WO2022174780A1 - DDoS攻击检测的方法和装置 - Google Patents

DDoS攻击检测的方法和装置 Download PDF

Info

Publication number
WO2022174780A1
WO2022174780A1 PCT/CN2022/076605 CN2022076605W WO2022174780A1 WO 2022174780 A1 WO2022174780 A1 WO 2022174780A1 CN 2022076605 W CN2022076605 W CN 2022076605W WO 2022174780 A1 WO2022174780 A1 WO 2022174780A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
nwdaf
ddos attack
request
amf
Prior art date
Application number
PCT/CN2022/076605
Other languages
English (en)
French (fr)
Inventor
孙陶然
胡力
吴义壮
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022174780A1 publication Critical patent/WO2022174780A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices

Definitions

  • the present application relates to the technical field of network security, and more particularly, to a method and apparatus for DDoS attack detection.
  • Distributed Denial of Service refers to the use of a large number of legitimate distributed servers to send requests to the target, resulting in the inability of normal users to obtain services.
  • DDoS is the use of machines in different locations (such as personal PCs, mobile phones, printers, cameras, etc.) to launch a large number of attack requests on the target at the same time, or an attacker controls machines in different locations and uses these machines to congest the target server at the same time and cannot provide normal services to the outside world. Since the starting point of the attack is distributed in different places, this type of attack is called a distributed denial of service attack.
  • the present application provides a DDoS attack detection method and apparatus, so as to detect the DDoS attack sources of all network devices and improve the accuracy of detecting the DDoS attack sources.
  • a first aspect provides a method for detecting a DDoS attack, the method comprising: receiving a DDoS attack detection request, the DDoS attack detection request being used to request DDoS attack detection on a first network device, the DDoS attack detection request Including information of the first network device and information of a potential attack device, the potential attack device is a device that may initiate a DDoS attack on the first network device; obtain data to be analyzed, and the data to be analyzed includes the first network device. The amount of data exchanged between a network device and the potential attacking device;
  • NWDAF can collect the amount of data interacting between network devices and all potential attacking devices according to the DDoS attack detection request of the requesting device, so as to detect the DDoS attack source of network devices, adapt to more DDoS attack detection scenarios, and Improve the accuracy of detecting the source of DDoS attacks.
  • the attack detection result of the DDoS attack on the first network device includes an attack source of the DDoS attack on the first network device.
  • the different attack sources of the DDoS attack on the first network device and the collected data to be analyzed of the different attack sources whether the different attack sources exist Attack analysis.
  • the method further includes: sending the attack detection result.
  • the first network device is a radio access network RAN device
  • the receiving a DDoS attack detection request includes: receiving the request from the operation, management and maintenance OAM DDoS attack detection request;
  • the acquiring the data to be analyzed includes: sending a data subscription request to the OAM; receiving data from the OAM interacting between the RAN and the potential attacking device to the session management network element
  • the SMF sends a data subscription request; receives from the SMF the amount of data for the session associated with the potentially attacking device.
  • NWDAF can collect the amount of data exchanged between the RAN and all potential attacking devices according to the DDoS attack detection request of the OAM, so as to detect the source of the DDoS attack on the RAN and improve the accuracy of detecting the source of the DDoS attack on the RAN.
  • the method before the receiving a DDoS attack detection request, the method further includes: receiving an analysis daily data request from the OAM, and the analysis daily data request uses requesting to analyze the daily data of the RAN; obtaining the daily data of the RAN; training an anomaly detection model for the RAN according to the daily data of the RAN, and the anomaly detection model is used to detect the data of the RAN Is it abnormal.
  • the method further includes: determining a data abnormality threshold according to the daily data of the RAN, where the data abnormality threshold is used for the OAM or the RAN to determine Whether the data of the RAN is abnormal.
  • NWDAF obtains the data abnormality threshold of the RAN by analyzing the daily data of the RAN, and more accurately judges whether the data of the RAN is abnormal, so as to request the NWDAF for DDoS attack detection in time, so as to solve the abnormality.
  • the method before acquiring the data to be analyzed, the method further includes: receiving abnormal data of the RAN from the OAM; The anomaly detection model determines whether the RAN is under a DDoS attack; wherein, the data to be analyzed is obtained when it is determined that the RAN is under a DDoS attack.
  • NWDAF trains an anomaly detection model for the RAN through daily RAN data, and combines the anomaly data to accurately determine whether the RAN is under DDoS attack before analyzing the source of the DDoS attack, so as to avoid false triggering of DDoS attack detection requests.
  • the method before acquiring the data to be analyzed, the method further includes: receiving abnormal data of the RAN of the OAM; according to the abnormal data and the The anomaly detection model determines whether the RAN is under a DDoS attack; wherein, the data to be analyzed is obtained when it is determined that the RAN is under a DDoS attack.
  • the first network device is a mobility management network element AMF
  • the receiving a DDoS attack detection request includes: receiving the DDoS attack from the AMF Detecting a request;
  • the acquiring the data to be analyzed includes: receiving the data to be analyzed from the AMF.
  • NWDAF can collect the amount of data exchanged between itself and all potential attacking devices according to the AMF's DDoS attack detection request, so as to detect the AMF's DDoS attack source and improve the accuracy of detecting the AMF's DDoS attack source.
  • the method before the receiving the DDoS attack detection request, further includes: receiving a request for analyzing daily data from the AMF, and the analyzing the daily data request uses In order to request to analyze the daily data of the AMF; obtain the daily data of the AMF; according to the daily data of the AMF, train an abnormality detection model for the AMF, and the abnormality detection model is used to detect the data of the AMF Is it abnormal.
  • NWDAF obtains the data abnormality threshold of AMF by analyzing the daily data of AMF, and more accurately judges whether the data of AMF is abnormal, so as to request DDoS attack detection from NWDAF in time, so as to solve the abnormality
  • the method further includes: determining a data abnormality threshold according to the daily data of the AMF, where the data abnormality threshold is used by the AMF to determine the abnormality of the AMF. Whether the data is abnormal.
  • the method before acquiring the data to be analyzed, the method further includes: receiving abnormal data of the AMF from the AMF; The anomaly detection model determines whether the AMF is under a DDoS attack; wherein, the data to be analyzed is obtained when it is determined that the AMF is under a DDoS attack.
  • NWDAF trains an anomaly detection model for AMF through AMF daily data, and combines the anomaly data to accurately determine whether AMF is under DDoS attack before analyzing the source of DDoS attacks, so as to avoid false triggering of DDoS attack detection requests.
  • the first network device is a user plane network element UPF
  • the receiving the DDoS attack detection request includes: receiving the DDoS attack detection request from the SMF;
  • the acquiring the data to be analyzed includes: sending a data subscription request to the SMF; receiving, from the SMF, the amount of data associated with the session between the potential attack objects and the session parameters associated with the potential attack objects. The amount of data.
  • NWDAF can collect the amount of data exchanged between UPF and all potential attacking devices according to the DDoS attack detection request of SMF, so as to detect the source of DDoS attack of UPF and improve the accuracy of detecting the source of DDoS attack of UPF.
  • the method before the receiving a DDoS attack detection request, the method further includes: receiving a request for analyzing daily data from the SMF, where the request for analyzing daily data is used for request to analyze the daily data of the UPF; obtain the daily data of the UPF; train an anomaly detection model for the UPF according to the daily data of the UPF, and the anomaly detection model is used to detect whether the data of the UPF is not abnormal.
  • NWDAF obtains the data abnormality threshold of UPF by analyzing the daily data of UPF, and more accurately judges whether the data of UPF is abnormal, so as to request DDoS attack detection from NWDAF in time, so as to solve the abnormality.
  • the method further includes: determining a data abnormality threshold according to the daily data of the UPF, where the data abnormality threshold is used by the UPF to determine the abnormality of the UPF. Whether the data is abnormal.
  • the method before acquiring the data to be analyzed, the method further includes: receiving abnormal data of the UPF from the SMF and the UPF; according to the abnormality The data and the anomaly detection model determine whether the UPF is subject to a DDoS attack; wherein, the data to be analyzed is acquired when it is determined that the UPF is subject to a DDoS attack.
  • NWDAF trains an anomaly detection model for UPF through UPF daily data, and combines the anomaly data to accurately determine whether UPF is under DDoS attack before analyzing the source of DDoS attack, so as to avoid false triggering of DDoS attack detection requests.
  • the DDoS attack detection request is used to request DDoS attack detection on the set of first network devices
  • the receiving the DDoS attack detection request includes: receiving the DDoS attack detection request from the set of the first network device of the OAM; the acquiring the data to be analyzed includes: receiving the data to be analyzed of each of the network devices in the set of the first network device .
  • NWDAF can detect the DDoS attack source of the set of first network devices according to the amount of data exchanged between all potential attacking devices of each network device in the set of first network devices, so as to improve the detection efficiency of the first network device. Accuracy of DDoS attack sources for a collection of network devices.
  • the method before the receiving a DDoS attack detection request, the method further includes: receiving a request for analyzing daily data from the OAM, where the request for analyzing daily data is used for request to analyze the daily data of the first network device set; obtain the daily data of the first network device set; according to the daily data of the first network device set, the first network device set An anomaly detection model is trained, where the anomaly detection model is used to detect whether the data of the set of first network devices is abnormal.
  • NWDAF obtains the data abnormality threshold of the first network device set by analyzing the daily data of the first network device set, and more accurately judges whether the data of the first network device set is abnormal, so as to timely report to the first network device set. NWDAF requests DDoS attack detection to resolve the anomaly.
  • the method further includes: determining a data abnormality threshold according to the daily data of the set of first network devices, where the data abnormality threshold is used for the first network
  • the set of devices determines whether data of the set of first network devices is abnormal.
  • the method before acquiring the data to be analyzed, the method further includes: receiving abnormal data of the set of first network devices of the OAM; according to the abnormal data and the anomaly detection model to determine whether the set of first network devices suffers from a DDoS attack; wherein, the data to be analyzed is obtained when it is determined that the set of first network devices suffers from a DDoS attack.
  • NWDAF trains an anomaly detection model for the set of first network devices through the daily data of the set of first network devices, and accurately determines whether the set of first network devices suffers a DDoS attack before analyzing the source of the DDoS attack in combination with the abnormal data. Avoid false triggering of DDoS attack detection requests.
  • a method for DDoS attack detection comprising: sending a DDoS attack detection request to NWDAF, where the DDoS attack detection request is used to request DDoS attack detection on the first network device, the The DDoS attack detection request includes information of the first network device and information of a potential attack device of the first network device, where the potential attack device is a network element that may initiate a DDoS attack on the first network device;
  • the NWDAF obtains the data to be analyzed request; collects the data to be analyzed according to the request; sends the data to be analyzed to the NWDAF, the data to be analyzed includes the first network device and the potential attack device. The amount of data exchanged between them, the data to be analyzed is used to detect a DDoS attack on the first network device.
  • NWDAF can collect the amount of data interacting between network devices and all potential attacking devices according to the DDoS attack detection request of the requesting device, so as to detect the DDoS attack source of network devices, adapt to more DDoS attack detection scenarios, and Improve the accuracy of detecting the source of DDoS attacks.
  • the attack detection result of the DDoS attack on the first network device includes an attack source of the DDoS attack on the first network device.
  • the first network device is a RAN
  • the method is performed by the OAM
  • the method before the DDoS attack detection request is sent to the NWDAF, the method further includes: It is determined that the data of the RAN is abnormal.
  • the method before the sending a DDoS attack detection request to the NWDAF, the method further includes: sending a request for analyzing daily data to the NWDAF, the analyzing daily data The request is used to request the NWDAF to analyze the daily data of the RAN; send the daily data of the RAN to the NWDAF, and the daily data of the RAN is used for the NWDAF to train an abnormality detection model for the RAN, and the abnormality The detection model is used to detect whether the data of the RAN is abnormal.
  • the method before the determining that the data of the RAN is abnormal, the method further includes: receiving a data abnormality threshold of the NWDAF;
  • the abnormal data includes: determining whether the data of the RAN is abnormal according to the data abnormality threshold.
  • NWDAF obtains the data abnormality threshold of RAN by analyzing the daily data of RAN, and more accurately judges whether the data of RAN is abnormal, so as to request DDoS attack detection to NWDAF in time, so as to solve the abnormality.
  • the method before the sending the data to be analyzed to the NWDAF, the method further includes: sending the data to the NWDAF when the data of the RAN is abnormal Abnormal data of the RAN, the abnormal data is used by the NWDAF to determine whether the RAN is under DDoS attack.
  • NWDAF can accurately determine whether the RAN is under DDoS attack by combining the abnormal data and the abnormal data detection model before analyzing the source of the DDoS attack, so as to avoid false triggering of the DDoS attack detection request.
  • the first network device is an AMF
  • the method is performed by the AMF
  • the method before the sending a DDoS attack detection request to the NWDAF, the method further includes: It is determined that the data of the AMF is abnormal.
  • the method before the sending the DDoS attack detection request to the NWDAF, the method further includes: sending the daily data of the AMF to the NWDAF, the AMF's daily data
  • the daily data is used for the NWDAF to train an abnormality detection model for the AMF, and the abnormality detection model is used to detect whether the data of the AMF is abnormal.
  • the method before the determining of the data abnormality of the AMF, the method further includes: receiving a data abnormality threshold of the NWDAF;
  • the abnormal data includes: determining whether the data of the AMF is abnormal according to the data abnormality threshold.
  • NWDAF obtains the abnormal data threshold of AMF by analyzing the daily data of AMF, and more accurately judges whether the data of AMF is abnormal, so as to request DDoS attack detection from NWDAF in time, so as to solve the abnormality.
  • the method before the sending the data to be analyzed to the NWDAF, the method further includes: sending the data to the NWDAF when the data of the AMF is abnormal Abnormal data of the AMF, the abnormal data is used by the NWDAF to determine whether the AMF is subject to a DDoS attack.
  • NWDAF can accurately determine whether AMF is under DDoS attack by combining abnormal data and abnormal data detection model before analyzing the source of DDoS attack, so as to avoid false triggering of DDoS attack detection request.
  • the first network device is a UPF
  • the method is performed by the SMF
  • the method before the DDoS attack detection request is sent to the NWDAF, the method further includes: It is determined that the data of the UPF is abnormal.
  • the method before the sending the DDoS attack detection request to the NWDAF, the method further includes: sending the daily data of the UPF to the NWDAF, the UPF's daily data
  • the daily data is used for the NWDAF to train an anomaly detection model for the UPF, and the anomaly detection model is used to detect whether the data of the UPF is abnormal.
  • the method before the determining that the data of the UPF is abnormal, the method further includes: receiving a data abnormality threshold of the NWDAF; sending the data to the UPF a data abnormality threshold, the data abnormality threshold is used by the UPF to determine whether the data of the UPF is abnormal; the determining that the data of the UPF is abnormal includes: determining the UPF according to whether the data abnormality information sent by the UPF to the SMF Whether the data is abnormal.
  • NWDAF obtains the abnormal data threshold of UPF by analyzing the daily data of UPF, and more accurately determines whether the data of UPF is abnormal, so as to request DDoS attack detection from NWDAF in time to solve the abnormality.
  • the method before the sending the data to be analyzed to the NWDAF, the method further includes: sending the data to the NWDAF when the data of the UPF is abnormal Abnormal data of the UPF, the abnormal data is used by the NWDAF to determine whether the UPF is subject to a DDoS attack.
  • NWDAF can accurately determine whether the UPF is under DDoS attack by combining anomaly data and training anomaly detection model before analyzing the source of DDoS attack, so as to avoid false triggering of DDoS attack detection request.
  • an apparatus for providing a DDoS attack detection the apparatus is used to perform the above-mentioned first aspect and the second aspect and any possible implementation manner of the first aspect and the second aspect.
  • the apparatus may include modules for performing the methods provided in the first aspect and the second aspect.
  • an apparatus for DDoS attack detection including a processor.
  • the processor is coupled to the memory and can be used to execute instructions in the memory to implement the method in any of the possible implementations of the first aspect and the second aspect above.
  • the apparatus further includes a memory.
  • the apparatus further includes a communication interface to which the processor is coupled, the communication interface being used for inputting and/or outputting information.
  • the information includes at least one of instructions and data.
  • the apparatus is a network device, such as a session management network element or an access network device.
  • the communication interface may be a transceiver, or an input/output interface.
  • the device is a chip or a system of chips.
  • the communication interface may be an input/output interface, and may be an input/output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit on the chip or a chip system.
  • the processor may also be embodied as a processing circuit or a logic circuit.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • a fifth aspect provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by an apparatus, causes the apparatus to realize the first aspect and the second aspect and the first aspect and the second aspect. method in any possible implementation.
  • a computer program product comprising instructions that, when executed by a computer, cause an apparatus to implement the methods provided in the first aspect and the second aspect.
  • FIG. 1 is a schematic diagram of a network structure applicable to an embodiment of the present application.
  • FIG. 2(a) and FIG. 2(b) are schematic diagrams of two request modes for sending request analysis to the NWDAF according to the embodiment of the present application.
  • FIG. 3(a) and FIG. 3(b) are schematic diagrams of two data collection methods applicable to the NWDAF in the embodiment of the present application.
  • FIG. 4 is a schematic diagram of a DDoS attack detection method proposed according to an embodiment of the present application.
  • FIG. 5 shows a schematic diagram of a DDoS attack detection method applicable to an embodiment of the present application.
  • FIG. 6 shows another schematic diagram of a DDoS attack detection method applicable to an embodiment of the present application.
  • FIG. 7 shows another schematic diagram of a DDoS attack detection method applicable to an embodiment of the present application.
  • FIG. 8 shows another schematic diagram of a DDoS attack detection method applicable to an embodiment of the present application.
  • FIG. 9 shows yet another schematic diagram of a DDoS attack detection method applicable to an embodiment of the present application.
  • FIG. 10 shows yet another schematic diagram of a DDoS attack detection method applicable to an embodiment of the present application.
  • FIG. 11 is a schematic block diagram of an apparatus for DDoS attack detection provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a device for DDoS attack detection provided by an embodiment of the present application.
  • FIG. 1 To facilitate understanding of the embodiments of the present application, a network architecture applicable to the embodiments of the present application is first described in detail with reference to FIG. 1 .
  • FIG. 1 is a schematic diagram of a network architecture suitable for the method provided by the embodiment of the present application.
  • the network architecture is, for example, the 5G system (the 5h generation system, 5GS) defined by the 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP).
  • the network architecture can be divided into two parts: access network (AN) and core network (CN).
  • the access network may be used to implement functions related to wireless access, and the access network may include a 3GPP access network (or 3GPP access technology) and a non-3rd Generation Partnership Project (non-3GPP) access network (or say non-3GPP access technology).
  • the core network mainly includes the following key logical network elements: access and mobility management function (AMF) network element, session management function (SMF) network element, user plane function (user plane function) network element function, UPF) network element, policy control function (policy control function, PCF) network element and unified data management (unified data management, UDM) network element and so on.
  • AMF access and mobility management function
  • SMF session management function
  • UPF user plane function
  • policy control function policy control function
  • PCF policy control function
  • UDM unified data management
  • User equipment can be called terminal equipment, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile equipment, user terminal, terminal, wireless communication equipment, User Agent or User Device.
  • the terminal device may be a device that provides voice/data connectivity to the user, such as a handheld device with a wireless connection function, a vehicle-mounted device, and the like.
  • some examples of terminals can be: mobile phone (mobile phone), tablet computer (pad), computer with wireless transceiver function (such as notebook computer, palmtop computer, etc.), mobile internet device (mobile internet device, MID), virtual reality (virtual reality, VR) equipment, augmented reality (augmented reality, AR) equipment, wireless terminals in industrial control (industrial control), wireless terminals in unmanned driving (self driving), wireless terminals in remote medical (remote medical) Terminal, wireless terminal in smart grid, wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home, cellular phone, cordless Telephone, session initiation protocol (SIP) telephone, wireless local loop (WLL) station, personal digital assistant (PDA), handheld device, computing device or connection with wireless communication capabilities
  • the terminal device may also be a terminal device in an Internet of things (Internet of things, IoT) system.
  • IoT Internet of things
  • IoT is an important part of the development of information technology in the future. Its main technical feature is to connect items to the network through communication technology, so as to realize the intelligent network of human-machine interconnection and interconnection of things. IoT technology can achieve massive connections, deep coverage, and terminal power saving through, for example, narrow-band NB technology.
  • terminal equipment can also include sensors such as smart printers, train detectors, and gas stations.
  • the main functions include collecting data (part of terminal equipment), receiving control information and downlink data of network equipment, and sending electromagnetic waves to transmit uplink data to network equipment. .
  • the terminal device may be any device that can access the network.
  • a certain air interface technology can be used to communicate with each other between the terminal device and the access network device.
  • Access network can provide network access functions for authorized users in a specific area, including radio access network (RAN) equipment and AN equipment.
  • the RAN device is mainly a 3GPP network wireless network device, and the AN device may be an access network device defined by non-3GPP.
  • the access network may be an access network using different access technologies.
  • 3GPP access technologies such as those employed in 3G, 4G or 5G systems
  • non-3GPP (non-3GPP) access technologies 3GPP access technology refers to the access technology that conforms to the 3GPP standard specifications.
  • the access network equipment in the 5G system is called the next generation Node Base station (gNB) or RAN.
  • Non-3GPP access technologies refer to access technologies that do not conform to 3GPP standards, such as air interface technologies represented by access points (APs) in wireless fidelity (WiFi), global interconnection microwave access (worldwide interoperability for microwave access, WiMAX), code division multiple access (code division multiple access, CDMA) networks, etc.
  • the access network equipment (AN equipment) can allow the terminal equipment and the 3GPP core network to use non-3GPP technology for interconnection and intercommunication.
  • An access network that implements an access network function based on a wireless communication technology may be referred to as a RAN.
  • the radio access network can be responsible for functions such as radio resource management, quality of service (QoS) management, data compression and encryption on the air interface side.
  • QoS quality of service
  • the wireless access network provides access services for terminal equipment, and then completes the forwarding of control signals and user data between the terminal and the core network.
  • a radio access network may include, but is not limited to, a macro base station, a micro base station (also called a small cell), a radio network controller (RNC), a Node B (Node B, NB), a base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved NodeB, or home Node B, HNB), baseband unit (baseband unit, BBU), AP in WiFi systems, wireless Relay node, wireless backhaul node, transmission point (TP) or transmission and reception point (TRP), etc. It can also be a gNB or a transmission point (TRP or TRP) in a 5G (eg, NR) system.
  • RNC radio network controller
  • Node B Node B
  • BSC base station controller
  • base transceiver station base transceiver station
  • BTS home base station
  • home base station for example, home evolved NodeB, or home Node B, HNB
  • TP one or a group (including multiple antenna panels) antenna panels of a base station in a 5G system, or, it can also be a network node that constitutes a gNB or a transmission point, such as a baseband unit (BBU), or a distributed unit ( distributed unit, DU), or the base station in the next-generation communication 6G system, etc.
  • BBU baseband unit
  • DU distributed unit
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the wireless access network device.
  • the access network may provide services to the cell.
  • the terminal device may communicate with the cell through transmission resources (eg, frequency domain resources, or spectrum resources) allocated by the access network device.
  • transmission resources eg, frequency domain resources, or spectrum resources
  • AMF network element mainly used for mobility management and access management, such as user location update, user registration network, user switching, etc.
  • AMF can also be used to implement other functions than session management in mobility management entity (mobility management entity, MME). For example, legal interception, or access authorization (or authentication) and other functions.
  • SMF network element It is mainly used for session management, UE's Internet Protocol (IP) address allocation and management, selection of user plane functions that can be managed, policy control, or termination point of charging function interfaces, and downlink data notification, etc.
  • IP Internet Protocol
  • the SMF main user is responsible for session management in the mobile network, such as session establishment, modification, release, and the like.
  • Specific functions may include, for example, assigning IP addresses to terminal devices, selecting UPFs that provide packet forwarding functions, and the like.
  • UPF network element responsible for the forwarding and reception of user data in the terminal equipment.
  • the UPF network element can receive user data from the data network (DN), and transmit it to the terminal equipment through the access network equipment.
  • the UPF network element can also receive user data from the terminal device through the access network device and forward it to the data network.
  • the transmission resources and scheduling functions that provide services to terminal equipment in the UPF network element are managed and controlled by the SMF network element.
  • Data Network A service network for providing data services to users.
  • the Internet Internet
  • a third-party service network an IP multimedia service (IP multi-media service, IMS) network, etc.
  • IP multimedia service IP multi-media service, IMS
  • AUSF Authentication server function
  • Network exposure function (NEF) network element It is mainly used to support the opening of capabilities and events, such as securely opening services and capabilities provided by 3GPP network functions to the outside.
