WO2023213133A1 - 一种通信方法和装置 - Google Patents

一种通信方法和装置 Download PDF

Info

Publication number
WO2023213133A1
WO2023213133A1 PCT/CN2023/080431 CN2023080431W WO2023213133A1 WO 2023213133 A1 WO2023213133 A1 WO 2023213133A1 CN 2023080431 W CN2023080431 W CN 2023080431W WO 2023213133 A1 WO2023213133 A1 WO 2023213133A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
data
model
network device
packet flow
Prior art date
Application number
PCT/CN2023/080431
Other languages
English (en)
French (fr)
Inventor
李卓明
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023213133A1 publication Critical patent/WO2023213133A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/0231—Traffic management, e.g. flow control or congestion control based on communication conditions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/16—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using machine learning or artificial intelligence
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/08—Load balancing or load distribution
    • H04W28/086—Load balancing or load distribution among access entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/08—Load balancing or load distribution
    • H04W28/09—Management thereof

Definitions

  • Embodiments of the present application relate to the field of communications, and, more specifically, to methods and devices for application detection.
  • UE User equipment
  • DN data network
  • P2P downloads specific services
  • Embodiments of the present application provide a method and device for application detection.
  • a method for application detection which is characterized in that it includes: a network device obtains first data, the first data is determined based on a first application message flow; the network device sends a request to a terminal The device sends a first model or a part of the first model, the first model is used to determine the application identifier corresponding to the first application message flow; the network device sends the first data to the terminal device , the first data is used to determine the correction factor of the first model; the network device receives the correction factor from the terminal device; the network device adjusts the first model according to the correction factor.
  • the first data may be data of a certain application of the terminal device, or may be data of certain applications.
  • the first data is determined based on the first application message flow.
  • the first application message flow is a series of messages sent by the terminal device to the application server or received from the application server through the network device.
  • the network device in this application can be a single network element.
  • the network device can be a network data analysis function network element or a user plane function network element; the network device in this application can also be multiple network elements integrated in the same
  • the network data analysis function network element and the user plane function network element are integrated on the same physical network device.
  • the first data sent by the network device to the terminal device can be sent all at once, or it can be sent in multiple times. This application does not limit this.
  • the way in which the network device obtains the first data may be that the network device obtains the first data from other devices or the network device The device itself stores relevant data. Because the way in which the network device obtains the first data has no impact on the implementation of the embodiments of the present application, this application does not limit this.
  • the terminal device can obtain the application identifier corresponding to the first data, obtain the loss and gradient information of the first model, and send them to the network device.
  • the network device The first model is updated, thereby making the first model more accurate, thereby making application detection using the first model more accurate.
  • the network device is a network data analysis function network element or a user plane function network element.
  • the first data includes: address information of the first application packet flow, and/or information indicating the first application packet flow.
  • the timestamp of the transmission period includes: address information of the first application packet flow, and/or information indicating the first application packet flow.
  • the network device determines the first data based on the first application packet flow. In a possible implementation, the network device determines the first application packet based on the packets in the first application packet flow. The address information of the message stream; in another possible implementation, the network device determines the timestamp according to the time when the message in the first application message stream is transmitted through the network device; in yet another possible implementation In an implementation manner, the network device determines the address information and the timestamp of the first application packet flow based on the packets in the first application packet flow.
  • the first data further includes: characteristic information of the first application packet flow.
  • the network device determines the first data according to the first application message flow.
  • One possible implementation is that the network device determines the first application message according to the message sequence in the first application message flow. Flow characteristic information.
  • the characteristic information of the application packet flow is used to describe the packet sending and receiving mode of the application service.
  • the characteristic information of the application message flow includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, the At least one of the security protection mechanism of the message and the change pattern of the size of the application message flow for sending and receiving traffic.
  • the address information of the application packet flow is the source address (IP address or MAC address), destination address (IP address or MAC address), protocol, source port number, and destination of an application packet transmitted between the UE and the application server. All or part of the port number.
  • the address information of the application message flow on the UE side refers to the source address of the service flow message sent by the UE or the destination address of the service flow message received by the UE.
  • the timestamp used to indicate the transmission period of the first application packet flow is the time when the first application packet flow directly received and sent by the terminal device and the application server passes through the network device.
  • the first data is data encrypted by the network device.
  • This application effectively protects the user's privacy and improves security by encrypting the first data.
  • the first model is a model in which the network device and the terminal device perform vertical federated learning.
  • the correction factor includes: the gradient and/or loss of the first model.
  • the method further includes: the network device inputs second data into the adjusted first model to obtain a first identification; the second data It is determined based on the second application packet flow, and the second data includes characteristic information of the second application packet flow.
  • the second data is determined based on the second message flow.
  • the second message flow is obtained by the terminal device through the network device.
  • the second application packet flow is the first application packet flow
  • the characteristic information of the second application packet flow is the characteristic information of the first application packet flow.
  • the method further includes: the network device determining a first correspondence between the characteristic information of the second application packet flow and the first identifier.
  • this application can quickly identify the application identifier of the application when the network device receives data of the same application, thereby reducing the calculation amount of the network device and improving the efficiency of application detection.
  • the method further includes: the network device sending the first correspondence relationship to a user plane functional network element.
  • the network device determines the first packet flow description corresponding to the second application packet flow according to the first correspondence relationship.
  • the method further includes: if a third application message flow is received within the first period of time, according to the first message flow description, the The first identification is determined to be the application identification of the third application message flow, the first period is the valid period of the first application relationship, the third application message flow and the second application message The address information of the streams is the same.
  • the packet flow description includes the correspondence between the application packet flow address information and the application identifier.
  • the network device determines the first packet flow description based on the first correspondence, including: the network device obtains the correspondence between the characteristic information and the address information of the application packet flow in the process of sending and receiving the application packet flow; the network device determines the first packet flow description based on the first correspondence.
  • the corresponding relationship between the characteristic information of the application packet flow and the application identifier; the superposition of the two can determine the application packet flow description.
  • This application further improves the accuracy of application detection by determining the effective time.
  • a timer is started; after the timer times out, the first correspondence is deleted.
  • the second data further includes address information of the second application packet flow, and the address information of the second application packet flow includes the third 2.
  • the address information of the terminal device carried in the application packet flow includes the third 2.
  • the second application packet flow is the first application packet flow
  • the address information of the second application packet flow is the address information of the first application packet flow.
  • the method further includes: the network device determining a second correspondence between the address information of the second application packet flow and the first identifier.
  • this application can quickly identify the application identifier of the application when the network device receives data of the same application, thereby reducing the calculation amount of the network device and improving the efficiency of application detection.
  • the method further includes: the network device sending the second correspondence relationship to a user plane functional network element.
  • the network device determines a second packet flow description of the second application packet flow according to the second correspondence relationship, and the second packet flow description is The flow description includes address information of the terminal device.
  • the second packet flow description includes the second corresponding relationship.
  • the second packet flow description includes terminal-side address information of the second application packet flow. information, the server-side address information of the second application message flow, and the first identifier.
  • the packet flow description can be targeted at the specific terminal device, thereby improving the accuracy of application detection.
  • the method further includes: if a fourth application message flow is received within the second time period, according to the second message flow description, the The first identification is determined to be the application identification of the fourth application packet flow, the second period is a valid period described by the second packet flow, and the fourth application packet flow and the second application The address information of the packet flows is the same.
  • the address information on the terminal side of the fourth application packet flow is the same as the address information on the terminal side of the second application packet flow
  • the address information on the application server side of the fourth application packet flow is It is the same as the address information on the application server side of the second application packet flow.
  • the method further includes: if fourth data is received within the second period, determining the first identification according to the second correspondence relationship is the application identifier of the fourth data, the second period is the valid period of the first application relationship, and the fourth data includes the characteristic information of the second application message flow and the second application message.
  • This application further improves the accuracy of application detection by determining the valid time and comparing the address information on the terminal side.
  • a timer is started; after the timer times out, the second correspondence is deleted.
  • a method for application detection is provided, which is characterized by including: a terminal device receiving first data from a network device, where the first data is determined by the network device based on a first application message flow.
  • the terminal device receives a first model or a part of the first model from a network device, and the first model is used to determine the application identifier corresponding to the first application message flow; the terminal device receives the first model according to the The first data determines a first identifier; the terminal device determines a correction factor according to the first identifier, and the correction factor is used to adjust the first model; the terminal device sends the correction factor to the network device .
  • the terminal device may determine the correction factor of the first model based on the first data and the first identifier.
  • the terminal device obtains the first model, the terminal device finds the corresponding local application activity information according to the received first data to determine the application identifier, and the terminal device calculates the first model based on the first data and the application identifier. Model losses and gradients.
  • the terminal device obtains a partial model of the first model, the terminal device finds the corresponding local application activity information according to the received first data to determine the application identifier, and the terminal device determines the application identifier according to the first data and the application identifier. , calculate the loss and gradient of the partial model of the first model.
  • the network device can also encrypt and send the gradient factor information of the partial model on the network device side calculated by itself to the corresponding terminal device.
  • the terminal device can also update based on the gradient factor information calculated by the network device and the gradient factor information calculated by the terminal device itself.
  • the application activity information is information about the running status of each APP on the terminal device.
  • the application activity information includes the IP address and port information of the network interface used by the APP for communication at each time point or time period, and the APP's Power consumption, whether the APP is running in the foreground (that is, whether the screen is on in the foreground).
  • the terminal device can obtain the loss and gradient information of the first model or a partial model of the first model based on the first data and the first identifier and send it to the network device, and the network device updates the first model, thereby making the second model
  • the first model is more accurate, thereby making application detection using the first model more accurate.
  • the first data is data encrypted by the network device.
  • This application effectively protects the user's privacy and improves security by encrypting the first data.
  • the first data includes: address information of the first application packet flow, and/or information indicating the first application packet flow.
  • the timestamp of the transmission period includes: address information of the first application packet flow, and/or information indicating the first application packet flow.
  • the address information of the first application packet flow is the server-side address of the first application packet flow and/or the terminal-side address of the first application packet flow.
  • the first data further includes: characteristic information of the first application packet flow.
  • the terminal device obtaining the first identification based on the first data includes: the terminal device determines a first characteristic, and the first characteristic is the terminal Features shared by the device and the network device data; the terminal device determines second data corresponding to the first data based on the first features, and the second data includes a first identifier.
  • the first feature includes: a timestamp of the transmission period of the first data and/or address information of the first application message flow.
  • the second data is the application identification of the application with the highest probability of matching the first feature.
  • obtaining the correction factor according to the first identification includes: if the terminal device receives the first model, the terminal device obtains the correction factor according to the first model. An identifier and characteristic information of the first application message flow determine the correction factor of the first model; or if the terminal device receives part of the first model, the terminal device determines the correction factor according to the first model. An identifier and the first characteristic determine the correction factor for the first model.
  • a method for application detection which is characterized in that it includes: first data obtained by a network device, the first data being determined based on a first application message flow; The terminal device sends the first data; the network device receives a first identifier from the terminal device, where the first identifier is an application identifier determined by the terminal device according to the first data; the network device receives the first identifier according to the first data.
  • the first data and the first identifier are used to adjust the first model, and the first model is used to determine the application identifier corresponding to the application.
  • the network device in this application can be a single network element.
  • the network device can be a network data analysis function network element or a user plane function network element; the network device in this application can also be multiple network elements integrated in the same
  • the network data analysis function network element and the user plane function network element are integrated on the same physical network device.
  • the first data sent by the network device to the terminal device can be sent all at once, or it can be sent in multiple times. This application does not limit this.
  • the way in which the network device obtains the first data may be that the network device obtains the first data from other devices or the network device itself stores relevant data. Because the way in which the network device obtains the first data has no impact on the implementation of the embodiments of the present application, this application does not limit this.
  • the terminal device can obtain the first data According to the corresponding application identifier and sent to the network device, the network device updates the first model according to the first data and the application identifier, thereby making the first model more accurate, thereby making application detection using the first model more accurate.
  • the method further includes: the network device obtaining a second identification based on the adjusted first model.
  • this application can obtain more accurate detection results, thereby improving the accuracy of application detection.
  • the network device is a network data analysis function network element or a user plane function network element.
  • the method further includes: the network device obtains the first correspondence relationship between the characteristic information of the application packet flow and the second identification or the application packet flow The second corresponding relationship between the address information and the second identification.
  • this application can quickly identify the application identifier of the application when the network device receives data of the same application, thereby reducing the calculation amount of the network device and improving the efficiency of application detection.
  • the network device when the network device is a network data analysis functional network element, the network device sends the first corresponding relationship or the second corresponding relationship to the user plane functional network element.
  • the application packet flow description includes address information of the terminal device.
  • the method further includes: determining a valid time of the first correspondence relationship or the second correspondence relationship.
  • This application further improves the accuracy of application detection by determining the effective time.
  • a timer is started; after the timer times out, the first correspondence is deleted.
  • the first data is data encrypted by the network device.
  • This application effectively protects the user's privacy and improves security by encrypting the first data.
  • the first data includes: address information of the first application packet flow, and/or information used to indicate the first application packet flow.
  • the timestamp of the transmission period includes: address information of the first application packet flow, and/or information used to indicate the first application packet flow.
  • the first data further includes: characteristic information of the first application packet flow.
  • the first model is a model in which the network device and the terminal device perform vertical federated learning.
  • a fourth aspect provides a method for application detection, which is characterized by including: a terminal device receiving first data from a network device, where the first data is determined based on a first application message flow; The terminal device determines a first identifier, where the first identifier is an application identifier corresponding to the first application message flow; the terminal device sends the first identifier to the network device.
  • the terminal device receives the first information to obtain the first identifier, and sends the first identifier to the network device, so that the network device can update the first model, thereby improving the accuracy of application detection.
  • the first data is data encrypted by the network device.
  • This application effectively protects the user's privacy and improves security by encrypting the first data.
  • the first data includes: at least one of address information or timestamp of the application packet flow; or, address information or time of the application packet flow. At least one item in the stamp and the characteristic information of the application packet flow.
  • the terminal device determining the first identification includes: the terminal device determining a first characteristic, and the first characteristic is a combination of the terminal device and the network device. Characteristics common to the data; the terminal device determines second data corresponding to the first data according to the first characteristic, and the second data includes a first identifier.
  • the first feature includes: time stamp and/or address information.
  • a system for application detection which is characterized in that it includes: a first network device and a second network device; the first network device is used to obtain and send an application to the second network device Relevant first data, the first data is determined based on the first application message flow; the first network device is used to send the first model or part of the first model to the second network device, the first The model is used to determine the application identifier corresponding to the application; the second network device is used to receive and send the first data and the first model or part of the first model to the terminal device, so The first data is used to determine the correction factor of the first model; the second network device is also used to receive and send the correction factor to the first network device; the first network device is also used to calculate the correction factor according to the first network device. Correction factors adjust the first model.
  • the first network device is further configured to obtain the first identification using the adjusted first model.
  • the first network device is further configured to obtain a first correspondence between the characteristic information of the application packet flow and the first identifier or a first correspondence between the application packet flow and the first identification. A second corresponding relationship between address information and the first identifier.
  • the first network device is further configured to send the first corresponding relationship or the second corresponding relationship to the second network device.
  • the first network device is further configured to determine the validity time of the first correspondence relationship or the second correspondence relationship.
  • the first network device is a network data analysis function network element; and the second network device is a user plane function network element.
  • a communication device including: a processing module, configured to obtain application-related first data, where the first data is determined based on the first application message flow; and a transceiver module, configured to send data to a terminal device Send the first data and a first model or a part of the first model, the first model is used to determine the application identifier corresponding to the first application message flow, and the first data is used to determine the first The correction factor of the model; the transceiver module is also used to receive the correction factor from the terminal device; the processing module is also used to adjust the first model according to the correction factor.
  • the first data includes: address information of the first application packet flow, and/or information indicating the first application packet flow.
  • the timestamp of the transmission period is a configurable period.
  • the first data further includes: characteristic information of the first application message flow.
  • the first data is data encrypted by the network device.
  • the first model is a model in which the network device and the terminal device perform vertical federated learning.
