WO2022061675A1 - 一种数据分析方法及装置 - Google Patents

一种数据分析方法及装置 Download PDF

Info

Publication number
WO2022061675A1
WO2022061675A1 PCT/CN2020/117547 CN2020117547W WO2022061675A1 WO 2022061675 A1 WO2022061675 A1 WO 2022061675A1 CN 2020117547 W CN2020117547 W CN 2020117547W WO 2022061675 A1 WO2022061675 A1 WO 2022061675A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
network element
data analysis
security
algorithm
Prior art date
Application number
PCT/CN2020/117547
Other languages
English (en)
French (fr)
Inventor
崇卫微
辛阳
吴晓波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN202080104295.0A priority Critical patent/CN116235526A/zh
Priority to EP20954527.6A priority patent/EP4207850A4/en
Priority to PCT/CN2020/117547 priority patent/WO2022061675A1/zh
Publication of WO2022061675A1 publication Critical patent/WO2022061675A1/zh
Priority to US18/187,929 priority patent/US20230224310A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a data analysis method and device.
  • a network data analysis function (NWDAF) network element is introduced.
  • NWDAF network element can first obtain data related to the communication network and terminal equipment. , and then generate an artificial intelligence (AI) model based on the acquired data training, obtain data analysis results based on the AI model, and finally send the analysis results to other functional network elements.
  • AI artificial intelligence
  • Other functional network elements can refer to the analysis results to implement corresponding communication service policies.
  • the attacker may add abnormal data to the data related to the communication network and terminal equipment obtained by the NWDAF network element, so that there is abnormal data in the data obtained by the NWDAF network element, which will make the data generated by the NWDAF The results of the analysis are inaccurate.
  • the present application provides a data analysis method and device for improving the accuracy of data analysis results.
  • the present application provides a data analysis method, the method includes: a data analysis network element sends a first request message to a security network element, where the first request message is used to request security detection of the first data, the first request message is One data is the data that the data analysis network element performs data analysis on a specified data analysis type; the data analysis network element receives the security detection result fed back by the security network element; the data analysis network element generates or The data analysis result corresponding to the data analysis type is updated.
  • the data analysis network element can send a request message to the security network element, the security network element performs security detection on the data to be analyzed, and then the data analysis network element generates or updates the data analysis result according to the security detection result, which can improve the data quality.
  • the accuracy of the analysis results can be used to improve the data quality.
  • the data analysis network element may trigger a security detection request in the following situations, which are as follows:
  • Scenario 1 When the data analysis network element determines that the accuracy of the first analysis result is low, a security detection request may be triggered to the security network element. It can be understood that the security detection request is the first request message.
  • the method before the data analysis network element sends the first request message to the first network element, the method further includes: the data analysis network element generates the data analysis type corresponding to the data analysis network element based on the first data the first analysis result; the data analysis network element determines that the accuracy of the first analysis result is less than the first threshold.
  • the data analysis network element can obtain the first analysis result based on the data to be analyzed in advance, and when the accuracy of the first analysis result is relatively low, request the security network element to perform security detection, so that the data analysis network element can After the security detection, the first analysis result is updated, thereby improving the accuracy of the data analysis result.
  • Scenario 2 When the data analysis network element receives the notification message sent by the subscription network element, it can trigger a security detection request to the security network element.
  • the method before the data analysis network element sends the first request message to the first network element, the method further includes: the data analysis network element generates the data analysis type corresponding to the data analysis network element based on the first data the first analysis result; the data analysis network element sends the first analysis result and the first threshold to the subscribing network element, and the first threshold is used by the subscribing network element to determine the accuracy of the first analysis result is less than the first threshold; the data analysis network element receives the notification message sent by the subscription network element when the accuracy of the first analysis result is less than the first threshold; the data analysis network element according to The notification message sends the first request message to the security network element.
  • the subscribing network element can judge the accuracy of the first analysis result, and when the accuracy of the first analysis result is low, the data analysis network element is notified, and then the data analysis network element requests the security network element to perform security detection.
  • Scenario 3 When the data analysis request message sent by the subscription network element is the data analysis result corresponding to the set range, the data analysis network element can trigger the security detection request.
  • the method before the data analysis network element sends the first request message to the network element, the method further includes: the data analysis network element receives a data analysis request message sent by the subscription network element, the data analysis request message The message is used to request the data analysis result corresponding to the data analysis type; the data analysis network element determines the data analysis result corresponding to the set range requested by the data analysis request message.
  • the data analysis network element may request the security network element to perform security detection.
  • the setting range includes a range corresponding to at least one of the following information: setting time information, setting area information, setting slice information, setting user information, and setting service type information.
  • the data analysis network element may actively send a security detection request to the security network element at fixed time intervals.
  • the data analysis network element may send a first request message to the security network element, so that the security network element performs security detection on the first data.
  • the data analysis network element may send the data analysis result to the subscribing network element, so that the subscribing network element can view the subscribed data analysis result of the specified data analysis type.
  • the first request message includes at least one item of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is the A model established by the data analysis network element based on the first data or a model pre-determined by the data analysis network element for the data analysis type, and the first algorithm includes when the data analysis network element establishes the first model. at least one algorithm used.
  • the information of the first data may be the first data itself, the storage address of the first data, and of course the file name of the first data, etc., which is not limited in this application.
  • the security network element can use the information included in the first request message to perform security detection on the first data, thereby separating abnormal data in the first data and improving the accuracy of the data analysis result.
  • the security detection is abnormal data detection;
  • the first request message includes: abnormal data ratio, and the abnormal data ratio is used to indicate that the data volume of abnormal data accounts for the first data proportion of the amount of data.
  • the proportion of abnormal data can be estimated by the data analysis network element or the security network element, so that the security network element can know the proportion of abnormal data existing in the first data, so that the security network element can be targeted.
  • the safety inspection is carried out to make the results of the safety inspection more accurate.
  • the security detection result includes at least one item of the following information: information of abnormal data, information of second data, and second algorithm; wherein, the second data is the first For data other than the abnormal data in the data, the second algorithm is a detection algorithm adopted by the security network element to obtain the abnormal data or the second data.
  • the data analysis network element requests the security network element to perform security detection on the first data, and after the security network element performs security detection, abnormal data and/or data other than abnormal data can be obtained.
  • the abnormal data is separated from the abnormal data, so that the data analysis results are obtained by using the data other than the abnormal data, and the accuracy of the data analysis results is improved.
  • the security detection result includes: a second model, where the second model is a model established by the first network element based on the second data.
  • the data analysis network element generates or updates the data analysis result corresponding to the data analysis type according to the security detection result, including: the data analysis network element generates or updates the data analysis type corresponding to the data analysis type based on the second model. Data analysis results.
  • the second model can be understood as a recommended model obtained after the security network element performs security detection.
  • the data analysis network element can directly use the recommendation model to obtain the data analysis result, which can improve the accuracy of the data analysis result.
  • the data analysis network element generates or updates the data analysis result corresponding to the data analysis type according to the security detection result, including: the data analysis network element obtains the first data analysis result according to the security detection result.
  • Second data the second data is the data other than the abnormal data in the first data; the data analysis network element trains the second data to obtain a third model, and generates a third model based on the third model Or update the data analysis result corresponding to the data analysis type.
  • the acquisition of the second data by the data analysis network element according to the security detection result may include two situations: (1) the data analysis network element obtains the second data directly from the security detection result; (2) the data analysis network element obtains the second data according to the security detection result; Abnormal data in the detection result is detected, and second data is obtained.
  • the data analysis network element can use data other than abnormal data to retrain to obtain a new model, and then obtain data analysis results based on the new model, which can improve the accuracy of the AI model and the data analysis results. accuracy.
  • the data analysis network element when the security detection result includes the second algorithm, performs training on the second data to obtain a third model, including: the data analysis network element utilizes the second algorithm.
  • the second algorithm trains the second data to obtain the third model.
  • the first data is training data or inference data corresponding to the data analysis type.
  • the security network element is a security network data analysis function NWDAF network element.
  • the security detection is bait data detection.
  • bait data refers to abnormal data or attack data whose distribution is similar to normal data distribution and affects the accuracy of data analysis results. Such bait data cannot be easily identified using existing data cleaning or outlier detection methods.
  • the present application provides a data analysis method, the method includes: a security network element receives a first request message sent by a data analysis network element, where the first request message is used to request security detection of the first data,
  • the first data is a data set that the data analysis network element performs data analysis on a specified data analysis type; the security network element performs security detection on the first data to obtain a security detection result; the security network element The security detection result is sent to the data analysis network element.
  • the security network element can perform security detection on the first data, so as to separate abnormal data from the first data, so that the data analysis network element can obtain the data analysis result according to the security detection result, and improve the accuracy of the data analysis result. Spend.
  • the first request message includes at least one item of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is the A model established by the data analysis network element based on the first data or a model pre-determined by the data analysis network element for the data analysis type, and the first algorithm includes when the data analysis network element establishes the first model. at least one algorithm used.
  • the security detection is abnormal data detection;
  • the first request message includes: abnormal data ratio, and the abnormal data ratio is used to indicate that the data volume of abnormal data accounts for the first data proportion of the amount of data.
  • the security detection result includes at least one item of the following information: information of abnormal data, information of second data, and second algorithm; wherein, the second data is the first For data other than the abnormal data in the data, the second algorithm is a detection algorithm adopted by the security network element to obtain the abnormal data or the second data.
  • the security detection result includes: a second model, where the second model is a model established by the security network element based on the second data.
  • the security network element performing security detection on the first data includes: the security network element performing security detection on the first data by using the second algorithm.
  • the method further includes: the security network element determines the second algorithm according to a first algorithm and/or a third algorithm, where the first algorithm includes the data analysis network element establishing the at least one algorithm used in the first model, and the third algorithm is at least one algorithm pre-stored in the security network element.
  • the security network element determines the second algorithm according to the first algorithm and/or the third algorithm, including: the security network element compares the first algorithm with the third algorithm Intersection is determined as the second algorithm.
  • the security network element may also decide on its own an algorithm for security detection, that is, it may not refer to the first algorithm, which is not limited in this application.
  • the first data is training data or inference data corresponding to the data analysis type.
  • the security network element is a security network data analysis function NWDAF network element.
  • the security detection is bait data detection.
  • the present application provides a data analysis device, the data analysis device having the function of implementing the behavior in the method example of the first aspect above.
  • the functions can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the data analysis device includes: a communication unit configured to send a first request message to a security network element, where the first request message is used to request security detection of first data, the first data being the data analysis network
  • the data analysis element performs data analysis on the specified data analysis type; and receives the security detection result fed back by the security network element; the processing unit is configured to generate or update the data analysis result corresponding to the data analysis type according to the security detection result.
  • the processing unit is further configured to: before sending the first request message to the first network element, based on the first data, generate a first analysis result corresponding to the data analysis type, and determine The accuracy of the first analysis result is less than the first threshold.
  • the processing unit is further configured to: generate a first analysis result corresponding to the data analysis type based on the first data before sending the first request message to the first network element; the The communication unit is further configured to: send the first analysis result and a first threshold to the subscribing network element, where the first threshold is used by the subscribing network element to determine that the accuracy of the first analysis result is less than the first threshold , and receive the notification message sent by the subscription network element when the accuracy of the first analysis result is less than the first threshold; the communication unit is specifically configured to send the first request to the security network element in the following manner Message: send the first request message to the security network element according to the notification message.
  • the communication unit is further configured to: before sending the first request message to the network element, receive a data analysis request message sent by a subscription network element, where the data analysis request message is used to request the data analysis The data analysis result corresponding to the type; the processing unit is further configured to: determine the data analysis result corresponding to the set range requested by the data analysis request message.
  • the setting range includes a range corresponding to at least one of the following information: setting time information, setting area information, setting slice information, setting user information, and setting service type information.
  • the first request message includes at least one item of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is the A model established by the data analysis network element based on the first data or a model pre-determined by the data analysis network element for the data analysis type, and the first algorithm includes when the data analysis network element establishes the first model. at least one algorithm used.
  • the security detection is abnormal data detection;
  • the first request message includes: abnormal data ratio, and the abnormal data ratio is used to indicate that the data volume of abnormal data accounts for the first data proportion of the amount of data.
  • the security detection result includes at least one item of the following information: information of abnormal data, information of second data, and second algorithm; wherein, the second data is the first For data other than the abnormal data in the data, the second algorithm is a detection algorithm adopted by the security network element to obtain the abnormal data or the second data.
  • the security detection result includes: a second model, where the second model is a model established by the first network element based on the second data;
  • the processing unit is specifically configured to generate or update the data analysis result corresponding to the data analysis type according to the security detection result in the following manner: generate or update the data analysis result corresponding to the data analysis type based on the second model.
  • the processing unit is specifically configured to generate or update the data analysis result corresponding to the data analysis type according to the security detection result in the following manner: obtain second data according to the security detection result, and then The second data is the data except the abnormal data in the first data; the third model is obtained by training the second data, and the data corresponding to the data analysis type is generated or updated based on the third model Analyze the results.
  • the processing unit when the security detection result includes the second algorithm, is specifically configured to perform training on the second data to obtain a third model in the following manner, including: using the second algorithm The algorithm trains the second data to obtain the third model.
  • the first data is training data or inference data corresponding to the data analysis type.
  • the security network element is a security network data analysis function NWDAF network element.
  • the security detection is bait data detection.
  • the present application provides a data analysis device, the data analysis device having the function of implementing the behavior in the method example of the second aspect above.
  • the functions can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the data analysis apparatus includes: a communication unit, configured to receive a first request message sent by a data analysis network element, where the first request message is used to request security detection of the first data, the The first data is a data set that the data analysis network element performs data analysis on a specified data analysis type; a processing unit is used to perform security detection on the first data to obtain a security detection result; the communication unit is further used for: Send the security detection result to the data analysis network element.
  • the first request message includes at least one item of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is the A model established by the data analysis network element based on the first data or a model pre-determined by the data analysis network element for the data analysis type, and the first algorithm includes when the data analysis network element establishes the first model. at least one algorithm used.
  • the security detection is abnormal data detection;
  • the first request message includes: abnormal data ratio, and the abnormal data ratio is used to indicate that the data volume of abnormal data accounts for the first data proportion of the amount of data.
  • the security detection result includes at least one item of the following information: information of abnormal data, information of second data, and second algorithm; wherein, the second data is the first For data other than the abnormal data in the data, the second algorithm is a detection algorithm adopted by the security network element to obtain the abnormal data or the second data.
  • the security detection result includes: a second model, where the second model is a model established by the security network element based on the second data.
  • the processing unit is specifically configured to perform security detection on the first data in the following manner: perform security detection on the first data by using the second algorithm.
  • the processing unit is further configured to: determine the second algorithm according to a first algorithm and/or a third algorithm, where the first algorithm includes the data analysis network element establishing the first algorithm at least one algorithm used in modeling, and the third algorithm is at least one algorithm pre-stored in the security network element.
  • the processing unit is specifically configured to determine the second algorithm according to the first algorithm and/or the third algorithm in the following manner: determine the intersection of the first algorithm and the third algorithm for the second algorithm.
  • the first data is training data or inference data corresponding to the data analysis type.
  • the data analysis device is a NWDAF network element of a secure network data analysis function.
  • the security detection is bait data detection.
  • a data analysis apparatus may be the data analysis network element in the above method embodiments.
  • the data analysis device may include a transceiver and at least one processor, where the transceiver is configured to perform the first aspect or the method described in any one of the first aspects, and the data analysis device performs the operations of receiving and sending messages;
  • the at least one processor invokes an instruction to execute the message processing operation performed by the data analysis apparatus in the second aspect or the method described in any one of the second aspect.
  • a data analysis apparatus may be the security network element in the above method embodiments.
  • the data analysis device may include a transceiver and at least one processor, the transceiver is configured to perform the method described in the second aspect or any one of the second aspects, and the data analysis device performs the operations of receiving and sending messages;
  • the at least one processor invokes an instruction to execute the message processing operation performed by the data analysis apparatus in the second aspect or the method described in any one of the second aspect.
  • a computer program product comprising: computer program code, when the computer program code is executed, the method performed by the data analysis network element in the above aspects is executed.
  • a computer program product comprising: computer program code, when the computer program code is executed, the method performed by the secure network element in the above aspects is executed.
  • the present application provides a chip system, the chip system includes at least one processor and a transceiver, and the processor executes any one of the first aspect and the second aspect by running instructions.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the present application further provides a data analysis system, including the data analysis device according to any one of the third aspect and the data analysis device according to any one of the fourth aspect.
  • the present application provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed, the method performed by the data analysis network element in the above aspects is implemented.
  • the present application provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed, the method performed by the security network element in the above aspects is implemented.
  • FIG. 1 is a schematic diagram of a 5G network architecture based on a service-oriented interface provided by an embodiment of the present application
  • FIG. 2 is a flow chart of a data analysis method provided in an embodiment of the present application.
  • FIG. 3 is a flowchart of a data analysis method provided in an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a data analysis apparatus provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a data analysis network element according to an embodiment of the present application.
  • FIG. 7 is a schematic diagram of another data analysis apparatus provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a security network element provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a data analysis system provided by the present application.