  • Network storage network element (network function (NF) repository function, NRF): used to store the description information of network function entities and the services they provide, as well as support service discovery, network element entity discovery, etc.
  • PCF network element a unified policy framework for guiding network behavior, providing policy rule information for control plane functional network elements (such as AMF, SMF network elements, etc.), and being responsible for acquiring user subscription information related to policy decision-making.
  • control plane functional network elements such as AMF, SMF network elements, etc.
  • UDM network element used to generate authentication credential, user identification processing (such as storing and managing user permanent identity, etc.), access authorization control and contract data management, etc.
  • Application function (AF) network element mainly supports interaction with the 3GPP core network to provide services, such as influencing data routing decisions, interacting with policy control functions (PCF), or providing third parties to the network side, etc.
  • PCF policy control functions
  • Network slice authentication and authorization network element network slice specific authentication and authorization function, NSSAAF.
  • each network element can communicate with each other through the interfaces shown in the figure, and some interfaces can be implemented in the form of service-oriented interfaces.
  • the UE and the AMF may interact through the N1 interface, and the interaction message may be called, for example, an N1 message (N1 Message).
  • the RAN and the AMF can interact through the N2 interface, and the N2 interface can be used for sending non-access stratum (NAS) messages.
  • the RAN and the UPF can interact through the N3 interface, and the N3 interface can be used to transmit data on the user plane.
  • the SMF and the UPF can interact through the N4 interface, and the N4 interface can be used to transmit information such as the tunnel identification information of the N3 connection, the data buffer indication information, and the downlink data notification message.
  • the UPF and the DN can interact through the N6 interface, and the N6 interface can be used to transmit data on the user plane.
  • the relationship between other interfaces and each network element is shown in FIG. 1 , and for brevity, it will not be described in detail here.
  • the above-mentioned network architecture applied to the embodiments of the present application is only a network architecture described from the perspective of a traditional point-to-point architecture and a service-oriented architecture, and the network architecture applicable to the embodiments of the present application is not limited thereto. Any network architecture capable of implementing the functions of the foregoing network elements is applicable to the embodiments of the present application.
  • Functional network elements for example, can be combined into network slices on demand.
  • These core network elements may be independent devices, or may be integrated into the same device to implement different functions.
  • the present application does not limit the specific forms of the foregoing network elements.
  • Protocol data unit (PDU) session PDU session
  • the 5G core network (5G corenet, 5GC) supports PDU connection services.
  • the PDU connection service may refer to the service of exchanging PDU data packets between the terminal device and the DN.
  • the PDU connection service is realized through the establishment of a PDU session initiated by the terminal device. After a PDU session is established, a data transmission channel between the terminal device and the DN is established. In other words, PDU sessions are UE-level. Each end device can establish one or more PDU sessions.
  • the terminal device can access the DN through the PDU session established between the terminal device and the DN.
  • NWDAF Network data analytics function
  • NWDAF is a new network function (NF) that 3GPP intends to introduce artificial intelligence (AI) into the 5G network.
  • NWDAF is a data-aware analysis network element. It automatically senses and analyzes the network based on network data, and participates in the whole life cycle of network planning, construction, operation and maintenance, network optimization, and operation, so that the network has been maintained and controlled. , to improve the efficiency of network resource usage and improve user experience.
  • NWDAF can collect specific data from specific network functions (network function, NF), network management system (Operation Administration and Maintenance, OAM) and AF (Application Function, AF), and perform intelligent analysis on the specific data Get the analysis results, and then send the analysis results to a specific NF, AF, OAM, etc. as needed.
  • a consumer requesting NWDAF service can request analysis from NWDAF, or subscribe to NWDAF for analysis.
  • request analysis means that NWDAF collects and analyzes data from different NFs, AFs, and OAMs in different time periods according to the parameters carried by the NWDAF Service Consumer when requesting analysis, and finally reports the analysis results to the NWDAF Service Consumer.
  • Subscription analysis means that NWDAF collects and analyzes data from different NFs, AFs, and OAMs at regular intervals or at a certain time according to the parameters carried by the NWDAF Service Consumer when subscribing to analysis, and then analyzes the results at a specified time according to the analysis service parameters. Report to NWDAF Service Consumer or other network elements.
  • the request analysis process can be divided into the following two steps, as shown in Figure 2(a).
  • the NWDAF service requester (Service Consumer) sends a request analysis request to the NWDAF.
  • the NWDAF Service Consumer sends the Nnwdaf_AnalyticsInfo_Request message to the NWDAF to request analysis from the NWDAF.
  • the analysis request contains the following parameters.
  • Analytics ID(s) Used to define the analytics type of the analytics request. Such as network slice analysis, NF load analysis, etc.
  • Timestamp Identifies the time period in which the data is counted.
  • Analytics Filter Information Indicates the analytics information that needs to be reported. For example, NF marks are used to narrow the scope of analysis data.
  • Target of Analytics Reporting Indicates the target of the analysis, such as a user equipment (User Equipment, UE), any UE.
  • UE User Equipment
  • Analytics Reporting Information Information included in the returned analytics report. Specific information is listed below.
  • Time interval which can be past time or future time.
  • Past analysis target times are requests or subscriptions for statistics
  • future analysis target periods are requests or subscriptions for forecasts.
  • the time interval can also be expressed as a positive or negative offset of the reporting time, indicating a subscription for forecasts or statistics, respectively.
  • Preferred level of accuracy of the analytics Indicates the desired analytical accuracy.
  • Time when analytics information is needed Analysis request service. Indicates the required time for the analysis report. If the report has not been completed after the time has elapsed, an error message will be returned.
  • the Analytics Reporting Information parameter further includes the maximum number of requests and/or the maximum number of user permanent identifiers (subscription permanent identifier, SUPI) requested.
  • NWDAF returns the requested analysis result to the NWDAF Service Consumer.
  • NWDAF reports the analysis result to NWDAF Service Consumer by sending Nnwdaf_AnalyticsInfo_-Request Response to NWDAF Service Consumer.
  • Subscribing to analysis means that when NWDAF Service Consumer subscribes to NWDAF for analysis, NWDAF can collect and analyze data from different NFs and/or AFs and/or OAMs at regular intervals or at a certain time according to the analysis type and analysis period, and then according to the analysis Service parameters, and report the analysis results to the NWDAF Service Consumer within the specified time.
  • the process can be divided into the following two steps, as shown in Fig. 2(b).
  • NWDAF Service Consumer sends a subscription analysis request to NWDAF.
  • the NWDAF Service Consumer sends the Nnwdaf_AnalyticsSubscrip-tion_Subscribe message to the NWDAF, and the subscription request includes the following parameters in addition to the same parameters as the analysis request above.
  • Analytics Reporting Parameters Basic reporting parameters, including report mode, maximum number of reports, report duration, immediate report flag, etc.
  • Thresholds for returning analysis results that is, NWDAF will return a report after the threshold is reached.
  • the matching direction can be less than the threshold, greater than the threshold, or intersecting with the threshold. The default is intersecting with the threshold.
  • Notification Target Address Indicates the notification address of the analysis result.
  • NWDAF sends the subscription data result to NWDAF Service Consumer.
  • NWDAF sends the Nnwdaf_AnalyticsSubscription_-Notify message to the NWDAF Service Consumer to notify the NWDAF Service Consumer of the analysis result.
  • NWDAF can collect data from NF, OAM and AF according to the parameters in the analysis request. Among them, the process of NWDAF collecting data from NF is as follows, as shown in Figure 3(a).
  • the NWDAF sends a subscription data request to the NF.
  • NWDAF sends Nnf_EventExposure_Subscribe message to NF, and subscribes data to NF, and the subscription message includes the following parameters.
  • Event ID Indicates the subscription event type, such as UE Reachability, UE access and Mobility, etc.
  • Target of Event Reporting Subscription target, instructing to collect specific UE or PDU session as granular collection data.
  • Event Filter Information Event filtering information, such as area of interest, single network slice selection assistance information (S-NSSAI), etc., specifies which data in Target of Event Reporting is collected.
  • S-NSSAI single network slice selection assistance information
  • Event reporting information including the following parameters.
  • Event reporting mode Reporting mode, such as maximum number of reports, reporting period and periodic reports, and maximum reporting period.
  • Maximum number of reports Indicates the maximum number of reports for which event subscriptions are stopped.
  • Maximum duration of reporting Indicates the maximum duration for which event subscriptions are stopped.
  • Immediate reporting flag The flag that the event provider NF will immediately notify the consumer NF of the current state of the subscription event.
  • Sampling ratio The sampling ratio among affected users, the range is 1%..100%.
  • Group Reporting Guard Time A group-based monitoring configuration parameter, indicating the time that UE-related monitoring events in the group can be aggregated before being sent to the consuming NF.
  • a Notification Target Address Subscription notification address, indicating the notification address of the subscription report.
  • the NF sends the subscription data result to the NWDAF.
  • the NF sends the Nnf_EventExposure_Notify message to the NWDAF, and returns the subscription data. NF will report the data to NWDAF at regular intervals or after collecting a certain amount of data according to the subscription parameters.
  • NWDAF sends a subscription data request to OAM.
  • the OAM notifies the NWDAF that the data preparation is complete, and the NWDAF obtains the data through a file transfer protocol (File Transfer Protocol, FTP).
  • FTP File Transfer Protocol
  • FIG. 4 shows a schematic interaction diagram of a method 400 adapted to an embodiment of the present application. The method 100 will be described in detail below with reference to each step.
  • the NWDAF receives a DDoS attack detection request sent from a requesting device, where the DDoS attack detection request is used to request the NWDAF to detect a DDoS attack on the first network device.
  • the DDoS attack detection request includes information of the first network device and information of a potential attack device of the first network device, where the potential attack device is a device that may initiate a DDoS attack on the first network device.
  • the first network device is a device other than NWDAF, such as RAN, AMF, UPF or other control plane network elements.
  • the requesting device may be the first network device, or may be a device that detects the data of the first network device and connects the first network device and the NWDAF.
  • the requested network element is the OAM.
  • the first network device is AMF, and the requesting device is AMF.
  • the DDoS attack detection request may be an analysis request or a subscription request.
  • the specific processes of the analysis request and the subscription request are as described above, and are not repeated here for brevity.
  • the NWDAF before receiving the DDoS attack detection request sent from the requesting device, receives a request for analyzing daily data, where the request for analyzing daily data is used to request to analyze the daily data of the first network device. Specifically, the NWDAF acquires the daily data of the first network device, and then trains an anomaly detection model for the first network device according to the daily data, where the anomaly detection model is used to detect whether the data of the first device is abnormal.
  • the NWDAF acquires data to be analyzed, where the data to be analyzed includes the amount of data exchanged between the first network device and the potential attacking device.
  • the NWDAF acquires different data to be analyzed from different devices according to different first network devices.
  • the potential attacking devices are UE, AMF, and UPF.
  • the data to be analyzed includes not only the amount of data exchanged between the RAN and the UE, AMF, and UPF, but also the data of the session associated with the UE and the identification information of the potential attacking device. Judging by the amount of the interactive data and the identification information of the potential attacking device Attack source of DDoS attack on RAN.
  • NWDAF detects a DDoS attack on the first network device according to the data to be analyzed.
  • NWDAF detects DDoS attacks on the first network devices according to different collected data to be analyzed.
  • the method further includes the NWDAF sending the attack detection result.
  • the NWDAF sends the attack detection result to the notification object, and if not specified, the NWDAF returns the attack detection result to the requesting device.
  • the method 400 will be described in detail below through the methods 500-1000.
  • FIG. 5 shows a schematic interaction diagram of a method 500 suitable for an embodiment of the present application.
  • the method 500 mainly introduces the above-mentioned solution for detecting a DDoS attack on the RAN when the first network device is the RAN.
  • Method 500 includes the following steps.
  • the OAM determines that the RAN data is abnormal.
  • the RAN actively reports its own data to the OAM at regular intervals, and the OAM determines that the RAN data is abnormal according to a preset threshold and the data reported by the RAN.
  • the OAM sends a DDoS attack detection request to the NWDAF.
  • the OAM monitors whether the RAN data is abnormal, and sends a DDoS attack detection message to the NWDAF in the event of an abnormality, requesting the NWDAF to perform DDoS attack detection on the RAN.
  • the parameter Target of Analytics Reporting indicates the possible source of the attack if the RAN is attacked by DDoS, that is, the potential attack device.
  • step 502 before step 502 is performed, that is, before the OAM sends a DDoS attack detection request to the NWDAF, the OAM sends a request for analyzing the daily data of the RAN to the NWDAF, and the NWDAF sends the analysis result to the OAM by analyzing the daily data of the RAN, and the OAM Determine whether the RAN data is abnormal by analyzing the results.
  • the specific process is as follows 601-613. The following will introduce the process of analyzing the daily data of the RAN by NWDAF with reference to FIG. 6 .
  • the OAM sends a daily data request for analyzing the RAN to the NWDAF.
  • the OAM sends a request for analyzing the daily data of the RAN to the NWDAF, and the analysis request is used to request the NWDAF for analyzing the daily data of the RAN.
  • the OAM sends a daily data request to the NWDAF to analyze the RAN in a subscription analysis manner.
  • the NWDAF subscribes the daily data of the RAN to the OAM.
  • the NWDAF subscribes the daily data of the RAN to the OAM according to the analysis request.
  • the daily data of subscription is as follows.
  • Global RAN Node ID The identifier of the RAN, which is used to determine the object of data collection.
  • Timestamp Identifies the time period in which the data is counted.
  • the number of radio resource control (RRC) messages received by the RAN from the UE the number of all RRC messages received by a RAN within the time indicated by the timestamp, including the RRC request (request) message and the RRC response ( response) message. If the UE attacks the RAN through RRC messages, the number of RRC messages from the UE will increase significantly.
  • RRC radio resource control
  • Downlink rate of data For each RAN, the downlink rate of data from UPF to RAN. If the UPF attacks the RAN through data packets, the downlink speed of the data will be greatly reduced.
  • Uplink rate of data For each RAN, the uplink rate of data from UE to RAN. If the UE attacks the RAN through data packets, the uplink speed of the data will drop significantly.
  • Number of messages received by RAN from AMF The number of all messages received by a RAN from AMF within the time indicated by the timestamp. If the AMF attacks the RAN via control plane signaling, the number of messages from the AMF increases dramatically.
  • the number of NAS messages received by the RAN from the UE The number of all non-access stratum (Non-Access Stratum, NAS) messages received by a RAN from the UE within the time indicated by the timestamp. If the UE attacks the RAN through NAS messages, the number of NAS messages received by the RAN will increase significantly.
  • Non-Access Stratum Non-Access Stratum
  • subscribed daily data includes but is not limited to the data listed above, and other data parameters may also appear in future technical replacements.
  • the OAM subscribes the daily data of the RAN to the RAN.
  • the OAM subscribes to the daily data of the RAN based on the NWDAF, and subscribes the daily data to the RAN.
  • the RAN reports the daily data of the RAN to the OAM.
  • the RAN collects the daily data of the RAN and reports it to the OAM.
  • the OAM reports the daily data of the RAN to the NWDAF.
  • the OAM reports the daily data reported by the RAN to the NWDAF.
  • NWDAF trains an anomaly detection model for the RAN.
  • NWDAF trains an anomaly detection model for the RAN according to the data from the OAM.
  • the anomaly detection model is used to detect the abnormal data of the RAN, and calculates the threshold of abnormal data according to the data, that is, the data anomaly threshold, which is used when the OAM or RAN is abnormal.
  • the data anomaly threshold which is used when the OAM or RAN is abnormal.
  • the abnormality detection model may be a machine learning model, which is also used to detect abnormal data of the RAN, and the name of this model is not limited in this application.
  • NWDAF sends the analysis result to OAM.
  • NWDAF returns the analysis result to OAM, and the analysis result includes the data anomaly threshold.
  • the OAM saves the analysis result and monitors the data of the RAN, and judges whether the data of the RAN is abnormal based on the data abnormality threshold.
  • step 608 is executed, and the OAM sends the analysis result to the RAN.
  • the OAM after receiving the analysis result, the OAM sends the analysis result to the RAN, so that the RAN monitors its own data, and judges whether the data is abnormal based on the data abnormality threshold.
  • the RAN reports the daily data of the RAN to the OAM.
  • the RAN collects statistics at intervals and reports the data to the OAM, and reports the same type of data in different time periods.
  • the OAM reports the daily data of the RAN to the NWDAF.
  • the OAM reports the daily data of the RAN to the NWDAF according to the subscription of the NWDAF.
  • the NWDAF updates the anomaly detection model for the RAN.
  • NWDAF updates the anomaly detection model and data anomaly thresholds according to the updated daily data.
  • the NWDAF sends the updated analysis result to the OAM.
  • the NWDAF notifies the OAM of the updated analysis result, and the updated analysis result includes the updated data anomaly threshold.
  • step 613 is performed.
  • the OAM sends the updated analysis result to the RAN for the RAN to monitor the data and determine whether the data is abnormal based on the analysis result.
  • the RAN determines that the data is abnormal, the data abnormality information is reported to the OAM, and the abnormal data is reported. OAM will also immediately report abnormal data to NWDAF.
  • the RAN determines that its own data is abnormal.
  • the RAN determines that its own data is abnormal according to a preset threshold.
  • the RAN determines that its own data is abnormal based on the data abnormality threshold.
  • the RAN sends data abnormality information to the OAM.
  • the data abnormality information includes abnormal data.
  • the OAM sends a DDoS attack detection request to the NWDAF.
  • the OAM immediately sends a DDoS attack detection request to the NWDAF after receiving the abnormal data information.
  • the OAM immediately reports the abnormal data C to the NWDAF or reports the abnormal data to the NWDAF when the NWDAF sends the DDoS attack detection request.
  • NWDAF judges whether the RAN is under DDoS attack according to the abnormal data and the abnormal detection model of the RAN.
  • OAM reports abnormal data to NWDAF.
  • the OAM after the OAM sends a DDoS attack detection request to the NWDAF, the OAM immediately reports the abnormal data collected by itself to the NWDAF.
  • the NWDAF reports abnormal data to the NWDAF while sending the DDoS attack detection request.
  • NWDAF analyzes whether the RAN is under DDoS attack according to the abnormal data and the abnormal detection model.
  • the NWDAF obtains the data to be analyzed from the OAM.
  • the NWDAF sends a data subscription request to the OAM, and subscribes the data to be analyzed to the OAM.
  • the data to be analyzed includes the amount of data exchanged between the RAN and its potential attacking device and the identification information of the potential attacking source.
  • NWDAF collects different data to be analyzed for different attack sources.
  • the attack sources may come from the user plane or the control plane.
  • the attack sources on the user plane can be divided into UE and UPF, and the attack sources on the control plane can be Divided into UE and AMF.
  • the subscribed data to be analyzed is as follows.
  • SUPI Permanent user identity of the UE, used to identify the UE that initiates the attack.
  • Timestamp Identifies the time period in which the data is counted.
  • RRCSetupRequest is used to establish an RRC connection between the UE and the RAN. When the UE is not in the connected state, this message can be used to establish a connection with the UE. Compare the status to determine whether the UE has sent a malicious message. At the same time, the UE may also carry out a DDoS attack on the RAN by sending a large number of RRCSetupRequest messages.
  • RRCResumeRequest is used to restore the RRC connection between the UE and the RAN.
  • this message can be used to restore the connection and communicate with the UE. Compare the status to determine whether the UE has sent a malicious message.
  • the UE may also perform DDoS attacks on the RAN by sending a large number of RRCResumeRequest messages.
  • RRCReestablishRequest is used to re-establish the RRC connection between the UE and the RAN.
  • RRCReestablishRequest When the UE is in the RRC connected state, the context of the UE has changed, resulting in If the RRC connection is disconnected, you can use this message to re-establish the connection, and compare it with the UE status to determine whether the UE has sent a malicious message.
  • the UE may also perform a DDoS attack on the RAN by sending a large number of RRCReestablishRequest messages.
  • the RRC status of the UE is compared with the RRC request sent by the UE to determine whether the UE has sent a malicious message.
  • Received the number of RRC responses sent by each UE The number of RRC responses sent by each UE to the RAN, compared with the number of RRC requests sent by the RAN to each UE, can determine whether the UE has sent a malicious response message. At the same time, the UE may also perform a DDoS attack on the RAN by sending a large number of RRC response messages.
  • Number of RRC requests sent to each UE The number of RRC requests sent by the RAN to each UE is compared with the number of RRC responses sent by each UE to the RAN to determine whether the UE has sent a malicious response message.
  • the UE may carry out a DDoS attack on the RAN by sending a large number of NAS messages. This number can increase significantly when a DDoS attack occurs.
  • the subscribed data to be analyzed is as follows.
  • AMF identifier used to identify the AMF that launched the attack. This identifier can be the AMF instance ID or the AMF identifier in 5G-GUTI.
  • Timestamp Identifies the time period in which the data is counted.
  • Received the number of requests sent by each AMF The number of request messages sent by each AMF to the RAN.
  • AMF may conduct DDoS attacks by sending a large number of request messages to the RAN. When the attack is launched, this value may increase significantly.
  • the number of requests sent by the RAN to each AMF Compare with the number of responses sent by the AMF to determine whether the AMF has sent malicious messages.
  • Received the number of responses sent by each AMF the number of response messages sent by each AMF to the RAN.
  • AMF may conduct DDoS attacks by sending a large number of response messages to the RAN. When the attack is launched, this value may increase significantly. At the same time, it can also be compared with the number of requests sent by the RAN to each AMF to determine whether the AMF has sent malicious messages.
  • the number of UEs served by each RAN The number of serving UEs has a linear relationship with the number of requests sent by AMF to RAN. When the number of serving UEs is small, but the number of requests sent by AMF to RAN is large, AMF may be abnormal.
  • the subscribed data to be analyzed is as follows.
  • SUPI Permanent user identity of the UE, used to identify the UE that initiates the attack.
  • Timestamp Identifies the time period in which the data is counted.
  • PDU Session ID PDU session identifier, used to identify the PDU session used by the UE to initiate an attack.
  • Uplink data traffic per PDU session For each PDU session, if the UE attacks the RAN through this PDU session, the uplink data rate of this PDU session will be high. Compare with the average uplink rate of such PDU sessions collected from the SMF to determine whether the uplink data of this PDU session is abnormal.
  • the subscribed data to be analyzed is as follows.
  • PDU Session ID PDU session identifier, used to identify the PDU session used by the UPF to launch an attack.
  • Timestamp Identifies the time period in which the data is counted.
  • Downlink data traffic per PDU session For each PDU session, if the UPF attacks the RAN through this PDU session, the downlink data rate for this PDU session will be high. Compare with the average downlink rate of such PDU sessions collected from the SMF to determine whether the downlink data of this PDU session is abnormal.
  • the OAM obtains the data to be analyzed from the RAN.
  • the OAM subscribes the data to be analyzed to the RAN based on the subscription of the data to be analyzed by the NWDAF.
  • the RAN reports the data to be analyzed to the OAM.
  • the RAN reports the data to be analyzed to the OAM based on the subscription of the OAM
  • the OAM reports the data to be analyzed to the NWDAF.
  • the OAM reports the data to be analyzed to the NWDAF based on the subscription of the NAWDAF.
  • the NWDAF obtains the data to be analyzed from the SMF.
  • the NWDAF subscribes the data to be analyzed from the SMF, where the data to be analyzed includes the data volume of the session associated with the potential attacking device and the identifier of the session, and the data to be analyzed is as follows.
  • the collected data is as follows.
  • PDU Session ID PDU session identifier, used to identify the PDU session used by the UE to initiate an attack.
  • Timestamp Identifies the time period in which the data is counted.
  • Data network name (DNN) and S-NSSAI PDU sessions of the same type have the same DNN and S-NSSAI.
  • Average uplink rate of PDU Session established using DNN and S-NSSAI For PDU sessions established using the same DNN and S-NSSAI, SMF will count their average uplink rate and compare it with the uplink rate of the current PDU session to determine the PDU at this time. Whether the session is abnormal.
  • PDU Session ID PDU session identifier, used to identify the PDU session used by the UPF to launch an attack.
  • Timestamp Identifies the time period in which the data is counted.
  • DNN and S-NSSAI PDU sessions of the same type have the same DNN and S-NSSAI.
  • the average downlink rate of the PDU Session established using DNN and S-NSSAI For PDU sessions established using the same DNN and S-NSSAI, SMF will count their average downlink rate, compare it with the downlink rate of the current PDU session, and determine the PDU at this time. Whether the session is abnormal.
  • NWDAF analyzes the source of the DDoS attack on the RAN according to the data to be analyzed.
  • NWDAF analyzes the collected data to be analyzed, and obtains the attack source of the DDoS attack.
  • the analysis of the control plane is specific to each UE or each AMF, and the analysis of the user plane is specific to each PDU session.
  • NWDAF sends the analysis result to OAM.
  • NWDAF sends analysis results to OAM, and OAM takes corresponding measures to deal with the attack.
  • the analysis results include the following information.
  • SUPI UE's user identity, if the attack is initiated by the UE, it indicates the specific UE that initiated the attack.
  • AMF instance ID AMF instance ID. If the attack is initiated by AMF, it indicates the specific AMF that initiated the attack.
  • PDU Session ID PDU session ID. If the attack is initiated on the user plane, it indicates the specific PDU session that initiated the attack.
  • Attack Level Attack level, indicating the level of possible attack.
  • Attack trend indicating the direction of attack, such as control surface UE or control surface AMF.
  • the NWDAF reports the analysis report to the SMF.
  • the NWDAF collects and analyzes data from different network devices or terminal devices to find the source of the DDoS attack on the RAN.
  • FIG. 7 shows a schematic interaction diagram of a method 700 suitable for an embodiment of the present application.
  • the method 700 mainly introduces the above-mentioned solution for detecting a DDoS attack on the RAN when the first network device is an AMF.
  • Method 700 includes the following steps.
  • the AMF determines that its own data is abnormal.
  • the AMF determines that its own data is abnormal through a preset threshold.
  • the AMF sends a DDoS attack detection request to the NWDAF.
  • the AMF monitors whether its own data is abnormal, and in the case of abnormality, sends a DDoS attack detection message to the NWDAF, requesting the NWDAF to perform DDoS attack detection on the AMF.
  • the parameter Target of Analytics Reporting indicates the possible source of the attack if the AMF is attacked by DDoS, that is, the potential attack device.
  • NF includes all control plane network elements except AMF, such as SMF, PCF, UDM, NRF, NSSF, NSSAAF, NEF, NRF, AUSF. It should be understood that in future technology development, NF may also include other network elements. Yuan
