WO2023207984A1

WO2023207984A1 - Behavior processing method and apparatus, and terminal, network-side device and medium

Info

Publication number: WO2023207984A1
Application number: PCT/CN2023/090602
Authority: WO
Inventors: 张鹏飞; 吕华章; 康艳超
Original assignee: 维沃移动通信有限公司
Priority date: 2022-04-27
Filing date: 2023-04-25
Publication date: 2023-11-02
Also published as: CN117014922A

Abstract

Disclosed in the present application are a behavior processing method and apparatus, and a terminal, a network-side device and a medium. The behavior processing method in the embodiments of the present application comprises: a terminal receiving target information from a network-side device, wherein the target information includes an analysis result of an abnormal behavior of the terminal; and the terminal making a decision regarding a behavior of the terminal on the basis of the target information.

Description

Behavior processing method, device, terminal, network side equipment and medium

Cross-references to related applications

This application claims priority from Chinese Patent Application No. 202210459394.1 filed in China on April 27, 2022, the entire content of which is incorporated herein by reference.

Technical field

This application belongs to the field of communication technology, and specifically relates to a behavior processing method, device, terminal, network side equipment and medium.

Background technique

Currently, the terminal can select and/or establish a corresponding PDU session for the application's traffic based on the traffic characteristics associated with the application. However, after selecting and/or establishing a PDU session, the terminal may experience some abnormal behavior on the PDU session. How to intelligently handle the abnormal behavior of the terminal to select and/or establish an appropriate PDU session has become an urgent problem. The problem.

Contents of the invention

Embodiments of the present application provide a behavior processing method, device, terminal, network side device and medium, which can solve the problem of how to intelligently process abnormal behavior of the terminal to select and/or establish an appropriate PDU session.

In the first aspect, a behavior processing method is provided. The method includes: a terminal receiving target information from a network side device, where the target information includes an analysis result of the terminal's abnormal behavior; and the terminal makes a decision on the terminal's behavior based on the target information.

In a second aspect, a behavior processing device is provided. The device includes: a receiving module for receiving target information from a network side device, where the target information includes analysis results of abnormal behavior of the terminal; a decision-making module for based on the target information, Make decisions about the behavior of the terminal.

In the third aspect, a behavior processing method is provided, which method includes: the network side device analyzes the behavior of the terminal; the network side device sends target information to the terminal, and the target information includes the analysis results of the terminal's abnormal behavior.

In a fourth aspect, a behavior processing device is provided. The device includes: an analysis module for analyzing the behavior of the terminal; and a sending module for sending target information to the terminal, where the target information includes analysis results of the terminal's abnormal behavior. .

In a fifth aspect, a terminal is provided. The terminal includes a processor and a memory. The memory stores programs or instructions that can be run on the processor. When the program or instructions are executed by the processor, the following implementations are implemented: The steps of the method described in one aspect.

In a sixth aspect, a terminal is provided, including a processor and a communication interface, wherein the communication interface is used to receive target information from a network side device, where the target information includes analysis results of abnormal behavior of the terminal, and the processor is used to Based on the target information, make decisions on the behavior of the terminal.

In a seventh aspect, a network side device is provided. The network side device includes a processor and a memory. The memory stores programs or instructions that can be run on the processor. The program or instructions are executed by the processor. When implementing the steps of the method described in the third aspect.

In an eighth aspect, a network side device is provided, including a processor and a communication interface, wherein the processor is used to analyze the behavior of the terminal, and the communication interface is used to send target information to the terminal, where the target information includes the terminal Analysis results of abnormal behavior.

A ninth aspect provides a communication system, including: a terminal and a network side device. The terminal can be used to perform the steps of the behavior processing method as described in the first aspect. The network side device can be used to perform the steps of the behavior processing method as described in the third aspect. The steps of the behavioral processing method.

In a tenth aspect, a readable storage medium is provided. Programs or instructions are stored on the readable storage medium. When the programs or instructions are executed by a processor, the steps of the method described in the first aspect are implemented, or the steps of the method are implemented as described in the first aspect. The steps of the method described in the third aspect.

In an eleventh aspect, a chip is provided. The chip includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the method described in the first aspect. method, or implement a method as described in the third aspect.

In a twelfth aspect, a computer program/program product is provided, the computer program/program product is stored in a storage medium, and the computer program/program product is executed by at least one processor to implement as described in the first aspect The steps of behavioral processing method.

In the embodiment of this application, the network side device can detect and analyze the behavior of the terminal, and then send the analysis result of the terminal's abnormal behavior to the terminal. After receiving the analysis result sent by the network side device, the terminal can perform the analysis according to the analysis result. , make decisions on the behavior of the terminal. Through this solution, the terminal can make decisions on the terminal's behavior based on the analysis results of the terminal's abnormal behavior by the network-side device, so that the terminal can handle the terminal's abnormal behavior more intelligently and accurately based on the assistance of the network.

Description of the drawings

Figure 1 is a schematic architectural diagram of a communication system provided by an embodiment of the present application;

Figure 2 is a schematic diagram of a behavior processing method provided by an embodiment of the present application;

Figure 3 is one of the structural schematic diagrams of a behavior processing device provided by an embodiment of the present application;

Figure 4 is the second structural schematic diagram of a behavior processing device provided by an embodiment of the present application;

Figure 5 is a schematic diagram of the hardware structure of a communication device provided by an embodiment of the present application;

Figure 6 is a schematic diagram of the hardware structure of a terminal provided by an embodiment of the present application;

FIG. 7 is a schematic diagram of the hardware structure of a network-side device provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly described below with reference to the accompanying drawings in the embodiments of the present application. However, the described embodiments are part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art fall within the scope of protection of this application.