  • the process of data analysis may include the following steps: First, a data analysis result subscriber (consumer) triggers a service operation of NWDAF, which is used to subscribe to the data analysis result type. After receiving the service operation triggered by the consumer, NWDAF can obtain relevant network data, terminal device data, third-party application data, etc. from the corresponding network element according to the data analysis result type subscribed by the consumer, and then use the obtained various Data training generates the corresponding AI model, and performs data inference based on the AI model to obtain data analysis results. Finally, NWDAF feeds back the AI model or data analysis results to the consumer. In this process, the attacker may inject bait data similar to the real data into the network data obtained by NWDAF, which will cause abnormal data in the network data, and then make the training model accuracy relatively low, and the obtained inference data analysis The results are also not accurate.
  • the bait data is a data sample designed by an attacker to conduct a bait attack on an AI model, which can be used to contaminate the training data used for training the model or the inference data used for model inference, thereby jeopardizing the normal function of the entire AI system. and the accuracy of data analysis results.
  • data analysis results may include but are not limited to: service experience data analysis results, network element load data analysis results, UE service behavior analysis results, UE mobility analysis results, UE interaction analysis results, and UE exceptions. Behavioral analysis results, etc.
  • a new network element is added to the 5G network architecture, and the newly added network element is used to detect abnormal data, and then the detection result is fed back to the NWDAF network element.
  • the NWDAF network element Based on the feedback detection results, AI model training or data analysis results are generated, which can improve the accuracy of data analysis results and ensure the security of the AI model.
  • the newly added network element in the 5G network architecture may be a network element responsible for security, and more specifically, in this application, it may be an NWDAF network element specifically responsible for security.
  • FIG. 1 a schematic diagram of a 5G network architecture based on a service-oriented interface provided by an embodiment of the present application.
  • the network architecture includes three parts, which are a data analysis result subscriber (consumer), a data provider network element, and a data analysis function network element.
  • the data analysis function network elements may include: NWDAF network elements and security (security) NWDAF network elements.
  • NWDAF network elements can collect data from network function (NF) network elements, operation management and maintenance (Operation, Administration, Maintenance, OAM) systems, terminal equipment or application function (application function, AF) network elements, and analyze the collected data. The data is analyzed to obtain the data analysis results. The NWDAF network element can also send the obtained data analysis results to the NF, OAM system, terminal equipment or AF network element, so that these entities can make corresponding policy formulation and operation execution.
  • NF network function
  • OAM operation management and maintenance
  • AF application function
  • security NWDAF network element is used to provide data analysis functions of security services. It can provide security services such as abnormal data detection by interacting with NWDAF network elements.
  • the data provider network element refers to the node or physical device in the network, which can provide corresponding functional support for user equipment (UE) to access the network, session, authentication, policy control, etc., and also generate corresponding network data.
  • UE user equipment
  • AMF access and mobility management function
  • SMF session management function
  • AF AF
  • the AMF network element is the control plane network element provided by the operator's network. It is responsible for the access control and mobility management of terminal equipment accessing the operator's network, such as mobility status management, assignment of temporary user identities, authentication and authorization of users, etc. Function.
  • the SMF network element is a control plane network element provided by the operator network and is responsible for managing the protocol data unit (PDU) session of the terminal device.
  • a PDU session is a channel for transmitting PDUs, and terminal devices need to transmit PDUs to each other through a PDU session and a data network (DN).
  • the PDU session is established, maintained and deleted by the SMF network element.
  • SMF network elements include session management (such as session establishment, modification and release, including tunnel maintenance between user plane function (UPF) and access network (AN)), selection and control of UPF network elements , Service and Session Continuity (SSC) mode selection, roaming and other session-related functions.
  • session management such as session establishment, modification and release, including tunnel maintenance between user plane function (UPF) and access network (AN)
  • UPF user plane function
  • AN access network
  • SSC Service and Session Continuity
  • the AF network element mainly provides application layer services, and also supports interaction with the 5G core network to provide services, such as influencing data routing decisions, policy control functions, or providing some third-party services to the network side.
  • Data analysis result subscriber which refers to OAM or some NFs in the 5G network structure (for example, policy control function (PCF), etc.), UE, RAN, AF, etc., which can subscribe to NWDAF for corresponding data Analyze the results and make corresponding adjustments based on the data analysis results.
  • the PCF may adjust the QoS parameters of the service according to the service-level service experience fed back by the NWDAF, so as to better ensure the service experience of the service.
  • the PCF network element is a control plane function provided by the operator and is used to provide policies to the network network element.
  • the policies may include access control policies, mobility management policies, charging-related policies, QoS-related policies, authorization-related policies, and the like.
  • Terminal equipment also known as user equipment (UE)
  • UE user equipment
  • UE is a device with wireless transceiver functions that can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on water (such as ships). etc.); can also be deployed in the air (eg on airplanes, balloons, satellites, etc.).
  • the terminal device may be a mobile phone (mobile phone), a tablet computer (pad), a computer with wireless transceiver function, a virtual reality (virtual reality, VR) terminal, an augmented reality (augmented reality, AR) terminal, an industrial control (industrial control) wireless terminals in ), wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety , wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • a virtual reality virtual reality, VR
  • augmented reality augmented reality
  • industrial control industrial control
  • the above-mentioned terminal device can establish a connection with the operator network through an interface (eg, N1, etc.) provided by the operator network, and use the data and/or voice services provided by the operator network.
  • the terminal device can also access the DN through the operator's network, and use the operator's service deployed on the DN and/or the service provided by a third party.
  • the above-mentioned third party may be a service provider other than the operator's network and the terminal device, and may provide other services such as data and/or voice for the terminal device.
  • the specific expression form of the above third party can be specifically determined according to the actual application scenario, and is not limited here.
  • the network architecture may further include: network exposure function (NEF) network element, unified data management (UDM) network element, network function repository function (network function repository function, NRF) network element, authentication server function (AUSF) network element, (radio) access network ((radio) access network, (R)AN) and user plane function (user plane function, UPF) network element, etc. .
  • NEF network exposure function
  • UDM unified data management
  • NRF network function repository function
  • AUSF authentication server function
  • R radio access network
  • UPF user plane function
  • the RAN is a sub-network of the operator's network, and is the implementation system between the service node and the terminal equipment in the operator's network.
  • the terminal device To access the operator's network, the terminal device first passes through the RAN, and then can be connected to the service node of the operator's network through the RAN.
  • the RAN device in this application is a device that provides wireless communication functions for terminal devices.
  • Access network devices include but are not limited to: next-generation base stations (g nodeB, gNB) in 5G, evolved node B (evolved node B) , eNB), radio network controller (RNC), node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station ( For example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), mobile switching center, etc.
  • next-generation base stations g nodeB, gNB in 5G
  • evolved node B evolved node B (evolved node B) , eNB
  • RNC radio network controller
  • node B node B
  • base station controller base station controller
  • BTS base transceiver station
  • home base station For example, home evolved nodeB, or home node
  • DN also known as packet data network (PDN)
  • PDN packet data network
  • the operator's network can access multiple DNs, and a variety of services can be deployed on the DNs, providing Services such as data and/or voice.
  • the DN is the private network of a smart factory.
  • the sensors installed in the workshop of the smart factory can be terminal devices, and the control server of the sensor is deployed in the DN, and the control server can provide services for the sensor.
  • the sensor can communicate with the control server, obtain the instruction of the control server, and transmit the collected sensor data to the control server according to the instruction.
  • the DN is the internal office network of a company.
  • the mobile phones or computers of employees of the company can be terminal devices, and the mobile phones or computers of employees can access information and data resources on the internal office network of the company.
  • the UDM network element is the control plane network element provided by the operator, which is responsible for storing the subscriber permanent identifier (SUPI), credential (credential), security context (security context), subscription data and other information.
  • the information stored by the UDM network element can be used for authentication and authorization of terminal equipment to access the operator's network.
  • the above-mentioned subscribers of the operator's network may specifically be users who use services provided by the operator's network, such as users using China Telecom's mobile phone core cards, or users using China Mobile's mobile phone core cards.
  • the permanent subscription identifier (Subscription Permanent Identifier, SUPI) of the above-mentioned subscriber may be the number or the like of the mobile phone core card.
  • the above-mentioned credential and security context of the signing user may be the encryption key of the mobile phone core card or a small file stored with information related to the encryption of the mobile phone core card, etc., for authentication and/or authorization.
  • the above-mentioned security context may be data (cookie) or token (token) stored on the user's local terminal (such as a mobile phone).
  • the contract data of the above-mentioned contract user may be the supporting services of the mobile phone chip card, such as the data package of the mobile phone chip card or the use of the network.
  • the NEF network element is the control plane network element provided by the operator.
  • the NEF network element opens the external interface of the operator's network to the third party in a secure manner.
  • the SMF network element needs to communicate with a third-party network element
  • the NEF network element can be used as a relay for the communication between the SMF network element and the third-party network element.
  • the NEF network element can be used as the translation of the identification information of the subscriber and the translation of the identification information of the third-party network element.
  • the NEF sends the SUPI of the subscriber from the operator network to the third party, it can translate the SUPI into its corresponding external identity (identity, ID).
  • ID the external identity
  • the NRF network element can be used to provide a network element discovery function, and based on the request of other network elements, provide network element information corresponding to the network element type, such as address information and/or identification information.
  • NRF also provides network element management services, such as network element registration, update, de-registration, and network element status subscription and push.
  • the AUSF network element is the control plane network element provided by the operator, and can usually be used for the first-level authentication, that is, the authentication between the terminal device (subscribed user) and the operator's network. After the AUSF network element receives the authentication request initiated by the subscriber, it can authenticate and/or authorize the subscriber through the authentication information and/or authorization information stored in the UDM network element, or generate the authentication and/or authorization of the subscriber through the UDM network element. or authorization information. The AUSF network element may feed back authentication information and/or authorization information to the subscriber.
  • the UPF network element is the gateway provided by the operator, and is the gateway for the communication between the operator's network and the DN.
  • UPF network elements include user plane-related functions such as data packet routing and transmission, packet detection, service usage reporting, Quality of Service (QoS) processing, legal interception, uplink packet detection, and downlink packet storage.
  • QoS Quality of Service
  • Nnef, Nausf, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, etc. are interface serial numbers.
  • 3GPP 3rd generation partnership project
  • the present application is not limited to be applied to the 5G system shown in FIG. 1 , but can also be applied to future communication systems, such as a sixth generation (6th generation, 6G) system.
  • 6G sixth generation
  • NWDAF NWDAF
  • data analysis network element the data provider network element
  • security NWDAF the security NWDAF network element
  • Security network element record the subscriber of the data analysis result as “subscribing network element”.
  • the NWDAF network element may be an independent network element, or may be co-located with other network elements.
  • the NWDAF network element is co-located with the AMF network element or the SMF network element.
  • other network elements may also have related functions of the NWDAF network element.
  • the AMF network element or the SMF network element has related functions of the NWDAF network element.
  • a flowchart of a data analysis method provided in an embodiment of the present application, referring to FIG. 2 , the method may include the following steps:
  • Step 201 The data analysis network element sends a first request message to the security network element.
  • the security network element receives the first request message sent by the data analysis network element.
  • the first request message is used to perform security detection on the first data
  • the first data is the data that the data analysis network element performs data analysis on the specified data analysis type.
  • Step 202 The security network element performs security detection on the first data to obtain a security detection result.
  • Step 203 The data analysis network element receives the security detection result fed back by the security network element.
  • the security network element After the security network element receives the first request message, it can perform security detection on the first data to obtain a security detection result. Moreover, the security network element can feed back the security detection result to the data analysis network element.
  • Step 204 The data analysis network element generates or updates the data analysis result corresponding to the data analysis type according to the security detection result.
  • the data analysis network element may generate the data analysis result corresponding to the data analysis type according to the security detection result, or update the data analysis result corresponding to the data analysis type.
  • the data analysis network element may first analyze the first data to obtain the data analysis result, and then request the security network element to perform security detection on the first data based on the data analysis result, obtain the security detection result, and finally analyze the data
  • the network element updates the data analysis result obtained earlier according to the security detection result, and obtains a new data analysis result.
  • the data analysis network element may directly trigger a security detection request to the security network element after acquiring the first data, and then the security network element performs security detection on the first data to obtain a security detection result, and the final data The analysis network element generates a data analysis result according to the security detection result of the first data by the security network element.
  • FIG. 2 The embodiment shown in FIG. 2 will be described in detail below with reference to specific embodiments.
  • a flow chart of a data analysis method provided for this application referring to Figure 3, the method may include the following steps:
  • Step 301 The subscribing network element sends a data analysis request message to the NWDAF.
  • the data analysis request message is used to request the data analysis result corresponding to the data analysis type to be analyzed.
  • the type of data analysis result (Analytics ID) may be carried in the data analysis request message, so that NWDAF can collect corresponding data according to the type of the data analysis result.
  • the data analysis request message can also be a subscription request message, for example, the subscription network element calls the Nnwdaf_AnalyticsSubscription_Subscribe service operation of NWDAF or calls the Nnwdaf_analytics request service operation to subscribe to or request the data analysis result it wants from NWDAF, such as service experience data. Analysis results, network element load data analysis results, or UE interaction information analysis results, etc.
  • the subscription request message may carry the Analytics ID. For example, if the subscription network element subscribes to NWDAF for service experience data analysis results, the Analytics ID carried in the subscription request message is Service Experience.
  • the Analytics ID carried in the subscription request message is NF load information; or the subscribing network element subscribes to the NWDAF for the analysis result of UE interaction information, then the Analytics ID carried in the subscription request message is NF load information.
  • Analytics ID is UE communication information.
  • Step 302 The NWDAF acquires the first data from the first network element.
  • NWDAF After NWDAF receives the data analysis request message sent by the subscription network element, it can determine the data provider network element (Data provider) according to the Analytics ID carried in the data analysis request message.
  • Data provider data provider network element
  • the correspondence between data analysis types and data provider network elements may be pre-stored, that is, different data analysis types may correspond to different data provider network elements.
  • NWDAF can obtain different information from different data provider network elements.
  • the NWDAF can obtain the location information (UE Location) of the UE from the AMF, such as network location or other geographic location information, such as base station, cell identifier, etc.; when the data provider network When the network element is UPF, NWDAF can obtain the service experience flow (Quality of Service Flow) information from UPF; when the data provider network element is OAM, NWDAF can obtain wireless access type/radio frequency priority (radio access type) from OAM type frequency selection priority, RFSP) information.
  • UE Location UE Location
  • UPF network location or other geographic location information, such as base station, cell identifier, etc.
  • NWDAF can obtain the service experience flow (Quality of Service Flow) information from UPF
  • NWDAF can obtain wireless access type/radio frequency priority (radio access type) from OAM type frequency selection priority, RFSP) information.
  • the data analysis result subscribed by the subscribing network element to the NWDAF is the first data analysis type
  • the data provider network element corresponding to the first data analysis type may be the first network element.
  • the number of the first network element may be one or multiple.
  • the first data acquired by the NWDAF from the first network element may be all data in the first network element corresponding to the specified data analysis type.
  • the first data acquired by the NWDAF from the first network element may be part of the data in the first network element, for example, may be some specific data.
  • the NWDAF when acquiring data from the first network element, the NWDAF also provides the data type, so that the first data acquired by the NWDAF from the first network element is the data corresponding to the data type.
  • Step 303 Based on the first data, the NWDAF generates a first analysis result corresponding to the data analysis type.
  • the first data here may be training data or inference data, which is used as input data for model training or data inference.
  • the first data is the data that NWDAF performs data analysis on the specified data analysis type.
  • the first data analysis result here may be the model itself, or may be a result obtained by inference based on the model, which is not limited.
  • NWDAF can train the training data to obtain an AI model, and obtain the first analysis result based on the AI model; when the first data is inference data, NWDAF can input the inference data to the trained data In the AI model, the first analysis result is obtained.
  • NWDAF can obtain one or more network elements corresponding to the specified data analysis type based on the pre-stored correspondence between the data analysis type and the data provider network element, and obtain data from these network elements, Using the acquired data for training and inference, to obtain data analysis results, help improve the efficiency and accuracy of data analysis.
  • Step 304 NWDAF sends the first analysis result to the subscribing network element.
  • the first analysis result may be sent to the subscribing network element.
  • the subscribing network element can receive the analysis result.
  • the NWDAF when it sends the first analysis result to the subscribing network element, it may send a preset accuracy (accuracy) threshold value (for example, recorded as "first threshold”) to the subscribing network element. .
  • the threshold value may be used by the subscribing network element to judge the accuracy of the first analysis result.
  • Step 305 The subscribing network element feeds back the accuracy of the first analysis result to the NWDAF.
  • the subscribing network element After the subscribing network element receives the first analysis result and the first threshold, if the accuracy of the first analysis result is less than the first threshold, it means that there may be abnormal data in the first data acquired by NWDAF, so that the accuracy of the first analysis result is accurate. degree is relatively low.
  • the accuracy of the first analysis result is greater than the first threshold, it means that the probability of abnormal data exists in the first data obtained by NWDAF is relatively low, and therefore, the accuracy of the first analysis result is relatively high.
  • the first threshold may be used for the subscribing network element to send a notification message to the NWDAF when it is determined that the accuracy of the first analysis result is less than the first threshold.
  • the NWDAF may receive the notification message sent by the subscribing network element. The notification message can be used to feed back the accuracy of the data analysis result to the NWDAF, so that the NWDAF sends a data detection request message to the security network element.
  • Step 306 NWDAF sends a first request message to security NWDAF, where the first request message is used to request security detection of the first data.
  • the NWDAF sends the first request message to the security NWDAF, which may include the following situations:
  • the first type When the NWDAF receives the notification message sent by the subscribing network element, it can send a request message for security detection to the security NWDAF.
  • NWDAF may also determine the accuracy of the first analysis result according to the first analysis result. That is, when the NWDAF determines that the accuracy of the first analysis result is less than the first threshold, a request message for performing security detection may be sent to the security NWDAF.
  • NWDAF can also automatically trigger security detection requirements based on the accuracy requirements of AI model training results. That is, NWDAF does not need to wait for the notification message sent by the subscribing network element, and can directly send a request message for security detection to the security NWDAF.
  • NWDAF can periodically send a request message for security detection to security NWDAF. That is to say, the NWDAF may send a request message for security detection to the security NWDAF at fixed time intervals. For example, NWDAF can send a request message for security detection to security NWDAF every 3 minutes. Of course, NWDAF can also send a request message for security detection to security NWDAF every 1 minute, etc., which is not limited in this application.
  • the NWDAF may send a request message for security detection to the security NWDAF.
  • the setting range may include a range corresponding to at least one of the following information: setting time information, setting area information, setting slice information, setting user information, and setting service type information.
  • the set time information may be a set time period or a set time point;
  • the set area information may be one or more set cell identities, one or more tracking area identities (TAI), Administrative region identification, geographic region latitude and longitude identification, etc.
  • setting slice information can be network slice selection assistance information (NSSAI) for the set network slice, single network slice selection assistance information (single network slice selection assistance information, S- NSSAI), network slice instance (network slice instance, NSI) information, network slice sub-instance (network slice subnet instance, NSSI) information, etc.
  • setting user information can be specified network element or specified terminal equipment (UE) or user object (user); where the user information may be a user type (eg, network element type, UE type, user type, etc.), or a user identifier (eg, network element identifier, UE identifier, user type), etc.
  • the NWDAF may send a first request message to the security NWDAF, where the request message may be used to perform security detection on the first data.
  • the security detection is abnormal data detection, that is, the request message can be used to detect abnormal data in the first data, so that abnormal data existing in the first data can be determined, so that abnormal data can be processed in time. , to improve the accuracy of data analysis results.