  • step 702 before step 702 is performed, that is, before the AMF sends a DDoS attack detection request to the NWDAF, the AMF sends an AMF analysis daily data request to the NWDAF, and the NWDAF sends the analysis result to the AMF by analyzing the AMF daily data, and the AMF Determine whether there is an abnormality in your own data by analyzing the results.
  • the specific process is as follows 801-807. The following will introduce the process of analyzing the daily data of the RAN by NWDAF with reference to FIG. 8 .
  • the AMF sends a daily data request for analyzing the AMF to the NWDAF.
  • the AMF sends a daily data request for analyzing the AMF to the NWDAF, and the analysis request is used to request the NWDAF to analyze its own daily data.
  • the AMF sends a daily data request to analyze the AMF to the NWDAF in a way of subscribed to analysis.
  • the NWDAF subscribes the daily data of the AMF to the AMF.
  • the NWDAF subscribes its own daily data to the AMF according to the analysis request, and accordingly, the AMF reports the daily data of the AMF to the NWDAF.
  • the daily data of the subscription is shown below.
  • AMF instance ID The identification of AMF, which is used to determine the object of data collection
  • Timestamp Includes start time and end time to mark the start and end time of collecting data.
  • the number of registration request messages received by the AMF from the UE the number of all registration request messages received by an AMF within the time indicated by the timestamp, including initial registration, periodic registration, mobility registration, and de-registration requests. If the UE attacks the AMF through the registration request message, the number of registration request messages from the UE will increase significantly.
  • the number of service request messages received by the AMF from the UE the number of all service request messages received by an AMF within the time indicated by the timestamp. If the UE attacks the AMF through the service request message, the number of service request messages from the UE will increase significantly.
  • the number of PDU session request messages received by the AMF from the UE the number of all PDU session request messages received by an AMF within the time indicated by the timestamp, including the PDU session establishment request, the PDU session release request and the PDU session modification request. If the UE attacks the AMF through the PDU Session Request message, the number of PDU Session Request messages from the UE will increase significantly.
  • the number of messages received by AMF from other NFs the number of messages received by an AMF from other network elements within the time indicated by the timestamp.
  • Other network elements include SMF, PCF, UDM, NRF, NSSF, NSSAAF, NEF, NRF, AUSF. If other network elements attack the AMF, the number of messages from other network elements will increase significantly.
  • the number of response messages received by the AMF from the UE the number of all response messages received by an AMF from the UE within the time indicated by the timestamp. If the UE attacks the AMF through the response message, the number of response messages received by the AMF will increase significantly.
  • AMF sends Nnf_EventExposure_Notify message to NWDAF to notify NWDAF that the subscription is successful and returns subscription data.
  • AMF will report data to NWDAF at regular intervals or after collecting a certain amount of data according to subscription parameters.
  • subscribed daily data includes but is not limited to the data listed above, and other data parameters may also appear in future technical replacements.
  • NWDAF trains an abnormal data model for AMF.
  • NWDAF trains an anomaly detection model for AMF according to the daily data from AMF.
  • the anomaly detection model is used to detect the abnormal data of AMF, and calculates the threshold of abnormal data according to the data, that is, the data anomaly threshold, which is used when the AMF is abnormal. When the collected data reaches this threshold, the data is considered abnormal.
  • the abnormality detection model may be a machine learning model, which is also used to detect abnormal data of AMF, and the name of this model is not limited in this application.
  • the NWDAF sends the analysis result to the AMF.
  • the NWDAF returns the analysis result to the AMF, and the analysis result includes the data anomaly threshold.
  • the AMF saves the analysis result and monitors the data of the RAN, and judges whether the data of the RAN is abnormal based on the data abnormality threshold.
  • the AMF reports the daily data of the AMF to the NWDAF.
  • the AMF collects statistics and reports the data to the NWDAF at regular intervals, and updates the same type of data in different time periods.
  • NWDAF updates the anomaly detection model for AMF.
  • NWDAF updates the machine learning model and the threshold for judging abnormal data according to the update data reported by the AMF.
  • the NWDAF sends the updated analysis result to the AMF.
  • the NWDAF returns the updated analysis result to the AMF, where the updated analysis result includes the updated data anomaly threshold.
  • the AMF immediately reports the abnormal data to the NWDAF or reports the abnormal data to the NWDAF when the NWDAF sends the DDoS attack detection request.
  • NWDAF judges whether the RAN is under DDoS attack according to the abnormal data and the abnormal detection model of the RAN. If DDoS attacked, go to step 703, otherwise go to step 705.
  • the NWDAF obtains the data to be analyzed from the AMF.
  • the NWDAF sends a data subscription request to the AMF, and subscribes the data to be analyzed to the AMF.
  • the data to be analyzed includes the amount of data interacting between the AMF and its potential attack sources.
  • NWDAF subscribes to different data for different attack sources.
  • the attack source may come from the UE or other network elements.
  • the subscribed data to be analyzed is as follows.
  • SUPI Permanent user identity of the UE, used to identify the UE that initiates the attack.
  • Timestamp Identifies the time period in which the data is counted.
  • Number of registration request messages from each UE The number of registration request messages sent by each UE received by an AMF within the time indicated by the timestamp, including initial registration, periodic registration, mobility registration, and deregistration requests. If a UE attacks the AMF through a registration request message, the number of registration request messages from this UE will increase significantly.
  • Number of service request messages from each UE The number of service request messages sent by each UE received by an AMF within the time indicated by the timestamp. If a UE attacks the AMF through a service request message, the number of service request messages from this UE will increase significantly.
  • Number of PDU Session Request messages from each UE The number of PDU Session Request messages sent by each UE received by an AMF within the time indicated by the timestamp, including PDU Session Establishment Request, PDU Session Release Request, and PDU Session Modification ask. If a UE attacks the AMF through a PDU Session Request message, the number of PDU Session Request messages from this UE will increase significantly.
  • Number of response messages from each UE The number of response messages sent by each UE received by an AMF within the time indicated by the timestamp. If a UE attacks the AMF with a response message, the number of response messages from this UE will increase significantly. At the same time, comparing with the number of request messages sent by the AMF to each UE, it can be determined whether the UE sends a malicious response message.
  • Number of request messages sent by AMF to each UE Compare with the number of response messages from each UE to determine whether the UE has sent malicious response messages.
  • the subscribed data to be analyzed is as follows.
  • NF instance ID NE instance ID, indicating which NE attacked the AMF.
  • Timestamp Identifies the time period in which the data is counted.
  • Number of request messages sent by each NF to AMF The number of request messages sent by each NF to this AMF within the time indicated by the timestamp. If the NF attacks the AMF through the request message, the number of request messages from the NF will increase significantly.
  • Number of response messages sent by each NF to AMF The number of response messages sent by each NF to this AMF within the time indicated by the timestamp. If the NF attacks the AMF through the response message, the number of response messages from the NF will increase significantly. At the same time, it is compared with the number of request messages sent by AMF to each NF to determine whether the NF has sent malicious messages.
  • Number of request messages sent by AMF to each NF The number of request messages sent by AMF to each NF within the time indicated by the timestamp. Compare with the number of response messages sent by each NF to determine whether the NF has sent malicious response messages.
  • NWDAF analyzes the attack source of the DDoS attack on the AMF according to the data to be analyzed.
  • NWDAF analyzes the specific source of attacks on AMF by analyzing the collected data.
  • the analysis for UE is specific to each UE, and the analysis for NF attack is specific to each NF instance.
  • the NWDAF sends the analysis result to the AMF.
  • the AMF takes corresponding measures to deal with the abnormal situation.
  • the analysis report includes:
  • SUPI UE's permanent user identity, if the attack is initiated by the UE, it indicates the specific UE that initiated the attack.
  • NF instance ID NE instance ID, if the attack is initiated by NF, it indicates the specific NF that initiated the attack
  • Attack level Attack level, indicating the level of possible attack.
  • Attack trend indicating the direction of attack, such as control surface UE or control surface AMF.
  • control plane network elements when data of other control plane network elements other than the AMF is abnormal, reference may be made to the foregoing method 700 for the detection method of the DDoS attack.
  • the potential attack devices of other control plane network elements are other control plane network elements other than the other control plane network elements.
  • Other control plane network elements are SMF, PCF, UDM, NRF, NSSF, NSSAAF, NEF, NRF, and AUSF.
  • SMF data is abnormal
  • its potential attack devices are AMF, PCF, UDM, NRF, NSSF, NSSAAF, NEF, NRF, AUSF.
  • FIG. 9 shows a schematic interaction diagram of a method 900 suitable for an embodiment of the present application.
  • the method 900 mainly introduces the above-mentioned solution for detecting a DDoS attack on the UPF when the first network device is a UPF.
  • Method 900 includes the following steps.
  • the UPF determines that its own data is abnormal.
  • the UPF determines that an abnormality occurs in its own data through a preset threshold.
  • the UPF sends data abnormality information to the SMF.
  • the UPF reports data abnormality information to the SMF, where the data abnormality information includes abnormal data.
  • the SMF sends a DDoS attack detection request to the NWDAF.
  • the SMF monitors whether the UPF data is abnormal and sends a DDoS attack detection request message to the NWDAF in the event of an abnormality, requesting the NWDAF to perform DDoS attack detection on the UPF.
  • the SMF requests the NWDAF by sending a request analysis message Nnwdaf_AnalyticsInfo_Request or a subscription analysis message Nnwdaf_AnalyticsSubsciption_Subscribe to the NWDAF including the request parameters:
  • Analytics ID DDoS Attack
  • Target of Analytics Reporting any UE, any AF
  • Analytics Filter Information UPF instance ID DDoS attack detection against UPF.
  • the parameter Target of Analytics Reporting indicates the possible source of the attack if the UPF is attacked by DDoS, that is, the potential attack device.
  • step 903 before step 903 is performed, that is, before the SMF sends a DDoS attack detection request to the NWDAF, the SMF sends a request for analyzing the daily data of the UPF to the NWDAF, and the NWDAF sends the analysis result to the UPF by analyzing the daily data of the UPF, and the UPF sends the analysis result to the UPF.
  • the specific process is as follows 1001-1011. The process of analyzing UPF daily data by NWDAF will be introduced below with reference to Figure 10.
  • the SMF sends a daily data request to the NWDAF to analyze the UPF.
  • the SMF sends a daily data request for analyzing the UPF to the NWDAF, and the analysis request is used to request the NWDAF for analyzing the daily data of the UPF.
  • the daily data request sent by the SMF to the NWDAF to analyze the UPF is sent in a subscription analysis manner.
  • NWDAF subscribes to SMF for daily data of UPF.
  • NWDAF subscribes to SMF for daily data on UPF upon analysis request.
  • the daily data requested is as follows.
  • UPF instance ID The identifier of the UPF, which is used to determine the object of data collection.
  • Timestamp Includes start time and end time to mark the start and end time of collecting data.
  • Data Downlink Rate of UPF For each UPF, the downlink rate of data from AF to UPF. If AF attacks UPF through data packets, the downlink rate of data will be greatly reduced.
  • UPF data uplink rate For each UPF, the data uplink rate from the UE to the UPF. If the UE attacks the UPF through data packets, the data uplink rate will be greatly reduced.
  • the SMF subscribes the daily data of the UPF to the UPF.
  • the SMF subscribes the daily data to the UPF based on the data request of the NWDAF. Accordingly, the UPF reports the daily data of the UPF to the SMF. Specifically, based on the subscription of SMF, UPF collects its own daily data and reports it to SMF.
  • the SMF reports the daily data of the UPF to the NWDAF.
  • the SMF reports the daily data reported by the UPF to the NWDAF.
  • NWDAF trains an anomaly detection model for UPF.
  • NWDAF trains an anomaly detection model for UPF according to the data from SMF, the anomaly detection model is used to detect abnormal data of RAN, and calculates the threshold of data abnormality according to the data, that is, the data abnormality threshold, which is used when OAM or When the data collected by the RAN reaches this threshold, it is determined that the data is abnormal.
  • the abnormality detection model may be a machine learning model, which is also used to detect abnormal data of the RAN, and the name of this model is not limited in this application.
  • the NWDAF sends the analysis results to the SMF.
  • the NWDAF returns the analysis result to the SMF, and the analysis result includes a threshold for judging abnormal data.
  • the SMF sends the analysis result to the UPF.
  • the SMF after receiving the analysis result, the SMF sends the analysis result to the UPF, so that the UPF monitors the data and judges that the data is abnormal based on the analysis result.
  • the UPF reports the daily data of the UPF to the SMF.
  • the UPF collects statistics at regular intervals and reports it to the SMF, and updates the same type of data in different time periods.
  • the SMF reported the daily data of the UPF to the NWDAF.
  • NWDAF updates the anomaly detection model.
  • NWDAF updates the anomaly detection model and data anomaly threshold according to the updated data.
  • the NWDAF sends the updated analysis result to the SMF.
  • the NWDAF notifies the SMF of the updated analysis result, and the updated analysis result includes the updated threshold.
  • the SMF sends the updated analysis result to the UPF.
  • the SMF sends the updated analysis result to the UPF, so that the UPF detects whether an abnormality occurs in its own data based on the analysis result.
  • the SMF immediately reports the abnormal data reported by the UPF to the NWDAF or reports the abnormal data to the NWDAF when the NWDAF sends the DDoS attack detection request.
  • NWDAF judges whether UPF is under DDoS attack according to the abnormal data and UPF's anomaly detection model. If DDoS attacked, go to step 904, otherwise go to step 908.
  • the NWDAF obtains the data to be analyzed from the SMF.
  • the NWDAF sends a data subscription request to the SMF, and subscribes the data to be analyzed to the SMF.
  • the data to be analyzed includes the amount of data associated with the session between the UPF and the potential attack object, the amount of data associated with the session parameters between the UPF and the potential attack object, and the identification information of the attack object.
  • the SMF collects the data volume associated with the session between the UPF and the potential attack object from the UPF, and the SMF collects the data volume associated with the session parameter between the UPF and the potential attack object.
  • NWDAF will subscribe to different data for different attack sources.
  • the attack source may come from UE or AF.
  • the collected data to be analyzed is as follows.
  • PDU Session ID PDU session identifier, used to identify the PDU session used by the UE to initiate an attack.
  • Timestamp Identifies the time period in which the data is counted.
  • DNN and S-NSSAI PDU sessions of the same type have the same DNN and S-NSSAI.
  • Uplink rate per PDU Session For each PDU session, if the UE attacks the RAN through this PDU session, the uplink data rate of this PDU session will be high. Compare with the average uplink rate of such PDU sessions collected from the SMF to determine whether the uplink data of this PDU session is abnormal.
  • Average uplink rate of PDU Session established using DNN and S-NSSAI For PDU sessions established using the same DNN and S-NSSAI, SMF will count their average uplink rate and compare it with the uplink rate of the current PDU session to determine the PDU at this time. Whether the session is abnormal.
  • the collected data to be analyzed is as follows.
  • PDU Session ID PDU session identifier, used to identify the PDU session used by the UPF to launch an attack
  • Timestamp Identifies the time period in which the data is counted.
  • DNN and S-NSSAI The same type of PDU session has the same DNN and S-NSSAI
  • Downlink rate per PDU Session For each PDU session, if the AF attacks the RAN through this PDU session, the downlink data rate of this PDU session will be high. Compare with the average downlink rate of such PDU sessions collected from the SMF to determine whether the downlink data of this PDU session is abnormal.
  • the average downlink rate of the PDU Session established using DNN and S-NSSAI For PDU sessions established using the same DNN and S-NSSAI, SMF will count their average downlink rate, compare it with the downlink rate of the current PDU session, and determine the PDU at this time. Whether the session is abnormal.
  • the SMF obtains the data to be analyzed from the UPF.
  • SMF collects the downlink rate of each PDU Session and the uplink rate of each PDU Session from UPF, and other parameters are counted by SMF.
  • the UPF reports the downlink rate of each PDU Session and the uplink rate of each PDU Session to the SMF.
  • the SMF reports the data to be analyzed to the NWDAF.
  • the SMF reports the data to be analyzed from the UPF to the NWDAF as the downlink rate of each PDU Session and the uplink rate of each PDU Session and other data to be analyzed collected by the SMF itself.
  • NWDAF analyzes the source of DDoS attacks on UPF according to the data to be analyzed.
  • NWDAF analyzes the data to be analyzed to obtain the attack source of the DDoS attack on the UPF.
  • the analysis for UE is specific to each PDU session
  • the analysis for AF is specific to each PDU session.
  • the NWDAF sends the analysis report result to the SMF.
  • the NWDAF sends an analysis report result to the SMF, and the SMF takes corresponding measures to deal with the abnormal situation according to the analysis result.
  • the analysis report includes the parameters shown below.
  • SUPI UE's user identity, if the attack is initiated by the UE, it indicates the specific UE that initiated the attack.
  • PDU Session ID PDU session identifier, indicating the specific PDU session that launched the attack.
  • Attack Level Attack level, indicating the level of possible attack.
  • Attack trend indicating the direction of attack, such as control surface UE or control surface AMF.
  • the method proposed in this application is also applicable to the DDoS attack detection of multiple network devices, that is, a set of network devices.
  • a set of network devices For the specific process, refer to method 700 .
  • the following will briefly introduce the DDoS attack detection method based on the difference from the method 700 by taking the network device set as the AMF set as an example.
  • the OAM When the OAM finds that the data in the AMF set is abnormal, it sends a DDoS attack detection request to the NWDAF. Specifically, the OAM monitors whether the AMF set data is abnormal, and sends a DDoS attack detection message to the NWDAF in the case of abnormality, requesting the NWDAF to perform DDoS attack detection on the AMF set.
  • the parameter Analytics Filter Information carried in the request message is AMF set instance ID.
  • the OAM before the OAM sends the DDoS attack detection request to the NWDAF, the OAM sends the NWDAF a request for analyzing the daily data of the AMF set, the NWDAF sends the analysis result to the OAM by analyzing the daily data of the AMF set, and the OAM analyzes the result through the analysis result. Determines whether an exception has occurred with the AMF set. For the specific process, please refer to 801-807.
  • NWDAF analyzes the attack source of the DDoS attack in the AMF set, and sends the analysis result to the OAM, and the OAM takes corresponding measures to deal with the abnormal situation according to the analysis result.
  • the above-mentioned method may also be referred to for the detection method of the DDoS attack.
  • the potential attacking devices of the other control plane network elements are other control plane network elements other than the other control plane network elements.
  • Other control plane network elements are SMF, PCF, UDM, NRF, NSSF, NSSAAF, NEF, NRF, and AUSF.
  • SMF set data is abnormal
  • its potential attack devices are AMF, PCF, UDM, NRF, NSSF, NSSAAF, NEF, NRF, AUSF.
  • FIG. 11 is a schematic block diagram of an apparatus 1100 for DDoS attack detection provided by an embodiment of the present application.
  • the apparatus 1100 may include: a transceiver unit 1110 and a processing unit 1120 .
  • the apparatus 1100 may be the NWDAF in the above method embodiments, or may be a chip for implementing the functions of the NWDAF in the above method embodiments.
  • the communication apparatus 1100 may correspond to the session management network element in the methods 400 to 1000 according to the embodiments of the present application, and the communication apparatus 1100 may include a method for executing the method 400 in FIG. 4 and the method 500 in FIG. 5 . , the method 600 in FIG. 6 , the method 700 in FIG. 7 , the method 800 in FIG. 8 , the method 900 in FIG. 9 , and the unit of the method performed by NWDAF in the method 1000 in FIG. 10 .
  • each unit in the apparatus 1100 and the above-mentioned other operations and/or functions are respectively for implementing the method 400 in FIG. 4 , the method 500 in FIG. 5 , the method 600 in FIG. 6 , the method 700 in FIG.
  • the apparatus 1100 may be a network device such as RAN, AMF, SMF, UPF, and OAM in the above method embodiment, or may be used to implement the functions of the network device in the above method embodiment chip.
  • the apparatus 1100 may correspond to the network equipment in the methods 400 to 1000 according to the embodiments of the present application, and the apparatus 1100 may include a method for executing the method 400 in FIG. 4 , the method 500 in FIG. 5 , and the method in FIG. 6 .
  • each unit in the apparatus 1100 and the above-mentioned other operations and/or functions are respectively for implementing the method 400 in FIG. 4 , the method 500 in FIG. 5 , the method 600 in FIG. 6 , the method 700 in FIG.
  • transceiver unit 1110 in the apparatus 1100 may correspond to the transceiver 1220 in the apparatus 1200 shown in FIG. 12
  • processing unit 1120 in the apparatus 1100 may correspond to the processor 1210.
  • the communication device 1100 when the communication device 1100 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input/output circuit or a communication interface
  • the processing unit may be a processor, a microprocessor or an integrated circuit integrated on the chip.
  • the transceiving unit 1110 is used to implement the transceiving operation of the signal of the apparatus 1100
  • the processing unit 1120 is used to implement the processing operation of the signal of the communication apparatus 1100 .
  • the communication apparatus 1100 further includes a storage unit 1130, and the storage unit 1130 is used for storing instructions.
  • FIG. 12 is a device 1200 for detecting a DDoS attack provided by an embodiment of the present application.
  • the device 1200 includes: at least one processor 1210 and a transceiver 1220.
  • the processor 1210 is coupled to the memory for executing instructions stored in the memory to control the transceiver 1220 to transmit and/or receive signals.
  • the device 1200 further includes a memory 1230 for storing instructions.
  • processor 1210 and the memory 1230 may be combined into a processing device, and the processor 1210 is configured to execute the program codes stored in the memory 1230 to realize the above-mentioned functions.
  • the memory 1230 may also be integrated in the processor 1210 or independent of the processor 1210 .
  • transceiver 1220 may include a receiver (or, receiver) and a transmitter (or, transmitter).
  • the transceiver 1220 may further include antennas, and the number of the antennas may be one or more.
  • the transceiver 1220 may be a communication interface or an interface circuit.
  • the chip When the device 1200 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input/output circuit or a communication interface;
  • the processing unit may be a processor, a microprocessor or an integrated circuit integrated on the chip.
  • the embodiment of the present application also provides a processing apparatus, including a processor and an interface.
  • the processor may be used to execute the methods in the above method embodiments.
  • the above processing device may be a chip.
  • the processing device may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), or a It is a central processing unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), or a microcontroller (microcontroller unit). , MCU), it can also be a programmable logic device (PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • MCU microcontroller unit
  • MCU programmable logic device
  • PLD programmable logic device
  • each step of the above-mentioned method can be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, detailed description is omitted here.
  • the embodiments of the present application further provide a computer-readable storage medium, on which computer instructions for implementing the method executed by the NWDAF in the above method embodiments are stored.
  • the computer program when executed by a computer, the computer can implement the method executed by NWDAF in the above method embodiments.
  • Embodiments of the present application further provide a computer-readable storage medium, which stores computer instructions for implementing the methods performed by OAM, SMF, and AMF in the foregoing method embodiments.
  • the computer program when executed by a computer, the computer can implement the methods executed by OAM, SMF, and AMF in the above method embodiments.
  • the embodiments of the present application further provide a computer-readable storage medium, on which computer instructions for implementing the method executed by the NWDAF in the above method embodiments are stored.
  • the computer program when executed by a computer, the computer can implement the method executed by NWDAF in the above method embodiments.
  • Embodiments of the present application further provide a computer program product including instructions, which, when executed by a computer, cause the computer to implement the method executed by OAM, SMF, and AMF in the above method embodiments, or the method executed by OAM, SMF, and AMF. , or a method performed by NWDAF.
  • the embodiments of the present application do not specifically limit the specific structure of the execution body of the methods provided by the embodiments of the present application, as long as the program in which the codes of the methods provided by the embodiments of the present application are recorded can be executed to execute the methods according to the embodiments of the present application.
  • the execution body of the method provided by the embodiment of the present application may be a terminal device or a network device, or a functional module in the terminal device or network device that can call a program and execute the program.
  • aspects or features of the present application may be implemented as methods, apparatus, or articles of manufacture using standard programming and/or engineering techniques.
  • article of manufacture as used herein may encompass a computer program accessible from any computer-readable device, carrier or media.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server, data center, etc., which includes one or more available mediums integrated.
  • Useful media may include, but are not limited to, magnetic media or magnetic storage devices (eg, floppy disks, hard disks (eg, removable hard disks), magnetic tapes), optical media (eg, optical disks, compact discs) , CD), digital versatile disc (digital versatile disc, DVD), etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), card, stick or key drive, etc. ), or semiconductor media (such as solid state disk (SSD), etc., U disk, read-only memory (ROM), random access memory (RAM), etc. that can store programs medium of code.
  • SSD solid state disk
  • Various storage media described herein can represent one or more devices and/or other machine-readable media for storing information.
  • the term "machine-readable medium” may include, but is not limited to, wireless channels and various other media capable of storing, containing, and/or carrying instructions and/or data.
  • the memory mentioned in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be random access memory (RAM).
  • RAM can be used as an external cache.
  • RAM may include the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM) , double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM) and Direct memory bus random access memory (direct rambus RAM, DR RAM).
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous link dynamic random access memory
  • Direct memory bus random access memory direct rambus RAM, DR RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components
  • the memory storage module
  • memory described herein is intended to include, but not be limited to, these and any other suitable types of memory.
  • the disclosed apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the above-mentioned units is only a logical function division.
  • multiple units or components may be combined or may be Integration into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, which may be in electrical, mechanical or other forms.
  • the units described above as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to implement the solution provided in this application.
  • each functional unit in each embodiment of the present application may be integrated into one unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer may be a personal computer, a server, or a network device or the like.
  • Computer instructions may be stored on or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server, or data center over a wire (e.g.
  • coaxial cable fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.) to another website site, computer, server, or data center.
  • DSL digital subscriber line
  • wireless eg, infrared, wireless, microwave, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种DDoS攻击检测的方法和装置，该方法包括接收DDoS攻击检测请求，该DDoS攻击检测请求用于请求对第一网络设备的DDoS攻击检测，该DDoS攻击检测请求包括第一网络设备的信息和第一网络设备的潜在攻击设备的信息，潜在攻击设备为可能对所述第一网络设备发起DDoS攻击的设备；获取待分析数据，该待分析数据包括第一网络设备与潜在攻击设备之间交互的数据量；根据待分析数据，检测对第一网络设备的DDoS攻击，实现检测网络设备的DDoS攻击的攻击来源，从而适应多种DDoS攻击检测场景，并提高检测DDoS攻击来源的精准度。

