  • the embodiment of the present invention also provides a base station. As shown in FIG. 9, it includes a processor 901, a memory 902, and a communication bus 903, where:
  • the communication bus 903 is used to implement connection and communication between the processor 901 and the memory 902;
  • the processor 901 is configured to execute one or more computer programs stored in the memory 902 to implement the following steps:
  • the preset joint probability density formed by the combination of the real feature parameters and the real-time feature parameters determine the number of matching items that each terminal does not meet the preset joint probability density corresponding to the joint decision condition;
  • Each terminal is detected according to the number of matching items and location information, and the access request of each terminal is controlled according to the detection result.
  • An embodiment of the present invention also provides a computer storage medium that stores one or more programs, where the one or more programs can be executed by one or more processors to implement the steps of the shooting method in the first to second embodiments. .
  • the computer storage medium includes volatile or nonvolatile, removable or non-removable implemented in any method or technology for storing information (such as computer readable instructions, data structures, computer program modules, or other data) In addition to the medium.
  • Computer-readable storage media include but are not limited to RAM (Random Access Memory), ROM (Read-Only Memory, read-only memory), EEPROM (Electrically Erasable Programmable read only memory, charged Erasable Programmable Read-Only Memory) ), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, Or any other medium that can be used to store desired information and that can be accessed by a computer.
  • the location information and real-time feature parameters of each terminal that initiates the access request are obtained; according to the combination of real feature parameters
  • the formed preset joint probability density and real-time feature parameters determine the number of matching items for each terminal that does not meet the joint decision condition corresponding to the preset joint probability density; each terminal is tested according to the number of matching items and location information, and each terminal is tested according to the detection result.
  • the terminal’s access request is controlled; in some implementations, the terminal’s location is used to measure the terminal’s real-time characteristic parameters, combined with the base station joint probability density, to detect each terminal, and then to intelligently determine whether the terminal is a malicious terminal, and
  • the access request is controlled; compared with filtering out external interference noise that does not have a specific rule in some cases, the network attack detection and control method provided in the embodiment of the present invention in real time can judge malicious attacks.
  • the access probability of the real terminal is increased by controlling the access request, thereby shortening the service delay and improving the network quality.
  • communication media usually contain computer-readable instructions, data structures, computer program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery medium. Therefore, the present invention is not limited to any specific combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种网络攻击检测控制方法、装置、基站及计算机存储介质，其中的方法包括当接入网异常时，获取发起接入请求的各终端位置信息和实时特征参数(S101)；根据由真实特征参数联合形成的预设联合概率密度，与实时特征参数，确定各终端不符合预设联合概率密度对应联合判决条件的匹配项数(S102)；根据匹配项数和位置信息对各终端进行检测，根据检测结果对各终端的接入请求进行控制(S103)。