  • the correction factor includes: the gradient and/or loss of the first model.
  • the transceiver module is also configured to obtain second data.
  • the second data is determined based on the second application message flow, and the second data includes Characteristic information of the second application message flow; the processing module is also configured to input the second data into the adjusted first model to obtain a first identification.
  • the processing module is further configured to determine a first correspondence between the characteristic information of the second application packet flow and the first identifier.
  • the transceiver module is further configured to send the first correspondence relationship to the user plane functional network element.
  • the transceiver module is further configured to send the first corresponding relationship to a user plane functional network element and send the first corresponding relationship to a user plane functional network element.
  • the processing module is further configured to determine a packet flow description of the second data, where the packet flow description includes the first correspondence.
  • the processing module is further configured to determine a first packet flow description corresponding to the second application packet flow according to the first correspondence relationship.
  • the transceiver module is further configured to receive a third application message flow in the first period; the processing module, according to the first message flow Description: Determine the first identifier as the application identifier of the third application message flow, the first period is the valid period of the first application relationship, and the third application message flow is related to the third application message flow.
  • the address information of the two application packet flows is the same.
  • the processing module is further configured to determine a second correspondence between the address information of the second application packet flow and the first identifier.
  • the transceiver module is further configured to send the second correspondence relationship to the user plane functional network element.
  • the transceiver module is further configured to send the second correspondence relationship to the user plane functional network element.
  • the processing module is further configured to determine a second packet flow description corresponding to the second application packet flow according to the second correspondence relationship.
  • the transceiver module is further configured to receive a fourth application message stream within the second period; the processing module, according to the second message Flow description, the first identifier is determined as the application identifier of the fourth application message flow, the second period is the valid period of the second message flow description, and the fourth application message flow is consistent with The address information of the second application packet flow is the same.
  • a communication device including: a transceiver module configured to receive first data and a first model or a part of the first model from a network device, where the first data is generated according to a first application report.
  • the first model is used to determine the application identifier corresponding to the application, and the first data is used to determine the correction factor of the first model.
  • the processing module is used to determine a first identifier according to the first application message flow and determine a correction factor according to the first identifier and the first feature, and the correction factor is used to adjust the first Model; the transceiver module is also used to send the correction factor to the network device.
  • the first data is data encrypted by the network device.
  • the first data includes: address information of the first application packet flow, and/or information used to indicate the first application packet flow.
  • the timestamp of the transmission period is
  • the first data further includes: characteristic information of the first application message flow.
  • obtaining the first identification according to the first data includes: the processing module determines a first characteristic according to the first data, and the first characteristic is a common feature of the terminal device and the network device data; the processing module determines second data corresponding to the first data according to the first feature, and the second data includes a first identifier.
  • the first feature includes: a timestamp of the transmission period of the first application message flow and/or an address of the first application message flow information.
  • obtaining the correction factor according to the first identification includes: if the transceiver module receives the first model, the processing module calculates the correction factor according to the first model. An identifier and the characteristic information of the first application message flow are used to obtain the correction factor of the first model; if the receiving module receives part of the first model, the processing module The identification and the first feature result in the correction factor for the first model.
  • a communication device including a processor and a memory.
  • the memory is used to store a computer program.
  • the processor is used to call and run the computer program from the memory, so that the communication device executes the first or second Or the communication method in the third or fourth aspect and its various possible implementations.
  • processors there are one or more processors and one or more memories.
  • the memory may be integrated with the processor, or the memory may be provided separately from the processor.
  • the communication device also includes a transmitter (transmitter) and a receiver (receiver).
  • a computer program product includes: a computer program (which may also be called a code, or an instruction).
  • a computer program which may also be called a code, or an instruction.
  • the computer program When the computer program is run, it causes the computer to execute the first aspect or the third aspect.
  • a computer-readable medium stores a computer program (which may also be called a code, or an instruction), and when run on a computer, causes the computer to execute the first aspect or the third aspect.
  • a computer program which may also be called a code, or an instruction
  • a chip system including a memory and a processor.
  • the memory is used to store a computer program.
  • the processor is used to call and run the computer program from the memory, so that the communication device installed with the chip system executes The method in any possible implementation manner of the above first aspect, second aspect, third aspect or fourth aspect.
  • the chip system may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.
  • Figure 1 is a system schematic diagram of the application scenario of the embodiment of the present application.
  • Figure 2 is a schematic structural diagram of the system according to the embodiment of the present application.
  • Figure 3 is a schematic diagram of an application packet flow feature model according to an embodiment of the present application.
  • Figure 4 is a flow chart of a method for optimizing the application packet flow feature model in an embodiment of the present application.
  • Figure 5 is a flow chart of a method for optimizing the application packet flow feature model in an embodiment of the present application.
  • Figure 6 is a flow chart of an application detection method in an embodiment of the present application.
  • Figure 7 is a flow chart of yet another application detection method in an embodiment of the present application.
  • Figure 8 is a flow chart of another application detection method in an embodiment of the present application.
  • Figure 9 is a flow chart of another application detection method in an embodiment of the present application.
  • FIG. 10 is a schematic block diagram of an example of a communication device in an embodiment of the present application.
  • FIG. 11 is a schematic block diagram of an example of a communication device in an embodiment of the present application.
  • LTE long term evolution
  • FDD frequency division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX global interoperability for microwave access
  • Figure 1 is a schematic diagram of the network system applied in this application. These include network data analysis network elements, access and mobility management network elements, session management network elements, policy control network elements and slice access control network elements. In addition, during normal operation of the system, it will also interact with terminal equipment, access network (AN) equipment, user plane network elements, network slice selection network elements, etc.
  • AN access network
  • AN access network
  • user plane network elements user plane network elements
  • network slice selection network elements etc.
  • Access and mobility management network element Mainly used for terminal attachment, mobility management, and tracking area update processes in mobile networks.
  • the access management network element terminates non-access stratum (NAS) messages and completes registration. Management, connection management and reachability management, allocation of tracking area list (track area list, TA list) and mobility management, etc., and transparent routing of session management (session management, SM) messages to session management network elements.
  • the access management network element can be the access and mobility management function (AMF).
  • Session management network element Mainly used for session management in mobile networks, such as session establishment, modification, and release. Specific functions include assigning Internet Protocol (IP) addresses to terminals and selecting user plane network elements that provide packet forwarding functions.
  • IP Internet Protocol
  • the session management network element may be a session management function (SMF).
  • Policy control network element includes user subscription data management functions, policy control functions, billing policy control functions, quality of service (QoS) control, etc.
  • the policy control network element can be a policy Policy control function (PCF).
  • PCF policy Policy control function
  • PCF may also be divided into multiple entities according to levels or functions, such as global PCF and PCF within slices, or session management PCF (session management PCF, SM-PCF) and access management PCF (access management PCF). , AM-PCF).
  • Network slice selection network element mainly used to select appropriate network slices for terminal services.
  • the network slice selection network element may be a network slice selection function (NSSF) network element.
  • NSSF network slice selection function
  • Unified data management network element responsible for managing terminal contract information.
  • the unified data management network element can be unified data management (UDM).
  • Data analysis network element from each network function (NF, AMF, SMF, PCF, etc.), through the network exposure function (NEF) or directly from the application function (AF), and from Operation administration and maintenance (OAM) systems collect data and perform analysis and predictions.
  • the data analysis network element can be a network data analytics function (NWDAF).
  • NWDAF can also output recommended values to each of the above network functions, AF or OAM.
  • User plane network element Mainly responsible for processing user messages, such as forwarding, accounting, legal interception, etc.
  • the user plane network element can also be called a protocol data unit (PDU) session anchor (PDU session anchor, PSA).
  • PDU session anchor PDU session anchor
  • PSA protocol data unit
  • the user plane network element can be the user plane function (UPF).
  • UPF can communicate directly with NWDAF through a service-like interface, or it can communicate with NWDAF through other means, such as through SMF or a private interface or internal interface with NWDAF.
  • control plane network functional entities of the same network slice can discover each other through NRF, obtain each other's access address information, and then use The control plane signaling buses communicate directly with each other.
  • embodiments of this application also involve the following devices or network elements:
  • Terminal device It is a device with wireless transceiver function that can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on water (such as ships, etc.); it can also be deployed in the air (such as aircraft) , balloons and satellites, etc.).
  • the terminal device may be a mobile phone (mobile phone), a tablet computer (pad), a computer with wireless transceiver functions, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, an industrial control ( Wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grid, and transportation safety Wireless terminals, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • the embodiments of this application do not limit application scenarios.
  • Terminal equipment may sometimes also be called user equipment (UE), mobile station, remote station, etc.
  • the embodiments of this application do not limit the specific technology, equipment form, and name used by the terminal equipment.
  • Access network AN (access network) equipment used for wireless side access of terminal equipment.
  • Possible deployment forms include: separation scenarios of centralized unit (CU) and distributed unit (DU) and Single site scenario.
  • CU supports protocols such as radio resource control (RRC), packet data convergence protocol (PDCP), service data adaptation protocol (SDAP);
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • SDAP service data adaptation protocol
  • DU Mainly supports wireless link control layer (radio link control, RLC), media access control layer (media access control, MAC) and physical layer protocols.
  • a single site may include a new radio Node (gNB), an evolved Node B (evolved Node B, eNB), radio network controller (RNC), Node B (NB), base station controller (BSC), base transceiver station (BTS), home base station, baseband Unit (base band unit, BBU), etc.
  • gNB new radio Node
  • eNB evolved Node B
  • RNC radio network controller
  • NB Node B
  • BSC base station controller
  • BTS base transceiver station
  • home base station baseband Unit (base band unit, BBU), etc.
  • FIG. 2 is a system structure diagram of an embodiment of the present application.
  • the NWDAF network element will perform federated learning with the UE.
  • the NWDAF network element collects the characteristic information and address information of the application packet flow from the UPF network element as training data on the NWDAF network element side.
  • the UE uses locally stored application activity information as training data on the UE side.
  • the federated learning proxy (FL Proxy) network element obtains the authorization from each user for the UE to participate in federated learning.
  • the FL Proxy network element serves as the AF network element to connect the data channel between the NWDAF network element and each UE.
  • NWDAF is divided into two parts: model training logical function (MTLF) and analytical reasoning logical function (analytics logical function, AnLF).
  • the NWDAF network element has at least one of the MTLF function and the AnLF function. Therefore, in this application, the MTLF can be an independent network element or a functional unit in the network element.
  • AnLF can be an independent network element or a functional unit in a network element.
  • MTLF trains the model based on the collected data. After the model training is completed, the trained model is distributed to one or multiple AnLFs.
  • MTLF uses the large amount of data mentioned above to perform machine learning training in advance, obtains a model corresponding to the statistical characteristics of application packet flows of various applications and their application identifiers, and then distributes this model to AnLF.
  • AnLF provides analysis services to each network element. Based on the statistical characteristics of the flows to be identified provided by UPF, it uses the model to perform inference and outputs the corresponding application type.
  • Federated Learning Also known as federated learning and alliance learning.
  • Federated learning is a machine learning framework that can effectively help multiple organizations perform data usage and machine learning modeling while meeting the requirements of user privacy protection, data security, and government regulations.
  • Each participant in federated learning models their own models, and their own data does not leave the local area.
  • the federated system can establish a virtual shared model through model parameter exchange under the encryption mechanism, that is, without violating data privacy regulations.
  • This virtual model is like the optimal model built by everyone by aggregating data. However, when building a virtual model, the data itself does not move, nor does it leak privacy or affect data compliance.
  • federated learning can be divided into horizontal federated learning (HFL) and vertical federated learning (VFL).
  • HFL horizontal federated learning
  • VFL vertical federated learning
  • the data of different participants in horizontal federated learning have a large overlap of features, but the overlap of data samples, that is, the samples to which the features belong, is not high.
  • Vertical federated learning algorithms facilitate cooperation between parties, using their unique data characteristics to jointly create more powerful models.
  • NWDAF network elements can update the model in time as applications change, and obtain a more accurate application packet flow feature model, thus improving the accuracy of application detection.
  • the UPF network element can be used to detect the application packet flow between the UE and the application server.
  • the UPF network element includes a feature detection module, which is used to obtain and output feature information of application packet flows.
  • the UPF network element sends the characteristic information of the application packet flow to the NWDAF network element.
  • the NWDAF network element includes an application packet flow characteristic model.
  • the application packet flow characteristic model can determine the corresponding App ID based on the characteristic information of the application packet flow to be detected.
  • the characteristic information of the application packet flow is used to describe the packet sending and receiving mode of the application service.
  • the characteristic information of the application message flow includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, the Message security protection mechanism, application message flow sending and receiving traffic At least one of the size variation styles.
  • the UPF network element stores a packet flow description (PFD) corresponding to the application identifier (App ID), where the PFD corresponding to the App ID can implement application reporting.
  • PFD packet flow description
  • App ID application identifier
  • URL uniform resource locator
  • the important part of the URL is the host name or the matching fully qualified domain name (FQDN).
  • the AF network element of the application provider will provide the PFD corresponding to one or more App IDs to the packet flow description function (FPFD) network element.
  • the PFDF network element is generally built into the NEF network element.
  • the PFDF network element will set the PFD corresponding to the App ID to the UPF network element through the SMF network element.
  • the UPF network element includes a fast detection module and a feature detection module.
  • the fast detection module can identify the application identifier corresponding to the application packet flow based on the packet flow description (PFD). For application packet flows that cannot match the PFD (That is, the application packet flow that does not have a corresponding PFD, also known as the application packet flow to be detected), the feature detection module obtains and outputs the characteristic information of the application packet flow to be detected and the address information of the application packet flow to be detected.
  • PFD packet flow description
  • the UPF network element sends the characteristic information of the application packet flow to be detected and the address information of the application packet flow to be detected to the NWDAF network element.
  • the NWDAF network element includes an application packet flow characteristic model, and provides analysis services to PFDF network elements, SMF network elements, or UPF network elements based on the application packet flow characteristic model.
  • the application packet flow characteristic model can determine the corresponding App ID based on the characteristic information of the application packet flow to be detected.
  • At least one network element among the NWDAF network element, PFDF network element, SMF network element, and UPF network element can determine the corresponding App ID based on the App ID and the to-be-detected
  • the address information of the application packet flow generates a PFD and is installed on the UPF network element. Subsequently, the UPF network element can use the rapid detection module to perform application detection on the above application packet flow based on the PFD.
  • Using the fast detection module in UPF to detect application packet flows can avoid complex model matching detection for each application packet flow, greatly reducing the amount of calculations and processing time, and improving the processing performance of user plane equipment.
  • FIG. 3 is a schematic diagram of an application packet flow feature model according to an embodiment of the present application.
  • NWDAF and UE perform federated learning, and NWDAF obtains the application packet flow feature model.
  • This model is a deep neural network, and its input side is some feature parameters. Some features are held by NWDAF, another part is held by UE, and some features are shared by both parties. The features shared by both parties can be used in the federation. The samples of each party are aligned during the learning process. Through federated learning, models with more feature dimensions can be obtained, which have better accuracy than models with fewer dimensions.
  • Each layer of neurons in this deep neural network has some parameters, including optimal weight parameters determined by training with a large number of samples through federated learning.
  • the application ID matching the application packet flow can be obtained on the output side, that is, an application that the operator is concerned about, or one that belongs to "other applications”. ” (for example, the APP ID is others).
  • the characteristic information of the application packet flow is used to describe the packet sending and receiving mode of the application service.
  • the characteristic information of the application message flow includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, the At least one of the security protection mechanism of the message and the change pattern of the size of the application message flow for sending and receiving traffic.
  • Figure 4 is a flow chart of another method for optimizing the application of a message flow feature model in an embodiment of the present application.
  • the network device obtains the first application packet flow characteristic model.
  • the application packet flow characteristic model can be based on the input
  • the characteristic information of the application packet flow is obtained to obtain the corresponding App ID.
  • the operator presets the first application packet flow characteristic model in the network device.
  • the network device performs initial training based on training data collected by the network device to obtain the first service data model.
  • the UE sends first request information to the network device.
  • the first request information is used to request data samples corresponding to the UE on the network device.