Description

DDoS攻击检测的方法和装置
本申请要求于2021年2月21日提交中国专利局、申请号为202110194841.0、申请名称为“DDoS攻击检测的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络安全技术领域，更具体地，涉及一种DDoS攻击检测的方法和装置。
背景技术
分布式拒绝服务(Distributed Denial of Service)指利用大量合法的分布式服务器对目标发送请求，从而导致正常用户无法获得服务。具体地，DDoS就是利用处于不同位置的机器(如个人PC、手机、打印机、摄像头等)同时对目标发起大量攻击请求，或者一个攻击者控制位于不同位置的机器并利用这些机器同时对目标服务器拥塞而无法对外提供正常服务。由于攻击的出发点是分布在不同地方，这类攻击称为分布式拒绝服务攻击。
当前主要只能通过分析终端设备的异常行为来检测终端设备对应用功能发起的DDoS攻击的检测，而忽视了终端设备对其他设备发起攻击时的检测，也忽视了其它网元和设备作为DDoS攻击发起者，向其他设备和网元发起攻击的检测。
发明内容
本申请提供一种DDoS攻击检测的方法和装置，以检测所有网络设备的DDoS攻击来源，提高检测DDoS攻击来源的精准度。
第一方面，提供了一种DDoS攻击检测的方法，所述方法包括：接收DDoS攻击检测请求，所述DDoS攻击检测请求用于请求对第一网络设备的DDoS攻击检测，所述DDoS攻击检测请求包括所述第一网络设备的信息和潜在攻击设备的信息，所述潜在攻击设备为可能对所述第一网络设备发起DDoS攻击的设备；获取待分析数据，所述待分析数据包括所述第一网络设备与所述潜在攻击设备之间交互的数据量；
基于上述技术方案，NWDAF可以根据请求设备的DDoS攻击检测请求，收集网络设备与其所有潜在攻击设备之间交互的数据量，从而检测网络设备的DDoS攻击来源，适应更多的DDoS攻击检测场景，并提高检测DDoS攻击来源的准确度。
结合第一方面，在第一方面的某些实现方式中，所述对所述第一网络设备的DDoS攻击的攻击检测结果包括对所述第一网络设备的DDoS攻击的攻击来源。
结合第一方面，在第一方面的某些实现方式中，根据对所述第一网络设备的DDoS攻击的攻击来源的不同，分别收集对于不同攻击来源的不同待分析数据
结合第一方面，在第一方面的某些实现方式中，根据对所述第一网络设备的DDoS攻击的攻击来源的不同和收集的不同攻击来源的待分析数据，分别对不同攻击来源是否存在 攻击进行分析。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：发送所述攻击检测结果。
结合第一方面，在第一方面的某些实现方式中，所述第一网络设备为无线接入网RAN设备，所述接收DDoS攻击检测请求，包括：接收来自操作、管理和维护OAM所述DDoS攻击检测请求；所述获取待分析数据，包括：向所述OAM发送数据订阅请求；接收来自所述OAM所述RAN与所述潜在攻击设备之间交互的数据量向所述会话管理网元SMF发送数据订阅请求；接收来自所述SMF的与所述潜在攻击设备关联的会话的数据量。
基于该实现方式，NWDAF可以根据OAM的DDoS攻击检测请求，收集RAN与其所有潜在攻击设备之间交互的数据量，从而检测RAN的DDoS攻击来源，提高检测RAN的DDoS攻击来源的准确度。
结合第一方面，在第一方面的某些实现方式中，在所述接收DDoS攻击检测请求之前，所述方法还包括：接收来自所述OAM的分析日常数据请求，所述分析日常数据请求用于请求对所述RAN的日常数据进行分析；获取所述RAN的日常数据；根据所述RAN的日常数据，为所述RAN训练异常检测模型，所述异常检测模型用于检测所述RAN的数据是否异常。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：根据所述RAN的日常数据，确定数据异常阈值，所述数据异常阈值用于所述OAM或所述RAN确定所述RAN的数据是否异常。
基于该实现方式，NWDAF通过对RAN日常数据的分析得出RAN的数据异常阈值，更准确判断RAN的数据是否发生异常，以便及时向NWDAF请求DDoS攻击检测，从而解决该异常。
结合第一方面，在第一方面的某些实现方式中，所述获取待分析数据之前，所述方法还包括：接收来自所述OAM的所述RAN的异常数据；根据所述异常数据和所述异常检测模型确定所述RAN是否遭受DDoS攻击；其中，在确定所述RAN遭受DDoS攻击时获取所述待分析数据。
基于该实现方式，NWDAF通过RAN日常数据为RAN训练异常检测模型，结合异常数据在分析DDoS攻击来源前准确判断RAN是否遭受DDoS攻击，避免引起DDoS攻击检测请求的误触发。
结合第一方面，在第一方面的某些实现方式中，所述获取待分析数据之前，所述方法还包括：接收所述OAM的所述RAN的异常数据；根据所述异常数据和所述异常检测模型确定所述RAN是否遭受DDoS攻击；其中，在确定所述RAN遭受DDoS攻击时获取所述待分析数据。
结合第一方面，在第一方面的某些实现方式中，所述第一网络设备为移动性管理网元AMF，所述接收DDoS攻击检测请求，包括：接收来自所述AMF的所述DDoS攻击检测请求；所述获取待分析数据，包括：接收来自所述AMF的所述待分析数据。
基于该实现方式，NWDAF可以根据AMF的DDoS攻击检测请求，收集自身与其所有潜在攻击设备之间交互的数据量，从而检测AMF的DDoS攻击来源，提高检测AMF的DDoS攻击来源的准确度。
结合第一方面，在第一方面的某些实现方式中，在所述接收DDoS攻击检测请求之前，所述方法还包括：接收来自所述AMF的分析日常数据请求，所述分析日常数据请求用于请求对所述AMF的日常数据进行分析；获取所述AMF的日常数据；根据所述AMF的日常数据，为所述AMF训练异常检测模型，所述异常检测模型用于检测所述AMF的数据是否异常。
基于该实现方式，NWDAF通过对AMF日常数据的分析得出AMF的数据异常阈值，更准确判断AMF的数据是否发生异常，以便及时向NWDAF请求DDoS攻击检测，从而解决该异常
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：根据所述AMF的日常数据，确定数据异常阈值，所述数据异常阈值用于所述AMF确定所述AMF的数据是否异常。
结合第一方面，在第一方面的某些实现方式中，所述获取待分析数据之前，所述方法还包括：接收来自所述AMF的所述AMF的异常数据；根据所述异常数据和所述异常检测模型确定所述AMF是否遭受DDoS攻击；其中，在确定所述AMF遭受DDoS攻击时获取所述待分析数据。
基于该实现方式，NWDAF通过AMF日常数据为AMF训练异常检测模型，结合异常数据在分析DDoS攻击来源前准确判断AMF是否遭受DDoS攻击，避免引起DDoS攻击检测请求的误触发。
结合第一方面，在第一方面的某些实现方式中，所述第一网络设备为用户面网元UPF，所述接收DDoS攻击检测请求，包括：接收来自SMF的所述DDoS攻击检测请求；所述获取待分析数据，包括：向所述SMF发送数据订阅请求，；接收来自所述SMF的与所述潜在攻击对象之间与会话关联的数据量以及潜在攻击对象之间与会话参数关联的数据量。
基于该实现方式，NWDAF可以根据SMF的DDoS攻击检测请求，收集UPF与其所有潜在攻击设备之间交互的数据量，从而检测UPF的DDoS攻击来源，提高检测UPF的DDoS攻击来源的准确度。
结合第一方面，在第一方面的某些实现方式中，在所述接收DDoS攻击检测请求之前，所述方法还包括：接收所述SMF的分析日常数据请求，所述分析日常数据请求用于请求对所述UPF的日常数据进行分析；获取所述UPF的日常数据；根据所述UPF的日常数据，为所述UPF训练异常检测模型，所述异常检测模型用于检测所述UPF的数据是否异常。
基于该实现方式，NWDAF通过对UPF日常数据的分析得出UPF的数据异常阈值，更准确判断UPF的数据是否发生异常，以便及时向NWDAF请求DDoS攻击检测，从而解决该异常。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：根据所述UPF的日常数据，确定数据异常阈值，所述数据异常阈值用于所述UPF确定所述UPF的数据是否异常。
结合第一方面，在第一方面的某些实现方式中，所述获取待分析数据之前，所述方法还包括：接收来自所述SMF所述UPF的所述UPF的异常数据；根据所述异常数据和所述异常检测模型确定所述UPF是否遭受DDoS攻击；其中，在确定所述UPF遭受DDoS攻击时获取所述待分析数据。
基于该实现方式，NWDAF通过UPF日常数据为UPF训练异常检测模型，结合异常数据在分析DDoS攻击来源前准确判断UPF是否遭受DDoS攻击，避免引起DDoS攻击检测请求的误触发。
结合第一方面，在第一方面的某些实现方式中，所述DDoS攻击检测请求用于请求对所述第一网络设备的集合的DDoS攻击检测，所述接收DDoS攻击检测请求，包括：接收来自OAM所述第一网络设备的集合的所述DDoS攻击检测请求；所述获取待分析数据，包括：接收所述第一网络设备的集合中的每一个所述网络设备的所述待分析数据。
基于该实现方式，NWDAF可以根据第一网络设备的集合中的每一个网络设备的的其所有潜在攻击设备之间交互的数据量，从而检测第一网络设备的集合的DDoS攻击来源，提高检测第一网络设备的集合的DDoS攻击来源的准确度。
结合第一方面，在第一方面的某些实现方式中，在所述接收DDoS攻击检测请求之前，所述方法还包括：接收所述OAM的分析日常数据请求，所述分析日常数据请求用于请求对所述第一网络设备集合的日常数据进行分析；获取所述第一网络设备的集合的日常数据；根据所述第一网络设备的集合的日常数据，为所述第一网络设备的集合训练异常检测模型，所述异常检测模型用于检测所述第一网络设备的集合的数据是否异常。
基于该实现方式，NWDAF通过对第一网络设备的集合的日常数据的分析得出第一网络设备的集合的数据异常阈值，更准确判断第一网络设备的集合的数据是否发生异常，以便及时向NWDAF请求DDoS攻击检测，从而解决该异常。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：据所述第一网络设备的集合的日常数据，确定数据异常阈值，所述数据异常阈值用于第一网络设备的集合确定所述第一网络设备的集合的数据是否异常。
结合第一方面，在第一方面的某些实现方式中，所述获取待分析数据之前，所述方法还包括：接收所述OAM的第一网络设备的集合的异常数据；根据所述异常数据和所述异常检测模型确定第一网络设备的集合是否遭受DDoS攻击；其中，在确定第一网络设备的集合遭受DDoS攻击时获取所述待分析数据。
基于该实现方式，NWDAF通过第一网络设备的集合的日常数据为第一网络设备的集合训练异常检测模型，结合异常数据在分析DDoS攻击来源前准确判断第一网络设备的集合是否遭受DDoS攻击，避免引起DDoS攻击检测请求的误触发。
第二方面，提供了一种DDoS攻击检测的方法，所述方法包括：向NWDAF发送DDoS攻击检测请求，所述DDoS攻击检测请求用于请求对所述第一网络设备的DDoS攻击检测，所述DDoS攻击检测请求包括所述第一网络设备的信息和所述第一网络设备的潜在攻击设备的信息，所述潜在攻击设备为可能对所述第一网络设备发起DDoS攻击的网元；接收所述NWDAF的获取待分析数据请求；根据所述请求收集所述待分析数据；向所述NWDAF发送所述待分析数据，所述待分析数据包括所述第一网络设备与所述潜在攻击设备之间交互的数据量，所述待分析数据用于检测对所述第一网络设备的DDoS攻击。
基于上述技术方案，NWDAF可以根据请求设备的DDoS攻击检测请求，收集网络设备与其所有潜在攻击设备之间交互的数据量，从而检测网络设备的DDoS攻击来源，适应更多的DDoS攻击检测场景，并提高检测DDoS攻击来源的准确度。
结合第二方面，在第二方面的某些实现方式中，所述对所述第一网络设备的DDoS攻 击的攻击检测结果包括对所述第一网络设备的DDoS攻击的攻击来源。
结合第二方面，在第二方面的某些实现方式中，所述第一网络设备为RAN，所述方法由OAM执行，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：确定所述RAN的数据异常。
结合第二方面，在第二方面的某些实现方式中，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：向所述NWDAF发送分析日常数据的请求，所述分析日常数据请求用于请求所述NWDAF分析所述RAN的日常数据；向所述NWDAF发送所述RAN的日常数据，所述RAN的日常数据用于所述NWDAF为所述RAN训练异常检测模型，所述异常检测模型用于检测所述RAN的数据是否异常。
结合第二方面，在第二方面的某些实现方式中，在所述确定所述RAN的数据异常之前，所述方法还包括：接收所述NWDAF的数据异常阈值；所述确定所述RAN的数据异常包括：根据所述数据异常阈值确定所述RAN的数据是否异常。
基于该实现方式，NWDAF通过对RAN日常数据分析得出RAN的数据异常阈值，更准确判断RAN的数据是否发生异常，以便及时向NWDAF请求DDoS攻击检测，从而解决该异常。
结合第二方面，在第二方面的某些实现方式中，在所述向所述NWDAF发送待分析数据之前，所述方法还包括：在所述RAN的数据异常时向所述NWDAF发送所述RAN的异常数据，所述异常数据用于所述NWDAF确定所述RAN是否遭受DDoS攻击。
基于该实现方式，NWDAF通过结合异常数据和异常数据检测模型在分析DDoS攻击来源前准确判断RAN是否遭受DDoS攻击，避免引起DDoS攻击检测请求的误触发。
结合第二方面，在第二方面的某些实现方式中，所述第一网络设备为AMF，所述方法由AMF执行，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：确定所述AMF的数据异常。
结合第二方面，在第二方面的某些实现方式中，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：向所述NWDAF发送所述AMF的日常数据，所述AMF的日常数据用于所述NWDAF为所述AMF训练异常检测模型，所述异常检测模型用于检测所述AMF的数据是否异常。
结合第二方面，在第二方面的某些实现方式中，在所述确定所述AMF的数据异常之前，所述方法还包括：接收所述NWDAF的数据异常阈值；所述确定所述AMF的数据异常包括：根据所述数据异常阈值确定所述AMF的数据是否异常。
基于该实现方式，NWDAF通过对AMF日常数据分析得出AMF的数据异常阈值，更准确判断AMF的数据是否发生异常，以便及时向NWDAF请求DDoS攻击检测，从而解决该异常。
结合第二方面，在第二方面的某些实现方式中，在所述向所述NWDAF发送待分析数据之前，所述方法还包括：在所述AMF的数据异常时向所述NWDAF发送所述AMF的异常数据，所述异常数据用于所述NWDAF确定所述AMF是否遭受DDoS攻击。
基于该实现方式，NWDAF通过结合异常数据和异常数据检测模型在分析DDoS攻击来源前准确判断AMF是否遭受DDoS攻击，避免引起DDoS攻击检测请求的误触发。
结合第二方面，在第二方面的某些实现方式中，所述第一网络设备为UPF，所述方法 由SMF执行，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：确定所述UPF的数据异常。
结合第二方面，在第二方面的某些实现方式中，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：向所述NWDAF发送所述UPF的日常数据，所述UPF的日常数据用于所述NWDAF为所述UPF训练异常检测模型，所述异常检测模型用于检测所述UPF的数据是否异常。
结合第二方面，在第二方面的某些实现方式中，在所述确定所述UPF的数据异常之前，所述方法还包括：接收所述NWDAF的数据异常阈值；向所述UPF发送所述数据异常阈值，所述数据异常阈值用于UPF确定所述UPF的数据是否异常；所述确定所述UPF的数据异常包括：根据所述UPF是否向所述SMF发送的数据异常信息确定所述UPF的数据是否异常。
基于该实现方式，NWDAF通过对UPF日常数据分析得出UPF的数据异常阈值，更准确判断UPF的数据是否发生异常，以便及时向NWDAF请求DDoS攻击检测，从而解决该异常。
结合第二方面，在第二方面的某些实现方式中，在所述向所述NWDAF发送待分析数据之前，所述方法还包括：在所述UPF的数据异常时向所述NWDAF发送所述UPF的异常数据，所述异常数据用于所述NWDAF确定所述UPF是否遭受DDoS攻击。
基于该实现方式，NWDAF通过结合异常数据和训练异常检测模型在分析DDoS攻击来源前准确判断UPF是否遭受DDoS攻击，避免引起DDoS攻击检测请求的误触发。
第三方面，提供了一种提供了一种DDoS攻击检测的装置，所述装置用于执行上述第一方面和第二方面提供以及第一方面和第二方面的任一可能的实现方式中的方法。具体地，所述装置可以包括用于执行第一方面和第二方面提供的方法的模块。
第四方面，提供一种DDoS攻击检测的装置，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第一方面和第二方面中任一种可能实现方式中的方法。可选地，该装置还包括存储器。可选地，该装置还包括通信接口，处理器与通信接口耦合，所述通信接口用于输入和/或输出信息。所述信息包括指令和数据中的至少一项。
在一种实现方式中，该装置为网络设备，如会话管理网元或者接入网设备。当该装置为设备时，所述通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该装置为芯片或芯片系统。当该装置为芯片或芯片系统时，所述通信接口可以是输入/输出接口可以是该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。所述处理器也可以体现为处理电路或逻辑电路。
可选地，所述收发器可以为收发电路。可选地，所述输入/输出接口可以为输入/输出电路。
第五方面，提供一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被装置执行时，使得所述装置实现第一方面和第二方面以及第一方面和第二方面的任一可能的实现方式中的方法。
第六方面，提供一种包含指令的计算机程序产品，所述指令被计算机执行时使得装置实现第一方面和第二方面提供的方法。
附图说明
图1是适用于本申请实施例的网络结构的示意图。
图2(a)和图2(b)适用于本申请实施例的两种向NWDAF发送请求分析的请求方式的示意图。
图3(a)和图3(b)适用于本申请实施例的NWDAF的两种收集数据方式的示意图。
图4是根据本申请实施例提出的DDoS攻击检测方法的示意图。
图5示出了适用于本申请一实施例的DDoS攻击检测方法的一示意图。
图6示出了适用于本申请一实施例的DDoS攻击检测方法的又一示意图。
图7示出了适用于本申请一实施例的DDoS攻击检测方法的又一示意图。
图8示出了适用于本申请一实施例的DDoS攻击检测方法的又一示意图。
图9示出了适用于本申请一实施例的DDoS攻击检测方法的再一示意图。
图10示出了适用于本申请一实施例的DDoS攻击检测方法的再一示意图。
图11是本申请实施例提供的DDoS攻击检测的装置的示意性框图。
图12是本申请实施例提供的DDoS攻击检测的设备的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
为便于理解本申请实施例，首先结合图1详细说明适用于本申请实施例的网络架构。
图1是适用于本申请实施例提供的方法的网络架构的示意图。如图1所示，该网络架构例如是第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)定义的5G系统(the 5h generation system，5GS)。该网络架构可以分为接入网(access network，AN)和核心网(core network，CN)两部分。其中，接入网可用于实现无线接入有关的功能，接入网可以包含3GPP接入网(或者说3GPP接入技术)和非第三代合作伙伴计划(non-3GPP)接入网(或者说non-3GPP接入技术)。核心网主要包括以下几个关键逻辑网元：接入和移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、用户面功能(user plane function，UPF)网元、策略控制功能(policy control function，PCF)网元和统一数据管理(unified data management，UDM)网元等。
下面对图1中示出的各网元做简单介绍：
1、用户设备(user equipment，UE)：可以称终端设备、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。
终端设备可以是一种向用户提供语音/数据连通性的设备，例如，具有无线连接功能的手持式设备、车载设备等。目前，一些终端的举例可以为：手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑(如笔记本电脑、掌上电脑等)、移动互联网设备(mobile internet device，MID)、虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无 线终端、智慧家庭(smart home)中的无线终端、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等。
此外，终端设备还可以是物联网(Internet of things，IoT)系统中的终端设备。IoT是未来信息技术发展的重要组成部分，其主要技术特点是将物品通过通信技术与网络连接，从而实现人机互连，物物互连的智能化网络。IoT技术可以通过例如窄带(narrow band)NB技术，做到海量连接，深度覆盖，终端省电。
此外，终端设备还可以包括智能打印机、火车探测器、加油站等传感器，主要功能包括收集数据(部分终端设备)、接收网络设备的控制信息与下行数据，并发送电磁波，向网络设备传输上行数据。
应理解，终端设备可以是任何可以接入网络的设备。终端设备与接入网设备之间可以采用某种空口技术相互通信。
2、接入网(access network，AN)：接入网可以为特定区域的授权用户提供入网功能，包含无线接入网(radio access network，RAN)设备和AN设备。RAN设备主要是3GPP网络无线网络设备，AN设备可以是non-3GPP定义的接入网设备。
接入网络可以为采用不同接入技术的接入网络。目前的无线接入技术有两种类型：3GPP接入技术(例如3G、4G或5G系统中采用的无线接入技术)和非3GPP(non-3GPP)接入技术。3GPP接入技术是指符合3GPP标准规范的接入技术，例如，5G系统中的接入网设备称为下一代基站节点(next generation Node Base station，gNB)或者RAN。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以无线保真(wireless fidelity，WiFi)中的接入点(access point，AP)为代表的空口技术、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)、码分多址(code division multiple access，CDMA)网络等。接入网设备(AN设备)可以允许终端设备和3GPP核心网之间采用非3GPP技术互连互通。
基于无线通信技术实现接入网络功能的接入网可以称为RAN。无线接入网能够负责空口侧的无线资源管理、服务质量(quality of service，QoS)管理、数据压缩和加密等功能。无线接入网为终端设备提供接入服务，进而完成控制信号和用户数据在终端和核心网之间的转发。
无线接入网例如可以包括但不限于：宏基站、微基站(也称为小站)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(baseband unit，BBU)，WiFi系统中的AP、无线中继节点、无线回传节点、传输点(transmission point，TP)或者发送接收点(transmission and reception point，TRP)等，还可以为5G(如，NR)系统中的gNB或传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)，或者下一代通信6G系统中的基站等。本申请实施例对无线接 入网设备所采用的具体技术和具体设备形态不做限定。
接入网可以为小区提供服务。终端设备可以通过接入网设备分配的传输资源(例如，频域资源，或者说，频谱资源)与小区通信。
3、AMF网元：主要用于移动性管理和接入管理等，如用户位置更新、用户注册网络、用户切换等。AMF还可用于实现移动性管理实体(mobility management entity，MME)中除会话管理之外的其它功能。例如，合法监听、或接入授权(或鉴权)等功能。
4、SMF网元：主要用于会话管理、UE的网际协议(Internet Protocol，IP)地址分配和管理、选择可管理用户平面功能、策略控制、或收费功能接口的终结点以及下行数据通知等。在本申请实施例中，SMF主要用户负责移动网络中的会话管理，如会话建立、修改、释放等。具体功能例如可以包括为终端设备分配IP地址、选择提供报文转发功能的UPF等。
5、UPF网元：负责终端设备中用户数据的转发和接收。UPF网元可以从数据网络(data network，DN)接收用户数据，通过接入网设备传输给终端设备。UPF网元还可以通过接入网设备从终端设备接收用户数据，转发到数据网络。UPF网元中为终端设备提供服务的传输资源和调度功能由SMF网元管理控制的。
6、数据网络(DN)：用于为用户提供数据服务的服务网络。例如，因特网(Internet)、第三方的业务网络、IP多媒体服务业务(IP multi-media service，IMS)网络等。
7、认证服务网元(authentication server function，AUSF)：主要用于用户鉴权等。
8、网络开放功能(network exposure function，NEF)网元：主要用于支持能力和事件的开放，如用于安全地向外部开放由3GPP网络功能提供的业务和能力等。
9、网络存储网元((network function(NF)repository function，NRF)：用于保存网络功能实体以及其提供服务的描述信息，以及支持服务发现，网元实体发现等。
10、PCF网元：用于指导网络行为的统一策略框架，为控制平面功能网元(例如AMF，SMF网元等)提供策略规则信息，负责获取与策略决策相关的用户签约信息等。
11、UDM网元：用于生成认证信任状，用户标识处理(如存储和管理用户永久身份等)，接入授权控制和签约数据管理等。
12、应用功能(application function，AF)网元：主要支持与3GPP核心网交互来提供服务，例如影响数据路由决策、与策略控制功能(PCF)交互、或者向网络侧提供第三方等。
13、网络切片认证和授权网元(network slice specific authentication and authorization function，NSSAAF)。
在图1所示的网络架构中，各网元之间可以通过图中所示的接口通信，部分接口可以采用服务化接口的方式实现。如图所示，UE和AMF之间可以通过N1接口进行交互，交互消息例如可以称为N1消息(N1Message)。RAN和AMF之间可以通过N2接口进行交互，N2接口可以用于非接入层(non-access stratum，NAS)消息的发送等。RAN和UPF之间可以通过N3接口进行交互，N3接口可以用于传输用户面的数据等。SMF和UPF之间可以通过N4接口进行交互，N4接口可以用于传输例如N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知消息等信息。UPF和DN之间可以通过N6接口进行交互，N6接口可以于传输用户面的数据等。其他接口与各网元之间的关系如图1中所示， 为了简洁，这里不一一详述。
应理解，上述应用于本申请实施例的网络架构仅是举例说明的从传统点到点的架构和服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