Description

网络攻击检测控制方法、装置、基站及计算机存储介质 技术领域
本发明实施例涉及通信领域，具体而言，涉及但不限于网络攻击检测控制方法、装置、基站及计算机存储介质。
背景技术
窄带物联网(Narrow Band Internet of Things，NB-IoT)是一种基于蜂窝的窄带物联网技术，支持低功耗设备在广域网的蜂窝数据连接，也被叫作低功耗广域网(LPWAN)。NB-IoT技术在物联网的应用日益广泛，由于其存在海量接入的终端用户，业务繁多，面临诸多的网络安全问题。
真实的NB-IoT终端根据自己所支持的频段和工作模式，通过小区搜索过程驻留到合适的小区，当终端需要发送上行数据的时候，就会发起随机接入流程以获取上行授权。根据相关协议，终端会从SIB2-NB系统信息中获取两个RSRP(Reference Signal Receiving Power，参考信号接收功率)阈值和小区的窄带物理随机接入信道(Narrow-band Physical Random Access Channel，NPRACH)配置信息，然后根据自己的RSRP测量值和两个阈值比较确定覆盖等级，并在确定的覆盖等级上选择合适的NPRACH资源发起随机接入先导序列(Random Access Preamble，后文简称Preamble)，然后正确地接受随机接入响应(Random Access Response，RAR)和发送Msg3，完成后续的随机接入流程。
但是，由于所有的NPRACH资源信息是通过广播信息下发，当有恶意的NB-IoT终端在NPRACH信道上一直发送Preamble，而对NB-IoT基站作出的随机接入响应不作出任何回应，而根据相关的标准协议，只要终端在NPRACH资源上发送Preamble，基站就会根据当前空口的资源情况对其作出RAR响应，这个时候就会出现窄带物理下行控制信道(Narrow-band Physical Downlink Control Channel，NPDCCH)、窄带物理下行共享信道(Narrow-band Physical Downlink Shared Channel，NPDSCH)以及窄带物理上行共享信道(Narrow-band Physical Uplink Shared Channel，NPUSCH)等空口资源被大量占用，造成无线网络的“恶意拥塞”情况。
在此背景下，对于处于空闲态的真实终端，当有上行数据需要发送或者收到寻呼消息时，便会发起随机接入请求。但是由于恶意终端发起的网络攻击，大量上下行空口资源被占用，导致信道资源浪费和基站NPRACH虚检的概率提高，加剧空口资源紧张。真实的NPRACH虚检是由无线环境的噪声、本小区NPUSCH上的业务对相邻子载波上NPRACH 的干扰、邻小区的业务干扰以及同频组网干扰造成的，这些都会对NPRACH产生干扰，也会引起NPRACH的误检。不过这些干扰都是偶发的，与这种故意为之的攻击，在发生频度上具有明显的不同。一些情形下的NPRACH检测算法只能过滤掉不具备特定规律的外界干扰噪声，对这种并不是外界干扰的基本无法过滤。最终导致真实终端调度延迟甚至长时间无法接入，增大终端的业务时延，同时也极大地浪费真实终端的电池电量。
发明内容
本发明实施例提供的网络攻击检测控制方法、装置及计算机存储介质，旨在至少在一定程度上解决相关的技术问题之一，包括一些情形下存在NB-IoT终端恶意发起NPrach网络攻击，资源被大量占用，造成NB-IoT小区接入网络拥塞的问题。
有鉴于此，本发明实施例提供一种网络攻击检测控制方法，包括：当接入网异常时，获取发起接入请求的各终端位置信息和实时特征参数；根据由真实特征参数联合形成的预设联合概率密度，与所述实时特征参数，确定各终端不符合所述预设联合概率密度对应联合判决条件的匹配项数；根据所述匹配项数和所述位置信息对所述各终端进行检测，根据检测结果对所述各终端的接入请求进行控制。
本发明实施例还提供一种网络攻击检测控制装置，包括：获取模块，用于获取发起接入请求的各终端位置信息和实时特征参数；联合判决条件模块，用于根据由真实特征参数联合形成的预设联合概率密度，与所述实时特征参数，确定各终端不符合所述预设联合概率密度对应联合判决条件的匹配项数；检测控制模块，用于根据所述匹配项数和所述位置信息对所述各终端进行检测，根据检测结果对各终端的接入请求进行控制。
本发明实施例还提供一种基站，所述基站包括处理器、存储器及通信总线；其中，所述通信总线用于实现处理器和存储器之间的连接通信；所述处理器用于执行存储器中存储的一个或者多个程序，以实现如上所述的网络攻击检测控制方法的步骤。
本发明实施例还提供一种计算机存储介质，存储有一个或者多个程序，其中，所述一个或者多个程序可被一个或者多个处理器执行，以实现如上所述的网络攻击检测控制方法的步骤。
本发明其他特征和相应的有益效果在说明书的后面部分进行阐述说明，且应当理解，至少部分有益效果从本发明说明书中的记载变得显而易见。
附图说明
图1是本发明实施例一提供的网络攻击检测控制的流程图；
图2是本发明实施例一提供的基于位置信息对终端进行初步检测判断的流程图；
图3是本发明实施例二提供的网络攻击检测控制的流程图；
图4是本发明实施例三提供的网络攻击检测装置的结构框图；
图5是本发明实施例三提供的网络攻击检测装置的定位模块的功能流程图；
图6是本发明实施例三提供的网络攻击检测装置的联合判决条件模块的功能流程图；
图7是本发明实施例三提供的网络攻击检测装置的调度模块的功能流程图；
图8是本发明实施例三提供的网络攻击检测装置的通知模块的功能流程图；
图9是本发明实施例四提供的基站的结构框图。
具体实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，下面通过具体实施方式结合附图对本发明实施例作进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