  • the abnormal data in this application can be the bait data (the distribution situation generated by the attacker is similar to the normal data distribution, and can affect the abnormal data or attack data of the accuracy of the data analysis result.
  • the security network element can perform security detection on the first data, and obtain the bait data existing in the first data, so as to help the data analysis network element to clear the obtained bait data.
  • the bait data in the data can improve the accuracy of the data analysis results.
  • the first request message may include at least one item of the following information: information of the first data, a first model, and a first algorithm.
  • the first model is a model established by NWDAF based on the first data or a model pre-determined by NWDAF for the data analysis type
  • the first algorithm is an algorithm recommended by NWDAF to security NWDAF, which may include NWDAF establishing the At least one algorithm used in the first model.
  • the first algorithm may be a linear regression algorithm, a recurrent neural network algorithm, or the like.
  • the information of the first data may be the data itself, a storage address of the first data, or a file name where the first data is stored, etc., which is not limited in this application.
  • the first request message may further include: abnormal data ratio, where the abnormal data ratio is used to indicate the ratio of the data volume of abnormal data to the data volume of the first data. That is, the first request message may further include a ratio of the data volume of the abnormal data to the data volume of the first data. It can be understood that the data ratio can also be the ratio of the data volume of abnormal data to the data volume of normal data (data other than abnormal data in the first data), etc., which is not limited in this application.
  • the subscription network element may estimate the proportion of the data volume of the abnormal data in the data volume of the first data according to the accuracy of the first analysis result. That is, in step 205, when the subscribing network element feeds back the accuracy of the first data analysis result to the NWDAF, it may also feed back the abnormal data proportion estimated by itself to the NWDAF.
  • NWDAF can estimate the proportion of abnormal data according to the accuracy requirements of AI model training results and other information. For example, NWDAF can train an AI model based on the first data, and then use the AI model on the test data to obtain the analysis results of the test data, and estimate the proportion of abnormal data according to the mean square error of the analysis results.
  • security NWDAF can set or estimate the proportion of abnormal data.
  • Step 307 security The NWDAF performs security detection on the first data to obtain a security detection result.
  • the security detection may be abnormal data detection.
  • the security detection can be bait data detection, such as TRIM algorithm.
  • TRIM algorithm When using the TRIM algorithm to detect bait data, it does not simply remove outliers, but uses the bait data and normal data to train a linear regression model, and TRIM iteratively estimates the regression parameters. In each iteration, the subset of data that minimizes the loss function is selected, and training is performed again on this subset of data until the loss function converges. After convergence, the identified data subsets are regarded as normal data (ie, second data), and other data are regarded as bait data (ie, abnormal data).
  • the AI model generated by the last iteration can be used as the model recommended to NWDAF (ie, the second model).
  • the security detection result may include at least one item of the following information: information of abnormal data, information of second data, and second algorithm.
  • the second data is data other than the abnormal data in the first data
  • the second algorithm is the detection algorithm used by the security NWDAF to obtain the abnormal data or the second data .
  • the second algorithm may be a linear regression algorithm, a deep neural network algorithm, or the like.
  • the information of the abnormal data may be the abnormal data itself, the storage address of the abnormal data, or the file name corresponding to the abnormal data, etc.
  • the information of the second data may be the second data itself, or is a storage address of the second data, or may also be a file name corresponding to the second data, etc., which is not limited in this application.
  • the security NWDAF After the security NWDAF receives the first request message sent by the NWDAF, it can use the second algorithm to perform security detection on the first data to obtain a security detection result.
  • the number of the second algorithm may be one or multiple, which is not limited in this application. It should be noted that when the number of the second algorithms is multiple, it may correspond to multiple detection results of abnormal data and detection results of the second data.
  • the NWDAF itself may store one or more algorithms in advance.
  • the algorithm pre-stored by the NWDAF is denoted as "third algorithm”
  • the first algorithm included in the first request message sent by the NWDAF to the security NWDAF may be One or more
  • the security NWDAF may determine the second algorithm based on the first algorithm and/or the third algorithm.
  • the security NWDAF can decide on its own the algorithm to be used for the security detection, for example, the security NWDAF can select one or more of the pre-saved third algorithms algorithm for security detection.
  • the security NWDAF may use the only one of the first algorithms to perform security detection.
  • the security NWDAF may not use the only one of the first algorithms for security detection, but select any one of the pre-stored third algorithms for security detection, etc., which is not limited in this application.
  • the security NWDAF may determine the intersection of the first algorithm and the third algorithm as the second algorithm, that is, the security NWDAF uses the first algorithm and the third algorithm at the same time Algorithms exist for security detection.
  • the security NWDAF may not select the intersection of the first algorithm and the third algorithm, and decides the algorithm to be used, etc., which is not limited in this application.
  • Step 308 The security NWDAF feeds back the security detection result to the NWDAF.
  • the NWDAF After the NWDAF performs abnormal data detection on the first data, it can send the security detection result to the NWDAF. Accordingly, the NWDAF can receive the security detection results.
  • Step 309 NWDAF generates or updates the data analysis result corresponding to the data analysis type according to the security detection result.
  • the security detection result may further include: a second model, where the second model is a model established by the security NWDAF based on the second data. That is to say, the second model may be a recommended model generated by security NWDAF after performing security detection. In this way, NWDAF may generate or update the data analysis result corresponding to the data analysis type based on the second model.
  • the NWDAF may obtain the second data from the security detection result, then train the second data to obtain a third model, and generate or update the data analysis result corresponding to the data analysis type based on the third model.
  • the second data is data other than abnormal data in the first data. That is to say, NWDAF can obtain data other than abnormal data from security detection results, and then train based on this data to obtain a new AI model, and then obtain data analysis results.
  • NWDAF can also obtain abnormal data from the safety detection results, and then extract abnormal data from the first data to obtain second data, and then train the second data to obtain a third model, based on the third model.
  • the model generates or updates the data analysis result corresponding to the data analysis type, which is not limited in this application.
  • NWDAF can use the second algorithm to train the second data to obtain the third model.
  • the AI model trained by NWDAF based on data without abnormal data is more accurate, and the data analysis results obtained are also more accurate.
  • Step 3010 The NWDAF sends the data analysis result to the subscribing network element.
  • the NWDAF can obtain a new data analysis result, and then can feed back the data analysis result to the subscribing network element.
  • the security NWDAF can extract abnormal data from the first data by detecting the first data, and then train the model based on the data after the abnormal data is extracted to obtain new data analysis results, which can improve the The accuracy of data analysis results and the stability of the AI system can be improved.
  • FIG. 4 a flowchart of another data analysis method provided in the embodiment of the present application, referring to FIG. 4 , the method includes:
  • steps 401 , 402 , 404 , 405 and 406 are the same as steps 301 , 302 , 307 , 308 , 309 and 3010 in the embodiment shown in FIG. 3 .
  • Please refer to FIG. 3 is described in the embodiment shown, and will not be described in detail in this embodiment.
  • Step 401 The subscribing network element sends a data analysis request message to the NWDAF.
  • Step 402 The NWDAF acquires the first data from the first network element.
  • Step 403 The NWDAF sends a first request message to the security NWDAF, where the first request message is used to request security detection of the first data.
  • the NWDAF may send the first request message to the security NWDAF based on the following conditions:
  • NWDAF may periodically send a first request message to security NWDAF.
  • NWDAF can send a request message for security detection to security NWDAF at fixed time intervals.
  • NWDAF can send a request message for security detection to security NWDAF every 5 minutes.
  • NWDAF can also send a request message for security detection every 5 minutes. Send a request message for security detection to security NWDAF once every 2 minutes, etc., which is not limited in this application.
  • Case 2 When the data analysis request sent by the subscribing network element is used to request the data analysis result corresponding to the set range, the NWDAF can send a request message for security detection to the security NWDAF.
  • the setting range may include a range corresponding to at least one of the following information: setting time information, setting area information, setting slice information, setting user information, and setting service type information.
  • NWDAF can send a first request message to security NWDAF to detect abnormal data existing in the first data, so as to obtain data other than abnormal data, and then subscribe to the data analysis results subscribed by network elements more acurrate.
  • the first request message may include at least one item of the following information: information of the first data, a first model, and a first algorithm.
  • the first model is a model pre-determined by NWDAF for the data analysis type
  • the first algorithm is at least one algorithm used by NWDAF when establishing the first model.
  • the information of the first data may be the data itself, the storage address of the data, or the file name of the data, etc., which is not limited in this application.
  • the difference between this step 403 and the step 306 in the embodiment shown in FIG. 3 is that the first model in the step 403 is only a model predetermined by the NWDAF for the data analysis type, and does not need to interact with the subscription network element in advance. Analyze the results.
  • Step 404 security NWDAF performs security detection on the first data to obtain a security detection result.
  • Step 405 The security NWDAF feeds back the security detection result to the NWDAF.
  • Step 406 NWDAF generates a data analysis result corresponding to the data analysis type according to the security detection result.
  • Step 407 The NWDAF sends the data analysis result to the subscribing network element.
  • the data analysis method of the embodiment shown in FIG. 3 is compared with the data analysis method of the embodiment shown in FIG. 4 , because the method of the embodiment shown in FIG.
  • the data analysis result generated based on the security detection result means that the data security detection is performed first and then the AI model is used. Therefore, the method of the embodiment shown in FIG. 4 is suitable for scenarios with high security of the AI model, and the security of the AI model can be guaranteed.
  • each network element in the above-mentioned implementation includes corresponding hardware structures and/or software modules for executing each function.
  • the present invention can be implemented in hardware or a combination of hardware and computer software in conjunction with the units and algorithm steps of each example described in the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of the present invention.
  • the embodiments of the present application provide a data analysis apparatus.
  • the data analysis device can be applied to a data analysis network element, as shown in FIG. 5 , the data analysis device 500 includes a communication unit 501.
  • the apparatus 500 is configured to implement the function of the data analysis network element in the above method.
  • the device may be a data analysis network element, or may be a device in a data analysis network element, such as a chip system.
  • the communication unit 501 is configured to send a first request message to the security network element, where the first request message is used to request security detection of first data, and the first data is the specified data of the data analysis network element and receive the security detection result fed back by the security network element; the processing unit 502 is configured to generate or update the data analysis result corresponding to the data analysis type according to the security detection result.
  • the processing unit 502 is further configured to: generate a first analysis result corresponding to the data analysis type based on the first data before sending the first request message to the first network element, And it is determined that the accuracy of the first analysis result is less than the first threshold.
  • the processing unit 502 is further configured to: generate a first analysis result corresponding to the data analysis type based on the first data before sending the first request message to the first network element.
  • the communication unit 501 is further configured to: send the first analysis result and a first threshold to the subscribing network element, where the first threshold is used by the subscribing network element to determine that the accuracy of the first analysis result is less than the a first threshold, and receive the notification message sent by the subscribing network element when it is determined that the accuracy of the first analysis result is less than the first threshold.
  • the communication unit 501 is specifically configured to send the first request message to the security network element in the following manner: send the first request message to the security network element according to the notification message.
  • the communication unit 501 is further configured to: before sending the first request message to the network element, receive a data analysis request message sent by a subscribing network element, where the data analysis request message is used to request the The data analysis result corresponding to the data analysis type.
  • the processing unit 502 is further configured to: determine a data analysis result corresponding to the set range requested by the data analysis request message.
  • the setting range includes a range corresponding to at least one of the following information: setting time information, setting area information, setting slice information, setting user information, and setting service type information.
  • the first request message includes at least one item of the following information: information of the first data, a first model, and a first algorithm;
  • the first model is a model established by the data analysis network element based on the first data or a model pre-determined by the data analysis network element for the data analysis type, and the first algorithm includes the data At least one algorithm used by the network element to build the first model is analyzed.
  • the security detection is abnormal data detection;
  • the first request message includes: abnormal data ratio, and the abnormal data ratio is used to indicate that the data volume of abnormal data accounts for the first The proportion of the data volume of the data.
  • the security detection result includes at least one item of the following information: information of abnormal data, information of second data, and second algorithm; wherein, the second data is the first For data other than the abnormal data in the data, the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.
  • the security detection result includes: a second model, where the second model is a model established by the first network element based on the second data.
  • the processing unit 502 is specifically configured to generate or update the data analysis result corresponding to the data analysis type according to the security detection result in the following manner: generate or update the data analysis result corresponding to the data analysis type based on the second model. .
  • the processing unit 502 is specifically configured to generate or update the data analysis result corresponding to the data analysis type according to the security detection result in the following manner: obtain second data according to the security detection result , the second data is the data other than the abnormal data in the first data; the third model is obtained by training the second data, and the corresponding data analysis type is generated or updated based on the third model data analysis results.
  • the processing unit 402 is specifically configured to perform training on the second data in the following manner to obtain a third model, including: using the The second algorithm trains the second data to obtain the third model.
  • the first data is training data or inference data corresponding to the data analysis type.
  • the security network element is a security network data analysis function NWDAF network element.
  • the safety detection is bait data detection.
  • the communication unit 501 may be a communication interface, a receiver, a transmitter, a transceiver circuit, and the like.
  • the communication interface is a general term, which may include one or more interfaces.
  • the data analysis apparatus 500 involved in this embodiment of the present application may be as shown in FIG. 6 .
  • a data analysis network element 600 is provided in this embodiment of the present application.
  • the data analysis network element 600 may include a transceiver 601 , a processor 602 , and a memory 603 .
  • the memory 603 stores instructions or programs, and the processor 602 is configured to execute the instructions or programs stored in the memory 603 .
  • the transceiver 601 is used to perform the operations performed by the communication unit 501 in the above embodiments.
  • the processor 602 is configured to perform the operations performed by the processing unit 502 in the above embodiments.
  • the data analysis apparatus 500 or the data analysis network element 600 may correspond to the data analysis network elements in the embodiments shown in FIG. 2 , FIG. 3 , and FIG. 4 , and the data analysis apparatus 500 or the data analysis network element
  • the operations and/or functions of each module in the network element 600 are respectively to implement the corresponding processes in the embodiments shown in FIG. 2 , FIG. 3 , and FIG. 4 , and are not repeated here for brevity.
  • the data analysis apparatus 700 includes a communication unit 701 , a processing unit 702.
  • the apparatus 700 is configured to implement the function of the security network element in the above method.
  • the device may be a security network element, or may be a device in the security network element, such as a chip system.
  • the communication unit 701 is configured to receive a first request message sent by a data analysis network element, where the first request message is used to request security detection of first data, and the first data is the pair of data analysis network elements.
  • the communication unit 701 is further configured to: send the security detection result to the data analysis network element.
  • the first request message includes at least one item of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is all the model established by the data analysis network element based on the first data or a model pre-determined by the data analysis network element for the data analysis type, and the first algorithm includes the data analysis network element building the first model at least one algorithm to use.
  • the security detection is abnormal data detection;
  • the first request message includes: abnormal data ratio, and the abnormal data ratio is used to indicate that the data volume of abnormal data accounts for the first The proportion of the data volume of the data.
  • the security detection result includes at least one item of the following information: information of abnormal data, information of second data, and second algorithm; wherein, the second data is the first For data other than the abnormal data in the data, the second algorithm is a detection algorithm adopted by the security network element to obtain the abnormal data or the second data.
  • the security detection result includes: a second model, where the second model is a model established by the security network element based on the second data.
  • the processing unit 702 is specifically configured to perform security detection on the first data in the following manner: perform security detection on the first data by using the second algorithm.
  • the processing unit 702 is further configured to: determine the second algorithm according to a first algorithm and/or a third algorithm, where the first algorithm includes the data analysis network element establishing the at least one algorithm used in the first model, and the third algorithm is at least one algorithm pre-stored in the security network element.
  • the processing unit 702 is specifically configured to determine the second algorithm according to the first algorithm and/or the third algorithm in the following manner: by comparing the difference between the first algorithm and the third algorithm Intersection is determined as the second algorithm.
  • the first data is training data or inference data corresponding to the data analysis type.
  • the data analysis device is a NWDAF network element of a secure network data analysis function.
  • the safety detection is bait data detection.
  • the communication unit 701 may be a communication interface, a receiver, a transmitter, a transceiver circuit, and the like.
  • the communication interface is a general term, which may include one or more interfaces.
  • a security network element 800 is provided in an embodiment of the present application.
  • the security network element 800 may include a transceiver 801 , a processor 802 , and a memory 803 .
  • the memory 803 stores instructions or programs, and the processor 802 is configured to execute the instructions or programs stored in the memory 803 .
  • the transceiver 801 is used to perform the operations performed by the communication unit 701 in the above embodiments.
  • the processor 802 is configured to perform the operations performed by the processing unit 702 in the above embodiments.
  • the data analysis apparatus 700 or the security network element 800 may correspond to the security network elements in the embodiments shown in FIG. 2 , FIG. 3 , and FIG. 4 , and the data analysis apparatus 700 or the security network element 800
  • the operations and/or functions of the respective modules in FIG. 2 , FIG. 3 , and FIG. 4 respectively implement the corresponding processes in the embodiments shown in FIG. 2 , and are not repeated here for brevity.
  • processors mentioned in the embodiments of the present application may be a central processing unit (central processing unit, CPU), and may also be other general-purpose processors, digital signal processors (digital signal processors, DSP), application-specific integrated circuits ( application specific integrated circuit, ASIC), off-the-shelf programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory mentioned in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM), which acts as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • double data rate SDRAM double data rate SDRAM
  • DDR SDRAM enhanced synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SCRAM synchronous link dynamic random access memory
  • direct rambus RAM direct rambus RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components
  • the memory storage module
  • memory described herein is intended to include, but not be limited to, these and any other suitable types of memory.
  • the system 900 may include a data analysis device 901 and a data analysis device 902 .
  • the data analysis apparatus 901 may be configured to: send a first request message to a security network element, where the first request message is used to request security detection of first data, where the first data is the data analysis network element Perform data analysis on the specified data analysis type; and receive the security detection result fed back by the security network element.
  • the data analysis device 902 may be configured to: receive a first request message sent by a data analysis network element, where the first request message is used to request security detection of first data, where the first data is specified by the data analysis network element
  • the data analysis type is the data for data analysis, and the security detection is performed on the first data to obtain the security detection result.
  • the embodiments of the present application further provide a computer-readable storage medium on which a computer program is stored.
  • the program is executed by a processor, the computer is made to execute the above method embodiments and method implementations.
  • the operations performed by the data analysis network element or the security network element in any possible implementation manner of the example.
  • the present application further provides a computer program product, which, when invoked and executed by a computer, can enable a computer to implement any one of the foregoing method embodiments and any possible implementation manners of the method embodiments. operations performed by data analysis NEs or security NEs.
  • the present application further provides a chip or a chip system, where the chip may include a processor.
  • the chip may also include a memory (or a storage module) and/or a transceiver (or a communication module), or the chip may be coupled with a memory (or a storage module) and/or a transceiver (or a communication module), wherein the transceiver ( or communication module) can be used to support the chip to perform wired and/or wireless communication, the memory (or storage module) can be used to store a program, and the processor can call the program to implement any one of the above method embodiments and method embodiments.
  • the chip system may include the above chips, or may include the above chips and other discrete devices, such as memories (or storage modules) and/or transceivers (or communication modules).
  • the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not be dealt with in the embodiments of the present application. implementation constitutes any limitation.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
  • Automatic Analysis And Handling Materials Therefor (AREA)