The terms "first", "second", etc. in the description and claims of this application are used to distinguish similar objects and are not used to describe a specific order or sequence. It is to be understood that the terms so used are interchangeable under appropriate circumstances so that the embodiments of the present application can be practiced in sequences other than those illustrated or described herein, and that "first" and "second" are distinguished objects It is usually one type, and the number of objects is not limited. For example, the first object can be one or multiple. In addition, "and/or" in the description and claims indicates at least one of the connected objects, and the character "/" generally indicates that the related objects are in an "or" relationship.

It is worth pointing out that the technology described in the embodiments of this application is not limited to Long Term Evolution (LTE)/LTE Evolution (LTE-Advanced, LTE-A) systems, and can also be used in other wireless communication systems, such as code Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access, OFDMA), Single-carrier Frequency Division Multiple Access (SC-FDMA) and other systems. The terms "system" and "network" in the embodiments of this application are often used interchangeably, and the described technology can be used not only for the above-mentioned systems and radio technologies, but also for other systems and radio technologies. The following description describes a New Radio (NR) system for example purposes, and NR terminology is used in much of the following description, but these techniques can also be applied to applications other than NR system applications, such as 6th ^generation Generation, 6G) communication system.

Figure 1 shows a block diagram of a wireless communication system to which embodiments of the present application are applicable. The wireless communication system includes a terminal 11 and a network side device 12. The terminal 11 may be a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer), or a notebook computer, a personal digital assistant (Personal Digital Assistant, PDA), a palmtop computer, a netbook, or a super mobile personal computer. (ultra-mobile personal computer, UMPC), mobile Internet device (Mobile Internet Device, MID), augmented reality (AR)/virtual reality (VR) equipment, robots, wearable devices (Wearable Device) , vehicle-mounted equipment (VUE), pedestrian terminal (PUE), smart home (home equipment with wireless communication functions, such as refrigerators, TVs, washing machines or furniture, etc.), game consoles, personal computers (PC), teller machines or self-service Terminal devices such as mobile phones, wearable devices include: smart watches, smart bracelets, smart headphones, smart glasses, smart jewelry (smart bracelets, smart bracelets, smart rings, smart necklaces, smart anklets, smart anklets, etc.), Smart wristbands, smart clothing, etc. It should be noted that the embodiment of the present application does not limit the specific type of the terminal 11. The network side device 12 may include an access network device or a core network device, where the access network device 12 may also be called a radio access network device, a radio access network (Radio Access Network, RAN), a radio access network function or Wireless access network unit. The access network device 12 may include a base station, a WLAN access point or a WiFi node, etc. The base station may be called a Node B, an evolved Node B (eNB), an access point, a Base Transceiver Station (BTS), a radio Base station, radio transceiver, Basic Service Set (BSS), Extended Service Set (ESS), Home Node B, Home Evolved Node B, Transmitting Receiving Point (TRP) or all some other appropriate term in the field described, as long as To achieve the same technical effect, the base station is not limited to specific technical terms. It should be noted that in the embodiment of this application, only the base station in the NR system is used as an example for introduction, and the specific type of the base station is not limited. Core network equipment may include but is not limited to at least one of the following: core network nodes, core network functions, mobility management entities (Mobility Management Entity, MME), access mobility management functions (Access and Mobility Management Function, AMF), session management functions (Session Management Function, SMF), User Plane Function (UPF), Policy Control Function (PCF), Policy and Charging Rules Function (PCRF), Edge Application Service Discovery function (Edge Application Server Discovery Function, EASDF), Unified Data Management (UDM), Unified Data Repository (UDR), Home Subscriber Server (HSS), centralized network configuration ( Centralized network configuration (CNC), Network Repository Function (NRF), Network Exposure Function (NEF), Local NEF (Local NEF, or L-NEF), Binding Support Function (Binding Support Function, BSF), application function (Application Function, AF), etc. It should be noted that in the embodiment of this application, only the core network equipment in the NR system is used as an example for introduction, and the specific type of the core network equipment is not limited.

Some concepts and/or terms involved in the behavioral processing methods provided by the embodiments of this application are explained below.

Currently, in the 3rd generation partnership project (3GPP) protocol, NWDAF is introduced to perform some intelligent analysis. NWDAF has certain intelligent analysis functions. It collects some data and uses built-in algorithms and analysis capabilities to analyze and obtain results, which are provided to 5G core network elements to perform some operational optimization or statistical analysis.

For example, the network data analytics function (NWDAF) can provide an observation service experience analysis function by collecting the quality of service (QoS) information of the terminal accessing a certain server, such as the uplink rate or Downlink rate, packet loss rate, etc., and output a statistical information, which includes the user experience of the terminal accessing the server; alternatively, NWDAF can predict based on the historical experience of the terminal accessing the server, for example, in a certain time period in the future In a certain area, if the terminal accesses the server, what is the user experience (such as QoS situation) that the terminal may obtain.