  • the first request information includes UE identification information.
  • the UE identification information is the user of the UE. Permanent identification (subscription permanent identifier, SUPI).
  • the UE uses the public key of the network device to encrypt the above information, so that other unrelated entities except the network device cannot decrypt the above information, thus protecting user privacy.
  • the network device receives the first request information, and searches for UE-related sample data, that is, the first data, from the local training data according to the UE identification information in the first request information.
  • the user IDs of the sample data are all the identification of the UE (for example, UE#1).
  • the sample data includes the address information of the application packet flow on the UE side in each time slice, the characteristic information of the application packet flow, and the network equipment from the UE. Receive or send the timestamp corresponding to the time slice of the application message flow to the UE.
  • the address information of the application message flow is the source address (IP address or MAC address), destination address (IP address or MAC address), protocol, and source port number of an application message transmitted between the UE and the application server.
  • the address information of the application packet flow on the UE side refers to the source address of the application packet flow packet sent by the UE or the destination address of the application packet flow packet received by the UE.
  • the characteristic information of the application packet flow is used to describe the packet sending and receiving mode of the service.
  • the characteristic information of the application message flow includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, the At least one of the security protection mechanism of the message and the change pattern of the size of the application message flow for sending and receiving traffic.
  • the network device sends first response information to the UE, where the first response information includes the data sample corresponding to the UE.
  • the first response information also includes application packet flow characteristic model parameters.
  • the first response information may include data samples corresponding to one or more application message flows of the UE in one time period, or may also include data samples of one or more application packets of the UE in multiple time periods. Data samples corresponding to the message flow.
  • the network device encrypts the first response information to the UE using the UE's public key. In this way, other unrelated entities except the UE cannot decrypt the first response information, thus protecting the users of the UE. privacy.
  • the application packet flow characteristic model parameters are used by the UE to generate the first application packet flow characteristic model.
  • the application packet flow characteristic model parameters include all parameters of the first application packet flow characteristic model.
  • the UE itself does not have an application packet flow characteristic model, and the first application packet flow characteristic model is generated according to the application packet flow characteristic model parameters. Apply the packet flow characteristic model.
  • the UE itself has an application packet flow characteristic model.
  • the application packet flow characteristic model parameters include the latest weight parameters of the application packet flow characteristic model.
  • the UE will apply the application packet flow characteristic model according to the application packet flow characteristic model parameters.
  • the packet flow characteristic model is updated to the first application packet flow characteristic model.
  • the UE itself has a complete model of the application packet flow feature model.
  • the data samples corresponding to the UE include the address information of the application packet flow on the UE side in each time slice. Feature information, and the timestamp corresponding to the time slice.
  • the UE itself has a partial model that applies the message flow characteristic model.
  • the UE The corresponding data sample only includes the address information and/or timestamp of the application packet flow on the UE side in each time slice.
  • the UE receives the first response information, generates a first application packet flow feature model according to the first response information, and finds corresponding application activity information from the local data of the UE according to the data samples corresponding to the UE.
  • Application activity information includes one or more of the power consumption of each APP, whether each APP lights up the screen in the foreground, the IP address and port information of the network interface used by each APP, and the traffic sent and received by each APP.
  • the UE analyzes the sample tag corresponding to the sample data based on the application activity information and sample data.
  • the sample tag includes the App ID corresponding to the sample data.
  • the UE analyzes the application activity information in the alignment sample data to obtain the application with the highest probability corresponding to the alignment sample data, and determines whether it is an application that the operator is concerned about, or belongs to "other applications", thereby Get the sample label of the aligned sample data (that is, the APP ID on the output side of the model).
  • the UE obtains gradient factor information by using the first application message flow feature model according to the sample data and sample labels.
  • the gradient factor information is used to correct the first application packet flow characteristic model, and the gradient factor information includes the gradient and loss of the first application packet flow characteristic model.
  • the UE itself has a complete model that applies the packet flow feature model. At this time, the UE calculates the gradient factor information of the complete model that applies the packet flow feature model based on the sample data and sample labels.
  • the UE itself has a partial model that applies the packet flow characteristic model.
  • the UE only calculates the gradient factor information of the partial model that applies the packet flow characteristic model based on the sample data and sample labels.
  • S480 The UE sends the gradient factor information to the network device.
  • the UE encrypts the gradient factor information and sends it to the network device.
  • the gradient factor of the model is sent and does not include information that reflects the user's habits such as what applications are installed on the UE, what applications are used during which time periods, etc., the user's privacy is protected.
  • the network device updates the first application packet flow characteristic model according to the gradient factor information. Specifically, the network device updates the weight parameters of the model using the gradient factor.
  • the UE itself has a complete model of the application packet flow feature model.
  • the network device updates the first application packet flow feature model based on the gradient factor information sent by the UE participating in federated learning.
  • the UE itself has a partial model that applies the packet flow characteristic model
  • the network device itself has a partial model on the network device side that applies the packet flow characteristic model.
  • the network device first uses the sample data sent to the UE.
  • the corresponding characteristic information of the application message flow is used to calculate the gradient factor information of the partial model on the network device side.
  • the network device updates the gradient factor information based on the gradient factor information sent by the UE participating in federated learning and the gradient factor information of the partial model on the network device side calculated by itself.
  • the network device can further encrypt the gradient factor information of the partial model on the network device side calculated by itself and send it to the corresponding UE.
  • the UE can also update the UE based on the gradient factor information calculated by the network device and the gradient factor information calculated by the UE itself. Apply the packet flow characteristic model. If the UE updates its own application packet flow characteristic model based on the gradient factor information, then in the subsequent federated learning process, the network device may not include the application packet flow characteristic model parameters in the first response message sent to the UE (step S440).
  • communication between the UE and the network device may be implemented through other devices.
  • the UE and the network device communicate through the AF, and the AF may be installed in the network device.
  • the UE and the network device communicate through FL Proxy.
  • the UE and the network device are both devices registered in the FL Proxy and can perform federated learning.
  • the FL Proxy can be installed in the network device. of.
  • the network equipment and UE are only illustrative.
  • federated learning is actually performed, a large number of UEs participate, and these UEs share the first application message flow feature model in the network equipment.
  • the network device can update the model based on the gradient factor information sent by all UEs with which it performs federated learning.
  • the network device can obtain a more accurate application packet flow characteristic model through multiple rounds of training, and even use the application packet flow characteristic model to perform analysis services after the network device is in the process.
  • Update training of the application packet flow feature model can also be performed at this time.
  • the application packet flow feature model updated in each round can be used as the initial application packet flow feature model for the next round of model update training.
  • Figure 5 is a flow chart of a method for optimizing the application packet flow feature model in an embodiment of the present application.
  • the network device obtains the first application packet flow characteristic model.
  • the application packet flow characteristic model can obtain the corresponding App ID based on the input characteristic information of the application packet flow.
  • the operator presets the first application packet flow characteristic model in the network device.
  • the network device performs initial training based on training data collected by the network device to obtain the first service data model.
  • the UE sends first request information to the network device.
  • the first request information is used to request data samples corresponding to the UE on the network device.
  • the first request information includes UE identification information.
  • the UE identification information is the user of the UE. Permanent identification (subscription permanent identifier, SUPI).
  • the UE uses the public key of the network device to encrypt the above information, so that other unrelated entities except the network device cannot decrypt the above information, thus protecting user privacy.
  • the network device receives the first request information, and searches for UE-related sample data from the local training data according to the UE identification information in the first request information.
  • the user IDs of the sample data are all UE identifiers (for example, UE#1).
  • the sample data includes the address information of the UE's application packet flow in each time slice, the characteristic information of the application packet flow, and the time corresponding to the time slice. stamp.
  • the network device also inputs the sample data into the first application packet flow characteristic model to obtain a calculation result.
  • the calculation result is an application identifier corresponding to the sample data obtained by the first application packet flow characteristic model.
  • the network device uses the address information of the UE-side application message flow in each time slice and/or the timestamp corresponding to the time slice as sample data sent to the UE, that is, the data sample corresponding to the UE.
  • the address information of the application message flow is the source address (IP address or MAC address), destination address (IP address or MAC address), protocol, and source port number of an application message transmitted between the UE and the application server. , all or part of the destination port number.
  • the address information of the application packet flow on the UE side refers to the source address of the application packet flow packet sent by the UE or the destination address of the application packet flow packet received by the UE.
  • the characteristic information of the application packet flow is used to describe the packet sending and receiving mode of the service.
  • the characteristic information of the application message flow includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, the At least one of the security protection mechanism of the message and the change pattern of the size of the application message flow for sending and receiving traffic.
  • the network device sends first response information to the UE, where the first response information includes the data sample corresponding to the UE.
  • the network device encrypts the first response information to the UE using the UE's public key. In this way, other unrelated entities except the UE cannot decrypt the first response information, thus protecting the users of the UE. privacy.
  • the UE receives the first response information and finds the corresponding application activity information from the local data of the UE according to the data sample corresponding to the UE.
  • Application activity information includes one or more of the power consumption of each APP, whether each APP lights up the screen in the foreground, the IP address and port information of the network interface used by each APP, and the traffic sent and received by each APP.
  • the UE analyzes the sample tag corresponding to the sample data based on the application activity information and sample data.
  • the sample tag includes the App ID corresponding to the sample data.
  • the UE analyzes the application activity information in the alignment sample data to obtain the application with the highest probability corresponding to the alignment sample data, and determines whether it is an application that the operator is concerned about, or belongs to "other applications", thereby Get the sample label of the aligned sample data (that is, the APP ID on the output side of the model).
  • the application with the highest probability can choose that the IP address and port information of the network interface used by an APP in the application activity information is the same as the address information of the UE-side application packet flow in the sample data, and the power of this APP in the application activity information is the same.
  • the consumption and/or foreground screen times match the timestamps in the sample data.
  • S570 The UE sends the sample label to the network device.
  • the UE encrypts the sample label and sends it to the network device.
  • the network device obtains gradient factor information based on the calculation results and sample labels.
  • the network device updates the first application packet flow characteristic model according to the gradient factor information. Specifically, the network device updates the weight parameters of the model using the gradient factor.
  • communication between the UE and the network device may be implemented through other devices.
  • the UE and the network device communicate through the AF, and the AF may be installed in the network device.
  • the UE and the network device communicate through FL Proxy.
  • the UE and the network device are both devices registered in the FL Proxy and can perform federated learning.
  • the FL Proxy can be installed in the network device.
  • the network equipment and UE are only illustrative.
  • federated learning is actually performed, a large number of UEs participate, and these UEs share the first application packet flow feature model in the network equipment.
  • the network device can update the model based on the gradient factor information sent by all UEs with which it performs federated learning.
  • the network device can obtain a more accurate application packet flow characteristic model through multiple rounds of training, and even use the application packet flow characteristic model to perform analysis services after the network device is in the process.
  • Update training of the application packet flow feature model can also be performed at this time.
  • the application packet flow feature model updated in each round can be used as the initial application packet flow feature model for the next round of model update training.
  • Figure 6 is a flow chart of an application detection method in an embodiment of the present application. After obtaining an application packet flow feature model that can be continuously updated through federated learning, the application packet flow feature model is applied in subsequent analysis services. In the embodiment of this application, the application packet flow characteristic model applied to the analysis service is located in the NWDAF network element.
  • NWDAF determines the UPF within the range.
  • NWDAF determines the UPF within the scope based on its own service scope.
  • PFDF sends an analysis subscription request to NWDAF.
  • NWDAF can be a PFD analysis subscription request.
  • the parameters carried in it can specify a network range, and NWDAF determines the UPF within the range based on the analysis subscription request.
  • the UPF receives the packets in the application packet flow of a certain application, that is, the second application packet flow.
  • UPF performs packet flow feature detection.
  • UPF obtains the characteristic information of the application message flow according to the message, that is, the characteristic information of the second application message flow, where the characteristic information of the application message flow is used to describe the message sending and receiving mode of the service.
  • the characteristic information of the application message flow includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, the At least one of the security protection mechanism of the message and the change pattern of the size of the application message flow for sending and receiving traffic.
  • UPF sends first information to NWDAF, where the first information includes characteristic information of the application packet flow.
  • NWDAF uses the application packet flow characteristic model to determine the application identifier matching the application packet flow, that is, the first corresponding relationship, according to the characteristic information of the application packet flow.
  • NWDAF sends second information to UPF.
  • the first information includes an application identifier matching the application packet flow.
  • NWDAF also performs online federated learning with the UE to update the application packet flow feature model.
  • NWDAF collects training data from network elements such as SMF and UPF, including the SUPI of the UE, the PDU session information established by the UE, the IP address assigned to the UE, the MAC address of the UE, and changes in the size of the application packet flow sending and receiving traffic.
  • the pattern also includes the start time, end time, bearer protocol, security protection mechanism, length of each message in the message sequence, sending interval of each message, and applications in each time slice of each application message flow. The size of the sending and receiving traffic of the packet flow.
  • the UE obtains application activity information from local records, including the time when each application sends and receives messages, the ⁇ source IP address, source port, protocol, destination IP address, destination port ⁇ five-tuple information of the messages sent and received or the UE's MAC address. Information, the amount of sending and receiving traffic of each application in each time slice.
  • the UE uses timestamp information, address quintuple information or MAC address information, and applies the time and traffic size of sending and receiving messages within the time slice to perform sample alignment.
  • NWDAF and UE perform online federated learning, and the specific steps for updating the application packet flow feature model can be seen in Figure 4 or Figure 5, which will not be described again.
  • the extracted characteristic information of the application packet flow is put into the application packet flow characteristic model for processing, and the application name corresponding to the application packet flow can be detected, because the application packet in the embodiment of the present application
  • the flow feature model is constantly being updated and optimized, so that the detection results are not affected by changes caused by application version upgrades, etc., making the detection results more accurate.
  • Figure 7 is a flow chart of another application detection method in an embodiment of the present application.
  • the NWDAF network element includes an application packet flow feature model that can be continuously updated through federated learning, and the application packet flow feature model is applied in subsequent analysis services.
  • NWDAF and UE perform online federated learning, and the specific steps for updating the application packet flow feature model can be seen in Figure 4 or Figure 5, which will not be described again.
  • NWDAF determines the UPF within the range.
  • NWDAF determines the UPF within the scope based on its own service scope.
  • PFDF sends an analysis subscription request to NWDAF.
  • NWDAF can be a PFD analysis subscription request.
  • the parameters carried in it can specify a network range, and NWDAF determines the UPF within the range based on the analysis subscription request.
  • UPF determines that it cannot directly detect the application identifier corresponding to the application packet flow. Specifically, UPF's fast detection module quickly detects the packets in the application packet flow based on its own stored PFD. If it cannot detect the PFD that matches the packet, it regards this application packet flow as the application packet flow to be detected. Hand it over to the feature detection module in UPF for processing.
  • UPF detects packet flow characteristics. Specifically, the feature detection module of UPF obtains the characteristic information of the application message flow to be detected and the address information of the application message flow to be detected based on the message, where the characteristic information of the application message flow to be detected is used to describe the sending and receiving messages of the service. mode, the address information of the application message flow to be detected is used to describe at least one of the source and destination information of the message sending and receiving.
  • the characteristic information of the application message flow to be detected includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, At least one of the security protection mechanism of each packet and the change pattern of the size of the sending and receiving traffic of the application packet flow.
  • the address information of the application packet flow to be detected includes the bearer protocol, the source port number of the packet, the destination port number of the packet, the source IP address of the packet, and the destination IP address of the packet.
  • the address information may also include the source MAC address and Destination MAC address, in which the bearer protocol, the source port number of the message, the destination port number of the message, the source IP address of the message, and the destination IP address of the message exist in the form of a five-tuple. .
  • UPF sends first information to NWDAF.
  • the first information includes characteristic information and address information of the application packet flow to be detected.
  • NWDAF obtains the application identifier matching the application message flow to be detected based on the first information. NWDAF inputs the characteristic information of the application packet flow to be detected into the application packet flow characteristic model to obtain an application identifier that matches the application packet flow to be detected.