实施例一：
对于处于空闲态的真实终端，当有上行数据需要发送或者收到寻呼消息时，便会发起随机接入请求。但是由于恶意终端发起的网络攻击，大量上下行空口资源被占用，导致信道资源浪费和基站NPRACH虚检的概率提高，加剧空口资源紧张。真实的NPRACH虚检是由无线环境的噪声、本小区NPUSCH上的业务对相邻子载波上NPRACH的干扰、邻小区的业务干扰以及同频组网干扰造成的，这些都会对NPRACH产生干扰，也会引起NPRACH的误检。不过这些干扰都是偶发的，与这种故意为之的攻击，在发生频度上具有明显的不同。这种NPrach网络攻击造成的基站大量NPrach虚检与真实的虚检最大的不同是，它是模仿真实终端在NPrach资源上发送Preamble，对基站的RAR响应不做出响应而造成的；普通NPRACH检测算法只能过滤掉不具备特定规律的外界干扰噪声，对这种并不是外界干扰的基本无法过滤。最终导致真实终端调度延迟甚至长时间无法接入，增大终端的业务时延。
有鉴于此，本发明实施例提供一种网络攻击检测控制方法，如图1所示，该网络攻击检测控制方法包括：
S101：当接入网异常时，获取发起接入请求的各终端位置信息和实时特征参数。
在本发明实施例中，基站检测到接入网异常时，获取发起接入请求的各终端位置信息和实时特征参数，则基站需先确定接入网是否异常，一个实施方式中，当接入网的接入性能参数值小于预设门限值，确定接入网异常；其中该接入性能参数值包括但不限于真实接入比例，信道资源利用率和虚检概率；例如，根据接入网的接入次数和真实完成接入次数，当真实接入次数的比例小于预设门限值，确定接入网异常；例如NB-IoT基站通过检测NPRACH的接入次数与真实完成接入次数的对比，基站自检系统发现真实接入的比例不足 一定门限值(如70％左右)，这个时候系统判断NPRACH的误检率过高，此时可获取发起接入请求的各终端位置信息和实时特征参数；其中当真实接入比例低于30％的门限值，粗略判断可能为恶意终端发起的接入攻击。
一个实施方式中，当信道资源利用率或虚检概率低于预设阈值时，确定接入网异常，当然，还根据真实接入比例、资源利用率和虚检概率中的至少两种参数确定接入网是否异常，例如当接入性能比例小于70％，信道资源利用率低于50％时，确定接入网异常。
在本发明实施例中，终端在NPrach资源上发送Preamble，进而发起接入请求，获取各终端的实时特征参数是基站采集终端的实时特征参数，该实时特征参数包括但不限于TA、频偏以及信噪比(Sinr)；而获取接入请求各终端的位置信息可以是基站主动测量定位终端位置，也可以是终端主动上报位置信息。例如基站通过测量终端TA(Timing Advance，TA)识别距离，然后与邻小区采用三角定位法，共同定位终端位置；一个实施方式中，基站通过高层网元通知服务小区和邻小区发起定位测量指令，终端在NPRACH信道上发送上行信息，服务小区和邻小区通过测量终端的上行信号到达不同基站天线端口的时间差，定位终端的具体位置。在一个实施方式中，也可以终端主动上报位置信息，进而基站获取各终端的位置信息；例如各终端在发起接入请求时，携带各终端的位置信息，进而基站接收各终端的位置信息。
S102：根据由真实特征参数联合形成的预设联合概率密度，与实时特征参数，确定各终端不符合预设联合概率密度对应联合判决条件的匹配项数。
在本发明实施例中，获取各终端的实时特征参数，结合预设联合联合概率密度，确定各终端是否符合对应的判决条件，其中预设联合概率密度是由真实终端(即非恶意终端)的真实特征参数联合形成的，预设联合概率密度可以是基站预先存储的，如基站存储了长期采集真实终端的特征参数，进行统计学习得到的多种联合概率密度谱；也可以是基站基于当前发起接入请求，且作出回应的真实终端的真实特征参数计算得到的多种联合概率密度谱。
在一个实施方式中，基站统计真实终端的真实特征参数落入分段区间概率，计算得到多种预设联合概率密度谱；如TA、频偏以及信噪比(Sinr)等特征参数，按小区分覆盖等级统计真实NPRACH接入的TA、Sinr和频偏落入分段区间概率，学习出真实接入终端的联合概率谱密度，针对终端不同特征参数的多种组合，形成不同的联合概率密度谱，如TA、频偏联合概率谱，频偏、Sinr联合概率谱以及TA、频偏、Sinr联合概率谱。可以理解的是，基站对于不同的特征参数TA、Sinr和频偏都维护了一张区间分配表，按小区覆盖等级，对不同的特征参数，统计在周期范围落在区间范围的次数，该周期是后台可配参数；统计周 期范围内，终端接入TA、Sinr和频偏落在各个区间的概率；即落在各个区间的次数除以统计周期内的总次数，
Figure PCTCN2021074151-appb-000001
表示第j个覆盖等级(如三个覆盖等级，CEL0，CEL1，CEL2，则j≤3)，第i个区间测量统计单位时间内成功接入终端上报的TA估计值分布统计表概率密度值；
Figure PCTCN2021074151-appb-000002
表示第j个覆盖等级，第i个区间测量统计单位时间内成功接入用户上报的频偏估计值分布统计表概率密度值；
Figure PCTCN2021074151-appb-000003
表示第j个覆盖等级，第i个区间测量统计单位时间内成功接入用户上报的Sinr估计值分布统计表概率密度值；针对不同的特征参数，再根据真实终端统计计算得到各个区间的概率密度值之后，计算不同特征参数的联合概率密度谱；比如TA和Sinr的联合概率密度
Figure PCTCN2021074151-appb-000004
为当前接入TA区间i范围的概率密度
Figure PCTCN2021074151-appb-000005
和
Figure PCTCN2021074151-appb-000006