还应理解，图1中所示的AMF、SMF、UPF、网络切片选择功能网元(network slice selection function，NSSF)、NEF、AUSF、NRF、PCF、UDM可以理解为核心网中用于实现不同功能的网元，例如可以按需组合成网络切片。这些核心网网元可以各自独立的设备，也可以集成于同一设备中实现不同的功能，本申请对于上述网元的具体形态不作限定。
还应理解，上述命名仅为便于区分不同的功能而定义，不应对本申请构成任何限定。本申请并不排除在5G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。图1中的各个网元之间的接口名称只是一个示例，具体实现中接口的名称可能为其他的名称，本申请对此不作具体限定。此外，上述各个网元之间的所传输的消息(或信令)的名称也仅仅是一个示例，对消息本身的功能不构成任何限定。
为便于理解本申请实施例，首先对本申请中涉及到的术语做简单说明。
1、协议数据单元(protocol data unit，PDU)会话(PDU session)
5G核心网(5G corenet，5GC)支持PDU连接业务。PDU连接业务可以是指终端设备与DN之间交换PDU数据包的业务。PDU连接业务通过终端设备发起PDU会话的建立来实现。一个PDU会话建立后，也就是建立了一条终端设备和DN的数据传输通道。换句话说，PDU会话是UE级别的。每个终端设备可以建立一个或多个PDU会话。终端设备可以通过终端设备到DN之间建立的PDU会话，来访问DN。
2、网络数据分析功能(network data analytics function，NWDAF)
NWDAF是3GPP拟将人工智能(artificial intelligent，AI)引入5G网络，新增的一个网络功能(network function，NF)。NWDAF是一个数据感知分析网元，它以网络数据为基础对网络进行自动感知的分析，并参与到网络规划、建设、运维、网络优化、运营全生命周期中，使得网络已于维护和控制，提高网络资源使用效率，提高用户体验。具体来说，NWDAF可以从特定的网络功能(network function，NF)、网管系统(Operation Administration and Maintenance，OAM)和AF(Application Function，AF)收集特定的数据，并对该特定的数据进行智能分析得出分析结果，然后把分析结果按需发送给特定的NF、AF、OAM等。
请求NWDAF服务的消费者(NWDAF Service Consumer)可以向NWDAF请求分析，也可以向NWDAF订阅分析。
其中，请求分析是指NWDAF根据NWDAF Service Consumer在请求分析时携带的参数，向不同NF、AF和OAM收集不同时间段的数据并分析，最后将分析结果报告给NWDAF Service Consumer。订阅分析是指NWDAF根据NWDAF Service Consumer在订阅分析时携带的参数，每隔一段时间或在某个时间向不同NF、AF和OAM收集数据并分析，然后根据分析服务参数，在规定时间将分析结果报告给NWDAF Service Consumer或其他网元。
具体的，请求分析过程可分为以下两步，如图2(a)所示。
201A，NWDAF服务请求者(Service Consumer)向NWDAF发送请求分析请求。
具体地，NWDAF Service Consumer向NWDAF发送Nnwdaf_AnalyticsInfo_Request消息，向NWDAF请求分析，分析请求中包含参数如下所示。
Analytics ID(s)：用于定义分析请求的分析类型。比如网络切片分析，NF负载分析等。
时间戳：标识统计该数据的时间段。
Analytics Filter Information：指示需要报告的分析信息。比如NF标识等，用于缩小分析数据范围。
Target of Analytics Reporting：指示了分析的目标，比如一个用户设备(User Equipment，UE)、任意UE。
Analytics Reporting Information：返回的分析报告中包括的信息。具体信息如下所列。
Analytics target period：时间间隔，可以是过去时间，也可以是未来时间。过去的分析目标时间是统计信息的请求或订阅，未来的分析目标期间是预测的请求或订阅。当Analytics Reporting Parameters指示周期性报告模式时，时间间隔也可以表示为报告时间的正或负偏移，分别指示预测或统计信息的订阅。通过将开始时间和结束时间设置为相同的值，分析的使用者可以请求分析或订阅特定时间的分析，而不是一个时间间隔的分析。
Preferred level of accuracy of the analytics：指示希望的分析精确度。
Time when analytics information is needed：分析请求服务。指示分析报告的需要时间。如果到时间后，还没完成报告，会返回错误信息。
可选地，该Analytics Reporting Information参数还包括最大请求数和或请求最大用户永久标识(subscription permanent identifier，SUPI)数。
202A，NWDAF向NWDAF Service Consumer返回请求分析结果。
具体地，NWDAF通过向NWDAF Service Consumer发送Nnwdaf_AnalyticsInfo_-Request Response将分析结果报告给NWDAF Service Consumer。
订阅分析是指NWDAF Service Consumer向NWDAF订阅分析时，NWDAF可以根据分析类型和分析周期，每隔一段时间或在某个时间向不同NF和/或AF和/或OAM收集数据并分析，然后根据分析服务参数，在规定时间内将分析结果报告给NWDAF Service Consumer。具体地，该过程可分为以下两步，如图2(b)所示。
201B，NWDAF Service Consumer向NWDAF发送订阅分析请求。
具体地，NWDAF Service Consumer向NWDAF发送Nnwdaf_AnalyticsSubscrip-tion_Subscribe消息，订阅请求中除了包含与上述请求分析请求中相同的参数，还包括以下参数。
Analytics Reporting Parameters：基本报告参数，包括报告模式，最大报告数，报告持续时间，立即报告标志等。
Reporting Thresholds：返回分析结果的阈值，即达到阈值之后NWDAF会返回报告，匹配方向可以是小于阈值、大于阈值或与阈值相交，默认为与阈值相交。
Notification Target Address：指示分析结果的通知地址。
202B，NWDAF向NWDAF Service Consumer发送订阅数据结果。
具体地，NWDAF向NWDAF Service Consumer发送Nnwdaf_AnalyticsSubscription_-Notify消息，通知NWDAF Service Consumer分析结果。
NWDAF可以根据分析请求中的参数，向NF、OAM和AF收集数据。其中，NWDAF 向NF收集数据的过程如下，如图3(a)所示。
301A，NWDAF向NF发送订阅数据请求。
具体地，NWDAF向NF发送Nnf_EventExposure_Subscribe消息，向NF订阅数据，订阅消息中包含以下参数。
Event ID：指示订阅事件类型，比如UE Reachability、UE access and Mobility等
Target of Event Reporting：订阅目标，指示收集具体UE或PDU session为粒度收集数据。
Event Filter Information：事件过滤信息，比如兴趣范围(area of interest)、单网络切片选择支撑信息(single network slice selection assistance information，S-NSSAI)等，指定收集Target of Event Reporting中的哪些数据。
Event Reporting Information：事件报告信息，具体包括以下参数。
Event reporting mode：报告模式，例如最多报告数量、报告周期和定期报告、最多报告期限。
Maximum number of reports：指示事件订阅停止的最大报告数。
Maximum duration of reporting：指示事件订阅停止的最大时长。
Immediate reporting flag：事件提供者NF将订阅事件的当前状态立即通知消费者NF的标志。
Sampling ratio：受影响用户中采样比例，范围为1％..100％。
Group Reporting Guard Time：基于组的监控配置参数，表示组内UE相关的监控事件上报在发送给消费NF之前可以聚合的时间。
A Notification Target Address：订阅通知地址，指示订阅报告的通知地址。
An Expiry time：订阅超时事件，表示订阅者希望订阅保持为活动状态的时间。
302A，NF向NWDAF发送订阅数据结果。
具体地，NF向NWDAF发送Nnf_EventExposure_Notify消息，返回订阅数据。NF会根据订阅参数，每隔一段时间或收集一定数量的数据后，将数据报告给NWDAF。
NWDAF向OAM收集数据的流程如下，如图3(b)所示：
301B：NWDAF向OAM发送订阅数据请求。
302B：OAM通知NWDAF订阅成功。
303B：OAM准备数据。
304B：OAM通知NWDAF数据准备完毕，NWDAF通过文件传输协议(File Transfer Protocol，FTP)获得数据。
下面将结合附图详细介绍本申请提供的各实施例。
图4示出了适应于本申请一实施例的方法400的示意性交互图。以下结合各步骤，对方法100进行详细介绍。
401，NWDAF接收来自请求设备发送的DDoS攻击检测请求，该DDoS攻击检测请求用于请求NWDAF对第一网络设备的DDoS攻击检测。该DDoS攻击检测请求包括所述第一网络设备的信息和所述第一网络设备的潜在攻击设备的信息，所述潜在攻击设备为可能对所述第一网络设备发起DDoS攻击的设备。
可选地，所述第一网络设备为除了NWDAF以外的设备，比如RAN，AMF，UPF或 其他控制面网元。请求设备可以为第一网络设备，也可以是检测第一网络设备数据并连接第一网络设备与NWDAF的设备。比如，第一网络设备为RAN时，请求网元为OAM。又如，第一网络设备是AMF，请求设备为AMF。
应理解，该DDoS攻击检测请求可以为分析请求也可以为订阅请求。分析请求和订阅请求的具体过程如上文所述，为简洁，此处不一一赘述。
可选地，NWDAF接收来自请求设备发送的DDoS攻击检测请求之前，接收分析日常数据请求，所述分析日常数据请求用于请求对第一网络设备的日常数据进行分析。具体地，NWDAF获取该第一网络设备的日常数据，然后根据该日常数据，为第一网络设备训练异常检测模型，该异常检测模型用于检测第一设备的数据是否异常。
402，NWDAF获取待分析数据，该所述待分析数据包括所述第一网络设备与所述潜在攻击设备之间交互的数据量。
具体地，NWDAF根据第一网络设备的不同，向不同设备获取不同的待分析数据。
示例性的，当第一网络设备为RAN时，潜在攻击设备为UE、AMF、UPF。待分析包括除了RAN分别与UE、AMF、UPF之间交互的数据量，还包括与UE关联的会话的数据以及潜在攻击设备的标识信息，通过该交互的数据量和潜在攻击设备的标识信息判断RAN的DDoS攻击的攻击来源。
403，NWDAF根据所述待分析数据，检测对所述第一网络设备的DDoS攻击。
具体地，NWDAF针对不同的第一网络设备，根据收集的不同待分析数据，检测对该第一网络设备的DDoS攻击。
可选地，该方法还包括NWDAF发送攻击检测结果。具体实现中，若请求设备指定了攻击检测结果的通知对象，则NWDAF向该通知对象发送攻击检测结果，若未指出，则NWDAF将该攻击检测结果返回给请求设备。
下面将通过方法500-1000对方法400进行详细介绍。
图5示出了适用于本申请一实施例的方法500的示意性交互图。方法500主要介绍了上文所述的第一网络设备为RAN时，对RAN进行DDoS攻击检测的方案。
方法500包括以下步骤。
501，OAM确定RAN数据发生异常。
具体地，RAN每隔一段时间将自身数据主动上报给OAM，OAM通过预设阈值和RAN上报的数据确定RAN数据发生异常。
502，OAM向NWDAF发送DDoS攻击检测请求。
由于RAN与NWDAF间没有直接相连的接口，由OAM监测RAN的数据是否发生异常，在发生异常的情况下向NWDAF发送DDoS攻击检测消息，请求NWDAF对RAN进行DDoS攻击检测。
具体地，OAM通过向NWDAF发送包括参数：Analytics ID＝DDoS Attack；Target of Analytics Reporting＝any UE，any UPF and any AMF；Analytics Filter Information＝一个或多个Global RAN node ID的请求分析消息Nnwdaf_AnalyticsInfo_Request或订阅分析消息Nnwdaf_AnalyticsSubsciption_Subscribe，向NWDAF请求对RAN的DDoS攻击检测。其中，参数Target of Analytics Reporting指明若RAN受到DDoS攻击时可能的攻击来源，即潜在攻击设备。
作为一种可选的实施方式，执行步骤502之前，即在OAM向NWDAF发送DDoS攻击检测请求之前，OAM向NWDAF发送RAN的分析日常数据请求，NWDAF通过分析RAN日常数据向OAM发送分析结果，OAM通过分析结果确定RAN的数据是否发生异常。具体过程如下601-613。下面将结合图6对NWDAF分析RAN日常数据过程予以介绍。
601，OAM向NWDAF发送分析RAN的日常数据请求。
其中，OAM向NWDAF发送分析RAN的日常数据请求，该分析请求用于向NWDAF请求分析RAN的日常数据。具体地，OAM向NWDAF发送Nnwdaf_AnalyticsSubscription_Subscribe消息，该消息中包括参数：Analytics ID＝RAN Performance；Target of Analytics Reporting＝Global RAN node ID，通过参数指示NWDAF该分析请求以RAN为粒度，分析RAN的日常数据。
应理解，OAM向NWDAF发送分析RAN的日常数据请求以订阅分析的方式发送。
602，NWDAF向OAM订阅RAN的日常数据。
具体地，NWDAF根据分析请求向OAM订阅RAN的日常数据。其中，订阅的日常数据如下所示。
Global RAN Node ID：RAN的标识，用于确定数据收集的对象。
时间戳：标识统计该数据的时间段。
RAN收到来自UE的无线资源控制(radio resource control，RRC)消息的数量：在时间戳所示时间内，一个RAN收到的所有RRC消息的数量，包括RRC请求(request)消息和RRC响应(response)消息。如果UE通过RRC消息攻击RAN，来自UE的RRC消息数量会大幅增加。
数据的下行速率：对于每个RAN，数据从UPF到RAN的下行速率。如果UPF通过数据包攻击RAN，数据的下行速度会大幅度降低。
数据的上行速率：对于每个RAN，数据从UE到RAN的上行速率。如果UE通过数据包攻击RAN，数据的上行速度回大幅下降。
RAN收到来自AMF的消息数量：在时间戳所示时间内，一个RAN收到的所有来自AMF的消息数量。如果AMF通过控制面信令攻击RAN，来自AMF的消息数量会大幅增加。
RAN收到来自UE的NAS消息数量：在时间戳所示时间内，一个RAN收到的所有来自UE的非接入层(Non-Access Stratum，NAS)消息数量。如果UE通过NAS消息攻击RAN，RAN收到的NAS消息数量会大幅增加。
应理解，上述订阅的日常数据包括并不限于以上列出的数据，在以后的技术更替中，还可能出现其他的数据参数。
603，OAM向RAN订阅RAN的日常数据。
具体地，OAM基于NWDAF订阅RAN的日常数据，向RAN订阅该日常数据。
604，RAN向OAM上报RAN的日常数据。
具体地，RAN基于OAM的订阅，统计RAN的日常数据并向OAM上报。
605，OAM向NWDAF上报RAN的日常数据。
具体地，OAM向NWDAF上报RAN上报的日常数据。
606，NWDAF为RAN训练异常检测模型。
具体地，NWDAF根据来自OAM的数据，为RAN训练异常检测模型，该异常检测模型用于检测RAN的异常数据，并根据该数据计算数据发生异常的阈值，即数据异常阈值，用于当OAM或RAN统计的数据达到此阈值时，认定数据异常。
可选地，该异常检测模型可以为机器学习模型，同样用于检测RAN的异常数据，本申请对此模型名称不做限定。
607，NWDAF向OAM发送分析结果。
具体地，NWDAF将分析结果返回给OAM，分析结果包括数据异常阈值。OAM收到该分析结果后，保存该分析结果并监控RAN的数据，基于该数据异常阈值判断RAN的数据是否发生异常。
可选地，执行步骤608，OAM向RAN发送分析结果。
具体地，OAM收到分析结果后，将分析结果发送给RAN，让RAN监控自身的数据，并基于该数据异常阈值判断数据是否发生异常。
609，RAN向OAM上报RAN的日常数据。
具体地，RAN根据OAM的订阅，每隔一段时间统计数据并向OAM上报，上报不同时间段的相同类型的数据。
610，OAM向NWDAF上报RAN的日常数据。
具体地，OAM根据NWDAF的订阅，向NWDAF上报RAN的日常数据。
611，NWDAF为RAN更新异常检测模型。
具体地，NWDAF根据更新的日常数据更新异常检测模型和数据异常阈值。
612，NWDAF向OAM发送更新的分析结果。
具体地，NWDAF将更新的分析结果通知OAM，更新的分析结果包括更新的数据异常阈值。
可选地，OAM收到更新的分析结果后，执行步骤613。
613，OAM将该更新的分析结果发送给RAN让RAN监控数据并基于分析结果判断数据是否发生异常。在RAN确定数据异常的情况下，向OAM报告数据异常信息，并上报异常数据。OAM也会立即向NWDAF上报异常数据。
作为触发OAM向NWDAF发送DDoS攻击检测请求的另一种实现方式，可通过步骤503-505实现。
503，RAN确定自身数据发生异常。
具体地，RAN根据预设阈值确定自身数据发生异常。
可选的，RAN基于数据异常阈值确定自身数据发生异常。
504，RAN向OAM发送数据异常信息。
具体地，该数据异常信息包括异常数据。
505，OAM向NWDAF发送DDoS攻击检测请求。
具体地，OAM收到数据异常信息后立即向NWDAF发送DDoS攻击检测请求。
可选地，OAM向NWDAF发送DDoS攻击检测请求后，立即向NWDAF上报异常数据C或NWDAF发送DDoS攻击检测请求的同时向NWDAF上报异常数据。NWDAF根据该异常数据与RAN的异常检测模型判断RAN是否遭受DDoS攻击。
可选地，OAM向NWDAF发送DDoS攻击检测请求后，执行506-507，
506，OAM向NWDAF上报异常数据。
可选地，OAM向NWDAF发送DDoS攻击检测请求后，OAM向NWDAF立即上报自身收集的异常数据。可选地，NWDAF发送DDoS攻击检测请求的同时向NWDAF上报异常数据。
507，NWDAF根据异常数据和异常检测模型分析RAN是否遭受DDoS攻击。
508，NWDAF向OAM获取待分析数据。
具体地，NWDAF向OAM发送数据订阅请求，向OAM订阅待分析数据。该待分析数据包括RAN与其潜在攻击设备之间交互的数据量和潜在攻击来源的标识信息。NWDAF会针对不同的攻击来源收集不同的待分析数据，对于RAN的DDoS攻击，攻击来源可能来自用户面也可能来自控制面，用户面的攻击来源可以分为UE和UPF，控制面的攻击来源可以分为UE和AMF。
针对来自控制面UE的攻击，订阅的的待分析数据如下所示。
SUPI：UE的永久用户标识，用于标识发起攻击的UE。
时间戳：标识统计该数据的时间段。
收到每个UE发送的RRCSetupRequest数量：来自每个UE的RRCSetupRequest消息的数量，RRCSetupRequest用于建立UE和RAN之间的RRC连接，当UE不处于连接态时，可以使用此消息建立连接，与UE状态对比，判断UE是否发送了恶意消息。同时UE也可能通过发送大量RRCSetupRequest消息对RAN进行DDoS攻击。
收到每个UE发送的RRCResumeRequest数量：来自每个UE的RRCResumeRequest消息的数量，RRCResumeRequest用于恢复UE和RAN之间的RRC连接，当UE处于RRC inactive状态时，可以使用此消息恢复连接，与UE状态对比，判断UE是否发送了恶意消息。同时UE也可能通过发送大量RRCResumeRequest消息对RAN进行DDoS攻击。
收到每个UE发送的RRCReestablishRequest数量：来自每个UE的RRCReestablishRequest消息的数量，RRCReestablishRequest用于重新建立UE和RAN之间的RRC连接，当UE处于RRC connected状态时，UE的上下文发生了变化，导致RRC连接断开，可以使用此消息重新建立连接，与UE状态对比，判断UE是否发送了恶意消息。同时UE也可能通过发送大量RRCReestablishRequest消息对RAN进行DDoS攻击。
UE状态：UE的RRC状态，比如RRC connected或RRC inactive状态，与UE发送的RRC请求对比，判断UE是否发送了恶意消息。
收到每个UE发送的RRC响应数量：每个UE向RAN发送的RRC响应数量，与RAN向每个UE发送的RRC请求数量对比，可以判断UE是否发送了恶意响应消息。同时UE也可能通过发送大量RRC响应消息对RAN进行DDoS攻击。
向每个UE发送的RRC请求数量：RAN向每个UE发送的RRC请求数量，与每个UE向RAN发送的RRC响应数量对比，可以判断UE是否发送了恶意响应消息。
收到每个UE发送的NAS消息数量：每个UE向RAN发送的NAS消息数量，UE可能通过发送大量的NAS消息对RAN进行DDoS攻击。当DDoS攻击发生时，此数值可能会显著增加。
针对来自控制面AMF的攻击，订阅的的待分析数据如下所示。
AMF标识：用于标识发起攻击的AMF，此标识可以是AMF instance ID，也可以是5G-GUTI中的AMF identifier。
时间戳：标识统计该数据的时间段。
收到每个AMF发送的请求数量：每个AMF向RAN发送的请求消息数量，AMF可能会通过向RAN发送大量请求消息进行DDoS攻击，当攻击发起时，此数值可能会大幅度增加。
RAN向每个AMF发送的请求数量：与AMF发送的响应数量作对比，判断AMF是否发送了恶意消息。
收到每个AMF发送的响应数量：每个AMF向RAN发送的响应消息数量，AMF可能会通过向RAN发送大量响应消息进行DDoS攻击，当攻击发起时，此数值可能会大幅度增加。同时也可以和RAN向每个AMF发送的请求数量作对比，判断AMF是否发送了恶意消息。
每个RAN服务的UE数量：服务UE数量与AMF向RAN发送的请求数量呈一定的线性关系，当服务UE数量很少，但AMF向RAN发送的请求数量很多，AMF就可能存在异常。
针对来自用户面UE的攻击，订阅的的待分析数据如下所示。
SUPI：UE的永久用户标识，用于标识发起攻击的UE。
时间戳：标识统计该数据的时间段。
PDU Session ID：PDU会话标识，用于标识UE发起攻击使用的PDU会话。
每个PDU会话的上行数据流量：对于每个PDU会话，如果UE通过此PDU会话攻击RAN，那么此PDU会话的上行数据速率会很高。与从SMF收集的此类PDU会话平均上行速率作对比，判断此PDU会话上行数据是否异常。
针对来自用户面UPF的攻击，订阅的的待分析数据如下所示。
PDU Session ID：PDU会话标识，用于标识UPF发起攻击使用的PDU会话。
时间戳：标识统计该数据的时间段。
每个PDU会话的下行数据流量：对于每个PDU会话，如果UPF通过此PDU会话攻击RAN，那么此PDU会话的下行数据速率会很高。与从SMF收集的此类PDU会话平均下行速率作对比，判断此PDU会话下行数据是否异常。
509，OAM向RAN获取待分析数据。
具体地，OAM基于NWDAF对待分析数据的订阅，向RAN订阅该待分析数据。
510，RAN向OAM上报待分析数据。
具体地，RAN基于OAM的订阅，向OAM上报该待分析数据
511，OAM向NWDAF上报待分析数据。
具体地，OAM基于NAWDAF的订阅，向NWDAF上报该待分析数据。
512，NWDAF向SMF获取待分析数据。
具体地，NWDAF向SMF订阅待分析数据，该待分析数据包括与所述潜在攻击设备关联的会话的数据量和会话的标识，该待分析数据如下所示。
针对来自用户面UE的攻击，收集数据如下所示。
PDU Session ID：PDU session标识，用于标识UE发起攻击使用的PDU会话。
时间戳：标识统计该数据的时间段。
数据网络标识(data network name，DNN)和S-NSSAI：相同类型的PDU会话具有相同的DNN和S-NSSAI。
使用DNN和S-NSSAI建立的PDU Session的平均上行速率：对于使用相同DNN和S-NSSAI建立的PDU会话，SMF会统计它们的平均上行速率，与当前PDU会话的上行速率对比，判断此时PDU会话是否存在异常。
针对来自用户面UPF的攻击，收集数据如下所示
PDU Session ID：PDU会话标识，用于标识UPF发起攻击使用的PDU session。
时间戳：标识统计该数据的时间段。
DNN和S-NSSAI：相同类型的PDU session具有相同的DNN和S-NSSAI。
使用DNN和S-NSSAI建立的PDU Session的平均下行速率：对于使用相同DNN和S-NSSAI建立的PDU会话，SMF会统计它们的平均下行速率，与当前PDU会话的下行速率对比，判断此时PDU会话是否存在异常。
513，NWDAF根据待分析数据分析RAN遭受DDoS攻击的攻击来源。
具体地，NWDAF对收集的待分析数据进行分析，得出DDoS攻击的攻击来源。根据待分析数据的分类，控制面的分析具体到每个UE或每个AMF，用户面的分析具体到每个PDU session。
514，NWDAF向OAM发送分析结果。
具体地，NWDAF向OAM发送分析结果，OAM采取相应措施处理攻击。该分析结果包括以下信息。
SUPI：UE的用户标识，如果攻击是UE发起的，指示发起攻击的具体UE。
AMF instance ID：AMF实例标识，如果攻击是AMF发起的，指示发起攻击的具体AMF。
PDU Session ID：PDU会话标识，如果攻击是在用户面发起的，指示发起攻击的具体PDU会话。
Attack Level：攻击等级，指示可能存在攻击的级别。
Attack trend：攻击倾向，指示攻击发起方向，比如控制面UE或控制面AMF。
Confidence：分析可信度，对于以上分析的可信度，取决于收集数据的完善程度。
可选地，如果是用户面发起的攻击，NWDAF将分析报告报告给SMF。
基于上述方法500，当RAN的数据发生异常时，通过向NWDAF发送DDoS攻击检测请求，NWDAF向不同的网络设备或终端设备收集和分析数据，找出对RAN的DDoS攻击来源。
图7示出了适用于本申请一实施例的方法700的示意性交互图。方法700主要介绍了上文所述的第一网络设备为AMF时，对RAN进行DDoS攻击检测的方案。
方法700包括以下步骤。
701，AMF确定自身数据发生异常。
具体地，AMF通过预设阈值确定自身数据发生异常。
702，AMF向NWDAF发送DDoS攻击检测请求。
具体地，AMF监测自身数据是否发生异常，在发生异常的情况下向NWDAF发送 DDoS攻击检测消息，请求NWDAF对AMF进行DDoS攻击检测。