Usually, the analysis content and/or prediction content that NWDAF can provide are distinguished by analysis IDs. By sending different analysis IDs and some parameters to NWDAF, NWDAF can provide corresponding analysis results and/or predictions. result. For example, if analytic ID=Service Experience, NWDAF provides observation service experience analysis. Therefore, as long as you obtain the network element of the NWDAF service and enter the analytic ID when requesting analysis or prediction, NWDAF can provide the corresponding analysis results and/or prediction results. The analysis or prediction results corresponding to the analytic ID that NWDAF can currently provide are shown in Table 1.

Table 1 Analysis identification and corresponding analysis results

For example, for different analytics IDs, NWDAF can provide the following performance analysis:

For analytics ID="Service Experience" or analytics ID="WLAN performance", NWDAF can provide the performance of the access method, for example, the performance of 3GPP access (such as 4G access and 5G access) or non-3GPP access (such as WLAN access) performance; wherein, the performance of this access method includes: the uplink rate or downlink rate after using this access method, the packet loss rate after using this access method, and the reference signal after using this access method Received power (reference signal received power, RSRP), reference signal received quality (reference signal received quality, RSRQ), received signal strength indicator (received signal strength indicator, RSSI), etc.

For analytics ID="Load level information" or analytics ID="Service Experience", NWDAF can provide the performance of the slice, for example, the load status of the currently used slice or the service experience of the currently used slice; where, the performance of the currently used slice The load situation includes: the resource usage of the currently used slice, the load level of the currently used slice, etc.; the service experience of the currently used slice includes: the uplink rate or downlink rate after using the slice, and the packet loss rate after using the slice. , the delay after using this slice, etc.

For analytics ID="Service Experience" or analytics ID="DN Performance", NWDAF can provide the performance of the DN, such as the average uplink rate or average downlink rate when accessing a certain DN, the packet loss rate when accessing a certain DN, and the average when accessing a certain DN. The packet delay of a DN, the maximum packet delay of accessing a certain DN, etc.

For analytics ID="UE Mobility", NWDAF can provide location analysis of the terminal, for example, the start and end time of the terminal at a certain location, the stay interval of the terminal at a certain location, etc.

The technical solutions provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings through some embodiments and their application scenarios.

An embodiment of the present application provides a behavior processing method. Figure 2 shows a flow chart of a behavior processing method provided by an embodiment of the present application. As shown in Figure 2, the behavior processing method provided by the embodiment of the present application includes the following steps 201 to 204.

Step 201: The network side device analyzes the behavior of the terminal.

In the embodiment of this application, the network side device can detect and analyze the behavior of the terminal, and then send the analysis result of the terminal's abnormal behavior to the terminal. After receiving the analysis result sent by the network side device, the terminal can, based on the analysis result, Make decisions about the behavior of the terminal, so as to handle abnormal behavior of the terminal more intelligently and accurately.

It should be noted that in the embodiment of the present application, the network side device may be a NWDAF, or may be other network elements with the same function or type, which is not limited in the embodiment of the present application.

Optionally, in the embodiment of this application, in one case, the network side device can detect and analyze the behavior of the terminal after receiving the request message from the terminal. In another case, the network-side device automatically detects and analyzes whether the terminal has abnormal behavior without requesting it from the terminal.

Step 202: The network side device sends target information to the terminal.

In this embodiment of the present application, the above target information includes analysis results of abnormal behavior of the terminal.

Optionally, in this embodiment of the present application, when the network side device determines that the terminal has abnormal behavior, the network side device may send target information to the terminal.

Optionally, in this embodiment of the present application, the above target information may include analysis results of the terminal's historical behavior, and may also include prediction results of the terminal's future performance.

Optionally, in this embodiment of the present application, the analysis results of the abnormal behavior of the terminal include at least one of the following: exception ID (except ID), traffic description information, protocol data unit (PDU) session ID, target unit Network slice selection assistance information (single network slice selection assistance information, S-NSSAI), target data network name (DNN) information, target QoS parameters, periodic time (periodic time), scheduled communication time (scheduled communication time) , scheduled communication type, communication duration time, traffic profile, expected transaction dispersion.

Wherein, the above-mentioned anomaly identification is used to indicate a risk detected by the network-side device, and the risk includes at least one of the following: unexpected long-live/large rate flows, suspected distributed Distributed denial of service (DDoS) attack (suspicion of DDoS attack), too frequent Service access (too frequent service access);

The above traffic description information includes at least one of the following: application descriptors, Internet protocol (IP) descriptors (IP descriptors), domain name descriptors (domain descriptors), non-IP descriptors (non-IP descriptors), DNN, connection capabilities.

Optionally, in this embodiment of the present application, the above-mentioned application descriptor may include an operating system identifier (operating system identifier, OS ID) and an operating system application identifier (OS application identifier, OS APP ID). The above-mentioned IP descriptor can be a destination IP triplet (IP address or IPv6 network prefix, port number, protocol ID of a protocol above IP) or IP five-tuple information. The above domain name descriptor can be a fully qualified domain name (Fully Qualified Domain Name, FQDN) used as a domain name matching condition. The above-mentioned non-IP descriptor may be source information and/or destination information of non-IP traffic. The above-mentioned DNN is a data network accessed or connected by application traffic. The above connection capabilities match the information provided by the application when requesting a network connection with certain capabilities.

Optionally, in this embodiment of the present application, the DNN in the above traffic description information may be a characteristic description of abnormal traffic.