的乘积，
Figure PCTCN2021074151-appb-000007
其它联合概率密度计算类似；可以理解的是，每种预设联合概率密度谱都有对应的判决条件，且该判决条件可以不同。
在本发明实施例中，S102步骤包括但不限于：计算终端的各实时特征参数组合的各联合概率，该联合概率包括至少三种，将各联合概率与对应的预设联合概率密度谱进行比较，确定各终端不符合联合判决条件的匹配项数。例如各实时特征参数为TA、Sinr和频偏，计算得到第一
Figure PCTCN2021074151-appb-000008
联合概率，第一
Figure PCTCN2021074151-appb-000009
联合概率以及第一
Figure PCTCN2021074151-appb-000010
联合概率，预设联合概率密度谱分别为第二
Figure PCTCN2021074151-appb-000011
联合概率谱，第二
Figure PCTCN2021074151-appb-000012
联合概率谱以及第二
Figure PCTCN2021074151-appb-000013
联合概率谱，分别将各第一联合概率与各第二联合概率谱进行比较，假设第一
Figure PCTCN2021074151-appb-000014
联合概率不符合对应的判决条件，第一
Figure PCTCN2021074151-appb-000015
联合概率符合对应的判决条件以及第一
Figure PCTCN2021074151-appb-000016
联合概率符合对应的判决条件，则确定不符合联合判断条件的匹配项数为2；当然当全部符合时，则匹配项数为0。
需要说明的是，由于预设联合概率密度谱是统计真实终端的真实特征参数落入分段区间概率并计算得到，因此在本发明实施例中，当联合概率落在对应的预设联合概率密度谱的预设低概率区间，确定不符合联合判决条件，例如，第一
Figure PCTCN2021074151-appb-000017
联合概率落入低于预设联合概率密度的30％概率区域，确定第一
Figure PCTCN2021074151-appb-000018
联合概率不符合判决条件；其中该预设低概率区间可以根据智能统计的真实终端数量不同而不同，其还可以根据实际情况进行灵活调整。
S103：根据匹配项数和位置信息对各终端进行检测，根据检测结果对各终端的接入请求进行控制。
在本发明实施例中，在一个实施方式中，在S102步骤之前，还包括通过终端的位置信息对终端是否恶意发起NPRACH网络攻击进行初步检测判断，如图2所示：
S201：根据终端的位置信息，确定终端在同一位置区域内发起接入请求；
S202：当终端发起接入次数超过阈值时，将终端作为可疑终端，降低可疑终端的调度优先级。
在本发明实施例中，首先判断终端是否在同一位置区域内发起接入请求，如是，则进一步判断发起接入次数，如是，则将该终端视为可疑终端。其中该同一位置区域可以是同一位置处，也可以是某一位置及其该位置附近位置，如以某一位置点为中心，半径为1000米的圆形位置区域。即由于物联网的特性，大多数终端一个月很可能只发送一次数据，则同一位置区域内终端频繁发起接入请求的终端视为可疑终端，进而降低该位置终端调度优先级，而不在同一位置频繁发起接入请求的终端初步视为真实终端。
值得注意的是，仅通过位置信息来对终端进行判断，可能会造成同一位置区域的真实终端误判，导致真实终端与真实的恶意终端调度优先级同时降低；也可能存在终端未能定位，进而无法对终端进行判断的情况，因此本发明实施例中，还根据不符合联合判决条件的匹配项数进一步对终端进行检测判断，可分为以下三种情况：
情况一：当根据位置信息确定某终端为可疑终端，确定匹配项数为0时，将该可疑终端作为真实终端；通过位置信息和发起接入请求的次数确定某个终端为可疑终端后，但该可疑终端全部符合判决条件时，则表示该终端被误判为可疑终端，此时将可疑终端作为真实终端，并恢复该真实终端的调度优先级。当然，当根据位置信息确定某终端初步为真实终端，且匹配项数为0，则该终端为真实终端。
情况二：将匹配项数等于1的终端作为可疑终端；在一个实施方式中，即无论通过位置信息和发起接入请求的次数确定某个终端为非可疑终端还是可疑终端，对于匹配项个数等于1个的终端将其判决为可疑终端，降低该可疑终端的优先级，值得注意的是，若该可疑终端已根据位置信息降低调度优先级后，无需再次降低优先级，当然在其他实施方式中，也可以在已降低优先级的基础上，继续降低调度优先级。
在一个实施方式中，当根据位置信息确定某终端为可疑终端，同时确定匹配项数等于1时，将该可疑终端确定为恶意终端，进而限制恶意终端的接入请求。
情况三：将匹配项数大于等于2的终端作为恶意终端；即无论通过位置信息和发起接入请求的次数确定某个终端为非可疑终端还是可疑终端，对于匹配项个数大于等于2个的终端将其判决为恶意终端，进而限制恶意终端的接入请求。
在本发明实施例中，检测确定为恶意终端时，可以是在一段时间内直接限制其接入请 求，该限制时间段可以根据当前资源剩余率进行灵活调整，例如当资源剩余率高，则限制时间短一点，资源剩余率低，则限制时间长一点。还可以根据某终端的位置信息和匹配项数确定该终端的限制时间长短，例如当根据位置信息确定某终端为可疑终端，且匹配项数大于等于2，则该终端的限制时间段为A，当根据位置信息确定某终端为可疑终端，且匹配项数等于1，则该终端的限制时间段为B(A>B)。
检测确定为可疑终端时，采用预设调度规则对该可疑终端的接入请求进行调度；其中该预设调度规则包括但不限于轮询调度、随机调度、间隔调度，其中轮询调度为基站按照调度优先级依次进行调度接入请求，随机调度为基站随机选择可疑终端进行调度，间隔调度为基站每间隔一个调度优先级进行调度，或基站每间隔一个空闲时间段调度，通过部分选择调度，最大可能地减少被误判的真实终端得不到调度情况。