具体地，AMF通过向NWDAF发送包括参数：Analytics ID＝DDoS Attack；Target of Analytics Reporting＝any UE，any NF；Analytics Filter Information＝AMF instance ID的请求分析消息Nnwdaf_AnalyticsInfo_Request或订阅分析消息Nnwdaf_AnalyticsSubsciption_Subscribe，向NWDAF请求对AMF的DDoS攻击检测。其中，参数Target of Analytics Reporting指明若AMF受到DDoS攻击时可能的攻击来源，即潜在攻击设备。其中，NF包括除了AMF以外的所有控制面网元，例如SMF、PCF、UDM、NRF、NSSF、NSSAAF、NEF、NRF、AUSF，应理解，在以后的技术发展中，NF还可能包括其他的网元
作为一种可选的实施方式，执行步骤702之前，即在AMF向NWDAF发送DDoS攻击检测请求之前，AMF向NWDAF发送AMF的分析日常数据请求，NWDAF通过分析AMF日常数据向AMF发送分析结果，AMF通过分析结果确定自身数据是否发生异常。具体过程如下801-807。下面将结合图8对NWDAF分析RAN日常数据过程予以介绍。
801，AMF向NWDAF发送分析AMF的日常数据请求。
其中，AMF向NWDAF发送分析AMF的日常数据请求，该分析请求用于向NWDAF请求分析自身日常数据。具体地，OAM向NWDAF发送Nnwdaf_Analytics-Subscription_Subscribe消息，该消息中包括参数：Analytics ID＝AMF Performance；Target of Analytics Reporting＝AMF instance ID，通过参数指示NWDAF该分析请求以AMF为粒度，分析AMF的日常数据。
应理解，AMF向NWDAF发送分析AMF的日常数据请求以订阅分析的方式发送。
802，NWDAF向AMF订阅AMF的日常数据。
具体地，NWDAF根据分析请求向AMF订阅自身日常数据，相应地，AMF向NWDAF上报AMF的日常数据。其中订阅的日常数据如下所示。
AMF instance ID：AMF的标识，用于确定数据收集的对象
时间戳：包括开始时间和结束时间，用于标记收集数据的开始和结束时间。
AMF收到来自UE的注册请求消息的数量：在时间戳所示时间内，一个AMF收到的所有注册请求消息的数量，包括初始注册、周期注册、移动性注册，去注册请求。如果UE通过注册请求消息攻击AMF，来自UE的注册请求消息数量会大幅增加。
AMF收到来自UE的服务请求消息的数量：在时间戳所示时间内，一个AMF收到的所有服务请求消息的数量。如果UE通过服务请求消息攻击AMF，来自UE的服务请求消息数量会大幅增加。
AMF收到来自UE的PDU会话请求消息的数量：在时间戳所示时间内，一个AMF收到的所有PDU会话请求消息的数量，包括PDU会话建立请求，PDU会话释放请求和PDU会话修改请求。如果UE通过PDU会话请求消息攻击AMF，来自UE的PDU会话请求消息数量会大幅增加。
AMF收到来自其他NF的消息数量：在时间戳所示时间内，一个AMF收到的所有来自其他网元的消息数量，其他网元包括SMF，PCF，UDM，NRF，NSSF，NSSAAF，NEF，NRF，AUSF。如果其他网元对AMF进行攻击，来自其他网元的消息数量会大幅增加。
AMF收到来自UE的响应消息数量：在时间戳所示时间内，一个AMF收到的所有来 自UE的响应消息数量。如果UE通过响应消息攻击AMF，AMF收到的响应消息数量会大幅增加。
AMF向NWDAF发送Nnf_EventExposure_Notify消息，通知NWDAF订阅成功，并返回订阅数据。AMF会根据订阅参数，每隔一段时间或收集一定数量的数据后，将数据报告给NWDAF。
应理解，上述订阅的日常数据包括并不限于以上列出的数据，在以后的技术更替中，还可能出现其他的数据参数。
803，NWDAF为AMF训练异常数据模型。
具体地，NWDAF根据来自AMF的日常数据，为AMF训练异常检测模型，该异常检测模型用于检测AMF的异常数据，并根据该数据计算数据发生异常的阈值，即数据异常阈值，用于当AMF收集的数据达到此阈值时，认定数据异常。
可选地，该异常检测模型可以为机器学习模型，同样用于检测AMF的异常数据，本申请对此模型名称不做限定。
804，NWDAF向AMF发送分析结果。
具体地，NWDAF将分析结果返回给AMF，分析结果包括数据异常阈值。AMF收到该分析结果后，保存该分析结果并监控RAN的数据，基于该数据异常阈值判断RAN的数据是否发生异常。
805，AMF向NWDAF上报AMF的日常数据。
具体地，AMF根据NWDAF的订阅，每隔一段时间统计数据并向NWDAF上报，更新不同时间段的相同类型数据。
806，NWDAF为AMF更新异常检测模型。
具体地，NWDAF根据AMF上报的更新数据更新机器学习模型和判断异常数据的阈值。
807，NWDAF向AMF发送更新的分析结果。
具体地，NWDAF将更新的分析结果返回给AMF，该更新的分析结果包括更新的数据异常阈值。
可选地，AMF向NWDAF发送DDoS攻击检测请求后，立即向NWDAF上报异常数据或NWDAF发送DDoS攻击检测请求的同时向NWDAF上报异常数据。NWDAF根据该异常数据与RAN的异常检测模型判断RAN是否遭受DDoS攻击。若遭受DDoS攻击则继续执行步骤703，否则执行步骤705。
703，NWDAF向AMF获取待分析数据。
具体地，NWDAF向AMF发送数据订阅请求，向AMF订阅待分析数据。该待分析数据包括AMF与其潜在攻击来源之间交互的数据量。NWDAF会针对不同的攻击来源订阅不同的数据，对于AMF的DDoS攻击，攻击来源可能来自UE，也可能来自其他网元。
针对来自UE的攻击，订阅的的待分析数据如下所示。
SUPI：UE的永久用户标识，用于标识发起攻击的UE。
时间戳：标识统计该数据的时间段。
来自每个UE的注册请求消息的数量：在时间戳所示时间内，一个AMF收到的每个UE发送的注册请求消息数量，包括初始注册、周期注册、移动性注册、去注册请求。如 果一个UE通过注册请求消息攻击AMF，来自这个UE的注册请求消息数量会大幅增加。
来自每个UE的服务请求消息的数量：在时间戳所示时间内，一个AMF收到的每个UE发送的服务请求消息数量。如果一个UE通过服务请求消息攻击AMF，来自这个UE的服务请求消息数量会大幅增加。
来自每个UE的PDU会话请求消息的数量：在时间戳所示时间内，一个AMF收到的每个UE发送的PDU会话请求消息数量，包括PDU会话建立请求、PDU会话释放请求和PDU会话修改请求。如果一个UE通过PDU会话请求消息攻击AMF，来自这个UE的PDU会话请求消息数量会大幅增加。
来自每个UE的响应消息的数量：在时间戳所示时间内，一个AMF收到的每个UE发送的响应消息数量。如果一个UE通过响应消息攻击AMF，来自这个UE的响应消息数量会大幅增加。同时，与AMF向每个UE发送的请求消息数量对比，可以判断UE是否发送了恶意响应消息。
AMF向每个UE发送的请求消息数量：与来自每个UE的响应消息数量做对比，判断UE是否发送了恶意响应消息。
针对来自其他NF的攻击。订阅的的待分析数据如下所示。
NF instance ID：网元实例标识，指示具体哪个网元向AMF发起攻击。
时间戳：标识统计该数据的时间段。
每个NF向AMF发送的请求消息数量：在时间戳所示时间内，每个NF向此AMF发送的请求消息数量。如果NF通过请求消息对AMF发起攻击，来自NF的请求消息数量会大幅增加。
每个NF向AMF发送的响应消息数量：在时间戳所示时间内，每个NF向此AMF发送的响应消息数量。如果NF通过响应消息对AMF进行攻击，来自NF的响应消息数量会大幅增加。同时与AMF向每个NF发送的请求消息数量作对比，判断此NF是否发送了恶意消息。
AMF向每个NF发送的请求消息数量：在时间戳所示时间内，AMF向每个NF发送的请求消息数量。与每个NF发送的响应消息数量作对比，判断此NF是否发送了恶意响应消息。
704，NWDAF根据待分析数据分析AMF遭受DDoS攻击的攻击来源。
具体地，NWDAF通过对收集的数据进行分析，分析对AMF的具体攻击来源。根据收集数据的分类，针对UE的分析具体到每个UE，针对NF攻击分析具体分析到每个NF实例。
705，NWDAF向AMF发送分析结果。
具体地，NWDAF向AMF发送分析报告后，AMF采取相应措施处理异常情况。其中，该分析报告包括：
SUPI：UE的永久用户标识，如果攻击是UE发起的，指示发起攻击的具体UE。
NF instance ID：网元实例标识，如果攻击是NF发起的，指示发起攻击的具体NF
Attack level：攻击等级，指示可能存在攻击的级别。
Attack trend：攻击倾向，指示攻击发起方向，比如控制面UE或控制面AMF。
Confidence：分析可信度，对于以上分析的可信度，取决于收集数据的完善程度。
在本申请实施例中，当除了AMF以外的其他控制面网元的数据发生异常时，其DDoS攻击的检测方法可参考上述方法700。与上述方法700中有所不同的是，其他控制面网元的潜在攻击设备为除了该其他控制面网元以外的其他控制面网元。其他控制面网元为SMF、PCF、UDM、NRF、NSSF、NSSAAF、NEF、NRF、AUSF。示例性地，当SMF数据发生异常时，其潜在攻击设备为AMF、PCF、UDM、NRF、NSSF、NSSAAF、NEF、NRF、AUSF。
图9示出了适用于本申请一实施例的方法900的示意性交互图。方法900主要介绍了上文所述的第一网络设备为UPF时，对UPF进行DDoS攻击检测的方案。
方法900包括以下步骤。
901，UPF确定自身数据发生异常。
具体地，UPF通过预设阈值确定自身数据发生异常。
902，UPF向SMF发送数据异常信息。
具体地，UPF向SMF报告数据异常信息，该数据异常信息包括异常数据。
903，SMF向NWDAF发送DDoS攻击检测请求。
由于UPF与NWDAF间没有直接相连的接口，由SMF监测UPF的数据是否发生异常，在发生异常的情况下向NWDAF发送DDoS攻击检测请求消息，请求NWDAF对UPF进行DDoS攻击检测。
具体地，SMF通过向NWDAF发送包括请求参数：Analytics ID＝DDoS Attack；Target of Analytics Reporting＝any UE，any AF；Analytics Filter Information＝UPF instance ID的请求分析消息Nnwdaf_AnalyticsInfo_Request或订阅分析消息Nnwdaf_AnalyticsSubsciption_Subscribe，向NWDAF请求对UPF的DDoS攻击检测。其中，参数Target of Analytics Reporting指明若UPF受到DDoS攻击时可能的攻击来源，即潜在攻击设备。
作为一种可选的实施方式，执行步骤903之前，即在SMF向NWDAF发送DDoS攻击检测请求之前，SMF向NWDAF发送UPF的分析日常数据请求，NWDAF通过分析UPF日常数据向UPF发送分析结果，UPF通过分析结果确定自身数据是否发生异常。具体过程如下1001-1011。下面将结合图10对NWDAF分析UPF日常数据过程予以介绍。
1001，SMF向NWDAF发送分析UPF的日常数据请求。
其中，SMF向NWDAF发送分析UPF的日常数据请求，该分析请求用于向NWDAF请求分析UPF的日常数据。具体地，OAM向NWDAF发送订阅分析消息Nnwdaf_AnalyticsSubscription_Subscribe，该消息中包括参数：Analytics ID＝UPF Performance；Target of Analytics Reporting＝UPF instance ID，通过参数指示NWDAF该分析请求以UPF为粒度，分析UPF的日常数据。
应理解，SMF向NWDAF发送分析UPF的日常数据请求以订阅分析的方式发送。
1002，NWDAF向SMF订阅UPF的日常数据。
具体地，NWDAF根据分析请求向SMF订阅关于UPF的日常数据。其中，请求的日常数据如下所示。
UPF instance ID：UPF的标识，用于确定数据收集的对象。
时间戳：包括开始时间和结束时间，用于标记收集数据的开始和结束时间。
UPF的数据下行速率：对于每个UPF，数据从AF到UPF的下行速率。如果AF通过数据包攻击UPF，数据的下行速率会大幅度降低。
UPF的数据上行速率：对于每个UPF，数据从UE到UPF的上行速率。如果UE通过数据包攻击UPF，数据的上行速率会大幅度降低。
1003，SMF向UPF订阅UPF的日常数据。
具体地，SMF基于NWDAF的数据请求，向UPF订阅该日常数据。相应地，UPF向SMF上报UPF的日常数据。具体地，UPF基于SMF的订阅，统计自身的日常数据并向SMF上报。
1004，SMF向NWDAF上报UPF的日常数据。
具体地，SMF向NWDAF上报UPF上报的日常数据。
1005，NWDAF为UPF训练异常检测模型。
具体地，NWDAF根据来自SMF的数据，为UPF训练异常检测模型，该异常检测模型用于检测RAN的异常数据，并根据该数据计算数据发生异常的阈值，即数据异常阈值，用于当OAM或RAN统计的数据达到此阈值时，认定数据异常。
可选地，该异常检测模型可以为机器学习模型，同样用于检测RAN的异常数据，本申请对此模型名称不做限定。
1006，NWDAF向SMF发送分析结果。
具体地，NWDAF将分析结果返回给SMF，分析结果包括判断异常数据的阈值。
1007，SMF向UPF发送分析结果。
具体地，SMF收到分析结果后，将分析结果发送给UPF，让UPF监控数据并基于分析结果判断数据异常。
1008，UPF向SMF上报UPF的日常数据。
具体地，UPF根据SMF的订阅，每隔一段时间统计数据并向SMF上报，更新不同时间段的相同类型数据。
1009，SMF向NWDAF上报UPF的日常数据。
1010，NWDAF更新异常检测模型。
具体地，NWDAF根据更新的数据更新异常检测模型和数据异常阈值。
1011，NWDAF向SMF发送更新的分析结果。
具体地，NWDAF将更新的分析结果通知SMF，更新的分析结果包括更新的阈值。
1012，SMF向UPF发送更新的分析结果。
具体地，SMF将更新的分析结果发送至UPF，使UPF基于该分析结果检测自身数据是否发生异常。
可选地，SMF向NWDAF发送DDoS攻击检测请求后，立即向NWDAF上报UPF上报的异常数据或NWDAF发送DDoS攻击检测请求的同时向NWDAF上报该异常数据。NWDAF根据该异常数据与UPF的异常检测模型判断UPF是否遭受DDoS攻击。若遭受DDoS攻击则继续执行步骤904，否则执行步骤908。
904，NWDAF向SMF获取待分析数据。
具体地，NWDAF向SMF发送数据订阅请求，向SMF订阅待分析数据。该待分析数据包括UPF与潜在攻击对象之间与会话关联的数据量、UPF与潜在攻击对象之间与会话 参数关联的数据量、以及攻击对象的标识信息。其中SMF向UPF收集上述UPF与潜在攻击对象之间与会话关联的数据量，SMF收集上述UPF与潜在攻击对象之间与会话参数关联的数据量。
具体实现中，NWDAF会针对不同的攻击来源订阅不同的数据，对于UPF的DDoS攻击，攻击来源可能来自UE，也可能来自AF。
针对来自UE的攻击，收集的待分析数据如下所示。
PDU Session ID：PDU会话标识，用于标识UE发起攻击使用的PDU会话。
时间戳：标识统计该数据的时间段。
DNN和S-NSSAI：相同类型的PDU会话具有相同的DNN和S-NSSAI。
每个PDU Session的上行速率：对于每个PDU会话，如果UE通过此PDU会话攻击RAN，那么此PDU会话的上行数据速率会很高。与从SMF收集的此类PDU会话平均上行速率作对比，判断此PDU会话上行数据是否异常。
使用DNN和S-NSSAI建立的PDU Session的平均上行速率：对于使用相同DNN和S-NSSAI建立的PDU会话，SMF会统计它们的平均上行速率，与当前PDU会话的上行速率对比，判断此时PDU会话是否存在异常。
针对来自AF的攻击，收集的待分析数据如下所示。
PDU Session ID：PDU会话标识，用于标识UPF发起攻击使用的PDU会话
时间戳：标识统计该数据的时间段。
DNN和S-NSSAI：相同类型的PDU会话具有相同的DNN和S-NSSAI
每个PDU Session的下行速率：对于每个PDU会话，如果AF通过此PDU会话攻击RAN，那么此PDU会话的下行数据速率会很高。与从SMF收集的此类PDU会话平均下行速率作对比，判断此PDU会话下行数据是否异常。
使用DNN和S-NSSAI建立的PDU Session的平均下行速率：对于使用相同DNN和S-NSSAI建立的PDU会话，SMF会统计它们的平均下行速率，与当前PDU会话的下行速率对比，判断此时PDU会话是否存在异常。
905，SMF向UPF获取待分析数据。
具体地，SMF基于NWDAF的订阅，向UPF收集每个PDU Session的下行速率和每个PDU Session的上行速率，其余参数都由SMF统计。相应地，UPF向SMF上报每个PDU Session的下行速率和每个PDU Session的上行速率。
906，SMF向NWDAF上报待分析数据。
具体地，SMF向NWDAF上报来自UPF的待分析数据为每个PDU Session的下行速率和每个PDU Session的上行速率和SMF自身收集的其他待分析数据。
907，NWDAF根据待分析数据分析UPF遭受DDoS攻击的攻击来源。
具体地，NWDAF对待分析数据进行分析得到UPF遭受DDoS攻击的攻击来源。根据收集数据的分类，针对UE的分析具体到每个PDU Session，针对AF的分析具体到每个PDU session。
908，NWDAF向SMF发送分析报结果。
具体地，NWDAF向SMF发送分析报结果，SMF根据该分析结果采取相应措施处理异常情况。其中，该分析报告包括如下所示的参数。
SUPI：UE的用户标识，如果攻击是UE发起的，指示发起攻击的具体UE。
PDU Session ID：PDU会话标识，指示发起攻击的具体PDU会话。
Attack Level：攻击等级，指示可能存在攻击的级别。
Attack trend：攻击倾向，指示攻击发起方向，比如控制面UE或控制面AMF。
Confidence：分析可信度，对于以上分析的可信度，取决于收集数据的完善程度。
本申请提出的方法除了适用于上述介绍的单个网络设备的DDoS攻击检测，同样适应于多个网络设备，即某种网络设备集合的DDoS攻击检测。具体过程可参考方法700。为了简洁，下面将以网络设备集合为AMF集合为例，针对与方法700的不同之处对该DDoS攻击检测方法进行简单介绍。
当OAM发现AMF集合(set)的数据发生异常时，向NWDAF发送发送DDoS攻击检测请求。具体地，OAM监测AMF set数据是否发生异常，在发生异常的情况下向NWDAF发送DDoS攻击检测消息，请求NWDAF对AMF set进行DDoS攻击检测。其中，该请求消息携带的参数Analytics Filter Information为AMF set instance ID。
作为一种可选的实施方式，在OAM向NWDAF发送DDoS攻击检测请求之前，OAM向NWDAF发送AMF set的分析日常数据请求，NWDAF通过分析AMF set的日常数据向OAM发送分析结果，OAM通过分析结果确定AMF set是否发生异常。具体过程参照801-807。
NWDAF根据向AMF set中每一个AMF订阅的待检测数据，分析AMF set的DDoS攻击的攻击来源，将分析结果发送给OAM，OAM根据该分析结果采取相应措施处理异常情况。
在本申请实施例中，当除了AMF set以外的其他控制面网元集合的数据发生异常时，其DDoS攻击的检测方法也可参考上述方法。与上述方法有所不同的是，其他控制面网元集合的潜在攻击设备为除了该其他控制面网元以外的其他控制面网元。其他控制面网元为SMF、PCF、UDM、NRF、NSSF、NSSAAF、NEF、NRF、AUSF。示例性地，当SMF set数据发生异常时，其潜在攻击设备为AMF、PCF、UDM、NRF、NSSF、NSSAAF、NEF、NRF、AUSF。
图11是本申请实施例提供的DDoS攻击检测的装置1100的示意性框图。如图所示，该装置1100可以包括：收发单元1110和处理单元1120。
在一种可能的设计中，该装置1100可以是上文方法实施例中的NWDAF，也可以是用于实现上文方法实施例中NWDAF的功能的芯片。
应理解，该通信装置1100可对应于根据本申请实施例的方法400至方法1000中的会话管理网元，该通信装置1100可以包括用于执行图4中的方法400、图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900和图10中的方法1000中的NWDAF执行的方法的单元。并且，该装置1100中的各单元和上述其他操作和/或功能分别为了实现图4中的方法400、图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900和图10中的方法1000的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该装置1100可以是上文方法实施例中的网络设备如RAN、 AMF、SMF、UPF、OAM，也可以是用于实现上文方法实施例中网络设备的功能的芯片。
应理解，该装置1100可对应于根据本申请实施例的方法400至方法1000中的网络设备，该装置1100可以包括用于执行图4中的方法400、图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900和图10中的方法1000中的网络设备执行的方法的单元。并且，该装置1100中的各单元和上述其他操作和/或功能分别为了实现图4中的方法400、图5中的方法500、图6中的方法600、图7中的方法700、图8中的方法800、图9中的方法900和图10中的方法1000的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
还应理解，该装置1100中的收发单元1110可对应于图12中示出的设备1200中的收发器1220，该装置1100中的处理单元1120可对应于图12中示出的设备1200中的处理器1210。
还应理解，当该通信装置1100为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
收发单元1110用于实现装置1100的信号的收发操作，处理单元1120用于实现通信装置1100的信号的处理操作。
可选地，该通信装置1100还包括存储单元1130，该存储单元1130用于存储指令。
图12是本申请实施例提供一种DDoS攻击检测的设备1200。如图所示，该设备1200包括：至少一个处理器1210和收发器1220。该处理器1210与存储器耦合，用于执行存储器中存储的指令，以控制收发器1220发送信号和/或接收信号。可选地，该设备1200还包括存储器1230，用于存储指令。
应理解，上述处理器1210和存储器1230可以合成一个处理装置，处理器1210用于执行存储器1230中存储的程序代码来实现上述功能。具体实现时，该存储器1230也可以集成在处理器1210中，或者独立于处理器1210。
还应理解，收发器1220可以包括接收器(或者称，接收机)和发射器(或者称，发射机)。收发器1220还可以进一步包括天线，天线的数量可以为一个或多个。收发器1220有可以是通信接口或者接口电路。
当该设备1200为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
本申请实施例还提供了一种处理装置，包括处理器和接口。所述处理器可用于执行上述方法实施例中的方法。
应理解，上述处理装置可以是一个芯片。例如，该处理装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
本申请实施例还提供一种计算机可读存储介质，其上存储有用于实现上述方法实施例中由NWDAF执行的方法的计算机指令。
例如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法实施例中由NWDAF执行的方法。
本申请实施例还提供一种计算机可读存储介质，其上存储有用于实现上述方法实施例中由OAM，SMF，AMF执行的方法的计算机指令。
例如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法实施例中由OAM，SMF，AMF执行的方法。
本申请实施例还提供一种计算机可读存储介质，其上存储有用于实现上述方法实施例中由NWDAF执行的方法的计算机指令。
例如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法实施例中由NWDAF执行的方法。
本申请实施例还提供一种包含指令的计算机程序产品，该指令被计算机执行时使得该计算机实现上述方法实施例中由OAM，SMF，AMF执行的方法，或由OAM，SMF，AMF执行的方法，或由NWDAF执行的方法。
所属领域的技术人员可以清楚地了解到，为描述方便和简洁，上述提供的任一种通信装置中相关内容的解释及有益效果均可参考上文提供的对应的方法实施例，此处不再赘述。
本申请实施例并未对本申请实施例提供的方法的执行主体的具体结构进行特别限定，只要能够通过运行记录有本申请实施例提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可。例如，本申请实施例提供的方法的执行主体可以是终端设备或网络设备，或者，是终端设备或网络设备中能够调用程序并执行程序的功能模块。
本申请的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本文中使用的术语“制品”可以涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。
其中，计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。可用介质(或者说计算机可读介质)例如可以包括但不限于：磁性介质或磁存储器件(例如，软盘、硬盘(如移动硬盘)、磁带)、光介质(例如，光盘、压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)、智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)、或者半导体介质(例如固态硬盘(solid state disk，SSD)等、U盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)等各种可以存储程序代码的介质。
本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读 介质。术语“机器可读介质”可以包括但不限于：无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
应理解，本申请实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)。例如，RAM可以用作外部高速缓存。作为示例而非限定，RAM可以包括如下多种形式：静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)可以集成在处理器中。
还需要说明的是，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅是示意性的，例如，上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。此外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元实现本申请提供的方案。
另外，在本申请各个实施例中的各功能单元可以集成在一个单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。
当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。例如，计算机可以是个人计算机，服务器，或者网络设备等。计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。关于计算机可读存储介质，可以参考上文描述。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (36)