  • NWDAF generates a PFD matching the application message flow to be detected and an aging time of the PFD based on the application identifier, address information and the communication analysis result of the UE that match the application message flow to be detected.
  • NWDAF can obtain the communication characteristic analysis of the UE from its own local data. Based on the communication characteristic analysis of the UE, it predicts the duration of the PDU session of the UE carrying the application message flow to be detected, and determines an aging time for this PFD. After the aging time expires, UPF will delete the PFD. This ensures that UPF can update the latest PFD in a timely manner if the application changes due to version upgrades.
  • NWDAF can also extend the PFD and add UE ID information to the PFD to ensure that the generated PFD is only used to match the application packet flow of this UE on the UPF, further improving the efficiency of application detection. accuracy.
  • NWDAF can also extend the PFD and add the address information of the terminal device to the PFD to ensure that the generated PFD is only used on the UPF to match the UE using the address of the terminal device to send and receive messages.
  • the received application packet flow packets further improve the accuracy of application detection.
  • NWDAF sends second information to UPF.
  • the second information includes PFD and PFD aging time.
  • NWDAF sends the second information to UPF through PFDF or through PFDF and SMF, which is not limited by this application.
  • UPF uses PFD to process subsequent messages of the above application. If the PFD is an extended PFD that carries the UE identity, then UPF will only use this PFD for matching in the subsequent application message flow carried by the PDU session of the UE. Specifically, UPF obtains the UE identity corresponding to the PDU session from the SMF through the N4 interface. And according to the UE identity, the PFD carrying the same UE identity is used to match the application message flow carried by this PDU session.
  • the PFD contains the address information of the terminal device, then the destination address of the message received by UPF on the terminal side of the subsequent application message flow and this This PFD is used for matching only when the address information matches, or when the source address of the packet sent by the terminal side of the subsequent application packet flow matches this address information. If the PFD still has a corresponding aging time, UPF starts the aging timer after setting the PFD, and clears the PFD after the timer expires. UPF matches the subsequent packets of the above application packet flow to PFD, and the rapid detection model performs processing.
  • NWDAF also performs online federated learning with the UE to update the application packet flow feature model.
  • NWDAF collects training data from network elements such as SMF and UPF, including the SUPI of the UE, the PDU session information established by the UE, the IP address assigned to the UE, the MAC address of the UE, and changes in the size of the application packet flow sending and receiving traffic.
  • the pattern also includes the start time, end time, bearer protocol, security protection mechanism, length of each message in the message sequence, sending interval of each message, and applications in each time slice of each application message flow. The size of the sending and receiving traffic of the packet flow.
  • the UE obtains application activity information from local records, including the time when each application sends and receives messages, the ⁇ source IP address, source port, protocol, destination IP address, destination port ⁇ five-tuple information of the messages sent and received or the UE's MAC address. Information, the amount of sending and receiving traffic of each application in each time slice.
  • the UE uses timestamp information, address quintuple information or MAC address information, and applies the time and traffic size of sending and receiving messages within the time slice to perform sample alignment.
  • NWDAF and UE perform online federated learning, and the specific steps for updating the application packet flow feature model can be seen in Figure 4 or Figure 5, which will not be described again.
  • the embodiment of this application also introduces UE ID and aging time to further improve the accuracy of detection.
  • this embodiment of the application also uses application packet flow The feature model determines the matching application identifier, and uses the application identifier and the address information of the application packet flow to generate a PFD, thereby avoiding the need to detect applications by performing feature matching on the entire application packet flow packet, and improving the processing performance of UPF.
  • Figure 8 is a flow chart of another application detection method in an embodiment of the present application.
  • the NWDAF network element includes an application packet flow feature model that can be continuously updated through federated learning, and the application packet flow feature model is applied in subsequent analysis services.
  • NWDAF determines the UPF within the range.
  • NWDAF determines the UPF within the scope based on its own service scope.
  • PFDF sends an analysis subscription request to NWDAF.
  • the analysis subscription request may be a PFD analysis subscription request, and the parameters carried therein may specify a network range.
  • NWDAF determines the UPF within the scope based on the analysis subscription request. NWDAF can also collect data from UPF needed to provide analysis services to PFDF through unknown application message flow event subscription.
  • UPF receives the packet in the application packet flow of an application.
  • UPF determines that it cannot directly detect the application identifier corresponding to the application packet flow. Specifically, UPF's fast detection module quickly detects the packets in the application packet flow based on its own stored PFD. If it cannot detect the PFD that matches the packet, it regards this application packet flow as the application packet flow to be detected. Hand it over to the feature detection module in UPF for processing.
  • UPF detects packet flow characteristics. Specifically, the feature detection module of UPF obtains the characteristic information of the application message flow to be detected and the address information of the application message flow to be detected based on the message, where the characteristic information of the application message flow to be detected is used to describe the sending and receiving messages of the service. mode, the address information of the application message flow to be detected is used to describe the source and destination of the message. at least one of the information. Specifically, the characteristic information of the application message flow to be detected includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, At least one of the security protection mechanism of each packet and the change pattern of the size of the sending and receiving traffic of the application packet flow.
  • the characteristic information of the application message flow to be detected includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, At least one of the security protection mechanism of each packet and the change pattern
  • the address information of the application packet flow to be detected includes the bearer protocol, the source port number of the packet, the destination port number of the packet, the source IP address of the packet, and the destination IP address of the packet.
  • the address information may also include the source MAC address and Destination MAC address, in which the bearer protocol, the source port number of the message, the destination port number of the message, the source IP address of the message, and the destination IP address of the message exist in the form of a five-tuple.
  • UPF sends first information to NWDAF.
  • the first information includes characteristic information and address information of the application packet flow to be detected.
  • This step can also be considered as NWDAF collecting unknown application packet flow events from UPF, where the event report contains characteristic information of the application packet flow.
  • NWDAF obtains the application identifier matching the application message flow to be detected based on the first information.
  • NWDAF inputs the characteristic information of the application packet flow to be detected into the application packet flow characteristic model to obtain an application identifier that matches the application packet flow to be detected.
  • the NWDAF sends second information to the PFDF.
  • the second information includes the application identifier matching the application message flow to be detected and the address information of the application message flow to be detected.
  • NWDAF sends the application identifier matching the application packet flow to be detected, the address information of the application packet flow to be detected, and the optional aging time as the output of the analysis service to PFDF.
  • the PFDF obtains the PFD corresponding to the application message flow to be detected based on the second information.
  • the PFDF generates a PFD corresponding to the application packet flow of the application based on the application identifier matched by the application packet flow to be detected and the address information of the application packet flow to be detected.
  • PFDF can also set a valid timer for the generated PFD based on the aging time contained in the NWDAF analysis service output.
  • PFDF sends third information to UPF.
  • the third information includes the PFD corresponding to the application message flow to be detected, and updates the PFD to UPF.
  • PFDF directly sends the updated PFD to UPF or PFDF sends the updated PFD to UPF through SMF.
  • the updated PFD is sent to UPF, and this application does not impose restrictions on this.
  • PFDF also sends the effective timer of PFD to UPF.
  • UPF uses PFD to process subsequent messages of the above application.
  • UPF matches the subsequent packets of the above application packet flow to PFD, and the rapid detection model performs processing.
  • PFDF sends a message to notify UPF to delete the corresponding PFD after the valid timer of the PFD expires.
  • the UPF deletes the corresponding PFD after the PFD valid timer expires.
  • NWDAF also performs online federated learning with the UE to update the application packet flow feature model.
  • NWDAF collects training data from network elements such as SMF and UPF, including the SUPI of the UE, the PDU session information established by the UE, the IP address assigned to the UE, the MAC address of the UE, and changes in the size of the application packet flow sending and receiving traffic.
  • the pattern also includes the start time, end time, bearer protocol, security protection mechanism, length of each message in the message sequence, sending interval of each message, and applications in each time slice of each application message flow. The size of the sending and receiving traffic of the packet flow.
  • the UE obtains application activity information from local records, including the time when each application sends and receives messages, the ⁇ source IP address, source port, protocol, destination IP address, destination port ⁇ five-tuple information of the messages sent and received or the UE's MAC address. Information, the amount of sending and receiving traffic of each application in each time slice.
  • the UE uses timestamp information, address quintuple information or MAC address information, and applies the time and traffic size of sending and receiving messages within the time slice to perform sample alignment.
  • NWDAF conducts online federated learning with the UE, and the specific steps for updating the application packet flow feature model can be seen in Figure 4 or Figure 5, which will not be described again.
  • the embodiments of this application also use the application packet flow characteristic model to determine the matching application identifier, and use the application identifier and the address information of the application packet flow to generate PFD, thereby avoiding the need to detect applications by performing feature matching on the entire application packet flow packet, improving the processing performance of UPF.
  • Figure 9 is a flow chart of another application detection method in an embodiment of the present application.
  • the NWDAF network element includes an application packet flow feature model that can be continuously updated through federated learning, and the application packet flow feature model is applied in subsequent analysis services.
  • NWDAF determines the UPF within the range.
  • NWDAF determines the UPF within the scope based on its own service scope.
  • PFDF sends an analysis subscription request to NWDAF.
  • NWDAF can be a PFD analysis subscription request, and the parameters carried in it can specify the network range.
  • NWDAF determines the UPF within the scope based on the analysis subscription request.
  • UPF receives the packet in the application packet flow of an application.
  • UPF determines that it cannot directly detect the application identifier corresponding to the application packet flow. Specifically, UPF's fast detection module quickly detects the packets in the application packet flow based on its own stored PFD. If it cannot detect the PFD that matches the packet, it regards this application packet flow as the application packet flow to be detected. Hand it over to the feature detection module in UPF for processing.
  • UPF detects packet flow characteristics. Specifically, the feature detection module of UPF obtains the characteristic information of the application message flow to be detected and the address information of the application message flow to be detected based on the message, where the characteristic information of the application message flow to be detected is used to describe the sending and receiving messages of the service. mode, the address information of the application message flow to be detected is used to describe at least one of the source and destination information of the message sending and receiving. Specifically, the characteristic information of the application message flow to be detected includes the sending direction (ie, receiving or sending) of each message in the message sequence of the application message flow, the length of each message, the sending interval of each message, At least one of the security protection mechanisms for each message. The address information of the application packet flow to be detected includes the bearer protocol, server-side port number and IP address.
  • UPF sends first information to NWDAF, where the first information includes characteristic information of the application packet flow to be detected.
  • NWDAF obtains the application identifier corresponding to the application message flow to be detected based on the first information. NWDAF inputs the characteristic information of the application packet flow to be detected into the application packet flow characteristic model to obtain an application identifier that matches the application packet flow to be detected.
  • the NWDAF sends second information to the UPF.
  • the second information includes the application identifier corresponding to the application message flow to be detected, the application identifier matching the application message flow to be detected, and the communication analysis result of the UE.
  • the UPF generates a PFD that matches the application message flow to be detected and the aging time of the PFD. Specifically, UPF generates a PFD corresponding to the application packet flow of this application based on the application identifier matched by the application packet flow to be detected and the address information of the application packet flow to be detected. The UPF can also determine an aging time for this PFD based on the communication prediction information in the UE's communication analysis results, such as the predicted duration of the PDU session. After the aging time expires, UPF will delete In addition to this PFD, this can ensure that when the application changes due to version upgrades, etc., UPF can update the latest PFD in a timely manner.
  • UPF uses PFD to process subsequent messages of the above application.
  • UPF matches the subsequent packets of the above application packet flow to PFD, and the rapid detection model performs processing.
  • NWDAF also performs online federated learning with the UE to update the application packet flow feature model.
  • NWDAF collects training data from network elements such as SMF and UPF, including the SUPI of the UE, the PDU session information established by the UE, the IP address assigned to the UE, the MAC address of the UE, and changes in the size of the application packet flow sending and receiving traffic.
  • the pattern also includes the start time, end time, bearer protocol, security protection mechanism, length of each message in the message sequence, sending interval of each message, and applications in each time slice of each application message flow. The size of the sending and receiving traffic of the packet flow.
  • the UE obtains application activity information from local records, including the time when each application sends and receives messages, the ⁇ source IP address, source port, protocol, destination IP address, destination port ⁇ five-tuple information of the messages sent and received or the UE's MAC address. Information, the amount of sending and receiving traffic of each application in each time slice.
  • the UE uses timestamp information, address quintuple information or MAC address information, and applies the time and traffic size of sending and receiving messages within the time slice to perform sample alignment.
  • NWDAF and UE perform online federated learning, and the specific steps for updating the application packet flow feature model can be seen in Figure 4 or Figure 5, which will not be described again.
  • the embodiments of this application also use the application packet flow characteristic model to determine the matching application identifier, and use the application identifier and the address information of the application packet flow to generate PFD, thereby avoiding the need to detect applications by performing feature matching on the entire application packet flow packet, improving the processing performance of UPF.
  • Figure 10 is a schematic diagram of a communication device 10 provided by an embodiment of the present application.
  • the device 10 can be a device that participates in updating the application flow feature information model, such as the above-mentioned UE, network equipment, or a chip or circuit. , for example, it can be provided in the chip or circuit of the above-mentioned device participating in updating the application flow feature information model.
  • the device 10 may include a processor 11 (ie, an example of a processing unit) and a memory 12 .
  • the memory 12 is used to store instructions
  • the processor 11 is used to execute the instructions stored in the memory 12, so that the device 10 implements the steps performed by the device for updating the application flow feature information model in the corresponding method in Figure 5.
  • the device 10 may also include an input port 13 (ie, an example of a communication unit) and an output port 14 (ie, another example of a communication unit).
  • the processor 11, the memory 12, the input port 13 and the output port 14 can communicate with each other through internal connection paths to transmit control and/or data signals.
  • the memory 12 is used to store computer programs.
  • the processor 11 can be used to call and run the computer program from the memory 12 to control the input port 13 to receive signals and the output port 14 to send signals to complete the terminal equipment in the above method.
  • the memory 12 may be integrated into the processor 11 or may be provided separately from the processor 11 .
  • the input port 13 is a receiver
  • the output port 14 is a transmitter.
  • the receiver and transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively called transceivers.
  • the input port 13 is an input interface
  • the output port 14 is an output interface
  • the functions of the input port 13 and the output port 14 can be implemented through a transceiver circuit or a dedicated chip for transceiver.
  • the processor 11 may be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer may be considered to implement the general communication method provided by the embodiments of the present application. letter equipment.
  • the program code that implements the functions of the processor 11, the input port 13, and the output port 14 is stored in the memory 12, and the general processor implements the functions of the processor 11, the input port 13, and the output port 14 by executing the code in the memory 12.
  • Each module or unit in the communication device 10 may be used to perform each action or processing process performed by the device (for example, a network device) that updates the application flow feature information model in the above method.
  • the device for example, a network device
  • the device for example, a network device
  • its detailed description is omitted. .
  • Figure 11 is a schematic diagram of a communication device 20 provided by an embodiment of the present application.
  • the device 20 can be a device participating in application detection, such as an NWDAF network element, a UPF network element, or a chip or circuit, such as The chip or circuit may be provided in the above-mentioned participating application detection equipment.
  • the device 20 may include a processor 21 (ie, an example of a processing unit) and a memory 22 .
  • the memory 22 is used to store instructions
  • the processor 21 is used to execute the instructions stored in the memory 22, so that the device 20 implements the steps performed by the detected equipment in the corresponding method as shown in Figures 6-8.
  • the device 20 may also include an input port 23 (ie, an example of a communication unit) and an output port 24 (ie, another example of a communication unit).
  • the processor 21, the memory 22, the input port 23 and the output port 24 can communicate with each other through internal connection paths to transmit control and/or data signals.
  • the memory 22 is used to store computer programs.
  • the processor 21 can be used to call and run the computer program from the memory 22 to control the input port 23 to receive signals and the output port 24 to send signals to complete the terminal equipment in the above method.
  • the memory 22 may be integrated into the processor 21 or may be provided separately from the processor 21 .
  • the input port 23 is a receiver
  • the output port 24 is a transmitter.
  • the receiver and transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively called transceivers.