Optionally, in this embodiment of the present application, the target S-NSSAI may be the S-NSSAI recommended for use by the network side device, or may be the S-NSSAI corresponding to abnormal traffic. The above target QoS parameters may be QoS parameters recommended for use by network-side devices, or may be QoS parameters corresponding to abnormal traffic. The above target DNN information can be the DNN recommended for network-side devices, or it can be the DNN corresponding to abnormal traffic. Specifically, it can be determined according to actual usage requirements, and is not limited by the embodiments of this application.

It should be noted that if the target DNN information is the DNN corresponding to the abnormal traffic, the target DNN information and the DNN content in the traffic description information are the same, but the sending form is different. In other words, the network side device can send DNN directly to the terminal, or it can send DNN in the form of traffic description.

Step 203: The terminal receives target information from the network side device.

Step 204: The terminal makes decisions on the behavior of the terminal based on the target information.

It can be understood that in the embodiment of the present application, the behavior of the terminal is first detected and analyzed through the network side device to obtain the analysis result of the abnormal behavior of the terminal, and then the terminal can judge the behavior of the terminal again based on the analysis result to determine the behavior of the terminal. Handle abnormal terminal behavior.

Embodiments of the present application provide a behavior processing method. The network side device can detect and analyze the behavior of the terminal, and then send the analysis results of the terminal's abnormal behavior to the terminal. After receiving the analysis results sent by the network side device, the terminal can Based on the analysis results, decisions are made on the behavior of the terminal. Through this solution, the terminal can make decisions on the terminal's behavior based on the analysis results of the terminal's abnormal behavior by the network-side device, so that the terminal can handle the terminal's abnormal behavior more intelligently and accurately based on the assistance of the network.

Optionally, in this embodiment of the present application, before the above-mentioned step 201, the behavior processing method provided by the embodiment of the present application further includes the following steps 301 and 302.

Step 301: The terminal sends a first message to the network side device.

Wherein, the above-mentioned first message includes an abnormal behavior identifier, and the above-mentioned abnormal behavior identifier is used to request analysis or prediction of whether abnormal behavior occurs in the terminal.

It can be understood that the above target information is the analysis result corresponding to the abnormal behavior identification.

Step 302: The network side device receives the first message sent by the terminal.

Optionally, in this embodiment of the present application, the above step 204 can be specifically implemented through the following steps 204a and 204b.

Step 204a: If it is determined that the behavior of the terminal is abnormal based on the target information, the terminal performs the target operation.

Step 204b: If it is determined that the behavior of the terminal is normal based on the target information, the terminal ignores the target information.

In the embodiment of this application, the terminal can determine whether the terminal's behavior is abnormal based on the target information. If it is determined that the terminal's behavior is abnormal, the terminal performs the target operation. If it is determined that the terminal's behavior is normal, the terminal ignores the target information.

For example, assuming that the above risks include unexpected long duration/large rate traffic, if the terminal determines that the unexpected long duration/large rate traffic is normal operation, the target information is ignored.

Normally, when the network side device discovers abnormal behavior of the terminal, the network side device will independently handle the abnormal behavior of the terminal. Compared with the network side device independently processing the abnormal behavior of the terminal, in the embodiment of the present application, the network side device can analyze the abnormal behavior of the terminal, and then the terminal makes decisions on the terminal's behavior based on the analysis results of the network side device. , so that the abnormal behavior of the terminal can be handled more intelligently and accurately.

Optionally, in this embodiment of the present application, the analysis results of the abnormal behavior of the terminal include traffic description information.

The above target operations include any of the following:

Release the PDU session carrying the data packet corresponding to the traffic description information;

Initiate the modification process of the PDU session carrying the data packet corresponding to the traffic description information;

It is not allowed to establish a PDU session for the data packet corresponding to the traffic description information;

The terminal discards or ignores the uplink or downlink data packets corresponding to the traffic description information.

Optionally, in this embodiment of the present application, the analysis result of the abnormal behavior of the terminal includes a PDU session identifier.

The above target operations include any of the following:

Release the PDU session corresponding to the PDU session ID;

Initiate the modification process of the PDU session corresponding to the PDU session identifier;

The establishment of a PDU session corresponding to the PDU session identifier is not allowed;

Among them, the above-mentioned PDU session is a PDU session carrying abnormal traffic.

Optionally, in this embodiment of the present application, the analysis results of the abnormal behavior of the terminal also include at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information.

The above process of modifying the PDU session corresponding to the initiated PDU session identifier includes at least one of the following:

If the analysis results include target QoS parameters, modify the Qos parameters in the PDU session to the target QoS parameters;

If the analysis result includes the target S-NSSAI, modify the S-NSSAI in the PDU session to the target S-NSSAI;

When the analysis result includes target DNN information, modify the DNN information in the PDU session to the target DNN information.

In the embodiment of this application, the target S-NSSAI is the S-NSSAI recommended by the network side device, the target QoS parameter is the QoS parameter recommended by the network side device, and the target DNN information is the DNN recommended by the network side device.

It can be understood that the terminal can modify certain parameters in the PDU session to parameters recommended by the network side device, so that an appropriate PDU session can be intelligently and accurately selected and/or established.

Optionally, in the embodiment of the present application, when the analysis result of the abnormal behavior of the terminal includes at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information, the above target operation is not allowed to establish the target information. The corresponding PDU session.

In the embodiment of this application, the target S-NSSAI is the S-NSSAI corresponding to the abnormal traffic, the target QoS parameter is the QoS parameter corresponding to the abnormal traffic, and the target DNN information is the DNN corresponding to the abnormal traffic.