  1. 一种分布式拒绝服务DDoS攻击检测的方法，其特征在于，包括：
    接收DDoS攻击检测请求，所述DDoS攻击检测请求用于请求对第一网络设备的DDoS攻击检测，所述DDoS攻击检测请求包括所述第一网络设备的信息和潜在攻击设备的信息，所述潜在攻击设备为可能对所述第一网络设备发起DDoS攻击的设备；
    获取待分析数据，所述待分析数据包括所述第一网络设备与所述潜在攻击设备之间交互的数据量；
    根据所述待分析数据，检测对所述第一网络设备的DDoS攻击。
  2. 根据权利要求1所述的方法，其特征在于，所述对所述第一网络设备的DDoS攻击的攻击检测结果包括对所述第一网络设备的DDoS攻击的攻击来源。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：发送所述攻击检测结果。
  4. 根据权利要求1或2所述的方法，其特征在于，所述第一网络设备为无线接入网RAN设备，所述接收DDoS攻击检测请求，包括：
    接收来自操作、管理和维护OAM所述DDoS攻击检测请求；
    所述获取待分析数据，包括：
    向所述OAM发送数据订阅请求；
    接收来自所述OAM所述RAN与所述潜在攻击设备之间交互的数据量；
    向所述会话管理网元SMF发送数据订阅请求；
    接收来自所述SMF的与所述潜在攻击设备关联的会话的数据量。
  5. 根据权利要求4所述的方法，其特征在于，在所述接收DDoS攻击检测请求之前，所述方法还包括：
    接收来自所述OAM的分析日常数据请求，所述分析日常数据请求用于请求对所述RAN的日常数据进行分析；
    获取所述RAN的日常数据；
    根据所述RAN的日常数据，为所述RAN训练异常检测模型，所述异常检测模型用于检测所述RAN的数据是否异常。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    根据所述RAN的日常数据，确定数据异常阈值，所述数据异常阈值用于确定所述RAN的数据是否异常。
  7. 根据权利要求5或6所述的方法，其特征在于，所述获取待分析数据之前，所述方法还包括：
    接收来自所述OAM的所述RAN的异常数据；
    根据所述异常数据和所述异常检测模型确定所述RAN是否遭受DDoS攻击；
    其中，在确定所述RAN遭受DDoS攻击时获取所述待分析数据。
  8. 根据权利要求1或2所述的方法，其特征在于，所述第一网络设备为移动性管理网元AMF，所述接收DDoS攻击检测请求，包括：
    接收来自所述AMF的所述DDoS攻击检测请求；
    所述获取待分析数据，包括：
    接收来自所述AMF的所述待分析数据。
  9. 根据权利要求8所述的方法，其特征在于，在所述接收DDoS攻击检测请求之前，所述方法还包括：
    接收来自所述AMF的分析日常数据请求，所述分析日常数据请求用于请求对所述AMF的日常数据进行分析；
    获取所述AMF的日常数据；
    根据所述AMF的日常数据，为所述AMF训练异常检测模型，所述异常检测模型用于检测所述AMF的数据是否异常。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    根据所述AMF的日常数据，确定数据异常阈值，所述数据异常阈值用于所述AMF确定所述AMF的数据是否异常。
  11. 根据权利要求9或10所述的方法，其特征在于，所述获取待分析数据之前，所述方法还包括：
    接收来自所述AMF的所述AMF的异常数据；
    根据所述异常数据和所述异常检测模型确定所述AMF是否遭受DDoS攻击；
    其中，在确定所述AMF遭受DDoS攻击时获取所述待分析数据。
  12. 根据权利要求1或2所述的方法，其特征在于，所述第一网络设备为用户面网元UPF，所述接收DDoS攻击检测请求，包括：
    接收来自SMF的所述DDoS攻击检测请求；
    所述获取待分析数据，包括：
    向所述SMF发送数据订阅请求；
    接收来自所述SMF的与所述潜在攻击对象之间与会话关联的数据量以及潜在攻击对象之间与会话参数关联的数据量。
  13. 根据权利要求12所述的方法，其特征在于，在所述接收DDoS攻击检测请求之前，所述方法还包括：
    接收来自所述SMF的分析日常数据请求，所述分析日常数据请求用于请求对所述UPF的日常数据进行分析；
    获取所述UPF的日常数据；
    根据所述UPF的日常数据，为所述UPF训练异常检测模型，所述异常检测模型用于检测所述UPF的数据是否异常。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    根据所述UPF的日常数据，确定数据异常阈值，所述数据异常阈值用于所述UPF确定所述UPF的数据是否异常。
  15. 根据权利要求13或14所述的方法，其特征在于，所述获取待分析数据之前，所述方法还包括：
    接收来自所述SMF的所述UPF的异常数据；
    根据所述异常数据和所述异常检测模型确定所述UPF是否遭受DDoS攻击；
    其中，在确定所述UPF遭受DDoS攻击时获取所述待分析数据。
  16. 根据权利要求1或2所述的方法，其特征在于，所述DDoS攻击检测请求用于请求对所述第一网络设备的集合的DDoS攻击检测，所述接收DDoS攻击检测请求，包括：
    接收来自所述OAM的所述DDoS攻击检测请求；
    所述获取待分析数据，包括：
    接收来自所述第一网络设备的集合中的每一个所述网络设备的所述待分析数据。
  17. 根据权利要求16所述的方法，其特征在于，在所述接收DDoS攻击检测请求之前，所述方法还包括：
    接收来自所述OAM的分析日常数据请求，所述分析日常数据请求用于请求对所述第一网络设备集合的日常数据进行分析；
    获取所述第一网络设备的集合的日常数据；
    根据所述第一网络设备的集合的日常数据，为所述第一网络设备的集合训练异常检测模型，所述异常检测模型用于检测所述第一网络设备的集合的数据是否异常。
  18. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    根据所述第一网络设备的集合的日常数据，确定数据异常阈值，所述数据异常阈值用于第一网络设备的集合确定所述第一网络设备的集合的数据是否异常。
  19. 根据权利要求17或18所述的方法，其特征在于，所述获取待分析数据之前，所述方法还包括：
    接收来自所述OAM的第一网络设备的集合的异常数据；
    根据所述异常数据和所述异常检测模型确定第一网络设备的集合是否遭受DDoS攻击；
    其中，在确定第一网络设备的集合遭受DDoS攻击时获取所述待分析数据。
  20. 一种DDoS攻击检测的方法，其特征在于，包括：
    向NWDAF发送DDoS攻击检测请求，所述DDoS攻击检测请求用于请求对所述第一网络设备的DDoS攻击检测，所述DDoS攻击检测请求包括所述第一网络设备的信息和所述第一网络设备的潜在攻击设备的信息，所述潜在攻击设备为可能对所述第一网络设备发起DDoS攻击的网元；
    接收来自所述NWDAF的获取待分析数据请求；
    根据所述请求收集所述待分析数据；
    向所述NWDAF发送所述待分析数据，所述待分析数据包括所述第一网络设备与所述潜在攻击设备之间交互的数据量，所述待分析数据用于检测对所述第一网络设备的DDoS攻击。
  21. 根据权利要求20所述的方法，其特征在于，所述对所述第一网络设备的DDoS攻击的攻击检测结果包括对所述第一网络设备的DDoS攻击的攻击来源。
  22. 根据权利要求20或21所述的方法，其特征在于，所述第一网络设备为RAN，所述方法由OAM执行，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：确定所述RAN的数据异常。
  23. 根据权利要求22所述的方法，其特征在于，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：
    向所述NWDAF发送分析日常数据的请求，所述分析日常数据请求用于请求所述NWDAF分析所述RAN的日常数据；
    向所述NWDAF发送所述RAN的日常数据，所述RAN的日常数据用于所述NWDAF为所述RAN训练异常检测模型，所述异常检测模型用于检测所述RAN的数据是否异常。
  24. 根据权利要求23所述的方法，其特征在于，在所述确定所述RAN的数据异常之前，所述方法还包括：
    接收来自所述NWDAF的数据异常阈值；
    所述确定所述RAN的数据异常包括：
    根据所述数据异常阈值确定所述RAN的数据是否异常。
  25. 根据权利要求23或24所述的方法，其特征在于，在所述向所述NWDAF发送待分析数据之前，所述方法还包括：
    在所述RAN的数据异常时向所述NWDAF发送所述RAN的异常数据，所述异常数据用于所述NWDAF确定所述RAN是否遭受DDoS攻击。
  26. 根据权利要求20或21所述的方法，其特征在于，所述第一网络设备为AMF，所述方法由AMF执行，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：
    确定所述AMF的数据异常。
  27. 根据权利要求26所述的方法，其特征在于，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：
    向所述NWDAF发送所述AMF的日常数据，所述AMF的日常数据用于所述NWDAF为所述AMF训练异常检测模型，所述异常检测模型用于检测所述AMF的数据是否异常。
  28. 根据权利要求27所述的方法，其特征在于，在所述确定所述AMF的数据异常之前，所述方法还包括：
    接收来自所述NWDAF的数据异常阈值；
    所述确定所述AMF的数据异常包括：
    根据所述数据异常阈值确定所述AMF的数据是否异常。
  29. 根据权利要求27或28所述的方法，其特征在于，在所述向所述NWDAF发送待分析数据之前，所述方法还包括：
    在所述AMF的数据异常时向所述NWDAF发送所述AMF的异常数据，所述异常数据用于所述NWDAF确定所述AMF是否遭受DDoS攻击。
  30. 根据权利要求20或21所述的方法，其特征在于，所述第一网络设备为UPF，所述方法由OAM执行，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：
    确定所述UPF的数据异常。
  31. 根据权利要求30所述的方法，其特征在于，在所述向NWDAF发送DDoS攻击检测请求之前，所述方法还包括：
    向所述NWDAF发送所述UPF的日常数据，所述UPF的日常数据用于所述NWDAF为所述UPF训练异常检测模型，所述异常检测模型用于检测所述UPF的数据是否异常。
  32. 根据权利要求31所述的方法，其特征在于，在所述确定所述UPF的数据异常之前，所述方法还包括：
    接收来自所述NWDAF的数据异常阈值；
    向所述UPF发送所述数据异常阈值，所述数据异常阈值用于UPF确定所述UPF的数据是否异常；
    所述确定所述UPF的数据异常包括：
    根据所述数据异常阈值确定所述UPF的数据是否异常。
  33. 根据权利要求31或32所述的方法，其特征在于，在所述向所述NWDAF发送待分析数据之前，所述方法还包括：
    在所述UPF的数据异常时向所述NWDAF发送所述UPF的异常数据，所述异常数据用于所述NWDAF确定所述UPF是否遭受DDoS攻击。
  34. 一种DDoS攻击检测的装置，其特征在于，包括用于实现如权利要求1至33中任一项所述的方法的单元。
  35. 一种DDoS攻击检测的装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机指令，以使得所述装置执行：如权利要求1至33中任一项所述的方法。
  36. 一种计算机可读存储介质，其特征在于，其上存储有计算机程序，所述计算机程序被计算机执行时，以使得实现如权利要求1至33中任一项所述的方法。
PCT/CN2022/076605 2021-02-21 2022-02-17 DDoS攻击检测的方法和装置 WO2022174780A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110194841.0 2021-02-21
CN202110194841.0A CN114978559A (zh) 2021-02-21 2021-02-21 DDoS攻击检测的方法和装置