  • the input port 23 is an input interface
  • the output port 24 is an output interface
  • the functions of the input port 23 and the output port 24 can be implemented by a transceiver circuit or a dedicated chip for transceiver.
  • the processor 21 may be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer may be considered to implement the communication device provided by the embodiments of the present application.
  • the program codes that implement the functions of the processor 21, the input port 23, and the output port 24 are stored in the memory 22, and the general processor implements the functions of the processor 21, the input port 23, and the output port 24 by executing the codes in the memory 22.
  • Each module or unit in the communication device 20 may be used to perform each action or processing process performed by the device (for example, NWDAF network element) that is applied for detection in the above method.
  • NWDAF network element for example, NWDAF network element
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Computation (AREA)
  • Medical Informatics (AREA)
  • Artificial Intelligence (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供了一种通信方法和装置，该方法包括：网络设备获取应用相关的第一数据，所述第一数据是根据第一应用报文流确定的；所述网络设备向终端设备发送第一模型或者所述第一模型的部分，所述第一模型用于确定所述第一应用报文流的应用对应的应用标识；所述网络设备向所述终端设备发送所述第一数据，所述第一数据用于确定第一模型的校正因子；所述网络设备接收来自所述终端设备的所述校正因子；所述网络设备根据所述校正因子，对所述第一模型进行调整。本申请实施例通过使用终端设备参与对网络设备中的第一模型进行调整，从而提高了模型的准确度，进而提高了应用模型进行应用检测的准确性。

Description

一种通信方法和装置
本申请要求于2022年5月6日提交中国专利局、申请号为202210488344.6、申请名称为“一种通信方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信领域，并且，更具体地，涉及用于应用检测的方法和装置。
背景技术
用户设备(user equipment，UE)通过移动网络连接到企业网或互联网等数据网络(data network，DN)中，访问DN中的应用服务器，进行业务通信，其中UE和应用服务器之间传递的某个应用的报文称为这个应用的报文流。运营商为了保障特定应用的业务质量(例如视频通话)，或者为了避免特定业务(例如P2P下载)占用过多网络资源影响其他业务，会检测终端设备的应用报文流对应什么应用，然后采取保障或控制的措施。现有技术通过预先设置应用对应的报文流描述(packet flow description，PFD)进行应用检测。
但是，当前在现实网络中，应用客户端或服务器经常升级，会导致PFD或应用的应用报文流统计特征发生变化，使用现有技术无法及时更新模型，会影响应用检测的准确性。
发明内容
本申请实施例提供一种用于应用检测的方法和装置。
第一方面，提供了一种用于应用检测的方法，其特征在于，包括：网络设备获取第一数据，所述第一数据是根据第一应用报文流确定的；所述网络设备向终端设备发送第一模型或者所述第一模型的部分，所述第一模型用于确定所述第一应用报文流对应的应用标识；所述网络设备向所述终端设备发送所述第一数据，所述第一数据用于确定第一模型的校正因子；所述网络设备接收来自所述终端设备的所述校正因子；所述网络设备根据所述校正因子对所述第一模型进行调整。
本申请中第一数据可以是终端设备某个应用的，也可以是某几个应用的数据。本申请中第一数据是根据第一应用报文流确定的，所述第一应用报文流是终端设备通过网络设备向应用服务器发送的或从应用服务器接收的一系列报文。
本申请中的网络设备可以是单个网元，示例性地，网络设备可以是网络数据分析功能网元、用户面功能网元；本申请中的网络设备也可以是多个网元集成在同一个实体设备上，示例性地，网络数据分析功能网元和用户面功能网元集成在同一实体网络设备上。
本申请中网络设备向终端设备发送第一数据可以一次性全部发完，也可以分成多次发送，本申请对此不做限定。
本申请中网络设备获得第一数据的方式可以是网络设备从其他设备中获取或者网络 设备自身存储有相关数据。因为网络设备获得第一数据的方式对于本申请实施例的实现没有影响，因此本申请对此不做限定。
本申请通过将网络设备的第一数据和第一模型发送给对应的终端设备，终端设备可以得到第一数据对应的应用标识，得到第一模型的损失和梯度信息并发送给网络设备，网络设备对第一模型进行更新，从而，使得第一模型更加准确，进而使得使用第一模型进行的应用检测更加准确。
结合第一方面，在第一方面的某些实现方式中，所述网络设备是网络数据分析功能网元或用户面功能网元。
结合第一方面，在第一方面的某些实现方式中，所述第一数据包括：所述第一应用报文流的地址信息，和/或用于指示所述第一应用报文流的传输时段的时间戳。
所述网络设备根据第一应用报文流确定所述第一数据，在一种可能的实现方式中，所述网络设备根据第一应用报文流内的报文，确定所述第一应用报文流的地址信息；在另一种可能的实现方式中，所述网络设备根据第一应用报文流内的报文经过网络设备进行传输的时间，确定所述时间戳；在又一种可能的实现方式中，所述网络设备根据第一应用报文流内的报文，确定所述第一应用报文流的地址信息和所述时间戳。
结合第一方面，在第一方面的某些实现方式中，所述第一数据还包括：所述第一应用报文流的特征信息。
所述网络设备根据第一应用报文流确定所述第一数据，一种可能的实现为，所述网络设备根据第一应用报文流内的报文序列，确定所述第一应用报文流的特征信息。
其中，应用报文流的特征信息用于描述应用业务的收发报文模式。具体地，应用报文流的特征信息包括所述应用报文流的报文序列中各个报文的发送方向(即接收或发送)、各个报文的长度、各个报文的发送间隔、各个报文的安全保护机制、应用报文流收发流量大小变化样式中的至少一种。应用报文流的地址信息是UE和应用服务器之间传递的某个应用的报文的源地址(IP地址或MAC地址)、目的地址(IP地址或MAC地址)、协议、源端口号、目的端口号中的全部或部分组合。具体地，UE侧的应用报文流的地址信息是指UE发送的业务流报文的源地址或UE接收的业务流报文的目的地址。具体的，用于指示所述第一应用报文流的传输时段的时间戳是终端设备和应用服务器直接接收和发送的第一应用报文流经过网络设备的时间。
结合第一方面，在第一方面的某些实现方式中，所述第一数据是经过所述网络设备加密后的数据。
本申请通过对第一数据加密，有效保护了用户的隐私，提高了安全性。
结合第一方面，在第一方面的某些实现方式中，所述第一模型是所述网络设备和所述终端设备进行纵向联邦学习的模型。
结合第一方面，在第一方面的某些实现方式中，所述校正因子包括：所述第一模型的梯度和/或损失。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：所述网络设备将第二数据输入调整后的所述第一模型，获得第一标识；所述第二数据是根据第二应用报文流确定的，所述第二数据包括第二应用报文流的特征信息。
本申请中第二数据是根据第二报文流确定的，所述第二报文流是终端设备通过网络设 备向应用服务器发送的或从应用服务器接收的一系列报文。本申请通过使用调整后的第一模型进行应用检测，可以得到更加准确地检测结果，从而提高应用检测的精度。
在一种可能的实现方式中，所述第二应用报文流是所述第一应用报文流，所述第二应用报文流的特征信息是所述第一应用报文流的特征信息。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：所述网络设备确定所述第二应用报文流的特征信息和所述第一标识的第一对应关系。
本申请通过建立第一对应关系，可以在网络设备接收到同一应用的数据时快速识别应用的应用标识，从而减少了网络设备的计算量，提高了应用检测的效率。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：所述网络设备向用户面功能网元发送所述第一对应关系。
结合第一方面，在第一方面的某些实现方式中，所述网络设备根据所述第一对应关系确定所述第二应用报文流对应的第一报文流描述。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：如果在第一时段内接收到第三应用报文流，则根据所述第一报文流描述，将所述第一标识确定为所述第三应用报文流的应用标识，所述第一时段为所述第一应用关系的有效时段，所述第三应用报文流与所述第二应用报文流的地址信息相同。
需要说明的是，报文流描述包括应用报文流地址信息和应用标识的对应关系。网络设备根据第一对应关系确定第一报文流描述包括：网络设备在收发应用报文流的过程中获得应用报文流的特征信息和地址信息的对应关系；网络设备根据第一对应关系确定应用报文流的特征信息和应用标识的对应关系；两者叠加可以确定应用报文流描述。
本申请通过确定有效时间进一步提高了应用检测的准确性。
在一种可能的实现方式中，在得到第一对应关系之后，启动定时器；在所述定时器超时后，删除所述第一对应关系。
结合第一方面，在第一方面的某些实现方式中，所述第二数据还包括所述第二应用报文流的地址信息，所述第二应用报文流的地址信息包括所述第二应用报文流携带的终端设备的地址信息。
在一种可能的实现方式中，所述第二应用报文流是所述第一应用报文流，所述第二应用报文流的地址信息是所述第一应用报文流的地址信息。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：所述网络设备确定所述第二应用报文流的地址信息和所述第一标识的第二对应关系。
本申请通过建立第二对应关系，可以在网络设备接收到同一应用的数据时快速识别应用的应用标识，从而减少了网络设备的计算量，提高了应用检测的效率。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：所述网络设备向用户面功能网元发送所述第二对应关系。
结合第一方面，在第一方面的某些实现方式中，所述网络设备根据所述第二对应关系确定所述第二应用报文流的第二报文流描述，所述第二报文流描述包括所述终端设备的地址信息。
具体地，所述第二报文流描述包括所述第二对应关系。
在一种可能的实现中，所述第二报文流描述包括所述第二应用报文流的终端侧地址信 息，所述第二应用报文流的服务器侧地址信息，和所述第一标识。
通过终端设备的地址信息，报文流描述可以针对特定的终端设备，从而提高应用检测的准确性。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：如果在第二时段内接收到第四应用报文流，则根据所述第二报文流描述，将所述第一标识确定为所述第四应用报文流的应用标识，所述第二时段为所述第二报文流描述的有效时段，所述第四应用报文流与所述第二应用报文流的地址信息相同。
具体的，所述第四应用报文流的终端侧的地址信息和所述第二应用报文流的终端侧的地址信息相同，并且所述第四应用报文流的应用服务器侧的地址信息和所述第二应用报文流的应用服务器侧的地址信息相同。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：如果在第二时段内接收到第四数据，则根据所述第二对应关系，将所述第一标识确定为所述第四数据的应用标识，所述第二时段为所述第一应用关系的有效时段，所述第四数据包括所述第二应用报文流的特征信息和所述第二应用报文流的地址信息。
本申请通过确定有效时间和比对终端侧的地址信息进一步提高了应用检测的准确性。
在一种可能的实现方式中，在得到第二对应关系之后，启动定时器；在所述定时器超时后，删除所述第二对应关系。
第二方面，提供了一种用于应用检测的方法，其特征在于，包括：终端设备接收来自网络设备的第一数据，所述第一数据是所述网络设备根据第一应用报文流确定的；所述终端设备接收来自网络设备的第一模型或者所述第一模型的部分，所述第一模型用于确定所述第一应用报文流对应的应用标识；所述终端设备根据所述第一数据确定第一标识；所述终端设备根据所述第一标识确定校正因子，所述校正因子用于调整所述第一模型；所述终端设备向所述网络设备发送所述校正因子。
本申请中，终端设备所述终端设备可以根据第一数据和第一标识确定第一模型的校正因子。
在一种可能的实现方式中，终端设备获取第一模型，终端设备根据接收到的第一数据找到对应的本地应用活动信息从而确定应用标识，终端设备根据第一数据和应用标识，计算第一模型的损失和梯度。
在另一种可能的实现方式中，终端设备获取第一模型的部分模型，终端设备根据接收到的第一数据找到对应的本地应用活动信息从而确定应用标识，终端设备根据第一数据和应用标识，计算第一模型的部分模型的损失和梯度。进一步地，网络设备还可以将自身计算的网络设备侧部分模型的梯度因子信息加密发送给相应的终端设备，终端设备也可以根据网络设备计算的梯度因子信息和终端设备自身计算的梯度因子信息更新UE的业务流特征模型。
其中，应用活动信息是各个APP在终端设备上运行状态的信息，具体的，应用活动信息包括在各个时间点或时间段内，APP进行通信时使用的网络接口的IP地址和端口信息，APP的电量消耗，APP是否在前台运行(即是否前台亮屏)。
本申请通过终端设备根据第一数据和第一标识，可以得到第一模型或第一模型的部分模型的损失和梯度信息并发送给网络设备，网络设备对第一模型进行更新，从而，使得第 一模型更加准确，进而使得使用第一模型进行的应用检测更加准确。
结合第二方面，在第二方面的某些实现方式中，所述第一数据是经过所述网络设备加密的数据。
本申请通过对第一数据加密，有效保护了用户的隐私，提高了安全性。
结合第二方面，在第二方面的某些实现方式中，所述第一数据包括：所述第一应用报文流的地址信息，和/或用于指示所述第一应用报文流的传输时段的时间戳。
具体的，所述第一应用报文流的地址信息是所述第一应用报文流的服务器侧地址和/或第一应用报文流的终端侧地址。
结合第二方面，在第二方面的某些实现方式中，所述第一数据还包括：所述第一应用报文流的特征信息。
结合第二方面，在第二方面的某些实现方式中，所述终端设备基于所述第一数据得到第一标识包括：所述终端设备确定第一特征，所述第一特征是所述终端设备和所述网络设备数据共有的特征；所述终端设备根据所述第一特征确定与第一数据对应的第二数据，所述第二数据包括第一标识。
结合第二方面，在第二方面的某些实现方式中，所述第一特征包括：所述第一数据的传输时段的时间戳和/或所述第一应用报文流的地址信息。
示例性地，所述第二数据是与第一特征匹配概率最大的应用的应用标识。具体的，可以选择应用活动信息中某个APP使用的网络接口的IP地址和端口信息与第一数据中的终端侧应用报文流的地址信息相同，并且应用活动信息中这个APP的电量消耗和/或前台亮屏时间与第一数据中的时间戳匹配。
结合第二方面，在第二方面的某些实现方式中，根据所述第一标识得到所述校正因子包括：若所述终端设备接收所述第一模型，则所述终端设备根据所述第一标识和所述第一应用报文流的特征信息确定所述第一模型的所述校正因子；或者若所述终端设备接收所述第一模型的部分，则所述终端设备根据所述第一标识和所述第一特征确定所述第一模型的所述校正因子。