It can be understood that since the target information is information corresponding to abnormal traffic, the terminal is not allowed to establish a PDU session corresponding to the target information, so that an appropriate PDU session can be intelligently and accurately selected and/or established.

Optionally, in this embodiment of the present application, the above target operation is to set the session management (session management, SM) back-off timer (SM back-off timer).

Among them, the terminal is not allowed to initiate a service request before the expiration of the session management backoff timer.

Optionally, in the embodiment of this application, the terminal can set the SM back-off timer using default parameters; or, the terminal can set the SM back-off timer according to the target information (such as cycle time).

For the behavior processing method provided by the embodiments of this application, the execution subject may be a behavior processing device. In the embodiments of this application, a behavior processing device executing a behavior processing method is used as an example to illustrate the behavior processing device provided in the embodiments of this application.

An embodiment of the present application provides a behavior processing device, which is applied to a terminal. As shown in Figure 3, the behavior processing device 500 includes: a receiving module 501 and a decision-making module 502. Among them, the receiving module 501 is used to receive target information from the network side device, where the target information includes the analysis results of the abnormal behavior of the terminal. The decision-making module 502 is used to make decisions on the behavior of the terminal based on the target information.

Optionally, in this embodiment of the present application, the above-mentioned behavior processing device 500 further includes: a sending module. The sending module is configured to send the first message to the network side device before the receiving module 501 receives the target information from the network side device. Wherein, the above-mentioned first message includes an abnormal behavior identifier, and the abnormal behavior identifier is used to request analysis or prediction of whether abnormal behavior occurs in the terminal.

Optionally, in this embodiment of the present application, the above-mentioned decision-making module 502 is specifically configured to perform the target operation when it is determined that the behavior of the terminal is abnormal based on the target information; when it is determined that the behavior of the terminal is normal based on the target information, ignore the target. information.

Optionally, in this embodiment of the application, the above analysis results include at least one of the following: exception identification, traffic description information, PDU session identification, target S-NSSAI, target DNN information, target QoS parameters, cycle time, scheduled communication time, Scheduled communication type, communication duration, traffic profile, expected business dispersion.

Wherein, the above-mentioned abnormality identification is used to indicate the risk detected by the network-side device, and the risk includes at least one of the following: unexpected long duration/large rate traffic, suspected DDoS attack, and too frequent service access. The above traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, Connectivity.

Optionally, in this embodiment of the present application, the above analysis results include traffic description information.

The above target operations include any of the following:

Optionally, in this embodiment of the present application, the above analysis results include a PDU session identifier.

The above target operations include any of the following:

Release the PDU session corresponding to the PDU session ID;

Among them, the PDU session is a PDU session carrying abnormal traffic.

Optionally, in this embodiment of the present application, the above analysis results also include at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information.

Optionally, in this embodiment of the present application, when the analysis result includes at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information, the above target operation is to not allow the establishment of a PDU session corresponding to the target information.

Optionally, in this embodiment of the present application, the above target operation is to set a session management backoff timer.

Embodiments of the present application provide a behavior processing device that can make decisions on the behavior of the terminal based on the analysis results of the abnormal behavior of the terminal by the network side device, so that the terminal can more intelligently and accurately respond to the abnormal behavior of the terminal based on the assistance of the network. for processing.

A behavior processing device provided by an embodiment of the present application is applied to network side equipment. As shown in Figure 4, the behavior processing device 600 includes: an analysis module 601 and a sending module 602. Among them, the analysis module 601 is used to analyze the behavior of the terminal. The sending module 602 is configured to send target information to the terminal, where the target information includes the analysis results of the abnormal behavior of the terminal.

Optionally, in this embodiment of the present application, the above-mentioned behavior processing device 600 further includes: a receiving module. The receiving module is configured to receive the first message sent by the terminal before the analysis module 601 analyzes the behavior of the terminal. Among them, the above-mentioned One message includes an abnormal behavior identifier, which is used to request analysis or predict whether abnormal behavior occurs on the terminal.

Optionally, in this embodiment of the application, the above analysis results include at least one of the following: exception identification, traffic description information, PDU session identification, target S-NSSAI, target DNN information, target QoS parameters, cycle time, scheduled communication time, Scheduled communication type, communication duration, traffic profile, expected business dispersion;

Wherein, the above-mentioned abnormality identification is used to indicate the risk detected by the network-side device, and the risk includes at least one of the following: unexpected long duration/large rate traffic, suspected DDoS attack, and too frequent service access. The above traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connection capability.

Embodiments of the present application provide a behavior processing device that can analyze the behavior of a terminal and send analysis results of the terminal's abnormal behavior to the terminal, so that the terminal can make decisions about the behavior of the terminal based on the analysis results, so that the terminal can Network-based assistance handles abnormal terminal behavior more intelligently and accurately.

The behavior processing device in the embodiment of the present application may be an electronic device, such as an electronic device with an operating system, or may be a component in the electronic device, such as an integrated circuit or chip. The electronic device may be a terminal or other devices other than the terminal. For example, terminals may include but are not limited to the types of terminals 11 listed above, and other devices may be servers, network attached storage (Network Attached Storage, NAS), etc., which are not specifically limited in the embodiment of this application.

The behavior processing device provided by the embodiment of the present application can implement each process implemented by the method embodiment in Figure 2 and achieve the same technical effect. To avoid duplication, the details will not be described here.