可以理解的是，确定发起接入请求的终端包括可疑终端时，将基站对应的服务器小区状态标识为坏小区，通知后台管理系统，通知包括但不限于消息通知，以使得后台管理系统发出告警消息，通知后台管理人员注意；在一些实施例中，当服务小区状态标识为坏小区后，基站可广播通知各终端，进而真实终端可根据实际情况减少接入该基站的接入请求。
本发明实施例提供的网络攻击检测控制方法，通过实时测量的终端特征参数信息，结合基站内部存储的长期采集真实终端的特征参数，进行统计学习得到的多种联合概率密度谱，使用定位算法及联合概率密度检测智能判决终端是否为恶意终端和可疑终端，对于判决为恶意终端直接限制其接入请求，可疑终端则降低其调度优先级，采用轮训、随机或者间隔等调度算法，进行部分选择调度，最大限度以减少真实终端的误判率；与一些情形相比，除了能够滤除TA、频偏在过滤范围外的虚检，还能够滤除TA、频偏取值范围内虚检以及恶意终端的发起NPRACH网络攻击，达到了有效控制基站接入网络拥塞问题，在有恶意终端发起NPRACH网络攻击的情况下，提高了真实终端的接入概率，缩短了业务时延，改善网络质量。
实施例二：
为了便于理解，本发明实施例以一个较为具体的例子对网络攻击检测控制方法进行说明，如图3所示，该网络攻击检测控制方法包括：
S301：当接入网的接入性能参数值小于预设门限值，确定接入网异常。
在本发明实施例中，当基站通过检测NPRACH的接入次数与真实完成接入次数的对比，基站自检系统发现真实接入的比例不足一定门限值，如当真实接入比例低于40％的门限值，粗略判断可能为恶意终端发起的接入攻击，确定接入网异常。
S302：获取发起接入请求的各终端位置信息。
基站侧通过测量终端TA识别距离，然后与邻小区采用三角定位法，共同定位终端位置；在一些实施例中，也可以从接入请求中提取各终端的位置信息。
S303：根据终端的位置信息，确定终端在同一位置区域内发起接入请求。
通过定位的位置信息判断是否同一位置区域内终端发起NPRACH接入请求。
S304：当终端发起接入次数超过阈值时，将终端作为可疑终端，降低该终端的调度优先级。
统计计算同一位置终端发送Preamble频率，当超过既定阈值情况下，如发起接入次数超过3次，将该终端初步作为可疑终端，降低该终端调度优先级。
S305：根据由真实特征参数联合形成的预设联合概率密度，与实时特征参数，确定各终端不符合预设联合概率密度对应联合判决条件的匹配项数。
对于那些未能定位的终端以及真实终端误判的情况，基站根据长期采集真实终端不同的真实特征参数，持续统计学习得到的多种组合的联合概率密度谱，该真实特征参数包括终端TA、频偏及Sinr；通过采集终端的实时测量参数，该实时测量参数也包括终端TA、频偏及Sinr，计算其不同实时特征参数组合的联合概率，与基站统计学习得到的多张联合概率密度谱进行比较，对于落在预设低概率区间的终端不符合联合判决条件，同时记录匹配项数，即对应终端不满足联合判决的条件的项数。
S306：结合位置信息和匹配项数确定各终端类型，对各终端进行接入请求进行控制。
对于匹配项个数大于等于两个的终端将其判决为恶意终端；当匹配项个数只有一个的终端，且当前终端之前被误判为可疑终端，则将其判决为恶意终端；当匹配项个数为0，且确定当前终端之前被误判为可疑终端，则判决为真实终端，恢复其调度优先级。
对于确认为恶意终端，则在一段时间内直接限制其接入请求；对于那些可疑终端降低调度优先级，可以采用不同的调度优化算法，例如轮询调度、随机调度、间隔调度等，部分选择调度，最大可能地减少被误判的真实终端得不到调度情况。
实施例三：
本发明实施例还提供一种网络攻击检测控制装置，用于实现上述各实施例中的网络攻击检测控制方法，如图4所示，其中，该网络攻击检测控制装置包括：获取模块401、联合判决条件模块402、检测控制模块403。
获取模块401，用于获取发起接入请求的各终端位置信息和实时特征参数；
联合判决条件模块402，用于根据由真实特征参数联合形成的预设联合概率密度，与实时特征参数，确定各终端不符合预设联合概率密度对应联合判决条件的匹配项数；
检测控制模块403，用于根据匹配项数和位置信息对各终端进行检测，根据检测结果 对各终端的接入请求进行控制。
在本发明实施例中，该获取模块401包括定位模块，该定位模块用于定位终端具体位置，统计计算同一位置区域终端发送Preamble频率，当超过既定阈值情况下，降低该位置终端调度优先级，优先调度其他位置终端，并做好记录。如图5所示，该定位模块的功能流程如下：
S501：根据NPRACH接入性能参数、资源利用率以及虚检概率判断，确定接入网异常，通过高层网元通知服务小区和邻小区发起定位测量指令。
S502：NB-IoT终端在NPRACH信道上发送上行信息。
S503：服务小区和邻小区通过测量终端的上行信号到达不同基站天线端口的时间差，定位终端的具体位置。
S504：判决条件，服务小区统计同一位置终端发起接入次数，判断是否超过既定阈值，如果超过既定阈值，不符合判决条件的终端直接进入联合判决条件模块402进行二次判决。
S505：符合判决条件的终端，将该位置的终端标记为可疑终端，做好记录，并送入检测控制模块403中的调度模块进行处理；
S506：不符合判决条件的终端直接进入联合判决条件模块402进行二次判决。
在本发明实施例中，联合判决条件模块402可以在定位模块的基础上进一步确定可疑终端，还可以用于处理那些未能定位的终端以及真实终端误判的情况，如图6所示，该联合判决条件模块402的功能流程如下：
S601：获取上下文，统计汇总服务小区接入的终端信息。
S602：根据海量真实终端现场NPRACH接入信息，不断持续统计学习，按小区分覆盖等级统计真实NPRACH接入的TA、Sinr和频偏落入分段区间概率，计算其预设联合概率密度谱。