Abstract

本申请公开了一种数据分析方法及装置，该方法包括：数据分析网元向安全网元发送第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据；然后安全网元对第一数据进行安全检测，得到安全检测结果，并将该安全检测结果发送给数据分析网元，数据分析网元根据安全检测结果生成或更新所述数据分析类型对应的数据分析结果。通过本申请的方法，安全网元可以对第一数据进行安全检测，在第一数据中分离出异常数据，使得数据分析网元可以基于除异常数据之外的数据建立模型，从而提高模型的精确度，同时提高数据分析结果的准确度。

Description

一种数据分析方法及装置 技术领域
本申请涉及通信技术领域，尤其涉及一种数据分析方法及装置。
背景技术
在第五代(the fifth generation，5G)移动通信系统中，引入了网络数据分析功能(network data analytics function，NWDAF)网元，该NWDAF网元可首先获取与通信网络及终端设备等相关的数据，然后基于获取到的数据训练生成人工智能(artificial intelligence，AI)模型，并基于AI模型得到数据分析结果，最后将分析结果发送给其他功能网元。其他功能网元可参考分析结果执行相应的通信业务策略。
在该过程中，攻击者可能会在NWDAF网元获取的与通信网络及终端设备等相关的数据中加入异常数据，以使得NWDAF网元获取的数据中存在异常数据，这会使得NWDAF产生的数据分析的结果不准确。
发明内容
本申请提供一种数据分析方法及装置，用于提高数据分析结果的准确度。
第一方面，本申请提供一种数据分析方法，该方法包括：数据分析网元向安全网元发送第一请求消息，该第一请求消息用于请求对第一数据进行安全检测，所述第一数据为数据分析网元对指定数据分析类型进行数据分析的数据；所述数据分析网元接收所述安全网元反馈的安全检测结果；所述数据分析网元根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果。
基于上述技术方案，数据分析网元可以向安全网元发送请求消息，由安全网元对待分析的数据进行安全检测，然后数据分析网元根据安全检测结果生成或更新数据分析结果，这样能够提高数据分析结果的准确度。
本申请实施例中，数据分析网元可以在如下几种情形下触发安全检测请求，具体如下：
情形1：当数据分析网元确定第一分析结果的准确度较低时，可向安全网元触发安全检测请求。可以理解的是，安全检测请求即为第一请求消息。
在一种可能的实现中，数据分析网元向第一网元发送第一请求消息之前，所述方法还包括：所述数据分析网元基于所述第一数据，生成所述数据分析类型对应的第一分析结果；所述数据分析网元确定所述第一分析结果的准确度小于第一阈值。
基于上述技术方案，数据分析网元可以预先基于待分析的数据得到第一分析结果，并且在第一分析结果的准确度比较低时，再请求安全网元进行安全检测，这样数据分析网元可在安全检测之后，对第一分析结果进行更新，从而提高数据分析结果的准确度。
情形2：当数据分析网元接收到订阅网元发送的通知消息时，可向安全网元触发安全检测请求。
在一种可能的实现中，数据分析网元向第一网元发送第一请求消息之前，所述方法还包括：所述数据分析网元基于所述第一数据，生成所述数据分析类型对应的第一分析结果；所述数据分析网元向订阅网元发送所述第一分析结果以及第一阈值，所述第一阈值用于所 述订阅网元确定所述第一分析结果的准确度小于所述第一阈值；所述数据分析网元接收所述订阅网元在所述第一分析结果的准确度小于所述第一阈值时发送的所述通知消息；所述数据分析网元根据所述通知消息向所述安全网元发送所述第一请求消息。
基于上述技术方案，订阅网元可以判断第一分析结果的准确度，当第一分析结果的准确度较低时，通知数据分析网元，然后数据分析网元才请求安全网元进行安全检测。
情形3：当订阅网元发送的数据分析请求消息为设定范围对应的数据分析结果时，数据分析网元可触发安全检测请求。
在一种可能的实现中，数据分析网元向网元发送第一请求消息之前，所述方法还包括：所述数据分析网元接收订阅网元发送的数据分析请求消息，所述数据分析请求消息用于请求所述数据分析类型对应的数据分析结果；所述数据分析网元确定所述数据分析请求消息请求设定范围对应的数据分析结果。
基于上述技术方案，如果订阅网元订阅的数据分析结果为设定范围的数据分析结果，那么数据分析网元可以请求安全网元进行安全检测。
在一种可能的实现中，所述设定范围包括以下至少一种信息对应的范围：设定时间信息，设定区域信息，设定切片信息，设定用户信息，设定业务类型信息。
情形4：数据分析网元可以按照固定的时间间隔主动向安全网元发送安全检测请求。
基于上述几种情形，数据分析网元可向安全网元发送第一请求消息，以使安全网元对第一数据进行安全检测。
在一种可能的实现中，数据分析网元可以将数据分析结果发送给订阅网元，以便订阅网元查看订阅的指定数据分析类型的数据分析结果。
在一种可能的实现中，所述第一请求消息中包括如下信息中的至少一项：所述第一数据的信息、第一模型、第一算法；其中，所述第一模型为所述数据分析网元基于所述第一数据建立的模型或所述数据分析网元针对所述数据分析类型预先确定的模型，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法。
需要说明的是，第一数据的信息可以为第一数据本身，也可以为第一数据的存储地址，当然也可以为第一数据的文件名等，本申请对此不作限定。
基于上述技术方案，安全网元可以利用第一请求消息中所包括的信息，对第一数据进行安全检测，从而分离出第一数据中的异常数据，提高数据分析结果的准确度。
在一种可能的实现中，所述安全检测为异常数据检测；所述第一请求消息包括：异常数据占比，所述异常数据占比用于指示异常数据的数据量占所述第一数据的数据量的比例。
在上述技术方案中，异常数据占比可以由数据分析网元或者安全网元来预估，这样安全网元就可知道第一数据中存在的异常数据的比例，从而安全网元可以有针对性的进行安全检测，使得安全检测的结果更准确。
在一种可能的实现中，所述安全检测结果中包括如下信息中的至少一项：异常数据的信息、第二数据的信息、第二算法；其中，所述第二数据为所述第一数据中除所述异常数据之外的数据，所述第二算法为所述安全网元获取所述异常数据或所述第二数据所采用的检测算法。
基于上述技术方案，数据分析网元请求安全网元对第一数据进行安全检测，当安全网元安全检测之后，可以得到异常数据和/或除异常数据之外的数据，这样可从第一数据中分离出异常数据，从而利用除异常数据之外的数据得出数据分析结果，提高数据分析结果的 准确度。
在一种可能的实现中，所述安全检测结果包括：第二模型，所述第二模型为所述第一网元基于所述第二数据建立的模型。
所述数据分析网元根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果，包括：所述数据分析网元基于所述第二模型生成或更新所述数据分析类型对应的数据分析结果。
需要说明的是，第二模型可以理解为安全网元进行安全检测后得出的推荐模型。
基于上述技术方案，如果安全检测结果中包括推荐模型，那么数据分析网元可以直接利用该推荐模型得到数据分析结果，这样可提高数据分析结果的准确率。
在一种可能的实现中，所述数据分析网元根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果，包括：所述数据分析网元根据所述安全检测结果获取第二数据，所述第二数据为所述第一数据中除异常数据之外的数据；所述数据分析网元对所述第二数据进行训练得到第三模型，并基于所述第三模型生成或更新所述数据分析类型对应的数据分析结果。
需要说明的是，数据分析网元根据安全检测结果获取第二数据可包括两种情况：(1)数据分析网元直接从安全检测结果中获取第二数据；(2)数据分析网元根据安全检测结果中的异常数据，获取第二数据。
基于上述技术方案，数据分析网元可以利用除异常数据之外的数据重新训练得到新的模型，然后基于新的模型得到数据分析结果，这样可提高AI模型的精确度，并且可提高数据分析结果的准确度。
在一种可能的实现中，当所述安全检测结果包括第二算法时，所述数据分析网元对所述第二数据进行训练得到第三模型，包括：所述数据分析网元利用所述第二算法对所述第二数据进行训练得到所述第三模型。
在一种可能的实现中，所述第一数据为数据分析类型对应的训练数据或者推理数据。
在一种可能的实现中，所述安全网元为安全网络数据分析功能NWDAF网元。
在一种可能的实现中，所述安全检测为药饵数据检测。
需要说明的是，药饵数据是指攻击者产生的分布情况类似于正常数据分布，并且会影响数据分析结果的准确性的异常数据或攻击数据。利用现有的数据清洗或离群点检测的方法无法轻易识别出这种药饵数据。
第二方面，本申请提供一种数据分析方法，该方法包括：安全网元接收数据分析网元发送的第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据集；所述安全网元对所述第一数据进行安全检测，得到安全检测结果；所述安全网元将所述安全检测结果发送给所述数据分析网元。
基于上述技术方案，安全网元可对第一数据进行安全检测，从而在第一数据中分离出异常数据，使得数据分析网元能够根据安全检测的结果得到数据分析结果，提高数据分析结果的准确度。
在一种可能的实现中，所述第一请求消息中包括如下信息中的至少一项：所述第一数据的信息、第一模型、第一算法；其中，所述第一模型为所述数据分析网元基于所述第一数据建立的模型或所述数据分析网元针对所述数据分析类型预先确定的模型，所述第一算 法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法。
在一种可能的实现中，所述安全检测为异常数据检测；所述第一请求消息包括：异常数据占比，所述异常数据占比用于指示异常数据的数据量占所述第一数据的数据量的比例。
在一种可能的实现中，所述安全检测结果中包括如下信息中的至少一项：异常数据的信息、第二数据的信息、第二算法；其中，所述第二数据为所述第一数据中除所述异常数据之外的数据，所述第二算法为所述安全网元获取所述异常数据或所述第二数据所采用的检测算法。
在一种可能的实现中，所述安全检测结果包括：第二模型，所述第二模型为所述安全网元基于所述第二数据建立的模型。
在一种可能的实现中，所述安全网元对所述第一数据进行安全检测，包括：所述安全网元利用所述第二算法对所述第一数据进行安全检测。
在一种可能的实现中，所述方法还包括：所述安全网元根据第一算法和/或第三算法确定所述第二算法，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法，所述第三算法为所述安全网元中预先保存的至少一种算法。
在一种可能的实现中，所述安全网元根据第一算法和/或第三算法确定所述第二算法，包括：所述安全网元将所述第一算法与所述第三算法的交集确定为所述第二算法。
当然，可以理解的是，安全网元也可以自行决定进行安全检测的算法，即可以不参考第一算法，本申请对此不作限定。
在一种可能的实现中，所述第一数据为数据分析类型对应的训练数据或者推理数据。
在一种可能的实现中，所述安全网元为安全网络数据分析功能NWDAF网元。
在一种可能的实现中，所述安全检测为药饵数据检测。
第三方面，本申请提供一种数据分析装置，所述数据分析装置具有实现上述第一方面的方法实例中行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。所述数据分析装置包括：通信单元，用于向安全网元发送第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据；并接收所述安全网元反馈的安全检测结果；处理单元，用于根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果。
在一种可能的实现中，所述处理单元还用于：向第一网元发送第一请求消息之前，基于所述第一数据，生成所述数据分析类型对应的第一分析结果，并确定所述第一分析结果的准确度小于第一阈值。
在一种可能的实现中，所述处理单元还用于：向第一网元发送第一请求消息之前，基于所述第一数据，生成所述数据分析类型对应的第一分析结果；所述通信单元还用于：向订阅网元发送所述第一分析结果以及第一阈值，所述第一阈值用于所述订阅网元确定所述第一分析结果的准确度小于所述第一阈值，并接收所述订阅网元在所述第一分析结果的准确度小于所述第一阈值时发送的所述通知消息；所述通信单元具体用于按如下方式向安全网元发送第一请求消息：根据所述通知消息向所述安全网元发送所述第一请求消息。
在一种可能的实现中，所述通信单元还用于：向网元发送第一请求消息之前，接收订阅网元发送的数据分析请求消息，所述数据分析请求消息用于请求所述数据分析类型对应的数据分析结果；所述处理单元还用于：确定所述数据分析请求消息请求设定范围对应的 数据分析结果。
在一种可能的实现中，所述设定范围包括以下至少一种信息对应的范围：设定时间信息，设定区域信息，设定切片信息，设定用户信息，设定业务类型信息。
在一种可能的实现中，所述第一请求消息中包括如下信息中的至少一项：所述第一数据的信息、第一模型、第一算法；其中，所述第一模型为所述数据分析网元基于所述第一数据建立的模型或所述数据分析网元针对所述数据分析类型预先确定的模型，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法。
在一种可能的实现中，所述安全检测为异常数据检测；所述第一请求消息包括：异常数据占比，所述异常数据占比用于指示异常数据的数据量占所述第一数据的数据量的比例。
在一种可能的实现中，所述安全检测结果中包括如下信息中的至少一项：异常数据的信息、第二数据的信息、第二算法；其中，所述第二数据为所述第一数据中除所述异常数据之外的数据，所述第二算法为所述安全网元获取所述异常数据或所述第二数据所采用的检测算法。
在一种可能的实现中，所述安全检测结果包括：第二模型，所述第二模型为所述第一网元基于所述第二数据建立的模型；
所述处理单元具体用于按如下方式根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果：基于所述第二模型生成或更新所述数据分析类型对应的数据分析结果。
在一种可能的实现中，所述处理单元具体用于按如下方式根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果：根据所述安全检测结果获取第二数据，所述第二数据为所述第一数据中除异常数据之外的数据；对所述第二数据进行训练得到第三模型，并基于所述第三模型生成或更新所述数据分析类型对应的数据分析结果。
在一种可能的实现中，当所述安全检测结果包括第二算法时，所述处理单元具体用于按如下方式对所述第二数据进行训练得到第三模型，包括：利用所述第二算法对所述第二数据进行训练得到所述第三模型。
在一种可能的实现中，所述第一数据为所述数据分析类型对应的训练数据或者推理数据。
在一种可能的实现中，所述安全网元为安全网络数据分析功能NWDAF网元。
在一种可能的实现中，所述安全检测为药饵数据检测。
第四方面，本申请提供一种数据分析装置，所述数据分析装置具有实现上述第二方面的方法实例中行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。在一个可能的设计中，所述数据分析装置包括：通信单元，用于接收数据分析网元发送的第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据集；处理单元，用于对所述第一数据进行安全检测，得到安全检测结果；所述通信单元还用于：将所述安全检测结果发送给所述数据分析网元。
在一种可能的实现中，所述第一请求消息中包括如下信息中的至少一项：所述第一数据的信息、第一模型、第一算法；其中，所述第一模型为所述数据分析网元基于所述第一数据建立的模型或所述数据分析网元针对所述数据分析类型预先确定的模型，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法。