Optionally, as shown in Figure 5, this embodiment of the present application also provides a communication device 700, which includes a processor 701 and a memory 702. The memory 702 stores programs or instructions that can be run on the processor 701, such as , when the communication device 700 is a terminal, when the program or instruction is executed by the processor 701, each step of the above behavior processing method embodiment is implemented, and the same technical effect can be achieved. When the communication device 700 is a network-side device, when the program or instruction is executed by the processor 701, each step of the above behavior processing method embodiment is implemented, and the same technical effect can be achieved. To avoid duplication, the details will not be described here.

Embodiments of the present application also provide a terminal, including a processor and a communication interface. The communication interface is used to receive target information from a network side device. The target information includes analysis results of abnormal behaviors of the terminal. The processor is used to perform analysis on the terminal based on the target information. behavior decisions. This terminal embodiment corresponds to the above-mentioned terminal-side method embodiment. Each implementation process and implementation manner of the above-mentioned method embodiment can be applied to this terminal embodiment, and can achieve the same technical effect. Specifically, FIG. 6 is a schematic diagram of the hardware structure of a terminal that implements an embodiment of the present application.

The terminal 800 includes but is not limited to: a radio frequency unit 801, a network module 802, an audio output unit 803, an input unit 804, a sensor 805, a display unit 806, a user input unit 807, an interface unit 808, a memory 809, a processor 810, etc. At least some parts.

Those skilled in the art can understand that the terminal 800 may also include a power supply (such as a battery) that supplies power to various components. The power supply may be logically connected to the processor 810 through a power management system, thereby managing charging, discharging, and power consumption through the power management system. Management and other functions. The terminal structure shown in Figure 6 does not constitute a limitation on the terminal. The terminal can include It may include more or fewer components than those shown in the figures, or combine certain components, or arrange different components, which will not be described again here.

It should be understood that in the embodiment of the present application, the input unit 804 may include a graphics processing unit (Graphics Processing Unit, GPU) 8041 and a microphone 8042. The graphics processor 8041 is responsible for the image capture device (GPU) in the video capture mode or the image capture mode. Process the image data of still pictures or videos obtained by cameras (such as cameras). The display unit 806 may include a display panel 8061, which may be configured in the form of a liquid crystal display, an organic light emitting diode, or the like. The user input unit 807 includes a touch panel 8071 and at least one of other input devices 8072 . Touch panel 8071, also known as touch screen. The touch panel 8071 may include two parts: a touch detection device and a touch controller. Other input devices 8072 may include but are not limited to physical keyboards, function keys (such as volume control keys, switch keys, etc.), trackballs, mice, and joysticks, which will not be described again here.

In this embodiment of the present application, after receiving downlink data from the network side device, the radio frequency unit 801 can transmit it to the processor 810 for processing; in addition, the radio frequency unit 801 can send uplink data to the network side device. Generally, the radio frequency unit 801 includes, but is not limited to, an antenna, amplifier, transceiver, coupler, low noise amplifier, duplexer, etc.

Memory 809 may be used to store software programs or instructions as well as various data. The memory 809 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, Image playback function, etc.) etc. Additionally, memory 809 may include volatile memory or non-volatile memory, or memory 809 may include both volatile and non-volatile memory. Among them, non-volatile memory can be read-only memory (Read-Only Memory, ROM), programmable read-only memory (Programmable ROM, PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electrically removable memory. Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory. Volatile memory can be random access memory (Random Access Memory, RAM), static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDRSDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synch link DRAM) , SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DRRAM). Memory 809 in embodiments of the present application includes, but is not limited to, these and any other suitable types of memory.

The processor 810 may include one or more processing units; optionally, the processor 810 integrates an application processor and a modem processor, where the application processor mainly handles operations related to the operating system, user interface, application programs, etc., Modem processors mainly process wireless communication signals, such as baseband processors. It can be understood that the above modem processor may not be integrated into the processor 810.

Among them, the radio frequency unit 801 is used to receive target information from the network side device, where the target information includes the analysis results of the abnormal behavior of the terminal. The processor 810 is used to make decisions on the behavior of the terminal based on the target information.

Optionally, in this embodiment of the present application, the radio frequency unit 801 is also configured to send the first message to the network side device before receiving the target information from the network side device. The first message is used to request analysis or prediction of whether abnormal behavior occurs in the terminal.

Optionally, in this embodiment of the present application, the processor 810 is specifically configured to determine abnormal behavior of the terminal based on the target information. If the behavior of the terminal is determined to be normal based on the target information, the target information is ignored.

Embodiments of the present application also provide a network side device, including a processor and a communication interface. The processor is used to analyze the behavior of the terminal, and the communication interface is used to send target information to the terminal. The target information includes the analysis results of the terminal's abnormal behavior. . This network-side device embodiment corresponds to the above-mentioned network-side device method embodiment. Each implementation process and implementation manner of the above-mentioned method embodiment can be applied to this network-side device embodiment, and can achieve the same technical effect.

An embodiment of the present application also provides a network side device. As shown in Figure 7, the network side device 900 includes: a processor 901, a network interface 902 and a memory 903. The network interface 902 is, for example, a common public radio interface (CPRI).

Specifically, the network side device 900 in this embodiment of the present invention also includes: instructions or programs stored in the memory 903 and executable on the processor 901. The processor 901 calls the instructions or programs in the memory 903 to execute each of the steps shown in Figure 4. The method of module execution and achieving the same technical effect will not be described in detail here to avoid duplication.