S603：根据终端实时测量值，联合基站智能统计学习的联合概率谱密度谱判决是否符合判决门限。通过采集终端的实时测量参数，计算其不同特征参数组合的联合概率，与基站统计学习得到的多张联合概率密度谱进行比较，对于联合概率落在联合概率密度谱的低概率区间的终端不符合联合判决条件；在本发明实施例中，不符合联合概率门限的接入视为虚检，同时统计当前虚检概率，再根据虚检概率对NPRACH检测的门限进行自动调整，例如虚检概率相比之前增大，则提高该NPRACH检测的门限。
S604：对于符合判决门限的终端，判断当前终端是否之前被误判，如果是则恢复其调度优先级，否则不进行处理。
S605：对于不合符判决门限的终端，认为存在恶意终端对基站发起网络攻击，送入检 测控制模块403中的调度算法模块进行下一步处理。
在本发明实施例中，检测控制模块403包括调度模块，如图7所示，该调度模块的功能流程如下：
S701：获取上下文，统计服务小区接入终端的各项检测结果数据。
S702：判决条件，综和前述定位检测结果和联合概率谱密度检测的统计结果，对于匹配大于等于两项的终端，判断其为恶意终端，对于满足仅匹配一项的终端，结合定位监测结果，判断其为恶意终端或可疑终端；
S703：对于恶意终端，将在一段时间内限制其接入请求。
S704：对于可疑终端，调整调度优先级，送入低优先级调度队列，送入下一级调度器进行进一步处理；
S705：二级调度器，调度被降低优先级的可疑终端；采取不同的调度算法优化终端调度，这些算法包括但不仅限于轮询调度算法、随机调度算法、间隔调度算法等，目的为了最大限度保证真实终端得到调度，保证业务成功率。
在本发明实施例的一些示例中，网络攻击检测控制装置还包括通知模块，用于出现恶意攻击现象，自动通知后台管理系统；如图8所示，该通知模块的流程如下：
S801：当服务小区发现处于被可疑终端攻击状态，将异常消息通知基站高层网元；
S802：收到对应小区的异常消息，将该服务小区状态标记为坏小区，并通知后台管理系统，后台管理系统收到异常消息，发出告警消息，通知后台管理人员注意。
实施例四：
本发明实施例还提供了一种基站，参见图9所示，其包括处理器901、存储器902及通信总线903，其中：
通信总线903用于实现处理器901和存储器902之间的连接通信；
处理器901用于执行存储器902中存储的一个或者多个计算机程序，以实现如下步骤：
当接入网异常时，获取发起接入请求的各终端位置信息和实时特征参数；
根据由真实特征参数联合形成的预设联合概率密度，与实时特征参数，确定各终端不符合预设联合概率密度对应联合判决条件的匹配项数；
根据匹配项数和位置信息对各终端进行检测，根据检测结果对各终端的接入请求进行控制。
值得注意的是，为了不累赘说明，在本实施例中并未完全阐述各实施例中的所有示例，应当明确的是，各实施例中的所有示例均适用于本实施例。
本发明实施例还提供一种计算机存储介质，存储有一个或者多个程序，其中，一个或 者多个程序可被一个或者多个处理器执行，以实现如实施例一至二中的拍摄方法的步骤。
该计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、计算机程序模块或其他数据)的任何方法或技术中实施的易失性或非易失性、可移除或不可移除的介质。计算机可读存储介质包括但不限于RAM(Random Access Memory，随机存取存储器)、ROM(Read-Only Memory，只读存储器)、EEPROM(Electrically Erasable Programmable read only memory，带电可擦可编程只读存储器)、闪存或其他存储器技术、CD-ROM(Compact Disc Read-Only Memory，光盘只读存储器)，数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。
根据本发明实施例提供的网络攻击检测控制方法、装置、基站以及计算机存储介质，通过当接入网异常时，获取发起接入请求的各终端位置信息和实时特征参数；根据由真实特征参数联合形成的预设联合概率密度，与实时特征参数，确定各终端不符合预设联合概率密度对应联合判决条件的匹配项数；根据匹配项数和位置信息对各终端进行检测，根据检测结果对各终端的接入请求进行控制；在某些实施过程中，通过终端位置，测量终端的实时特征参数，结合基站联合概率密度，对各终端进行检测，进而智能判断出终端是否为恶意终端，并对其接入请求进行控制；与一些情形中只能过滤掉不具备特定规律的外界干扰噪声相比，本发明实施例实时提供的网络攻击检测控制方法，能够对恶意攻击进行判断，在有恶意终端发起NPrach网络攻击的情况下，通过对接入请求的控制提高真实终端的接入概率，进而缩短了业务时延，改善网络质量。
可见，本领域的技术人员应该明白，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件(可以用计算装置可执行的计算机程序代码来实现)、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。
此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、计算机程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。所以，本发明不限制于任何特定的硬件和软件结合。
以上内容是结合具体的实施方式对本发明实施例所作的进一步详细说明，不能认定本发明的具体实施只局限于这些说明。对于本发明所属技术领域的普通技术人员来说，在不 脱离本发明构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本发明的保护范围。