在一种可能的实现中，所述安全检测为异常数据检测；所述第一请求消息包括：异常数据占比，所述异常数据占比用于指示异常数据的数据量占所述第一数据的数据量的比例。
在一种可能的实现中，所述安全检测结果中包括如下信息中的至少一项：异常数据的信息、第二数据的信息、第二算法；其中，所述第二数据为所述第一数据中除所述异常数据之外的数据，所述第二算法为安全网元获取所述异常数据或所述第二数据所采用的检测算法。
在一种可能的实现中，所述安全检测结果包括：第二模型，所述第二模型为安全网元基于所述第二数据建立的模型。
在一种可能的实现中，所述处理单元具体用于按如下方式对所述第一数据进行安全检测：利用所述第二算法对所述第一数据进行安全检测。
在一种可能的实现中，所述处理单元还用于：根据第一算法和/或第三算法确定所述第二算法，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法，所述第三算法为所述安全网元中预先保存的至少一种算法。
在一种可能的实现中，所述处理单元具体用于按如下方式根据第一算法和/或第三算法确定所述第二算法：将所述第一算法与所述第三算法的交集确定为所述第二算法。
在一种可能的实现中，所述第一数据为所述数据分析类型对应的训练数据或者推理数据。
在一种可能的实现中，所述数据分析装置为安全网络数据分析功能NWDAF网元。
在一种可能的实现中，所述安全检测为药饵数据检测。
第五方面，提供了一种数据分析装置，该数据分析装置可以为上述方法实施例中的数据分析网元。该数据分析装置可包括收发器和至少一个处理器，所述收发器用于执行上述第一方面或第一方面任一项所述的方法中，所述数据分析装置进行消息接收和发送的操作；所述至少一个处理器调用指令，执行上述第二方面或第二方面任一项所述的方法中，所述数据分析装置进行的消息处理操作。
第六方面，提供了一种数据分析装置，该数据分析装置可以为上述方法实施例中的安全网元。该数据分析装置可包括收发器和至少一个处理器，所述收发器用于执行上述第二方面或第二方面任一项所述的方法中，所述数据分析装置进行消息接收和发送的操作；所述至少一个处理器调用指令，执行上述第二方面或第二方面任一项所述的方法中，所述数据分析装置进行的消息处理操作。
第七方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码并运行时，使得上述各方面中由数据分析网元执行的方法被执行。
第八方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码被运行时，使得上述各方面中由安全网元执行的方法被执行。
第九方面，本申请提供了一种芯片系统，该芯片系统包括至少一个处理器，和收发器，所述处理器通过运行指令，以执行上述第一方面以及第二方面任一项所述的方法。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
第十方面，本申请还提供一种数据分析系统，包括第三方面中任意一项所述的数据分析装置和第四方面任意一项所述的数据分析装置。
第十一方面，本申请提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，当该计算机程序被运行时，实现上述各方面中由数据分析网元执行的方法。
第十二方面，本申请提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序，当该计算机程序被运行时，实现上述各方面中由安全网元执行的方法。
应当理解的是，本申请实施例的第三方面至第十二方面技术方案及对应的可行实施方式所取得的有益效果可以参见上述对第一方面、第二方面及其对应的可能的实现方式的技术效果，此处不再赘述。
附图说明
图1为本申请实施例提供的一种基于服务化接口的5G网络架构示意图；
图2为本申请实施例提供的一种数据分析方法流程图；
图3为本申请实施例提供的一种数据分析方法流程图；
图4为本申请实施例提供的又一种数据分析方法流程图；
图5为本申请实施例提供的一种数据分析装置示意图；
图6为本申请实施例提供的一种数据分析网元的结构示意图；
图7为本申请实施例提供的又一种数据分析装置示意图；
图8为本申请实施例提供的一种安全网元的结构示意图；
图9为本申请提供的一种数据分析系统示意图。
具体实施方式
为了使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作进一步地详细描述。
目前，数据分析的过程可包括如下步骤：首先，数据分析结果订阅者(consumer)触发NWDAF的服务操作，该操作用于订阅数据分析结果类型。NWDAF接收到consumer触发的服务操作后，可根据consumer订阅的数据分析结果类型，从对应的网元中获取相关的网络数据、终端设备数据、第三方应用的数据等，然后利用获取到的各种数据训练生成相应的AI模型，并基于AI模型进行数据推理得到数据分析结果。最后NWDAF将AI模型或数据分析结果反馈给consumer。在该过程中，攻击者可能会在NWDAF获取的网络数据中注入与真实数据相似的药饵数据，这样会使得网络数据中存在异常数据，进而使得训练的模型精度比较低，得到的推理数据分析结果也不准确。
需要说明的是，药饵数据是攻击者对AI模型进行药饵攻击时所设计的数据样本，可用于污染训练模型所用的训练数据或模型推理所用的推理数据，进而危及整个AI系统的正常功能和数据分析结果的准确性。
可以理解的是，数据分析结果类型可包括但不限于：业务体验数据分析结果、网元负载数据分析结果、UE的业务行为分析结果、UE的移动性分析结果、UE交互性分析结果、UE异常行为分析结果等。
另外，在利用获取到的数据训练生成相应的AI模型之前，需要进行数据清洗，以得到准确、高质量的数据。由于药饵数据的分布和真实数据的分布相似，数据清洗的过程难以彻底去除药饵数据，从而危及AI系统的正常功能。
鉴于上述存在的技术问题，本申请实施例中，在5G网络架构中新增加一个网元，利用该新增加的网元进行异常数据的检测，然后将检测结果反馈给NWDAF网元，NWDAF 网元再基于反馈的检测结果进行AI模型训练或生成数据分析结果，这样可提高数据分析结果的准确性，并且能够保证AI模型的安全性。
需要说明的是，在5G网络架构中新增加的网元可以是负责安全的网元，更为具体的，在本申请中可以是一个专门负责安全的NWDAF网元。
如图1所示，为本申请实施例提供的一种基于服务化接口的5G网络架构示意图。在本申请实施例中，该网络架构包括三部分，分别为数据分析结果订阅者(consumer)、数据提供者网元以及数据分析功能网元。
其中，数据分析功能网元可包括：NWDAF网元以及安全(security)NWDAF网元。
NWDAF网元，能够从网络功能(network function，NF)网元、操作管理维护(Operation、Administration、Maintenance，OAM)系统、终端设备或应用功能(application function，AF)网元收集数据，并对收集的数据进行数据分析，从而得到数据分析结果。NWDAF网元还可以将所得的数据分析结果发送给NF、OAM系统、终端设备或AF网元，以便于这些实体做相应的策略制定、操作执行等。
security NWDAF网元，用于提供安全服务的数据分析功能，其可以通过与NWDAF网元交互，提供异常数据检测等安全服务。
数据提供者网元，指网络中的节点或物理设备，可为用户设备(user equipment，UE)接入网络、会话、鉴权认证、策略控制等提供相应的功能支持，也会产生相应的网络数据。例如，可包括：接入与移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、AF等。
AMF网元，是由运营商网络提供的控制面网元，负责终端设备接入运营商网络的接入控制和移动性管理，例如包括移动状态管理，分配用户临时身份标识，认证和授权用户等功能。
SMF网元，是由运营商网络提供的控制面网元，负责管理终端设备的协议数据单元(protocol data unit，PDU)会话。PDU会话是一个用于传输PDU的通道，终端设备需要通过PDU会话与数据网络(data network，DN)互相传送PDU。PDU会话由SMF网元负责建立、维护和删除等。SMF网元包括会话管理(如会话建立、修改和释放，包含用户面功能(user plane function，UPF)和接入网(access network，AN)之间的隧道维护)、UPF网元的选择和控制、业务和会话连续性(Service and Session Continuity，SSC)模式选择、漫游等会话相关的功能。
AF网元，主要提供应用层服务，还支持与5G核心网交互来提供服务，例如影响数据路由决策，策略控制功能或者向网络侧提供第三方的一些服务。
数据分析结果订阅者(consumer)，指OAM或者5G网络结构中的一些NF(例如，策略控制功能(policy control function，PCF)等)、UE、RAN、AF等，它们可向NWDAF订阅相应的数据分析结果，并根据数据分析结果做出相应的调整。示例性的，PCF可以根据NWDAF反馈的业务级业务体验，调整业务的QoS参数从而更好地保证业务的业务体验。
PCF网元，是由运营商提供的控制面功能，用于向网络网元提供策略。作为一种实现方式，策略可以包括接入控制策略、移动性管理策略、计费相关策略、QoS相关策略和授权相关策略等。
终端设备，也可以称为用户设备(user equipment，UE)，是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船 等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端设备可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
上述终端设备可通过运营商网络提供的接口(例如N1等)与运营商网络建立连接，使用运营商网络提供的数据和/或语音等服务。终端设备还可通过运营商网络访问DN，使用DN上部署的运营商业务，和/或第三方提供的业务。其中，上述第三方可为运营商网络和终端设备之外的服务方，可为终端设备提供他数据和/或语音等服务。其中，上述第三方的具体表现形式，具体可根据实际应用场景确定，在此不做限制。
需要说明的是，在该网络架构中，还可包括：网络开放功能(network exposure function，NEF)网元、统一数据管理(unified data management，UDM)网元、网络仓库功能(network function repository function，NRF)网元、认证服务器功能(authentication server function，AUSF)网元、(无线)接入网((radio)access network，(R)AN)以及用户面功能(user plane function，UPF)网元等。
其中，RAN是运营商网络的子网络，是运营商网络中业务节点与终端设备之间的实施系统。终端设备要接入运营商网络，首先是经过RAN，进而可通过RAN与运营商网络的业务节点连接。本申请中的RAN设备，是一种为终端设备提供无线通信功能的设备，接入网设备包括但不限于：5G中的下一代基站(g nodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。
DN，也可以称为分组数据网络(packet data network，PDN)，是位于运营商网络之外的网络，运营商网络可以接入多个DN，DN上可部署多种业务，可为终端设备提供数据和/或语音等服务。例如，DN是某智能工厂的私有网络，智能工厂安装在车间的传感器可为终端设备，DN中部署了传感器的控制服务器，控制服务器可为传感器提供服务。传感器可与控制服务器通信，获取控制服务器的指令，根据指令将采集的传感器数据传送给控制服务器等。又例如，DN是某公司的内部办公网络，该公司员工的手机或者电脑可为终端设备，员工的手机或者电脑可以访问公司内部办公网络上的信息、数据资源等。
UDM网元，是由运营商提供的控制面网元，负责存储运营商网络中签约用户的用户永久标识符(subscriber permanent identifier，SUPI)、信任状(credential)、安全上下文(security context)、签约数据等信息。UDM网元所存储的这些信息可用于终端设备接入运营商网络的认证和授权。其中，上述运营商网络的签约用户具体可为使用运营商网络提供的业务的用户，例如使用中国电信的手机芯卡的用户，或者使用中国移动的手机芯卡的用户等。上述签约用户的永久签约标识(Subscription Permanent Identifier，SUPI)可为该手机芯卡的号码等。上述签约用户的信任状、安全上下文可为该手机芯卡的加密密钥或者跟该手机芯卡加密相关的信息等存储的小文件，用于认证和/或授权。上述安全上下文可为存储在用户 本地终端(例如手机)上的数据(cookie)或者令牌(token)等。上述签约用户的签约数据可为该手机芯卡的配套业务，例如该手机芯卡的流量套餐或者使用网络等。需要说明的是，永久标识符、信任状、安全上下文、认证数据(cookie)、以及令牌等同认证、授权相关的信息，在本发明本申请文件中，为了描述方便起见不做区分、限制。如果不做特殊说明，本申请实施例将以用安全上下文为例进行来描述，但本申请实施例同样适用于其他表述方式的认证、和/或授权信息。
NEF网元，是由运营商提供控制面网元。NEF网元以安全的方式对第三方开放运营商网络的对外接口。在SMF网元需要与第三方的网元通信时，NEF网元可作为SMF网元与第三方的网元通信的中继。NEF网元作为中继时，可作为签约用户的标识信息的翻译，以及第三方的网元的标识信息的翻译。比如，NEF将签约用户的SUPI从运营商网络发送到第三方时，可以将SUPI翻译成其对应的外部身份标识(identity，ID)。反之，NEF网元将外部ID(第三方的网元ID)发送到运营商网络时，可将其翻译成SUPI。
NRF网元，可用于提供网元发现功能，基于其他网元的请求，提供网元类型对应的网元信息，如地址信息和/或标识信息等。NRF还提供网元管理服务，如网元注册、更新、去注册以及网元状态订阅和推送等。
AUSF网元，是由运营商提供的控制面网元，通常可用于一级认证，即终端设备(签约用户)与运营商网络之间的认证。AUSF网元接收到签约用户发起的认证请求之后，可通过UDM网元中存储的认证信息和/或授权信息对签约用户进行认证和/或授权，或者通过UDM网元生成签约用户的认证和/或授权信息。AUSF网元可向签约用户反馈认证信息和/或授权信息。
UPF网元，是由运营商提供的网关，是运营商网络与DN通信的网关。UPF网元包括数据包路由和传输、包检测、业务用量上报、服务质量(Quality of Service，QoS)处理、合法监听、上行包检测、下行数据包存储等用户面相关的功能。
图1中Nnef、Nausf、Npcf、Nudm、Naf、Namf、Nsmf、N1、N2、N3、N4等为接口序列号。这些接口序列号的含义可参见第三代合作伙伴计划(3rd generation partnership project，3GPP)标准协议中定义的含义，在此不做限制。
需要说明的是，本申请不限于应用于图1所示的5G系统，还可以应用于未来通信系统，如第六代(6th generation，6G)系统等。
以下，为了描述方便，将NWDAF网元简称NWDAF，或者记为“数据分析网元”，将数据提供者网元记为“第一网元”，将security NWDAF网元简称security NWDAF，或者记为“安全网元”，将数据分析结果订阅者记为“订阅网元”。以下以数据分析网元为NWDAF，安全网元为security NWDAF为例，进行介绍。
在本申请的实施例中，NWDAF网元可以是一个单独的网元，也可以与其他网元合设。例如，NWDAF网元与AMF网元或者SMF网元合设。在另一种可能的实现方式中，也可以是其他网元具有NWDAF网元的相关功能。例如：AMF网元或者SMF网元具有NWDAF网元的相关功能。
如图2所示，为本申请实施例提供的一种数据分析方法流程图，参阅图2所示，该方法可包括如下步骤：