第三方面，提供了一种用于应用检测的方法，其特征在于，包括：网络设备获取的第一数据，所述第一数据是根据第一应用报文流确定的；所述网络设备向终端设备发送所述第一数据；所述网络设备接收来自所述终端设备第一标识，所述第一标识是所述终端设备根据所述第一数据确定的应用标识；所述网络设备根据所述第一数据和所述第一标识，对所述第一模型进行调整，所述第一模型用于确定所述应用对应的应用标识。
本申请中的网络设备可以是单个网元，示例性地，网络设备可以是网络数据分析功能网元、用户面功能网元；本申请中的网络设备也可以是多个网元集成在同一个实体设备上，示例性地，网络数据分析功能网元和用户面功能网元集成在同一实体网络设备上。
本申请中网络设备向终端设备发送第一数据可以一次性全部发完，也可以分成多次发送，本申请对此不做限定。
本申请中网络设备获得第一数据的方式可以是网络设备从其他设备中获取或者网络设备自身存储有相关数据。因为网络设备获得第一数据的方式对于本申请实施例的实现没有影响，因此本申请对此不做限定。
本申请通过将网络设备的第一数据发送给对应的终端设备，终端设备可以得到第一数 据对应的应用标识并发送给网络设备，网络设备根据第一数据和应用标识对第一模型进行更新，从而，使得第一模型更加准确，进而使得使用第一模型进行的应用检测更加准确。
结合第三方面，在第三方面的某些实现方式中，所述方法还包括：所述网络设备根据调整后的所述第一模型，得到第二标识。
本申请通过使用调整后的第一模型进行应用检测，可以得到更加准确地检测结果，从而提高应用检测的精度。
结合第三方面，在第三方面的某些实现方式中，所述网络设备是网络数据分析功能网元或用户面功能网元。
结合第三方面，在第三方面的某些实现方式中，所述方法还包括：所述网络设备得到应用报文流的特征信息和所述第二标识的第一对应关系或应用报文流的地址信息和所述第二标识的第二对应关系。
本申请通过建立第一对应关系或第二对应关系，可以在网络设备接收到同一应用的数据时快速识别应用的应用标识，从而减少了网络设备的计算量，提高了应用检测的效率。
结合第三方面，当所述网络设备是网络数据分析功能网元时，所述网络设备向用户面功能网元发送所述第一对应关系或所述第二对应关系。
结合第三方面，在第三方面的某些实现方式中，所述应用报文流描述包括所述终端设备的地址信息。
结合第三方面，在第三方面的某些实现方式中，所述方法还包括：确定所述第一对应关系或所述第二对应关系的有效时间。
本申请通过确定有效时间进一步提高了应用检测的准确性。
在一种可能的实现方式中，在得到第一对应关系或第二对应关系之后，启动定时器；在所述定时器超时后，删除所述第一对应关系。
结合第三方面，在第三方面的某些实现方式中，所述第一数据是经过所述网络设备加密后的数据。
本申请通过对第一数据加密，有效保护了用户的隐私，提高了安全性。
结合第三方面，在第三方面的某些实现方式中，所述第一数据包括：所述第一应用报文流的地址信息，和/或用于指示所述第一应用报文流的传输时段的时间戳。
结合第三方面，在第三方面的某些实现方式中，所述第一数据还包括：所述第一应用报文流的特征信息。
结合第三方面，在第三方面的某些实现方式中，所述第一模型是所述网络设备和所述终端设备进行纵向联邦学习的模型。
第四方面，提供了一种用于应用检测的方法，其特征在于，包括：终端设备接收来自网络设备的第一数据，所述第一数据是根据第一应用报文流确定的；所述终端设备确定第一标识，所述第一标识是所述第一应用报文流对应的应用标识；所述终端设备向所述网络设备发送第一标识。
本申请通过终端设备接收第一信息得到第一标识，并将第一标识发送给网络设备，使得网络设备可以更新第一模型，从而，提高应用检测的准确性。
结合第四方面，在第四方面的某些实现方式中，所述第一数据是经过所述网络设备加密的数据。
本申请通过对第一数据加密，有效保护了用户的隐私，提高了安全性。
结合第四方面，在第四方面的某些实现方式中，所述第一数据包括：应用报文流的地址信息或时间戳中的至少一项；或者，应用报文流的地址信息或时间戳中的至少一项和应用报文流的特征信息。
结合第四方面，在第四方面的某些实现方式中，所述终端设备确定第一标识包括：所述终端设备确定第一特征，所述第一特征是所述终端设备和所述网络设备数据共有的特征；所述终端设备根据所述第一特征确定与第一数据对应的第二数据，所述第二数据包括第一标识。
结合第四方面，在第四方面的某些实现方式中，所述第一特征包括：时间戳和/或地址信息。
第五方面，提供了一种用于应用检测的系统，其特征在于，包括：第一网络设备和第二网络设备；所述第一网络设备用于获取并向所述第二网络设备发送应用相关的第一数据，所述第一数据是根据第一应用报文流确定的；所述第一网络设备用于向第二网络设备发送第一模型或第一模型的部分，所述第一模型用于确定所述应用对应的应用标识；所述第二网路设备用于接收并向所述终端设备发送所述第一数据和所述第一模型或所述第一模型的部分，所述第一数据用于确定第一模型的校正因子；所述第二网络设备还用于接收并向所述第一网络设备发送所述校正因子；所述第一网络设备还用于根据所述校正因子调整所述第一模型。
结合第五方面，在第五方面的某些实现方式中，所述第一网络设备还用于使用调整过的所述第一模型得到第一标识。
结合第五方面，在第五方面的某些实现方式中，所述第一网络设备还用于得到应用报文流的特征信息和所述第一标识的第一对应关系或应用报文流的地址信息和所述第一标识的第二对应关系。
结合第五方面，在第五方面的某些实现方式中，所述第一网络设备还用于向所述第二网络设备发送所述第一对应关系或所述第二对应关系。
结合第五方面，在第五方面的某些实现方式中，所述第一网络设备还用于确定所述第一对应关系或所述第二对应关系的有效时间。
结合第五方面，在第五方面的某些实现方式中，所述第一网络设备是网络数据分析功能网元；所述第二网络设备是用户面功能网元。
第六方面，提供了一种通信装置，包括：处理模块，用于获取应用相关的第一数据，所述第一数据是根据第一应用报文流确定的；收发模块，用于向终端设备发送所述第一数据和第一模型或者所述第一模型的部分，所述第一模型用于确定所述第一应用报文流对应的应用标识，所述第一数据用于确定第一模型的校正因子；所述收发模块，还用于接收来自所述终端设备的所述校正因子；所述处理模块，还用于根据所述校正因子对所述第一模型进行调整。
结合第六方面，在第六方面的某些实现方式中，所述第一数据包括：所述第一应用报文流的地址信息，和/或用于指示所述第一应用报文流的传输时段的时间戳。
结合第六方面，在第六方面的某些实现方式中，所述第一数据还包括：所述第一应用报文流的特征信息。
结合第六方面，在第六方面的某些实现方式中，所述第一数据是经过所述网络设备加密后的数据。
结合第六方面，在第六方面的某些实现方式中，所述第一模型是所述网络设备和所述终端设备进行纵向联邦学习的模型。
结合第六方面，在第六方面的某些实现方式中，所述校正因子包括：所述第一模型的梯度和/或损失。
结合第六方面，在第六方面的某些实现方式中，所述收发模块，还用于获取第二数据所述第二数据是根据第二应用报文流确定的，所述第二数据包括所述第二应用报文流的特征信息；所述处理模块，还用于将所述第二数据输入调整后的所述第一模型，得到第一标识。
结合第六方面，在第六方面的某些实现方式中，所述处理模块还用于确定所述第二应用报文流的特征信息和所述第一标识的第一对应关系。
结合第六方面，在第六方面的某些实现方式中，所述收发模块还用于向用户面功能网元发送所述第一对应关系。
结合第六方面，在第六方面的某些实现方式中，所述收发模块还用于向用户面功能网元发送所述第一对应关系向用户面功能网元发送所述第一对应关系。
结合第六方面，在第六方面的某些实现方式中，所述处理模块还用于确定所述第二数据的报文流描述，所述报文流描述包括所述第一对应关系。
结合第六方面，在第六方面的某些实现方式中，所述处理模块还用于根据所述第一对应关系确定所述第二应用报文流对应的第一报文流描述。
结合第六方面，在第六方面的某些实现方式中，所述收发模块，还用于在第一时段接收到第三应用报文流；所述处理模块，根据所述第一报文流描述，将所述第一标识确定为所述第三应用报文流的应用标识，所述第一时段为所述第一应用关系的有效时段，所述第三应用报文流与所述第二应用报文流的地址信息相同。
结合第六方面，在第六方面的某些实现方式中，所述处理模块还用于确定所述第二应用报文流的地址信息和所述第一标识的第二对应关系。
结合第六方面，在第六方面的某些实现方式中，所述收发模块还用于向用户面功能网元发送所述第二对应关系。
结合第六方面，在第六方面的某些实现方式中，所述收发模块还用于向用户面功能网元发送所述第二对应关系。
结合第六方面，在第六方面的某些实现方式中，所述处理模块还用于根据所述第二对应关系确定所述第二应用报文流对应的第二报文流描述。
结合第六方面，在第六方面的某些实现方式中，所述收发模块，还用于在第二时段内接收到第四应用报文流；所述处理模块，根据所述第二报文流描述，将所述第一标识确定为所述第四应用报文流的应用标识，所述第二时段为所述第二报文流描述的有效时段，所述第四应用报文流与所述第二应用报文流的地址信息相同。
第七方面，提供了一种通信装置，包括：收发模块，用于接收来自网络设备的第一数据和第一模型或者所述第一模型的部分，所述第一数据是根据第一应用报文流确定的，所述第一模型用于确定所述应用对应的应用标识，所述第一数据用于确定第一模型的校正因 子；所述处理模块，用于根据所述第一应用报文流确定第一标识并根据所述第一标识和所述第一特征确定校正因子，所述校正因子用于调整所述第一模型；所述收发模块，还用于向所述网络设备发送所述校正因子。
结合第七方面，在第七方面的某些实现方式中，所述第一数据是经过所述网络设备加密的数据。
结合第七方面，在第七方面的某些实现方式中，所述第一数据包括：所述第一应用报文流的地址信息，和/或用于指示所述第一应用报文流的传输时段的时间戳。
结合第七方面，在第七方面的某些实现方式中，所述第一数据还包括：所述第一应用报文流的特征信息。
结合第七方面，在第七方面的某些实现方式中，根据所述第一数据得到所述第一标识包括：所述处理模块根据所述第一数据确定第一特征，所述第一特征是所述终端设备和所述网络设备数据共有的特征；所述处理模块根据所述第一特征确定与第一数据对应的第二数据，所述第二数据包括第一标识。
结合第七方面，在第七方面的某些实现方式中，所述第一特征包括：所述第一应用报文流的传输时段的时间戳和/或所述第一应用报文流的地址信息。
结合第七方面，在第七方面的某些实现方式中，根据所述第一标识得到所述校正因子包括：若所述收发模块接收所述第一模型，则所述处理模块根据所述第一标识和所述第一应用报文流的特征信息得到所述第一模型的所述校正因子；若所述接收模块接收所述第一模型的部分，则所述处理模块根据所述第一标识和所述第一特征得到所述第一模型的所述校正因子。
第八方面，提供了一种通信设备，包括，处理器，存储器，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得该通信设备执行第一或第二或第三或第四方面及其各种可能实现方式中的通信方法。
一种可能的实现方式，所述处理器为一个或多个，所述存储器为一个或多个。
一种可能的实现方式，所述存储器可以与所述处理器集成在一起，或者所述存储器与处理器分离设置。
可选的，该通信设备还包括，发射机(发射器)和接收机(接收器)。
第九方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当所述计算机程序被运行时，使得计算机执行上述第一方面或第二方面或第三方面或第四方面中任一种可能实现方式中的方法。
第十方面，提供了一种计算机可读介质，所述计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述第一方面或第二方面或第三方面或第四方面中任一种可能实现方式中的方法。
第十一方面，提供了一种芯片系统，包括存储器和处理器，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得安装有该芯片系统的通信设备执行上述第一方面或第二方面或第三方面或第四方面中任一种可能实现方式中的方法。
其中，该芯片系统可以包括用于发送信息或数据的输入电路或者接口，以及用于接收信息或数据的输出电路或者接口。
附图说明
图1是本申请实施例应用场景的系统示意图。
图2是本申请实施例的系统结构示意图。
图3是本申请实施例的应用报文流特征模型示意图。
图4是本申请实施例中一优化应用报文流特征模型的方法流程图。
图5是本申请实施例中一优化应用报文流特征模型的方法流程图。
图6是本申请实施例中一应用检测的方法流程图。
图7是本申请实施例中再一应用检测的方法流程图。
图8是本申请实施例中另一应用检测的方法流程图。
图9是本申请实施例中另一应用检测的方法流程图。
图10是本申请实施例中通信装置的一例的示意性框图。
图11是本申请实施例中通信装置的一例的示意性框图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)系统或新无线(new radio，NR)等。
本申请实施例以5G网络系统为例进行说明，需要说明的是本申请同样可以应用于现有的4G网络系统，也可以适用于未来的6G等网络系统，本申请对此不作限制。
以5G系统为例，图1是本申请应用的网络系统示意图。其中包括网络数据分析网元、接入和移动管理网元、会话管理网元、策略控制网元和切片接入控制网元。另外，该系统的正常运行期间还会和终端设备、接入网(access network，AN)设备、用户面网元、网络切片选择网元等进行交互。
下面分别对上述设备或网元进行介绍。
接入和移动管理网元：主要用于移动网络中的终端的附着、移动性管理、跟踪区更新流程，接入管理网元终结了非接入层(non access stratum，NAS)消息、完成注册管理、连接管理以及可达性管理、分配跟踪区域列表(track area list，TA list)以及移动性管理等，并且透明路由会话管理(session management，SM)消息到会话管理网元。在5G通信系统中，接入管理网元可以是接入与移动性管理功能(access and mobility management function，AMF)。
会话管理网元：主要用于移动网络中的会话管理，如会话建立、修改、释放。具体功能如为终端分配互联网协议(internet protocol，IP)地址、选择提供报文转发功能的用户面网元等。在5G通信系统中，会话管理网元可以是会话管理功能(session management function，SMF)。
策略控制网元：包含用户签约数据管理功能、策略控制功能、计费策略控制功能、服务质量(quality of service，QoS)控制等。在5G通信系统中，策略控制网元可以是策略 控制功能(policy control function，PCF)。需要指出实际网络中PCF还可能按照层次或按功能分为多个实体，例如全局PCF和切片内的PCF，或者会话管理PCF(session management PCF，SM-PCF)和接入管理PCF(access management PCF，AM-PCF)。
网络切片选择网元：主要用于为终端的业务选择合适的网络切片。在5G通信系统中，网络切片选择网元可以是网络切片选择功能(network slice selection function，NSSF)网元。
统一数据管理网元：负责管理终端的签约信息。在5G通信系统中，统一数据管理网元可以是统一数据管理(unified data management，UDM)。
数据分析网元：从各个网络功能(network function，NF，即AMF、SMF、PCF等)，可以通过网络开发功能(network exposure function，NEF)或直接从应用功能(application function，AF)，以及从运行管理和维护(operation administration and maintenance，OAM)系统收集数据并进行分析和预测。在5G通信系统中，数据分析网元可以是网络数据分析功能(network data analytics function，NWDAF)。在本申请实施例中，NWDAF还可以向上述各个网络功能，AF或OAM输出推荐值。
用户面网元：主要负责对用户报文进行处理，如转发、计费、合法监听等。用户面网元也可以称为协议数据单元(protocol data unit，PDU)会话锚点(PDU session anchor，PSA)。在5G通信系统中，用户面网元可以是用户面功能(user plane function，UPF)。UPF可以通过类似服务化的接口直接和NWDAF通信，也可以通过其他途径，例如通过SMF或者和NWDAF之间的私有接口或内部接口，和NWDAF通信。
服务化使得5G核心网形成一个扁平化的架构，通过控制面的信令总线，同一个网络切片的控制面网络功能实体之间可以通过NRF相互发现对方，获得对方的访问地址信息，然后可以通过控制面信令总线直接相互通信。