Claims (11)

  1. 一种网络攻击检测控制方法，包括：
    当接入网异常时，获取发起接入请求的各终端位置信息和实时特征参数；
    根据由真实特征参数联合形成的预设联合概率密度，与所述实时特征参数，确定各终端不符合所述预设联合概率密度对应联合判决条件的匹配项数；
    根据所述匹配项数和所述位置信息对所述各终端进行检测，根据检测结果对所述各终端的接入请求进行控制。
  2. 如权利要求1所述的网络攻击检测控制方法，所述获取发起接入请求的各终端位置信息和实时特征参数之前，还包括：
    当所述接入网的接入性能参数值小于预设门限值，确定所述接入网异常。
  3. 如权利要求1所述的网络攻击检测控制方法，所述确定各终端不符合所述预设联合概率密度对应联合判决条件的匹配项数之前，还包括：
    根据所述终端的位置信息，确定所述终端在同一位置区域内发起接入请求；
    当所述终端发起接入次数超过阈值时，将所述终端作为可疑终端，降低所述可疑终端的调度优先级。
  4. 如权利要求3所述的网络攻击检测控制方法，其中，所述根据由真实特征参数联合形成的预设联合概率密度，与所述实时特征参数，确定各终端不符合所述预设联合概率密度对应联合判决条件的匹配项数包括：
    计算终端的各所述实时特征参数组合的各联合概率，所述联合概率包括至少三种；
    将所述各联合概率与对应的所述预设联合概率密度谱进行比较，确定各终端不符合所述联合判决条件的匹配项数。
  5. 如权利要求4所述的网络攻击检测控制方法，其中，所述确定各终端不符合所述联合判决条件的匹配项数包括：
    统计真实终端的真实特征参数落入分段区间概率，计算得到多种所述预设联合概率密度谱；
    当所述联合概率落在对应的所述预设联合概率密度谱的预设低概率区间，确定不符合所述联合判决条件。
  6. 如权利要求1-5任一项所述的网络攻击检测控制方法，其中，所述根据所述匹配项数和所述位置信息对所述各终端进行检测，包括：
    当根据位置信息确定某终端为可疑终端，确定所述匹配项数为0时，将所述可疑终端作为真实终端；
    将所述匹配项数大于等于2的终端作为所述恶意终端；
    将所述匹配项数等于1的终端作为所述可疑终端；
    或，当根据位置信息确定某终端为可疑终端，确定所述匹配项数为1时，将该可疑终端作为恶意终端。
  7. 如权利要求6所述的网络攻击检测控制方法，其中，所述根据检测结果对各终端的接入请求进行控制，包括：
    限制所述恶意终端的接入请求；
    恢复所述真实终端的调度优先级；
    降低所述可疑终端的调度优先级，采用预设调度规则对所述可疑终端的接入请求进行调度。
  8. 如权利要求1所述的网络攻击检测控制方法，所述根据检测结果对各终端的接入请求进行控制之后，还包括：
    确定发起接入请求的终端包括可疑终端时，将服务小区状态标识为坏小区，通知后台管理系统，以使得所述后台管理系统发出告警消息。
  9. 一种基站，包括处理器、存储器及通信总线；其中，
    所述通信总线用于实现处理器和存储器之间的连接通信；
    所述处理器用于执行存储器中存储的一个或者多个程序，以实现如权利要求1至8中任一项所述的网络攻击检测控制方法的步骤。
  10. 一种网络攻击检测控制装置，包括：
    获取模块，用于获取发起接入请求的各终端位置信息和实时特征参数；
    联合判决条件模块，用于根据由真实特征参数联合形成的预设联合概率密度，与所述实时特征参数，确定各终端不符合所述预设联合概率密度对应联合判决条件的匹配项数；
    检测控制模块，用于根据所述匹配项数和所述位置信息对所述各终端进行检测，根据检测结果对所述各终端的接入请求进行控制。
  11. 一种计算机存储介质，存储有一个或者多个程序，其中，所述一个或者多个程序可被一个或者多个处理器执行，以实现如权利要求1至8中任一项所述的网络攻击检测控制方法中的步骤。
PCT/CN2021/074151 2020-05-21 2021-01-28 网络攻击检测控制方法、装置、基站及计算机存储介质 WO2021232847A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010434725.7A CN113709083A (zh) 2020-05-21 2020-05-21 网络攻击检测控制方法、装置、基站及计算机存储介质
CN202010434725.7 2020-05-21