步骤201：数据分析网元向安全网元发送第一请求消息。相应的，安全网元接收数据分析网元发送的第一请求消息。
其中，第一请求消息用于对第一数据进行安全检测，所述第一数据为数据分析网元对指定数据分析类型进行数据分析的数据。
步骤202：安全网元对第一数据进行安全检测，得到安全检测结果。
步骤203：数据分析网元接收安全网元反馈的安全检测结果。
当安全网元接收到第一请求消息之后，可对第一数据进行安全检测，得到安全检测结果。并且，安全网元可将安全检测结果反馈给数据分析网元。
步骤204：数据分析网元根据安全检测结果生成或更新数据分析类型对应的数据分析结果。
本申请实施例中，数据分析网元在接收到安全检测结果之后，可根据安全检测结果生成数据分析类型对应的数据分析结果，或者更新数据分析类型对应的数据分析结果。
在一些实施例中，数据分析网元可以先对第一数据进行分析，得到数据分析结果，然后基于数据分析结果再请求安全网元对第一数据进行安全检测，得到安全检测结果，最后数据分析网元根据安全检测结果对先得到的数据分析结果进行更新，得到新的数据分析结果。
在另一些实施例中，数据分析网元可以在获取到第一数据之后，就直接向安全网元触发安全检测请求，然后安全网元对第一数据进行安全检测，得到安全检测结果，最后数据分析网元根据安全网元对第一数据的安全检测结果生成数据分析结果。
以下结合具体实施例对图2所示的实施例进行详细介绍。
如图3所示，为本申请提供的一种数据分析方法流程图，参阅图3所示，该方法可包括以下步骤：
步骤301：订阅网元向NWDAF发送数据分析请求消息。
其中，所述数据分析请求消息用于请求待分析的数据分析类型对应的数据分析结果。并且在该数据分析请求消息中可以携带数据分析结果的类型(Analytics ID)，以便NWDAF能够根据该数据分析结果的类型收集相应的数据。
示例性的，该数据分析请求消息也可以为订阅请求消息，例如订阅网元调用NWDAF的Nnwdaf_AnalyticsSubscription_Subscribe服务操作或者调用Nnwdaf_analytics request服务操作，向NWDAF订阅或请求自身想要的数据分析结果，例如业务体验数据分析结果、网元负载数据分析结果或者UE交互信息分析结果等。该订阅请求消息中可以携带Analytics ID，比如，订阅网元向NWDAF订阅业务体验数据分析结果，则订阅请求消息中携带的Analytics ID为Service Experience。
又例如，订阅网元向NWDAF订阅网元负载数据分析结果，则订阅请求消息中携带的Analytics ID为NF load information；或者订阅网元向NWDAF订阅UE交互信息分析结果，则订阅请求消息中携带的Analytics ID为UE communication information。
步骤302：NWDAF从第一网元获取第一数据。
当NWDAF接收到订阅网元发送的数据分析请求消息之后，可根据数据分析请求消息中携带的Analytics ID，确定数据提供者网元(Data provider)。在一种可能的实现方式中，可以预先存储数据分析类型与数据提供者网元之间的对应关系，即不同的数据分析类型，可对应不同的数据提供者网元。并且，NWDAF从不同的数据提供者网元中可获取不同的信息。示例性的，当数据提供者网元为AMF时，NWDAF可以从AMF中获取UE的位置信息(UE Location)，比如网络位置或者其他地理位置信息，如基站、小区标识等；当数 据提供者网元为UPF时，NWDAF可以从UPF中获取服务体验流(Quality of Service Flow)信息；当数据提供者网元为OAM时，NWDAF可以从OAM中获取无线接入类型/无线频率优先级(radio access type frequency selection priority，RFSP)信息。
假设本申请实施例中，订阅网元向NWDAF订阅的数据分析结果为第一数据分析类型，则该第一数据分析类型对应的数据提供者网元可以为第一网元。当然，可以理解的是，第一网元的数量可以为一个，也可以为多个。
作为一种可能的实现方式，NWDAF从第一网元中获取的第一数据可以是与指定数据分析类型对应的第一网元中的所有数据。
作为又一种可能的实现方式，NWDAF从第一网元中获取的第一数据可以是第一网元中的部分数据，例如可以为某些特定的数据。比如，NWDAF在向第一网元获取数据时，还提供数据类型，这样NWDAF从第一网元中获取的第一数据即为与该数据类型对应的数据。
步骤303：NWDAF基于第一数据，生成与数据分析类型对应的第一分析结果。
这里的第一数据可以为训练数据或者推理数据，其用于作为模型训练或数据推理的输入数据。并且，该第一数据为NWDAF对指定数据分析类型进行数据分析的数据。这里的第一数据分析结果可以是模型本身，也可以是基于模型推理得到的结果，对此不作限定。
当第一数据为训练数据时，NWDAF可以对该训练数据进行训练得到AI模型，并基于AI模型得到第一分析结果；当第一数据为推理数据时，NWDAF可以将推理数据输入到训练好的AI模型中，进而得到第一分析结果。该过程属于现有技术，此处不予详述。
通过步骤201-步骤203，NWDAF可以基于预先存储的数据分析类型与数据提供者网元的对应关系获取到与指定数据分析类型对应的一个或多个网元，并从这些网元中获取数据，利用获取到的数据进行训练和推理，从而得到数据分析结果，有助于提高数据分析的效率和准确性。
步骤304：NWDAF将第一分析结果发送给订阅网元。
当NWDAF得到第一分析结果之后，可将该第一分析结果发送给订阅网元。相应的，订阅网元可接收到该分析结果。
作为一种可能的实施方式，NWDAF在向订阅网元发送第一分析结果时，可向订阅网元发送一个预设准确性(accuracy)的门限值(例如，记为“第一阈值”)。该门限值可用于订阅网元判断第一分析结果的准确性。
步骤305：订阅网元向NWDAF反馈第一分析结果的准确度。
当订阅网元接收到第一分析结果和第一阈值之后，若第一分析结果的准确度小于第一阈值，则说明NWDAF获取的第一数据中可能存在异常数据，使得第一分析结果的准确度比较低。
相反，若第一分析结果的准确度大于第一阈值，则说明NWDAF获取到的第一数据中存在异常数据的可能性比较低，因此，第一分析结果的准确度比较高。
在一些实施例中，第一阈值可用于订阅网元在确定第一分析结果的准确度小于第一阈值时，向NWDAF发送通知消息。相应的，NWDAF可接收订阅网元发送的该通知消息。该通知消息可用于向NWDAF反馈数据分析结果的准确度，以使NWDAF向安全网元发送数据检测请求消息。
步骤306：NWDAF向security NWDAF发送第一请求消息，所述第一请求消息用于请 求对第一数据进行安全检测。
在本申请实施例中，NWDAF向security NWDAF发送第一请求消息，可包括如下几种情况：
第一种：当NWDAF接收到订阅网元发送的通知消息时，可向security NWDAF发送进行安全检测的请求消息。
第二种：由于第一分析结果为NWDAF基于第一数据生成的，因此，NWDAF也可以根据第一分析结果确定第一分析结果的准确性。也就是说，当NWDAF确定第一分析结果的准确度小于第一阈值时，可向security NWDAF发送进行安全检测的请求消息。
或者，NWDAF也可以根据AI模型训练结果精度的要求等，自动触发安全检测需求。即NWDAF不需要等待订阅网元发送的通知消息，可以直接向security NWDAF发送进行安全检测的请求消息。
第三种：NWDAF可以定期向security NWDAF发送进行安全检测的请求消息。也就是说，NWDAF可以按照固定的时间间隔向security NWDAF发送进行安全检测的请求消息。比如，NWDAF可以每隔3分钟向security NWDAF发送一次进行安全检测的请求消息，当然，NWDAF也可以每隔1分钟向security NWDAF发送一次进行安全检测的请求消息等，本申请对此不作限定。
第四种：当订阅网元发送的数据分析请求用于请求设定范围对应的数据分析结果时，NWDAF可以向security NWDAF发送进行安全检测的请求消息。
其中，设定范围可包括以下至少一种信息对应的范围：设定时间信息，设定区域信息，设定切片信息，设定用户信息，设定业务类型信息。
具体来说，设定时间信息可以设定时间段或者设定时间点；设定区域信息可以为设定的一个或多个小区标识、一个或多个跟踪区标识(tracking area identity，TAI)、行政区域标识、地理区域经纬度标识等；设定切片信息可以为设定的网络切片选择辅助信息(network slicing selection assistance information，NSSAI),单网络切片选择辅助信息(single network slice selection assistance information，S-NSSAI),网络切片实例(network slice instance，NSI)信息，网络切片子实例(network slice subnet instance，NSSI)信息等；设定用户信息可以为指定网元或指定的终端设备(UE)或用户对象(user)；其中，用户信息可以为用户类型(比如网元类型、UE类型、user类型等)，也可以为用户标识(比如网元标识、UE标识、user类型)等。
基于上述几种情况之一，NWDAF可以向security NWDAF发送第一请求消息，该请求消息可用于对第一数据进行安全检测。换句话来说，该安全检测为异常数据检测，即该请求消息可用于对第一数据中的异常数据进行检测，这样能够确定出第一数据中存在的异常数据，以便及时的处理异常数据，提高数据分析结果的准确度。
需要说明的是，本申请中异常数据可以为药饵数据(攻击者产生的分布情况类似于正常数据分布，并且会影响数据分析结果的准确性的异常数据或攻击数据。利用现有的数据清洗或离群点检测的方法无法轻易识别出这种药饵数据)，安全网元可以对第一数据进行安全检测，得到第一数据中存在的药饵数据，从而帮助数据分析网元清除获取到的数据中的药饵数据，提高数据分析结果的准确度。
具体的，第一请求消息中可包括如下信息中的至少一项：第一数据的信息、第一模型、第一算法。其中，所述第一模型为NWDAF基于第一数据建立的模型或NWDAF针对所述 数据分析类型预先确定的模型，所述第一算法为NWDAF向security NWDAF推荐使用的算法，可包含NWDAF建立所述第一模型时所使用的至少一种算法。示例性的，第一算法可以是线性回归算法、循环神经网络算法等。
需要说明的是，第一数据的信息可以为数据本身，也可以为第一数据的存储地址，或者也可以为存储第一数据的文件名等，本申请对此不作限定。
在又一些实施例中，第一请求消息中还可以包括：异常数据占比，所述异常数据占比用于指示异常数据的数据量占所述第一数据的数据量的比例。也就是说，第一请求消息中还可以包括异常数据的数据量在第一数据的数据量中所占的比值。可以理解的是，数据占比还可以是异常数据的数据量与正常数据(第一数据中除异常数据之外的数据)的数据量的比值等，本申请对此不作限定。
针对异常数据占比，本申请实施例中可以通过下述几种方式得到：
方式1，订阅网元可根据第一分析结果的准确度估计异常数据的数据量在第一数据的数据量中的占比。即在步骤205中，订阅网元向NWDAF反馈第一数据分析结果的准确度时，也可以向NWDAF反馈自身估计的异常数据占比。
方式2，NWDAF可以根据AI模型训练结果的精度要求等信息估计异常数据占比。举例来说，NWDAF可以根据第一数据训练得到AI模型，然后在测试数据上利用AI模型得到测试数据的分析结果，根据分析结果的均方差估计异常数据占比。
方式3，security NWDAF可以设置或者估算异常数据占比。
步骤307：security NWDAF对第一数据进行安全检测，得到安全检测结果。
作为一种可能的实现方式，安全检测可以为异常数据检测。示例性的，该安全检测可以为药饵数据检测，例如TRIM算法。利用TRIM算法进行药饵数据检测时，并不是简单地移除离群点，而是将药饵数据和正常数据一起用来训练线性回归模型，TRIM迭代估计回归参数。在每次迭代中，选择使得损失函数最小的数据子集，然后在此数据子集上再次进行训练，直到损失函数收敛。收敛后，将识别出的数据子集作为正常数据(即第二数据)，而将其他数据作为药饵数据(即异常数据)。可选地，最后一次迭代生成的AI模型可以作为向NWDAF推荐的模型(即第二模型)。
具体的，安全检测结果中可包括如下信息中的至少一项：异常数据的信息、第二数据的信息、第二算法。其中，所述第二数据为所述第一数据中除所述异常数据之外的数据，所述第二算法为所述security NWDAF获取所述异常数据或所述第二数据所采用的检测算法。示例性地，第二算法可以是线性回归算法、深度神经网络算法等。
需要说明的是，异常数据的信息可以为异常数据本身，也可以为异常数据的存储地址，或者也可以为异常数据对应的文件名等，第二数据的信息可以为第二数据本身，也可以为第二数据的存储地址，或者也可以为第二数据对应的文件名等，本申请对此不作限定。
当security NWDAF接收到NWDAF发送的第一请求消息之后，可利用第二算法对第一数据进行安全检测，得到安全检测结果。其中，第二算法的数量可以一个，也可以为多个，本申请对此不作限定。需要说明的是，当第二算法的数量为多个时，可能对应多个异常数据的检测结果和第二数据的检测结果。
作为一种可能的实现方式，NWDAF自身可预先存储一个或多种算法，例如NWDAF预先保存的算法记为“第三算法”，NWDAF向security NWDAF发送第一请求消息中包括的第一算法可以为一种或多种，security NWDAF可根据第一算法和/或第三算法确定第二 算法。
具体而言，当第一请求消息中包括的第一算法的数量为0时，security NWDAF可以自行决定进行安全检测所要使用的算法，例如security NWDAF可以选择预先保存的第三算法中的一个或多个算法来进行安全检测。
当第一请求消息中包括的第一算法的数量为一种时，security NWDAF可以使用第一算法中的唯一一种算法进行安全检测。当然，security NWDAF也可以不使用第一算法中的唯一一种算法进行安全检测，而选择预先保存的第三算法中的任意一种算法进行安全检测等，本申请对此不作限定。
当第一请求消息中包括的第一算法的数量为多种时，security NWDAF可以将第一算法与第三算法的交集确定为第二算法，即security NWDAF利用第一算法和第三算法中同时存在的算法进行安全检测。当然，可以理解的是，security NWDAF也可以不选择第一算法和第三算法的交集，自行决定所要使用的算法等，本申请对此不作限定。
步骤308：security NWDAF向NWDAF反馈安全检测结果。
security NWDAF对第一数据进行异常数据检测之后，可以向NWDAF发送安全检测结果。相应的，NWDAF可接收安全检测结果。
步骤309：NWDAF根据安全检测结果，生成或更新数据分析类型对应的数据分析结果。
在一些实施例中，安全检测结果中还可包括：第二模型，所述第二模型为security NWDAF基于第二数据建立的模型。也就是说，第二模型可以为security NWDAF在进行安全检测之后生成的推荐模型，这样，NWDAF可以基于该第二模型生成或更新数据分析类型对应的数据分析结果。
在另一些实施例中，NWDAF可以从安全检测结果中获取第二数据，然后对第二数据进行训练得到第三模型，并基于第三模型生成或更新数据分析类型对应的数据分析结果。其中，第二数据为第一数据中除异常数据之外的数据。也就是说，NWDAF可以从安全检测结果中获取除异常数据之外的数据，然后基于此数据进行训练，得到新的AI模型，进而得到数据分析结果。
需要说明的是，NWDAF也可以从安全检测结果中获取异常数据，然后在第一数据中提取出异常数据，进而得到第二数据，然后再对第二数据进行训练得到第三模型，基于第三模型生成或更新数据分析类型对应的数据分析结果，本申请对此不作限定。
进一步的，当安全检测结果包括第二算法时，NWDAF可以利用该第二算法对第二数据进行训练得到第三模型。
如此一来，NWDAF基于没有异常数据的数据训练得到的AI模型更准确，得到的数据分析结果也更准确。