Embodiments of the present application also provide a readable storage medium. Programs or instructions are stored on the readable storage medium. When the program or instructions are executed by a processor, each process of the above behavioral processing method embodiment is implemented, and the same can be achieved. The technical effects will not be repeated here to avoid repetition.

Wherein, the processor is the processor in the terminal described in the above embodiment. The readable storage medium includes computer readable storage media, such as computer read-only memory ROM, random access memory RAM, magnetic disk or optical disk, etc.

An embodiment of the present application further provides a chip. The chip includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the above behavior processing method embodiment. Each process can achieve the same technical effect. To avoid duplication, it will not be described again here.

It should be understood that the chips mentioned in the embodiments of this application may also be called system-on-chip, system-on-a-chip, system-on-chip or system-on-chip, etc.

Embodiments of the present application further provide a computer program/program product. The computer program/program product is stored in a storage medium. The computer program/program product is executed by at least one processor to implement the above behavioral processing method embodiment. Each process can achieve the same technical effect. To avoid repetition, we will not go into details here.

Embodiments of the present application also provide a communication system, including: a terminal and a network side device. The terminal can be used to perform the steps of the behavior processing method as described above. The network side device can be used to perform the behavior processing as described above. Method steps.

It should be noted that, in this document, the terms "comprising", "comprises" or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or device that includes a series of elements not only includes those elements, It also includes other elements not expressly listed or inherent in the process, method, article or apparatus. Without further limitation, an element defined by the statement "comprises a..." does not exclude the presence of additional identical elements in a process, method, article or apparatus that includes that element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, but may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved. Execution functions, for example, can be pressed differently than The described methods are performed in the order described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is better. implementation. Based on this understanding, the technical solution of the present application can be embodied in the form of a computer software product that is essentially or contributes to the existing technology. The computer software product is stored in a storage medium (such as ROM/RAM, disk , CD), including several instructions to cause a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in various embodiments of this application.

The embodiments of the present application have been described above in conjunction with the accompanying drawings. However, the present application is not limited to the above-mentioned specific implementations. The above-mentioned specific implementations are only illustrative and not restrictive. Those of ordinary skill in the art will Inspired by this application, many forms can be made without departing from the purpose of this application and the scope protected by the claims, all of which fall within the protection of this application.

Claims

A behavioral approach that includes:

The terminal receives target information from the network side device, where the target information includes analysis results of abnormal behavior of the terminal;

The terminal makes a decision on the behavior of the terminal based on the target information.
The method according to claim 1, wherein before the terminal receives the target information from the network side device, the method further includes:

The terminal sends a first message to the network side device;

Wherein, the first message includes an abnormal behavior identifier, and the abnormal behavior identifier is used to request analysis or prediction of whether abnormal behavior occurs in the terminal.
The method according to claim 1, wherein the terminal makes decisions on the behavior of the terminal based on the target information, including:

If it is determined that the behavior of the terminal is abnormal based on the target information, the terminal performs a target operation;

If it is determined that the behavior of the terminal is normal based on the target information, the terminal ignores the target information.
The method according to any one of claims 1 to 3, wherein the analysis results include at least one of the following: exception identification, traffic description information, protocol data unit PDU session identification, target single network slice selection auxiliary information S-NSSAI , target data network name DNN information, target quality of service QoS parameters, cycle time, scheduled communication time, scheduled communication type, communication duration, traffic profile, expected business dispersion;

Wherein, the abnormality identification is used to indicate the risk detected by the network side device, and the risk includes at least one of the following: unexpected long duration/large rate traffic, suspected distributed denial of service DDoS attack, too frequent service Access;

The traffic description information includes at least one of the following: application descriptor, Internet Protocol IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connection capability.
The method according to claim 4, wherein the analysis results include traffic description information;

The target operations include any of the following:

Release the PDU session carrying the data packet corresponding to the traffic description information;

Initiate the modification process of the PDU session carrying the data packet corresponding to the traffic description information;

It is not allowed to establish a PDU session for the data packet corresponding to the traffic description information;

The terminal discards or ignores the uplink or downlink data packet corresponding to the traffic description information.
The method according to claim 4, wherein the analysis result includes a PDU session identifier;

The target operations include any of the following:

Release the PDU session corresponding to the PDU session identifier;

Initiate the modification process of the PDU session corresponding to the PDU session identifier;

The establishment of a PDU session corresponding to the PDU session identifier is not allowed;

Wherein, the PDU session is a PDU session carrying abnormal traffic.
The method according to claim 6, wherein the analysis result further includes at least one of the following: target QoS Parameters, target S-NSSAI, target DNN information;

The modification process of initiating the PDU session corresponding to the PDU session identifier includes at least one of the following:

If the analysis result includes the target QoS parameter, modify the Qos parameter in the PDU session to the target QoS parameter;

If the analysis result includes the target S-NSSAI, modify the S-NSSAI in the PDU session to the target S-NSSAI;

If the analysis result includes the target DNN information, modify the DNN information in the PDU session to the target DNN information.
The method of claim 4, wherein when the analysis result includes at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information, the target operation is to not allow establishment to the target The PDU session corresponding to the information.
The method according to claim 3, wherein the target operation is to set a session management backoff timer;

Wherein, before the session management backoff timer expires, the terminal is not allowed to initiate a service request.
A behavioral approach that includes:

The network side device analyzes the behavior of the terminal;