Publications (1)

Publication Number Publication Date
WO2021232847A1 true WO2021232847A1 (zh) 2021-11-25

Family

ID=78646034

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/074151 WO2021232847A1 (zh) 2020-05-21 2021-01-28 网络攻击检测控制方法、装置、基站及计算机存储介质

Country Status (2)

Country Link
CN (1) CN113709083A (zh)
WO (1) WO2021232847A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114071561B (zh) * 2021-12-07 2023-06-23 中国联合网络通信集团有限公司 一种数据上报方法、装置、设备及存储介质
EP4297341A1 (en) * 2022-06-20 2023-12-27 Nokia Solutions and Networks Oy Apparatus and method for detecting prach storm attacks

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101217766A (zh) * 2008-01-03 2008-07-09 中国移动通信集团湖北有限公司 用于移动网络的网优实时参数优化调整系统及其方法
WO2018063063A1 (en) * 2016-09-30 2018-04-05 Telefonaktiebolaget Lm Ericsson (Publ) Partitioning of random access resources
CN110536472A (zh) * 2019-08-08 2019-12-03 中兴通讯股份有限公司 一种数据传输方法、装置及计算机可读存储介质
CN110691420A (zh) * 2019-09-30 2020-01-14 东南大学 一种基于防作弊随机数的新型物联网接入方式

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101217766A (zh) * 2008-01-03 2008-07-09 中国移动通信集团湖北有限公司 用于移动网络的网优实时参数优化调整系统及其方法
WO2018063063A1 (en) * 2016-09-30 2018-04-05 Telefonaktiebolaget Lm Ericsson (Publ) Partitioning of random access resources
CN110536472A (zh) * 2019-08-08 2019-12-03 中兴通讯股份有限公司 一种数据传输方法、装置及计算机可读存储介质
CN110691420A (zh) * 2019-09-30 2020-01-14 东南大学 一种基于防作弊随机数的新型物联网接入方式

Also Published As

Publication number Publication date
CN113709083A (zh) 2021-11-26

Similar Documents

Publication Publication Date Title
US11197167B2 (en) Facilitation of self-adjusting network uplink noise balancing
Radosavac et al. A framework for MAC protocol misbehavior detection in wireless networks
US7092732B2 (en) Radio-communication control method and equipment
US20230022791A1 (en) Detecting Device Interfering with Security Device
US9521587B2 (en) System and method for determining a clear channel assessment threshold
WO2021232847A1 (zh) 网络攻击检测控制方法、装置、基站及计算机存储介质
US8555343B2 (en) Managing resource allocations based on traffic patterns
CN107623554B (zh) 一种基于信任值的协作频谱感知方法、认知无线网络
US20080013462A1 (en) Managing overload of an access medium for a communication system
Li et al. Mac-layer selfish misbehavior in ieee 802.11 ad hoc networks: Detection and defense
US20090310548A1 (en) Apparatus and method for radio communication
CN103338082A (zh) 一种基于“k秩”准则的双门限协作频谱感知方法
US20220182864A1 (en) Detection Method, Apparatus, and System
Althunibat et al. Novel energy-efficient reporting scheme for spectrum sensing results in cognitive radio
CN113472463B (zh) 一种认知无线网络中次用户违反干扰约束行为的检测方法
CN102256280B (zh) 随机接入方法和设备
CN102111887B (zh) 一种prach资源密度调整的方法及基站
Amjad et al. Reputation aware collaborative spectrum sensing for mobile cognitive radio networks
CN110300094B (zh) 一种数据节点可信评估方法、装置、设备及存储介质
EP2826271B1 (en) Improved detection of a primary user transmission
Althunibat et al. Secure cluster-based cooperative spectrum sensing against malicious attackers
CN111818506B (zh) 一种识别热点小区的方法和装置
CN109195167B (zh) 无线能量传输通信网络的加塞攻击防御方法及系统
CN111385814A (zh) 小区网络负荷的评估方法、装置、设备及介质
CN109275137B (zh) 无线能量传输通信网络的加塞攻击预测方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21807896

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 17/04/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21807896

Country of ref document: EP

Kind code of ref document: A1