步骤3010：NWDAF向订阅网元发送数据分析结果。
基于上述步骤，NWDAF可以得到新的数据分析结果，然后可将该数据分析结果反馈给订阅网元。
在本申请实施例中，security NWDAF通过对第一数据进行检测，可以从第一数据中提取出异常数据，然后基于提取出异常数据之后的数据训练模型，得到新的数据分析结果，这样可提高数据分析结果的准确度，并且可提高AI系统的稳定性。
如图4所示，为本申请实施例提供的又一种数据分析方法流程图，参阅图4所示，该方法包括：
需要说明的是，步骤401、步骤402、步骤404、步骤405以及步骤406与图3所示实施例中的步骤301、步骤302、步骤307、步骤308、步骤309、步骤3010相同，可以参阅图3所示实施例中的介绍，在此实施例中不再详细介绍。
步骤401：订阅网元向NWDAF发送数据分析请求消息。
步骤402：NWDAF从第一网元获取第一数据。
步骤403：NWDAF向security NWDAF发送第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测。
在本申请实施例中，NWDAF可以基于如下几种情况向security NWDAF发送第一请求消息：
第一种情况：NWDAF可以定期向security NWDAF发送进行第一请求消息。或者换句话说，NWDAF可以按照固定的时间间隔向security NWDAF发送进行安全检测的请求消息，比如，NWDAF可以每隔5分钟向security NWDAF发送一次进行安全检测的请求消息，当然，NWDAF也可以每隔2分钟向security NWDAF发送一次进行安全检测的请求消息等，本申请对此不作限定。
第二种情况：当订阅网元发送的数据分析请求用于请求设定范围对应的数据分析结果时，NWDAF可以向security NWDAF发送进行安全检测的请求消息。
其中，设定范围可包括如下至少一种信息对应的范围：设定时间信息，设定区域信息，设定切片信息，设定用户信息，设定业务类型信息。
在上述两种情况之一，NWDAF可以向security NWDAF发送第一请求消息，以检测第一数据中存在的异常数据，从而得到除异常数据之外的数据，进而使得订阅网元订阅的数据分析结果更准确。
作为一种可能的实现方式，第一请求消息中可以包括如下信息中的至少一项：第一数据的信息、第一模型、第一算法。其中，所述第一模型为NWDAF针对所述数据分析类型预先确定的模型，所述第一算法为NWDAF建立所述第一模型时所使用的至少一种算法。
需要说明的是，第一数据的信息可以为数据本身，也可以为数据的存储地址，或者也可以为数据的文件名等，本申请对此不作限定。
该步骤403与图3所示实施例中的步骤306不同的是，步骤403中的第一模型仅是由NWDAF针对数据分析类型预先确定的模型，并且不需要提前与订阅网元进行交互第一分析结果。
值得注意的是，图3所示实施例中，在NWDAF向security NWDAF发送第一请求消息之前，已经对第一数据进行过一次数据分析，而图4所示实施例中，NWDAF在向security NWDAF发送第一请求消息之前，并没有对第一数据进行数据分析，而是直接对获取到的数据进行安全检测。换句话来说，图3所示实施例是在获取到数据分析结果之后对数据进行的安全检测，而图4所示实施例是在获取到数据分析结果之前对数据进行的安全检测。
步骤404：security NWDAF对第一数据进行安全检测，得到安全检测结果。
步骤405：security NWDAF向NWDAF反馈安全检测结果。
步骤406：NWDAF根据安全检测结果，生成数据分析类型对应的数据分析结果。
步骤407：NWDAF向订阅网元发送数据分析结果。
通过本申请实施例的方法，在NWDAF进行模型训练之前，对获取到的数据进行安全检测，然后基于检测之后的除去异常数据之外的数据进行模型训练，这样可提高模型的准确度，进而使得数据分析结果更准确。
需要理解的是，图3所示实施例的数据分析方法与图4所示实施例的数据分析方法相比，由于图4所示实施例的方法是先对获取到的数据进行安全检测，然后基于安全检测结果生成的数据分析结果，即先进行数据安全检测再使用AI模型，因此图4所示实施例的方法适用于对AI模型安全性较高的场景，可以保障AI模型的安全性。
需要说明的是，本申请实施例中的步骤并不限定所有步骤都要执行，可选地执行上述实施例的一个或多个步骤。
上述主要从各个网元之间交互的角度对本申请提供的方案进行了介绍。可以理解的是，上述实现各网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
下面结合附图介绍本申请实施例中用来实现上述方法的装置。因此，上文中的内容均可以用于后续实施例中，重复的内容不再赘述。
基于与上述方法实施例相同构思，本申请实施例提供了一种数据分析装置。在采用集成的单元的情况下，如图5所示为一种数据分析装置的逻辑结构示意图，该数据分析装置可应用于数据分析网元，参阅图5所示，数据分析装置500包括通信单元501、处理单元502。作为一种示例，装置500用于实现上述方法中数据分析网元的功能。例如，该装置可以是数据分析网元，也可以是数据分析网元中的装置，例如芯片系统。
其中，通信单元501，用于向安全网元发送第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据；并接收所述安全网元反馈的安全检测结果；处理单元502，用于根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果。
在一种可能的实施方式中，所述处理单元502还用于：向第一网元发送第一请求消息之前，基于所述第一数据，生成所述数据分析类型对应的第一分析结果，并确定所述第一分析结果的准确度小于第一阈值。
在一种可能的实施方式中，所述处理单元502还用于：向第一网元发送第一请求消息之前，基于所述第一数据，生成所述数据分析类型对应的第一分析结果。
所述通信单元501还用于：向订阅网元发送所述第一分析结果以及第一阈值，所述第一阈值用于所述订阅网元确定所述第一分析结果的准确度小于所述第一阈值，并接收所述订阅网元在确定所述第一分析结果的准确度小于所述第一阈值时发送的所述通知消息。
所述通信单元501具体用于按如下方式向安全网元发送第一请求消息：根据所述通知消息向所述安全网元发送所述第一请求消息。
在一种可能的实施方式中，所述通信单元501还用于：向网元发送第一请求消息之前，接收订阅网元发送的数据分析请求消息，所述数据分析请求消息用于请求所述数据分析类型对应的数据分析结果。
所述处理单元502还用于：确定所述数据分析请求消息请求设定范围对应的数据分析结果。
在一种可能的实施方式中，所述设定范围包括以下至少一种信息对应的范围：设定时间信息，设定区域信息，设定切片信息，设定用户信息，设定业务类型信息。
在一种可能的实施方式中，所述第一请求消息中包括如下信息中的至少一项：所述第一数据的信息、第一模型、第一算法；
其中，所述第一模型为所述数据分析网元基于所述第一数据建立的模型或所述数据分析网元针对所述数据分析类型预先确定的模型，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法。
在一种可能的实施方式中，所述安全检测为异常数据检测；所述第一请求消息包括：异常数据占比，所述异常数据占比用于指示异常数据的数据量占所述第一数据的数据量的比例。
在一种可能的实施方式中，所述安全检测结果中包括如下信息中的至少一项：异常数据的信息、第二数据的信息、第二算法；其中，所述第二数据为所述第一数据中除所述异常数据之外的数据，所述第二算法为所述安全网元获取所述异常数据或所述第二数据所采用的检测算法。
在一种可能的实施方式中，所述安全检测结果包括：第二模型，所述第二模型为所述第一网元基于所述第二数据建立的模型。
所述处理单元502具体用于按如下方式根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果：基于所述第二模型生成或更新所述数据分析类型对应的数据分析结果。
在一种可能的实施方式中，所述处理单元502具体用于按如下方式根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果：根据所述安全检测结果获取第二数据，所述第二数据为所述第一数据中除异常数据之外的数据；对所述第二数据进行训练得到第三模型，并基于所述第三模型生成或更新所述数据分析类型对应的数据分析结果。
在一种可能的实施方式中，当所述安全检测结果包括第二算法时，所述处理单元402具体用于按如下方式对所述第二数据进行训练得到第三模型，包括：利用所述第二算法对所述第二数据进行训练得到所述第三模型。
在一种可能的实施方式中，所述第一数据为所述数据分析类型对应的训练数据或者推理数据。
在一种可能的实施方式中，所述安全网元为安全网络数据分析功能NWDAF网元。
在一种可能的实施方式中，所述安全检测为药饵数据检测。
当采用硬件形式实现时，本申请实施例中，通信单元501可以是通信接口、接收器、发射器、收发电路等。其中，通信接口是统称，可以包括一个或多个接口。
当通信单元501是收发器、处理单元502是处理器时，本申请实施例所涉及的数据分析装置500可以如图6所示。参阅图6所示，为本申请实施例提供的一种数据分析网元600。该数据分析网元600可包括收发器601、处理器602、存储器603。其中，存储器603中存储指令或程序，处理器602用于执行存储器603中存储的指令或程序。收发器601用于执行上述实施例中通信单元501执行的操作。处理器602用于执行上述实施例中处理单元502执行的操作。
应理解，根据本申请实施例的数据分析装置500或数据分析网元600可对应于图2、图3以及图4所示的实施例中的数据分析网元，并且数据分析装置500或数据分析网元600中的各个模块的操作和/或功能分别为了实现图2、图3以及图4所示的实施例中的相应流程，为了简洁，在此不再赘述。
如图7所示，为本申请实施例提供的一种数据分析装置的逻辑结构示意图，该数据分析装置可应用于安全网元，参阅图7所示，数据分析装置700包括通信单元701、处理单元702。作为一种示例，装置700用于实现上述方法中安全网元的功能。例如，该装置可以是安全网元，也可以是安全网元中的装置，例如芯片系统。
其中，通信单元701，用于接收数据分析网元发送的第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据集；处理单元702，用于对所述第一数据进行安全检测，得到安全检测结果。所述通信单元701还用于：将所述安全检测结果发送给所述数据分析网元。
在一种可能的实施方式中，所述第一请求消息中包括如下信息中的至少一项：所述第一数据的信息、第一模型、第一算法；其中，所述第一模型为所述数据分析网元基于所述第一数据建立的模型或所述数据分析网元针对所述数据分析类型预先确定的模型，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法。
在一种可能的实施方式中，所述安全检测为异常数据检测；所述第一请求消息包括：异常数据占比，所述异常数据占比用于指示异常数据的数据量占所述第一数据的数据量的比例。
在一种可能的实施方式中，所述安全检测结果中包括如下信息中的至少一项：异常数据的信息、第二数据的信息、第二算法；其中，所述第二数据为所述第一数据中除所述异常数据之外的数据，所述第二算法为安全网元获取所述异常数据或所述第二数据所采用的检测算法。
在一种可能的实施方式中，所述安全检测结果包括：第二模型，所述第二模型为安全网元基于所述第二数据建立的模型。
在一种可能的实施方式中，所述处理单元702具体用于按如下方式对所述第一数据进行安全检测：利用所述第二算法对所述第一数据进行安全检测。
在一种可能的实施方式中，所述处理单元702还用于：根据第一算法和/或第三算法确定所述第二算法，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法，所述第三算法为所述安全网元中预先保存的至少一种算法。
在一种可能的实施方式中，所述处理单元702具体用于按如下方式根据第一算法和/或第三算法确定所述第二算法：将所述第一算法与所述第三算法的交集确定为所述第二算法。
在一种可能的实施方式中，所述第一数据为所述数据分析类型对应的训练数据或者推理数据。
在一种可能的实施方式中，所述数据分析装置为安全网络数据分析功能NWDAF网元。
在一种可能的实施方式中，所述安全检测为药饵数据检测。
当采用硬件形式实现时，本申请实施例中，通信单元701可以是通信接口、接收器、发射器、收发电路等。其中，通信接口是统称，可以包括一个或多个接口。
当通信单元701是收发器、处理单元702是处理器时，本申请实施例所涉及的数据分 析装置700可以如图8所示。参阅图8所示，为本申请实施例提供的一种安全网元800。该安全网元800可包括收发器801、处理器802、存储器803。其中，存储器803中存储指令或程序，处理器802用于执行存储器803中存储的指令或程序。收发器801用于执行上述实施例中通信单元701执行的操作。处理器802用于执行上述实施例中处理单元702执行的操作。
应理解，根据本申请实施例的数据分析装置700或安全网元800可对应于图2、图3以及图4所示的实施例中的安全网元，并且数据分析装置700或安全网元800中的各个模块的操作和/或功能分别为了实现图2、图3以及图4所示的实施例中的相应流程，为了简洁，在此不再赘述。
应理解，本申请实施例中提及的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)集成在处理器中。
应注意，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
进一步的，如图9所示，为本申请实施例提供的一种数据分析系统900示意图，该系统900可以包括数据分析装置901和数据分析装置902。示例性的，数据分析装置901可用于：向安全网元发送第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据；并接收所述安全网元反馈的安全检测结果。数据分析装置902可用于：接收数据分析网元发送的第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据，对所述第一数据进行安全检测，得到安全检测结果。
可以理解的是，该系统用于上述数据分析方法时的具体实现过程以及相应的有益效果，可以参考前述方法实施例中的相关描述，这里不再赘述。
基于与上述方法实施例相同构思，本申请实施例中还提供一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时，使该计算机执行上述方法实施例、方法 实施例的任意一种可能的实现方式中由数据分析网元或安全网元执行的操作。
基于与上述方法实施例相同构思，本申请还提供一种计算机程序产品，该计算机程序产品在被计算机调用执行时，可以使得计算机实现上述方法实施例、方法实施例的任意一种可能的实现方式中由数据分析网元或安全网元执行的操作。
基于与上述方法实施例相同构思，本申请还提供一种芯片或芯片系统，该芯片可包括处理器。该芯片还可包括存储器(或存储模块)和/或收发器(或通信模块)，或者，该芯片与存储器(或存储模块)和/或收发器(或通信模块)耦合，其中，收发器(或通信模块)可用于支持该芯片进行有线和/或无线通信，存储器(或存储模块)可用于存储程序，该处理器调用该程序可用于实现上述方法实施例、方法实施例的任意一种可能的实现方式中由数据分析网元或安全网元执行的操作。该芯片系统可包括以上芯片，也可以包含上述芯片和其他分立器件，如存储器(或存储模块)和/或收发器(或通信模块)。
应理解，在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请实施例的保护范围并不局限于此， 任何熟悉本技术领域的技术人员在本申请实施例揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请实施例的保护范围应所述以权利要求的保护范围为准。