Publications (1)

Publication Number Publication Date
WO2022174780A1 true WO2022174780A1 (zh) 2022-08-25

Family

ID=82932120

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/076605 WO2022174780A1 (zh) 2021-02-21 2022-02-17 DDoS攻击检测的方法和装置

Country Status (2)

Country Link
CN (1) CN114978559A (zh)
WO (1) WO2022174780A1 (zh)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110519802A (zh) * 2018-05-21 2019-11-29 华为技术有限公司 一种数据处理方法、发送方法及装置
CN111770490A (zh) * 2019-04-02 2020-10-13 电信科学技术研究院有限公司 一种确定终端行为分析的方法和设备

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110519802A (zh) * 2018-05-21 2019-11-29 华为技术有限公司 一种数据处理方法、发送方法及装置
CN111770490A (zh) * 2019-04-02 2020-10-13 电信科学技术研究院有限公司 一种确定终端行为分析的方法和设备

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on security aspects of enablers for Network Automation (eNA) for the 5G system (5GS) Phase 2; (Release 17)", 3GPP STANDARD; TECHNICAL REPORT; 3GPP TR 33.866, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. V0.3.0, 29 January 2021 (2021-01-29), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , pages 1 - 16, XP051999428 *
"Subject Index^*", SURGERY, MOSBY, INC., US, vol. 138, no. 6, 1 December 2005 (2005-12-01), US , pages 1214 - 1230, XP005208323, ISSN: 0039-6060, DOI: 10.1016/S0039-6060(05)00759-2 *

Also Published As

Publication number Publication date
CN114978559A (zh) 2022-08-30

Similar Documents

Publication Publication Date Title
US10849122B2 (en) Cache-based data transmission methods and apparatuses
WO2020073855A1 (zh) 建立会话的方法和装置以及发送报文的方法和装置
US9386617B2 (en) Discovery and operation of hybrid wireless wide area and wireless local area networks
US20220345929A1 (en) Apparatus and method for psa-upf relocation in wireless communication system
KR20200039295A (ko) 5g 이동 통신 시스템에서 네트워크 분석 정보를 활용한 효율적 mico 모드 관리 방법
US20240171647A1 (en) Method and apparatus for discovering edge application server
US11855864B2 (en) Method and apparatus for collecting network traffic in wireless communication system
US20220256396A1 (en) Congestion control method and apparatus
KR20210054923A (ko) 이동통신 네트워크에서 rfsp 인덱스 선택을 위한 네트워크 분석 정보 제공하는 방법 및 장치
US11558813B2 (en) Apparatus and method for network automation in wireless communication system
US20230142002A1 (en) Communication Method and Apparatus
WO2022237778A1 (zh) 异常检测的方法、通信装置及通信系统
US20230132454A1 (en) Method and apparatus for supporting edge computing service for roaming ue in wireless communication system
WO2023060409A1 (zh) 感知控制方法、装置、设备、系统及存储介质
WO2022174780A1 (zh) DDoS攻击检测的方法和装置
WO2023078183A1 (zh) 一种数据收集方法及通信装置
WO2023060408A1 (zh) 感知数据的收集方法、装置、设备、系统及存储介质
WO2023202503A1 (zh) 通信方法和装置
WO2023083153A1 (zh) 获取安全分级结果的方法及通信装置
WO2023213112A1 (zh) 通信方法和装置
WO2023197772A1 (zh) 一种通信方法及相关装置
US20240155325A1 (en) Information obtaining method and apparatus, and system
WO2024092677A1 (zh) 漫游场景下传输数据的方法、装置及可读存储介质
WO2022214094A1 (zh) 一种网络切换方法和装置
WO2024000166A1 (zh) 感知数据提供方法、装置、设备、存储介质及程序产品

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22755553

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22755553

Country of ref document: EP

Kind code of ref document: A1