除了上述服务化的控制面网络功能实体外，本申请实施例还涉及下列设备或网元：
终端设备：是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持、穿戴或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端设备可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。本申请的实施例对应用场景不做限定。终端设备有时也可以称为用户设备(user equipment，UE)、移动台和远方站等，本申请的实施例对终端设备所采用的具体技术、设备形态以及名称不做限定。
接入网AN(access network)设备：用于负责终端设备的无线侧接入，可能的部署形态包括：集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)的分离场景以及单站点场景。其中，在分离场景中，CU支持无线资源控制(radio resource control，RRC)、分组数据汇聚协议(packet data convergence protocol，PDCP)、业务数据适配协议(service data adaptation protocol，SDAP)等协议；DU主要支持无线链路控制层(radio link control，RLC)、媒体接入控制层(media access control，MAC)和物理层协议。在单站点场景中，单站点可以包括(new radio Node，gNB)、演进型节点B(evolved Node B， eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station,BTS)、家庭基站、基带单元(base band unit，BBU)等。
图2是本申请实施例的系统结构图。如图2所示，本申请实施例中，NWDAF网元会和UE进行联邦学习。NWDAF网元和UE进行联邦学习时，NWDAF网元从UPF网元收集应应用报文流的特征信息和地址信息，作为NWDAF网元侧的训练数据。UE将本地存储的应用活动信息作为UE侧的训练数据。联邦学习代理(federated learning proxy，FL Proxy)网元获得各个用户同意UE参与联邦学习的授权，另外FL Proxy网元作为AF网元连接NWDAF网元和各个UE之间的数据通道，在联邦学习过程中交换模型训练的中间数据。
NWDAF分为模型训练逻辑功能(model training logical function，MTLF)和分析推理逻辑功能(analytics logical function，AnLF)两个部分。NWDAF网元具有MTLF功能和AnLF功能中的至少一个功能，因此本申请中MTLF可以是独立的网元，也可以是网元中的功能单元。同理，AnLF可以是独立的网元，也可以是网元中的功能单元。MTLF根据收集的数据训练模型，模型训练完成后，向一到多个AnLF分发训练好的模型。在上述解决方案中，MTLF使用上述大量数据预先进行机器学习训练，得到各种应用的应用报文流的统计特征与其应用标识对应的模型，然后将这个模型分发到AnLF。AnLF向各个网元提供分析服务，根据UPF提供的待识别流的统计特征，使用模型进行推理，输出对应的应用类型。
联邦学习(Federated Learning)：又名联合学习，联盟学习。联邦学习是一个机器学习框架，能有效帮助多个机构在满足用户隐私保护、数据安全和政府法规的要求下，进行数据使用和机器学习建模。联邦学习各个参与方各自建模，自有数据不出本地,而后联邦系统可以通过加密机制下的模型参数交换方式,即在不违反数据隐私法规情况下,建立一个虚拟的共有模型。这个虚拟模型就好像大家把数据聚合在一起建立的最优模型一样。但是在建立虚拟模型的时候,数据本身不移动,也不泄露隐私和影响数据合规。根据联邦学习所使用数据在各参与方的不一样分布状况，能够将联邦学习划分为横向联邦学习(horizontal federated learning,HFL)和纵向联邦学习(vertical federated learning,VFL)。其中，横向联邦学习中不一样参与方的数据有较大的特征的重叠，但数据样本，即特征所属的样本的重叠度不高。纵向联邦学习中不一样参与方的数据样本有较大的重叠，但样本特征的重叠度不高。纵向联邦学习算法有利于各方之间合作，使用各自的特有数据特征，共同创建更增强大的模型。
通过联邦学习，NWDAF网元可以随着应用的变化及时更新模型，获得了更加准确地应用报文流特征模型，从而提高应用检测的准确性。
UPF网元能够用于检测UE与应用服务器之间的应用报文流。UPF网元内部包括特征检测模块，特征检测模块用于获取并输出应用报文流的特征信息。UPF网元将应用报文流的特征信息发送给NWDAF网元。NWDAF网元中包括应用报文流特征模型，应用报文流特征模型能够根据待检测应用报文流的特征信息确定对应的App ID。
其中，应用报文流的特征信息用于描述应用业务的收发报文模式。具体地，应用报文流的特征信息包括所述应用报文流的报文序列中各个报文的发送方向(即接收或发送)、各个报文的长度、各个报文的发送间隔、各个报文的安全保护机制、应用报文流收发流量 大小变化样式中的至少一种。
在另一种可能的实现方式中，UPF网元中储存有应用标识(application identifier，App ID)对应的报文流描述(packet flow description，PFD)，其中App ID对应的PFD是能够实现应用报文流检测的信息的集合，其包括：PFD标识PFD ID，以及协议、服务器侧IP(因特网协议)地址和端口号组成的三元组；或者要匹配的统一资源定位符(uniform resource locator，URL)的重要部分，示例性地，该URL的重要部分是主机名或者匹配的标准域名(full qualified domain name，FQDN)。
示例性地，应用提供商的AF网元会将一个或多个App ID对应的PFD提供给报文流描述功能(packet flow description function，FPFD)网元，其中PFDF网元一般内置在NEF网元中，PFDF网元会通过SMF网元把App ID对应的PFD设置到UPF网元上。
UPF网元内部包括快速检测模块和特征检测模块，其中快速检测模块能够根据报文流描述(packet flow description，PFD)识别应用报文流对应的应用标识，对于不能匹配PFD的应用报文流(即没有对应的PFD的应用报文流，又称为待检测应用报文流)，由特征检测模块获取并输出待检测应用报文流的特征信息和待检测应用报文流的地址信息。
UPF网元将待检测应用报文流的特征信息和待检测应用报文流的地址信息发送给NWDAF网元。NWDAF网元中包括应用报文流特征模型，并根据应用报文流特征模型向PFDF网元或SMF网元或UPF网元提供分析服务。应用报文流特征模型能够根据待检测应用报文流的特征信息确定对应的App ID，NWDAF网元、PFDF网元、SMF网元、UPF网元中的至少一个网元根据App ID和待检测应用报文流的地址信息生成PFD并安装到UPF网元上，后续UPF网元根据PFD就可以使用快速检测模块对上述应用报文流进行应用检测。
利用UPF中的快速检测模块对应用报文流进行检测，可以避免对每条应用报文流都进行复杂的模型匹配检测，大大减少了运算量和处理时间，提高了用户面设备的处理性能。
图3是本申请实施例的应用报文流特征模型示意图。NWDAF和UE进行联邦学习，NWDAF获得应用报文流特征模型。这个模型是一个深度神经网络，其输入侧是一些特征参数，其中一部分特征是NWDAF持有的，另一部分特征由UE持有，还有一部分特征是双方共有的，双方共有的特征可以用于联邦学习过程中各方的样本对齐。通过联邦学习可以获得更多特征维度的模型，相比于较少维度的模型，具有更好的准确性。这个深度神经网络的各层神经元都有一些参数，其中包括通过联邦学习由大量样本训练来确定的最佳权重参数。其输出侧是运营商关注的一些应用，除这些关注的应用外的其他应用都会被认为属于“其它应用”。通过联邦学习获得这个模型后，通过在输入侧输入应用报文流的特征信息，就能够在输出侧得到应用报文流匹配的应用标识，即运营商关注的某个应用，或者属于“其它应用”(例如APP ID为others)。
其中，应用报文流的特征信息用于描述应用业务的收发报文模式。具体地，应用报文流的特征信息包括所述应用报文流的报文序列中各个报文的发送方向(即接收或发送)、各个报文的长度、各个报文的发送间隔、各个报文的安全保护机制、应用报文流收发流量大小变化样式中的至少一种。
图4是本申请实施例中另一优化应用报文流特征模型的方法流程图。
S410，网络设备获取第一应用报文流特征模型，该应用报文流特征模型可以根据输入 的应用报文流的特征信息得到对应的App ID。
在一种可能的实现方式中，运营商在网络设备中预先设定了第一应用报文流特征模型。
在另一种可能的实现方式中，网络设备根据网络设备收集的训练数据进行初始训练得到第一业务数据模型。
S420，UE向网络设备发送第一请求信息，第一请求信息用于请求该UE在网络设备上对应的数据样本，第一请求信息包括UE标识信息，示例性地，UE标识信息是UE的用户永久标识(subscription permanent identifier，SUPI)。
在一种可能的实现方式中，UE使用网络设备的公共密钥加密上述信息，这样除了网络设备外，其它无关实体都无法解密上述信息，从而保护了用户隐私。
S430，网络设备接收第一请求信息，根据第一请求信息中的UE标识信息从本地训练数据中查找UE相关的样本数据，即所述第一数据。该样本数据的用户ID都为UE的标识(例如UE#1)，该样本数据包括各个时间片内UE侧的应用报文流的地址信息，应用报文流的特征信息，以及网络设备从UE接收或向UE发送应用报文流的时间片所对应的时间戳。其中，应用报文流的地址信息是UE和应用服务器之间传递的某个应用的报文的源地址(IP地址或MAC地址)、目的地址(IP地址或MAC地址)、协议、源端口号、目的端口号中的全部或部分组合。具体的，UE侧的应用报文流的地址信息是指UE发送的应用报文流报文的源地址或UE接收的应用报文流报文的目的地址。其中应用报文流的特征信息用于描述业务的收发报文模式。具体的，应用报文流的特征信息包括所述应用报文流的报文序列中各个报文的发送方向(即接收或发送)、各个报文的长度、各个报文的发送间隔、各个报文的安全保护机制、应用报文流收发流量大小变化样式中的至少一种。
S440，网络设备向UE发送第一响应信息，第一响应信息包括UE对应的数据样本。在一种可能的实现方式中，第一响应信息还包括应用报文流特征模型参数。
在一种可能的实现方式中，第一响应信息可以包括UE在一个时间段内一个或多个应用报文流所对应的数据样本，也可以包括UE在多个时间段内一个或多个应用报文流所对应的数据样本。
在一种可能的实现方式中，网络设备通过UE的公共密钥加密后将第一响应信息发送给UE，这样除了UE外，其它无关实体都无法解密第一响应信息，从而保护了UE的用户隐私。
应用报文流特征模型参数用于UE生成第一应用报文流特征模型。
在一种可能的实现方式中，应用报文流特征模型参数包括第一应用报文流特征模型的全部参数，UE本身没有应用报文流特征模型，根据应用报文流特征模型参数生成第一应用报文流特征模型。
在另一种可能的实现方式中，UE本身具有应用报文流特征模型，应用报文流特征模型参数包括应用报文流特征模型的最新权重参数，UE根据应用报文流特征模型参数将应用报文流特征模型更新为第一应用报文流特征模型。
在一种可能的实现方式中，UE本身具有应用报文流特征模型的完整模型，这时UE对应的数据样本包括各个时间片内UE侧的应用报文流的地址信息，应用报文流的特征信息，以及时间片对应的时间戳。
在另一种可能的实现方式中，UE本身具有应用报文流特征模型的部分模型，这时UE 对应的数据样本只包括各个时间片内UE侧的应用报文流的地址信息和/或时间戳。
S450，UE接收第一响应信息，根据第一响应信息生成第一应用报文流特征模型并进行根据UE对应的数据样本从UE的本地数据中找到对应的应用活动信息。应用活动信息包括各个APP的电量消耗、各个APP是否在前台亮屏、各个APP使用的网络接口的IP地址和端口信息，各个APP的收发流量中的一个或多个。
S460，UE根据应用活动信息和样本数据分析出样本数据对应的样本标签，样本标签包括样本数据对应的App ID。
具体地，UE通过分析对齐样本数据中的应用活动信息，得到对齐样本数据对应的概率最大的应用是哪一个，并判断其是否为运营商关注的某个应用，或者属于“其它应用”，从而得到对齐样本数据的样本标签(即模型输出侧的APP ID)。
S470，UE根据样本数据和样本标签，利用第一应用报文流特征模型得到梯度因子信息。梯度因子信息用于校正第一应用报文流特征模型，梯度因子信息包括第一应用报文流特征模型的梯度和损失。
在一种可能的实现方式中，UE本身具有应用报文流特征模型的完整模型，这时UE根据样本数据和样本标签，计算应用报文流特征模型的完整模型的梯度因子信息。
在另一种可能的实现方式中，UE本身具有应用报文流特征模型的部分模型，这时UE根据样本数据和样本标签，只计算应用报文流特征模型的部分模型的梯度因子信息。
S480，UE将梯度因子信息发送给网络设备。
在一种可能的实现方式中，UE将梯度因子信息加密后发送给网络设备。
因为只发送了模型的梯度因子，并不包含UE安装了什么应用，什么时间段使用了什么应用等能够反映用户习惯的信息，所以用户的隐私得到了保护。
S490，网络设备根据梯度因子信息更新第一应用报文流特征模型，具体地，网络设备使用梯度因子更新模型的权重参数。
在一种可能的实现方式中，UE本身具有应用报文流特征模型的完整模型，这时网络设备根据参与联邦学习的UE发来的梯度因子信息更新第一应用报文流特征模型。
在另一种可能的实现方式中，UE本身具有应用报文流特征模型的部分模型，网络设备本身具有应用报文流特征模型的网络设备侧部分模型，网络设备首先根据发送给UE的样本数据对应的应用报文流的特征信息，计算网络设备侧部分模型的梯度因子信息，网络设备根据参与联邦学习的UE发来的梯度因子信息和自身计算的网络设备侧部分模型的梯度因子信息一起更新第一应用报文流特征模型。类似的，网络设备还可以将自身计算的网络设备侧部分模型的梯度因子信息进一步加密发送给相应的UE，UE也可以根据网络设备计算的梯度因子信息和UE自身计算的梯度因子信息更新UE的应用报文流特征模型。如果UE根据梯度因子信息更新自身的应用报文流特征模型，那么在后续联邦学习过程中，网络设备向UE发送第一响应信息(步骤S440)中可以不包含应用报文流特征模型参数。
应理解，本申请实施例中，UE与网络设备之间的通信可以是通过其它设备实现。
在一种可能的实现方式中，UE和网络设备通过AF进行通信，AF可以是安装在网络设备中的。
在另一种可能的实现方式中，UE和网络设备通过FL Proxy进行通信，UE和网络设备都是登记在FL Proxy中可以进行联邦学习的设备，FL Proxy可以是安装在网络设备中 的。
应理解，本申请实施例中，网络设备和UE都只是示意性的，实际进行联邦学习时，有大量的UE参与，这些UE共用网络设备中的第一应用报文流特征模型，上述S480中，网络设备可以根据所有与其进行联邦学习的UE发送的梯度因子信息进行模型更新。
应理解，上述步骤仅仅是一轮模型更新训练，实际上网络设备可以经过多轮训练得到更加准确的应用报文流特征模型，甚至在网络设备在进行后续用应用报文流特征模型进行分析服务时也能进行应用报文流特征模型的更新训练。每轮更新后的应用报文流特征模型可以作为下轮模型更新训练的初始应用报文流特征模型。
通过这样的在线学习，应用版本升级等引起的变化，会被很快通过联邦学习反映到应用报文流特征模型中，从而提高了应用报文流特征模型的准确性。
图5是本申请实施例中一优化应用报文流特征模型的方法流程图。
S510，网络设备获取第一应用报文流特征模型，该应用报文流特征模型可以根据输入的应用报文流的特征信息得到对应的App ID。
在一种可能的实现方式中，运营商在网络设备中预先设定了第一应用报文流特征模型。
在另一种可能的实现方式中，网络设备根据网络设备收集的训练数据进行初始训练得到第一业务数据模型。
S520，UE向网络设备发送第一请求信息，第一请求信息用于请求该UE在网络设备上对应的数据样本，第一请求信息包括UE标识信息，示例性地，UE标识信息是UE的用户永久标识(subscription permanent identifier，SUPI)。
在一种可能的实现方式中，UE使用网络设备的公共密钥加密上述信息，这样除了网络设备外，其它无关实体都无法解密上述信息，从而保护了用户隐私。