Claims (31)

  1. 一种数据分析方法，其特征在于，包括：
    数据分析网元向安全网元发送第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据；
    所述数据分析网元接收所述安全网元反馈的安全检测结果；
    所述数据分析网元根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果。
  2. 如权利要求1所述的方法，其特征在于，所述数据分析网元向第一网元发送第一请求消息之前，所述方法还包括：
    所述数据分析网元基于所述第一数据，生成所述数据分析类型对应的第一分析结果；
    所述数据分析网元确定所述第一分析结果的准确度小于第一阈值。
  3. 如权利要求1所述的方法，其特征在于，所述数据分析网元向第一网元发送第一请求消息之前，所述方法还包括：
    所述数据分析网元基于所述第一数据，生成所述数据分析类型对应的第一分析结果；
    所述数据分析网元向订阅网元发送所述第一分析结果以及第一阈值，所述第一阈值用于所述订阅网元确定所述第一分析结果的准确度小于所述第一阈值；
    所述数据分析网元接收所述订阅网元在所述第一分析结果的准确度小于所述第一阈值时发送的所述通知消息；
    所述数据分析网元向安全网元发送第一请求消息，包括：
    所述数据分析网元根据所述通知消息向所述安全网元发送所述第一请求消息。
  4. 如权利要求1所述的方法，其特征在于，所述数据分析网元向网元发送第一请求消息之前，所述方法还包括：
    所述数据分析网元接收订阅网元发送的数据分析请求消息，所述数据分析请求消息用于请求所述数据分析类型对应的数据分析结果；
    所述数据分析网元确定所述数据分析请求消息请求设定范围对应的数据分析结果。
  5. 如权利要求4所述的方法，其特征在于，所述设定范围包括以下至少一种信息对应的范围：设定时间信息，设定区域信息，设定切片信息，设定用户信息，设定业务类型信息。
  6. 如权利要求1-5任一项所述的方法，其特征在于，所述第一请求消息中包括如下信息中的至少一项：所述第一数据的信息、第一模型、第一算法；
    其中，所述第一模型为所述数据分析网元基于所述第一数据建立的模型或所述数据分析网元针对所述数据分析类型预先确定的模型，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法。
  7. 如权利要求1-6任一项所述的方法，其特征在于，所述安全检测为异常数据检测；所述第一请求消息包括：异常数据占比，所述异常数据占比用于指示异常数据的数据量占所述第一数据的数据量的比例。
  8. 如权利要求1-7任一项所述的方法，其特征在于，所述安全检测结果中包括如下信息中的至少一项：异常数据的信息、第二数据的信息、第二算法；
    其中，所述第二数据为所述第一数据中除所述异常数据之外的数据，所述第二算法为所述安全网元获取所述异常数据或所述第二数据所采用的检测算法。
  9. 如权利要求1-8任一项所述的方法，其特征在于，所述安全检测结果包括：第二模型，所述第二模型为所述第一网元基于所述第二数据建立的模型；
    所述数据分析网元根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果，包括：
    所述数据分析网元基于所述第二模型生成或更新所述数据分析类型对应的数据分析结果。
  10. 如权利要求1-8任一项所述的方法，其特征在于，所述数据分析网元根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果，包括：
    所述数据分析网元根据所述安全检测结果获取第二数据，所述第二数据为所述第一数据中除异常数据之外的数据；
    所述数据分析网元对所述第二数据进行训练得到第三模型，并基于所述第三模型生成或更新所述数据分析类型对应的数据分析结果。
  11. 如权利要求10所述的方法，其特征在于，当所述安全检测结果包括第二算法时，所述数据分析网元对所述第二数据进行训练得到第三模型，包括：
    所述数据分析网元利用所述第二算法对所述第二数据进行训练得到所述第三模型。
  12. 如权利要求1-11任一项所述的方法，其特征在于，所述第一数据为所述数据分析类型对应的训练数据或者推理数据。
  13. 如权利要求1-12任一项所述的方法，其特征在于，所述安全网元为安全网络数据分析功能NWDAF网元。
  14. 如权利要求1-13任一项所述的方法，其特征在于，所述安全检测为药饵数据检测。
  15. 一种数据分析方法，其特征在于，包括：
    安全网元接收数据分析网元发送的第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据集；
    所述安全网元对所述第一数据进行安全检测，得到安全检测结果；
    所述安全网元将所述安全检测结果发送给所述数据分析网元。
  16. 如权利要求15所述的方法，其特征在于，所述第一请求消息中包括如下信息中的至少一项：所述第一数据的信息、第一模型、第一算法；
    其中，所述第一模型为所述数据分析网元基于所述第一数据建立的模型或所述数据分析网元针对所述数据分析类型预先确定的模型，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法。
  17. 如权利要求15或16所述的方法，其特征在于，所述安全检测为异常数据检测；
    所述第一请求消息包括：异常数据占比，所述异常数据占比用于指示异常数据的数据量占所述第一数据的数据量的比例。
  18. 如权利要求15-17任一项所述的方法，其特征在于，所述安全检测结果中包括如下信息中的至少一项：异常数据的信息、第二数据的信息、第二算法；
    其中，所述第二数据为所述第一数据中除所述异常数据之外的数据，所述第二算法为所述安全网元获取所述异常数据或所述第二数据所采用的检测算法。
  19. 如权利要求15-18任一项所述的方法，其特征在于，所述安全检测结果包括：第二模型，所述第二模型为所述安全网元基于所述第二数据建立的模型。
  20. 如权利要求18或19所述的方法，其特征在于，所述安全网元对所述第一数据进行安全检测，包括：
    所述安全网元利用所述第二算法对所述第一数据进行安全检测。
  21. 如权利要求18-20任一项所述的方法，其特征在于，所述方法还包括：
    所述安全网元根据第一算法和/或第三算法确定所述第二算法，所述第一算法包含所述数据分析网元建立所述第一模型时所使用的至少一种算法，所述第三算法为所述安全网元中预先保存的至少一种算法。
  22. 如权利要求21所述的方法，其特征在于，所述安全网元根据第一算法和/或第三算法确定所述第二算法，包括：
    所述安全网元将所述第一算法与所述第三算法的交集确定为所述第二算法。
  23. 如权利要求15至22任一所述的方法，其特征在于，所述第一数据为所述数据分析类型对应的训练数据或者推理数据。
  24. 如权利要求15-23任一项所述的方法，其特征在于，所述安全网元为安全网络数据分析功能NWDAF网元。
  25. 如权利要求15-24任一项所述的方法，其特征在于，所述安全检测为药饵数据检测。
  26. 一种数据分析装置，其特征在于，包括：
    通信单元，用于向安全网元发送第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据；并接收所述安全网元反馈的安全检测结果；
    处理单元，用于根据所述安全检测结果生成或更新所述数据分析类型对应的数据分析结果。
  27. 一种数据分析装置，其特征在于，包括：
    通信单元，用于接收数据分析网元发送的第一请求消息，所述第一请求消息用于请求对第一数据进行安全检测，所述第一数据为所述数据分析网元对指定数据分析类型进行数据分析的数据集；
    处理单元，用于对所述第一数据进行安全检测，得到安全检测结果；
    所述通信单元还用于：将所述安全检测结果发送给所述数据分析网元。
  28. 一种数据分析装置，其特征在于，包括：处理器和存储器；所述存储器用于存储一个或多个程序，所述一个或多个程序包括计算机执行指令，当该装置运行时，所述处理器执行所述存储器存储的所述一个或多个程序以使该装置执行如权利要求1-14中任一项所述的方法。
  29. 一种数据传输装置，其特征在于，包括：处理器和存储器；所述存储器用于存储一个或多个程序，所述一个或多个程序包括计算机执行指令，当该装置运行时，所述处理器执行所述存储器存储的所述一个或多个程序以使该装置执行如权利要求15-25中任一项所述的方法。
  30. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，当所述计算机程序被运行时，实现如权利要求1-14中任一项所述的方法或实现如权 利要求15-25中任一项所述的方法。
  31. 一种数据分析系统，其特征在于，包括如权利要求26所述的数据分析装置和用于如权利要求27所述的数据分析装置。
PCT/CN2020/117547 2020-09-24 2020-09-24 一种数据分析方法及装置 WO2022061675A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CN202080104295.0A CN116235526A (zh) 2020-09-24 2020-09-24 一种数据分析方法及装置
EP20954527.6A EP4207850A4 (en) 2020-09-24 2020-09-24 METHOD AND DEVICE FOR DATA ANALYSIS
PCT/CN2020/117547 WO2022061675A1 (zh) 2020-09-24 2020-09-24 一种数据分析方法及装置
US18/187,929 US20230224310A1 (en) 2020-09-24 2023-03-22 Data analysis method and apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/117547 WO2022061675A1 (zh) 2020-09-24 2020-09-24 一种数据分析方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/187,929 Continuation US20230224310A1 (en) 2020-09-24 2023-03-22 Data analysis method and apparatus

Publications (1)

Publication Number Publication Date
WO2022061675A1 true WO2022061675A1 (zh) 2022-03-31

Family

ID=80846004

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/117547 WO2022061675A1 (zh) 2020-09-24 2020-09-24 一种数据分析方法及装置

Country Status (4)

Country Link
US (1) US20230224310A1 (zh)
EP (1) EP4207850A4 (zh)
CN (1) CN116235526A (zh)
WO (1) WO2022061675A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110049508A (zh) * 2018-01-15 2019-07-23 华为技术有限公司 一种获取业务数据的方法及装置
CN110602697A (zh) * 2018-06-13 2019-12-20 华为技术有限公司 一种限制终端设备接入的方法及装置
CN111147422A (zh) * 2018-11-02 2020-05-12 华为技术有限公司 控制终端与网络连接的方法及装置
CN111148105A (zh) * 2018-11-02 2020-05-12 华为技术有限公司 类别信息的确定方法及装置
CN111240975A (zh) * 2020-01-07 2020-06-05 平安科技（深圳）有限公司 人工智能系统风险检测方法、装置、计算机设备与介质
US20200288296A1 (en) * 2019-03-08 2020-09-10 Telefonaktiebolaget Lm Ericsson (Publ) Method for end-to-end (e2e) user equipment (ue) trajectory network automation based on future ue location

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020162719A1 (ko) * 2019-02-08 2020-08-13 엘지전자 주식회사 무선 통신 시스템에서 qos 만족 여부를 표시하는 이동 단말기
CN110569288A (zh) * 2019-09-11 2019-12-13 中兴通讯股份有限公司 一种数据分析方法、装置、设备和存储介质
CN111212038B (zh) * 2019-12-23 2021-02-09 江苏国泰新点软件有限公司 基于大数据人工智能的开放数据api网关系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110049508A (zh) * 2018-01-15 2019-07-23 华为技术有限公司 一种获取业务数据的方法及装置
CN110602697A (zh) * 2018-06-13 2019-12-20 华为技术有限公司 一种限制终端设备接入的方法及装置
CN111147422A (zh) * 2018-11-02 2020-05-12 华为技术有限公司 控制终端与网络连接的方法及装置
CN111148105A (zh) * 2018-11-02 2020-05-12 华为技术有限公司 类别信息的确定方法及装置
US20200288296A1 (en) * 2019-03-08 2020-09-10 Telefonaktiebolaget Lm Ericsson (Publ) Method for end-to-end (e2e) user equipment (ue) trajectory network automation based on future ue location
CN111240975A (zh) * 2020-01-07 2020-06-05 平安科技（深圳）有限公司 人工智能系统风险检测方法、装置、计算机设备与介质

Also Published As

Publication number Publication date
CN116235526A (zh) 2023-06-06
US20230224310A1 (en) 2023-07-13
EP4207850A1 (en) 2023-07-05
EP4207850A4 (en) 2023-10-25

Similar Documents

Publication Publication Date Title
US11522960B2 (en) Programmable user plane function
WO2020224463A1 (zh) 一种数据分析方法及装置
US10264413B1 (en) Integrated rich communications services (RCS) messaging
WO2019220172A1 (en) Token-based debugging for a service-based architecture
WO2023280121A1 (zh) 一种获取边缘服务的方法和装置
CN110557744B (zh) 订阅事件的方法与网络功能网元
US11871223B2 (en) Authentication method and apparatus and device
US20230099786A1 (en) Methods and Apparatus for Provisioning Private Network Devices During Onboarding
US11882234B2 (en) Method and apparatus for granting or not granting a chargeable party at a session management with required quality of service utilizing a MAC address
CN111434083A (zh) 用于netconf的网络管理设备和集中式授权服务器
WO2021138822A1 (zh) 签约信息获取方法及装置
US20220263879A1 (en) Multicast session establishment method and network device
US11789803B2 (en) Error handling framework for security management in a communication system
US20240048986A1 (en) Communication method and apparatus
US11477829B2 (en) Systems and methods for paging over WiFi for mobile terminating calls
US11228896B2 (en) Authorization of roaming for new radio subscribers via an alternative radio access technology
US9439169B2 (en) Reducing paging delays using location analytics in communications networks
WO2022061675A1 (zh) 一种数据分析方法及装置
US11601947B2 (en) Systems and methods for network slice selection according to application specific request
US11689960B2 (en) Systems and methods for obtaining and indicating subscription information for a wireless communication service
JP2024519311A (ja) データ入手方法およびシステム、ならびにその装置
KR20230137998A (ko) Af 세션에 대한 외부 매개변수 프로비저닝을 위한 새로운 방법
CN116803052A (zh) 用于akma的路由指示符检索
WO2023060408A1 (zh) 感知数据的收集方法、装置、设备、系统及存储介质
CN117478431B (zh) 一种基于可信网络的工业物联网控制方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20954527

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020954527

Country of ref document: EP

Effective date: 20230331

NENP Non-entry into the national phase

Ref country code: DE