The network side device sends target information to the terminal, where the target information includes analysis results of abnormal behavior of the terminal.
The method according to claim 10, wherein before the network side device analyzes the behavior of the terminal, the method further includes:

The network side device receives the first message sent by the terminal;

Wherein, the first message includes an abnormal behavior identifier, and the abnormal behavior identifier is used to request analysis or prediction of whether abnormal behavior occurs in the terminal.
The method according to claim 10 or 11, wherein the analysis results include at least one of the following: anomaly identification, traffic description information, PDU session identification, target S-NSSAI, target DNN information, target QoS parameters, cycle time, Scheduled communication time, scheduled communication type, communication duration, traffic profile, expected business dispersion;

Wherein, the abnormality identifier is used to indicate a risk detected by the network side device, and the risk includes at least one of the following: unexpected long duration/large rate traffic, suspected DDoS attack, too frequent service access;

The traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connection capability.
A behavioral treatment device comprising:

A receiving module, configured to receive target information from a network side device, where the target information includes analysis results of abnormal behavior of the terminal;

A decision-making module is used to make decisions on the behavior of the terminal based on the target information.
The device of claim 13, wherein the device further comprises:

A sending module, configured to send a message to the network before the receiving module receives the target information from the network side device. The network side device sends the first message;

Wherein, the first message includes an abnormal behavior identifier, and the abnormal behavior identifier is used to request analysis or prediction of whether abnormal behavior occurs in the terminal.
The device according to claim 13, wherein the decision-making module is specifically configured to perform a target operation when it is determined that the behavior of the terminal is abnormal based on the target information; The behavior is normal and the target information is ignored.
The device according to any one of claims 13 to 15, wherein the analysis results include at least one of the following: anomaly identification, traffic description information, PDU session identification, target S-NSSAI, target DNN information, target QoS parameters, Cycle time, scheduled communication time, scheduled communication type, communication duration, traffic profile, expected business dispersion;

Wherein, the abnormality identifier is used to indicate a risk detected by the network side device, and the risk includes at least one of the following: unexpected long duration/large rate traffic, suspected DDoS attack, too frequent service access;

The traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connection capability.
The device according to claim 16, wherein the analysis results include flow description information;

The target operations include any of the following:

Release the PDU session carrying the data packet corresponding to the traffic description information;

Initiate the modification process of the PDU session carrying the data packet corresponding to the traffic description information;

It is not allowed to establish a PDU session for the data packet corresponding to the traffic description information;

The terminal discards or ignores the uplink or downlink data packet corresponding to the traffic description information.
The device according to claim 16, wherein the analysis result includes a PDU session identification;

The target operations include any of the following:

Release the PDU session corresponding to the PDU session identifier;

Initiate the modification process of the PDU session corresponding to the PDU session identifier;

The establishment of a PDU session corresponding to the PDU session identifier is not allowed;

Wherein, the PDU session is a PDU session carrying abnormal traffic.
The device according to claim 18, wherein the analysis result further includes at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information;

The modification process of initiating the PDU session corresponding to the PDU session identifier includes at least one of the following:

If the analysis result includes the target QoS parameter, modify the Qos parameter in the PDU session to the target QoS parameter;

If the analysis result includes the target S-NSSAI, modify the S-NSSAI in the PDU session to the target S-NSSAI;

If the analysis result includes the target DNN information, modify the DNN information in the PDU session to the target DNN information.
The device according to claim 16, wherein the analysis result includes at least one of the following: target QoS In the case of parameter, target S-NSSAI, and target DNN information, the target operation is not allowed to establish a PDU session corresponding to the target information.
The apparatus according to claim 15, wherein the target operation is to set a session management backoff timer;

Wherein, before the session management backoff timer expires, the terminal is not allowed to initiate a service request.
A behavioral treatment device comprising:

Analysis module, used to analyze the behavior of the terminal;

A sending module, configured to send target information to the terminal, where the target information includes analysis results of abnormal behavior of the terminal.
The device of claim 22, wherein the device further comprises:

A receiving module, configured to receive the first message sent by the terminal before the analysis module analyzes the behavior of the terminal;

Wherein, the first message includes an abnormal behavior identifier, and the abnormal behavior identifier is used to request analysis or prediction of whether abnormal behavior occurs in the terminal.
The device according to claim 22 or 23, wherein the analysis result includes at least one of the following: anomaly identification, traffic description information, PDU session identification, target S-NSSAI, target DNN information, target QoS parameters, cycle time, Scheduled communication time, scheduled communication type, communication duration, traffic profile, expected business dispersion;

Wherein, the abnormality identifier is used to indicate a risk detected by the network side device, and the risk includes at least one of the following: unexpected long duration/large rate traffic, suspected DDoS attack, too frequent service access;

The traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connection capability.
A terminal includes a processor and a memory, the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the implementation of any one of claims 1 to 9 is achieved. The steps for handling the behavior described above.
A network side device, including a processor and a memory. The memory stores programs or instructions that can be run on the processor. When the program or instructions are executed by the processor, any one of claims 10 to 12 is implemented. Steps in the behavioral approach described in Item .
A readable storage medium on which programs or instructions are stored. When the programs or instructions are executed by a processor, the behavior processing method as described in any one of claims 1 to 9 is implemented, or the behavior processing method as claimed in any one of claims 1 to 9 is implemented. The steps of the behavioral treatment method described in any one of claims 10 to 12.