S530，网络设备接收第一请求信息，根据第一请求信息中的UE标识信息从本地训练数据中查找UE相关的样本数据。该样本数据的用户ID都为UE的标识(例如UE#1)，该样本数据包括各个时间片内UE的应用报文流的地址信息，应用报文流的特征信息，以及时间片对应的时间戳。网络设备还将样本数据输入第一应用报文流特征模型得到计算结果，该计算结果为第一应用报文流特征模型得到的样本数据对应的应用标识。网络设备将各个时间片内UE侧应用报文流的地址信息和/或时间片对应的时间戳作为发送给UE的样本数据，即UE对应的数据样本。
其中，应用报文流的地址信息是UE和应用服务器之间传递的某个应用的报文的源地址(IP地址或MAC地址)、目的地址(IP地址或MAC地址)、协议、源端口号、目的端口号中的全部或部分组合。具体的，UE侧的应用报文流的地址信息是指UE发送的应用报文流报文的源地址或UE接收的应用报文流报文的目的地址。其中应用报文流的特征信息用于描述业务的收发报文模式。具体的，应用报文流的特征信息包括所述应用报文流的报文序列中各个报文的发送方向(即接收或发送)、各个报文的长度、各个报文的发送间隔、各个报文的安全保护机制、应用报文流收发流量大小变化样式中的至少一种。
S540，网络设备向UE发送第一响应信息，第一响应信息包括UE对应的数据样本。
在一种可能的实现方式中，网络设备通过UE的公共密钥加密后将第一响应信息发送给UE，这样除了UE外，其它无关实体都无法解密第一响应信息，从而保护了UE的用户隐私。
S550，UE接收第一响应信息，根据UE对应的数据样本从UE的本地数据中找到对应的应用活动信息。应用活动信息包括各个APP的电量消耗、各个APP是否在前台亮屏、各个APP使用的网络接口的IP地址和端口信息，各个APP的收发流量中的一个或多个。
S560，UE根据应用活动信息和样本数据分析出样本数据对应的样本标签，样本标签包括样本数据对应的App ID。
具体地，UE通过分析对齐样本数据中的应用活动信息，得到对齐样本数据对应的概率最大的应用是哪一个，并判断其是否为运营商关注的某个应用，或者属于“其它应用”，从而得到对齐样本数据的样本标签(即模型输出侧的APP ID)。其中，概率最大的应用可以选择应用活动信息中某个APP使用的网络接口的IP地址和端口信息与样本数据中的UE侧应用报文流的地址信息相同，并且应用活动信息中这个APP的电量消耗和/或前台亮屏时间与样本数据中的时间戳匹配。
S570，UE向网络设备发送样本标签。
在一种可能的实现方式中，UE将样本标签加密后发送给网络设备。
S580，网络设备根据计算结果和样本标签得到梯度因子信息。
S590，网络设备根据梯度因子信息更新第一应用报文流特征模型，具体地，网络设备使用梯度因子更新模型的权重参数。
应理解，本申请实施例中，UE与网络设备之间的通信可以是通过其它设备实现。
在一种可能的实现方式中，UE和网络设备通过AF进行通信，AF可以是安装在网络设备中的。
在另一种可能的实现方式中，UE和网络设备通过FL Proxy进行通信，UE和网络设备都是登记在FL Proxy中可以进行联邦学习的设备，FL Proxy可以是安装在网络设备中的。
应理解，本申请实施例中，网络设备和UE都只是示意性的，实际进行联邦学习时，有大量的UE参与，这些UE共用网络设备中的第一应用报文流特征模型，上述S580中，网络设备可以根据所有与其进行联邦学习的UE发送的梯度因子信息进行模型更新。
应理解，上述步骤仅仅是一轮模型更新训练，实际上网络设备可以经过多轮训练得到更加准确的应用报文流特征模型，甚至在网络设备在进行后续用应用报文流特征模型进行分析服务时也能进行应用报文流特征模型的更新训练。每轮更新后的应用报文流特征模型可以作为下轮模型更新训练的初始应用报文流特征模型。
通过这样的在线学习，应用版本升级等引起的变化，会被很快通过联邦学习反映到应用报文流特征模型中，从而提高了应用报文流特征模型的准确性。
图6是本申请实施例中一应用检测的方法流程图。在获得可以通过联邦学习进行持续更新的应用报文流特征模型后，将该应用报文流特征模型应用在后续的分析服务中。本申请实施例中，应用于分析服务的应用报文流特征模型位于NWDAF网元。
S610，NWDAF确定范围内的UPF。
在一种可能的实现方式中，NWDAF根据自身的服务范围，确定范围内的UPF。
在另一种可能的实现方式中，PFDF向NWDAF发送分析订阅请求，具体的可以是PFD分析订阅请求，其中携带的参数可以指定网络范围，NWDAF根据分析订阅请求确定范围内的UPF。
S620，UPF收到某个应用的应用报文流中的报文，即所述第二应用报文流。
S630，因为UPF根据应用报文流中的报文的地址信息，无法匹配到已经设置的PFD，所以UPF进行报文流特征检测。UPF根据报文获得应用报文流的特征信息，即所述第二应用报文流的特征信息，其中应用报文流的特征信息用于描述业务的收发报文模式。具体的，应用报文流的特征信息包括所述应用报文流的报文序列中各个报文的发送方向(即接收或发送)、各个报文的长度、各个报文的发送间隔、各个报文的安全保护机制、应用报文流收发流量大小变化样式中的至少一种。
S640，UPF向NWDAF发送第一信息，第一信息包括应用报文流的特征信息。
S650，NWDAF根据应用报文流的特征信息，使用应用报文流特征模型，确定应用报文流匹配的应用标识，即所述第一对应关系。
S660，NWDAF向UPF发送第二信息，第一信息包括应用报文流匹配的应用标识。
本申请实施例中，NWDAF还与UE进行在线的联邦学习，更新应用报文流特征模型。在此过程中，NWDAF从SMF、UPF等网元收集训练数据，其中包括UE的SUPI，UE建立的PDU会话信息、为UE分配的IP地址、UE的MAC地址，应用报文流收发流量大小变化样式，另外还包括每个应用报文流的起始时间、终止时间、承载协议、安全保护机制、报文序列中各个报文的长度、各个报文的发送间隔、每个时间片内的应用报文流的收发流量大小。UE从本地记录中获得应用活动信息，其中包括各个应用收发报文的时间，收发报文的{源IP地址，源端口，协议，目的IP地址，目的端口}五元组信息或UE的MAC地址信息，各个应用在各个时间片内的收发流量大小。UE使用时间戳信息，地址五元组信息或MAC地址信息，时间片内应用收发报文的时间和流量大小来进行样本对齐。其中，NWDAF与UE进行在线的联邦学习，更新应用报文流特征模型的具体步骤可以参见图4或图5，不再赘述。
本申请实施例中，将提取的应用报文流的特征信息放入应用报文流特征模型中进行处理，可以检测出应用报文流对应的应用名称，因为本身申请实施例中的应用报文流特征模型一直在更新优化，所以让检测出来的结果不受应用版本升级等引起的变化的影响，使得检测的结果更加准确。
图7是本申请实施例中另一应用检测的方法流程图。本申请实施例中，NWDAF网元中包括可以通过联邦学习进行持续更新的应用报文流特征模型，将该应用报文流特征模型应用在后续的分析服务中。其中，NWDAF与UE进行在线的联邦学习，更新应用报文流特征模型的具体步骤可以参见图4或图5，不再赘述。
应理解，本申请实施例针对的情况是UPF中储存的PFD无法直接匹配UPF接收到的应用报文流，若UPF中储存的PFD可以直接匹配UPF接收到的应用报文流则直接检测出应用标识，本申请实施例对此不作赘述。
S710，NWDAF确定范围内的UPF。
在一种可能的实现方式中，NWDAF根据自身的服务范围，确定范围内的UPF。
在另一种可能的实现方式中，PFDF向NWDAF发送分析订阅请求，具体的可以是PFD分析订阅请求，其中携带的参数可以指定网络范围，NWDAF根据分析订阅请求确定范围内的UPF。
S720，UPF收到某个应用的应用报文流中的报文。
S730，UPF确定无法直接检测出应用报文流对应的应用标识。具体地，UPF的快速检测模块根据自身储存的PFD对应用报文流中的报文进行快速检测，无法检测到与报文匹配的PFD，将这个应用报文流作为待检测应用报文流，交给UPF中的特征检测模块进行处理。
S740，UPF进行报文流特征检测。具体地，UPF的特征检测模块根据报文获得待检测应用报文流的特征信息和待检测应用报文流的地址信息，其中待检测应用报文流的特征信息用于描述业务的收发报文模式，待检测应用报文流的地址信息用于描述报文收发源、目的信息中的至少一个。具体的，待检测应用报文流的特征信息包括所述应用报文流的报文序列中各个报文的发送方向(即接收或发送)、各个报文的长度、各个报文的发送间隔、各个报文的安全保护机制、应用报文流收发流量大小变化样式中的至少一种。待检测应用报文流的地址信息包括承载协议、报文的源端口号、报文的目的端口号、报文的源IP地址、报文的目的IP地址，地址信息还可以包括源MAC地址和目的MAC地址，其中，承载协议、报文的源端口号、报文的目的端口号、报文的源IP地址、报文的目的IP地址以五元组的形式存在。。
S750，UPF向NWDAF发送第一信息，第一信息包括待检测应用报文流的特征信息、地址信息。
S760，NWDAF根据第一信息得到待检测应用报文流匹配的应用标识。NWDAF将待检测应用报文流的特征信息输入应用报文流特征模型得到待检测应用报文流匹配的应用标识。
S770，NWDAF根据待检测应用报文流匹配的应用标识、地址信息和UE的通信分析结果生成待检测应用报文流匹配的PFD和PFD的老化时间。
具体地，NWDAF可以从自身的本地数据中获得UE的通信特征分析，根据这个UE的通信特征分析，预测UE承载待检测应用报文流的PDU会话的持续时间，为这个PFD确定一个老化时间。等老化时间到期后，UPF会删除这个PFD，这样可以保证应用因为版本升级等发生变化后，UPF能及时更新最新的PFD。
在一种可能的实现方式中，NWDAF还可以扩展PFD，在PFD中新增加UE ID的信息，确保生成的这个PFD在UPF上只用于匹配这个UE的应用报文流，进一步提高应用检测的准确性。
在另一种可能的实现方式中，NWDAF还可以扩展PFD，在PFD中新增加终端设备的地址信息，确保生成的这个PFD在UPF上只用于匹配这个UE使用这个终端设备的地址进行发送和接收的应用报文流报文，进一步提高应用检测的准确性。
S780，NWDAF向UPF发送第二信息，第二信息包括PFD和PFD的老化时间。具体地，NWDAF通过PFDF或者通过PFDF和SMF将第二信息发送给UPF，本申请对此不做限制。
S790，UPF使用PFD处理上述应用的后续报文。如果PFD是经过扩展携带UE标识的PFD，那么UPF只在后续该UE的PDU会话承载的应用报文流使用这个PFD进行匹配，具体地，UPF通过N4接口从SMF获得PDU会话对应的UE标识，并根据UE标识使用携带相同UE标识的PFD对这个PDU会话承载的应用报文流进行匹配。如果PFD中包含终端设备的地址信息，那么UPF在后续应用报文流的终端侧接收的报文的目的地址和这 个地址信息匹配时，或者在后续应用报文流的终端侧发送的报文的源地址和这个地址信息匹配时，才使用这个PFD进行匹配。如果PFD还有对应的老化时间，UPF在设置该PFD后，启动老化定时器，定时器到期后清除这个PFD。UPF将上述应用报文流的后续报文匹配到PFD，由快速检测模型执行处理。
本申请实施例中，NWDAF还与UE进行在线的联邦学习，更新应用报文流特征模型。在此过程中，NWDAF从SMF、UPF等网元收集训练数据，其中包括UE的SUPI，UE建立的PDU会话信息、为UE分配的IP地址、UE的MAC地址，应用报文流收发流量大小变化样式，另外还包括每个应用报文流的起始时间、终止时间、承载协议、安全保护机制、报文序列中各个报文的长度、各个报文的发送间隔、每个时间片内的应用报文流的收发流量大小。UE从本地记录中获得应用活动信息，其中包括各个应用收发报文的时间，收发报文的{源IP地址，源端口，协议，目的IP地址，目的端口}五元组信息或UE的MAC地址信息，各个应用在各个时间片内的收发流量大小。UE使用时间戳信息，地址五元组信息或MAC地址信息，时间片内应用收发报文的时间和流量大小来进行样本对齐。其中，NWDAF与UE进行在线的联邦学习，更新应用报文流特征模型的具体步骤可以参见图4或图5，不再赘述。
本申请实施例除了应用更新的应用报文流特征模型提高检测结果的准确性外，还引入了UE ID和老化时间进一步提高了检测的准确性，此外，本申请实施例还使用应用报文流特征模型确定匹配的应用标识，并利用应用标识和应用报文流的地址信息，生成PFD，从而避免通过对整个应用报文流报文执行特征匹配来检测应用，提高了UPF的处理性能。
图8是本申请实施例中另一应用检测的方法流程图。本申请实施例中，NWDAF网元中包括可以通过联邦学习进行持续更新的应用报文流特征模型，将该应用报文流特征模型应用在后续的分析服务中。
应理解，本申请实施例针对的情况是UPF中储存的PFD无法直接匹配UPF接收到的应用报文流，若UPF中储存的PFD可以直接匹配UPF接收到的应用报文流则直接检测出应用标识，本申请实施例对此不作赘述。
S810，NWDAF确定范围内的UPF。
在一种可能的实现方式中，NWDAF根据自身的服务范围，确定范围内的UPF。
在另一种可能的实现方式中，PFDF向NWDAF发送分析订阅请求，具体地，分析订阅请求可以是PFD分析订阅请求，其中携带的参数可以指定网络范围。NWDAF根据分析订阅请求确定范围内的UPF。NWDAF还可以通过未知应用报文流事件订阅，从UPF收集向PFDF提供分析服务所需要的数据。
S820，UPF收到某个应用的应用报文流中的报文。
S830，UPF确定无法直接检测出应用报文流对应的应用标识。具体地，UPF的快速检测模块根据自身储存的PFD对应用报文流中的报文进行快速检测，无法检测到与报文匹配的PFD，将这个应用报文流作为待检测应用报文流，交给UPF中的特征检测模块进行处理。
S840，UPF进行报文流特征检测。具体地，UPF的特征检测模块根据报文获得待检测应用报文流的特征信息和待检测应用报文流的地址信息，其中待检测应用报文流的特征信息用于描述业务的收发报文模式，待检测应用报文流的地址信息用于描述报文收发源、目 的信息中的至少一个。具体的，待检测应用报文流的特征信息包括所述应用报文流的报文序列中各个报文的发送方向(即接收或发送)、各个报文的长度、各个报文的发送间隔、各个报文的安全保护机制、应用报文流收发流量大小变化样式中的至少一种。待检测应用报文流的地址信息包括承载协议、报文的源端口号、报文的目的端口号、报文的源IP地址、报文的目的IP地址，地址信息还可以包括源MAC地址和目的MAC地址，其中，承载协议、报文的源端口号、报文的目的端口号、报文的源IP地址、报文的目的IP地址以五元组的形式存在。
S850，UPF向NWDAF发送第一信息，第一信息包括待检测应用报文流的特征信息和地址信息。这个步骤也可以认为是NWDAF从UPF收集未知应用报文流事件，其中事件报告中包含应用报文流的特征信息。
S860，NWDAF根据第一信息得到待检测应用报文流匹配的应用标识。
NWDAF将待检测应用报文流的特征信息输入应用报文流特征模型得到待检测应用报文流匹配的应用标识。
S870，NWDAF向PFDF发送第二信息，第二信息包括待检测应用报文流匹配的应用标识和待检测应用报文流的地址信息。NWDAF将待检测应用报文流匹配的应用标识，待检测应用报文流的地址信息，以及可选的老化时间作为分析服务的输出，发送给PFDF。
S880，PFDF根据第二信息得到待检测应用报文流对应的PFD。PFDF根据待检测应用报文流匹配的应用标识和待检测应用报文流的地址信息生成这个应用的应用报文流对应的PFD。
在一种可能的实现方式中，PFDF还可以根据NWDAF分析服务输出中包含的老化时间，为生成的PFD设置有效定时器。
S890，PFDF向UPF发送第三信息，第三信息包括待检测应用报文流对应的PFD，将PFD更新到UPF上，具体地，PFDF直接将更新后的PFD发到UPF上或PFDF通过SMF将更新后的PFD发到UPF上，本申请对此不做限制。
在一种可能的实现方式中，PFDF还将PFD的有效定时器也发送到UPF上。
S8100，UPF使用PFD处理上述应用的后续报文。UPF将上述应用报文流的后续报文匹配到PFD，由快速检测模型执行处理。
在一种可能的实现方式中，PFDF在PFD的有效定时器过期后，发消息通知UPF删除相应的PFD。
在另一种可能的实现方式中，UPF在PFD有效定时器过期后，UPF删除对应的PFD。
本申请实施例中，NWDAF还与UE进行在线的联邦学习，更新应用报文流特征模型。在此过程中，NWDAF从SMF、UPF等网元收集训练数据，其中包括UE的SUPI，UE建立的PDU会话信息、为UE分配的IP地址、UE的MAC地址，应用报文流收发流量大小变化样式，另外还包括每个应用报文流的起始时间、终止时间、承载协议、安全保护机制、报文序列中各个报文的长度、各个报文的发送间隔、每个时间片内的应用报文流的收发流量大小。UE从本地记录中获得应用活动信息，其中包括各个应用收发报文的时间，收发报文的{源IP地址，源端口，协议，目的IP地址，目的端口}五元组信息或UE的MAC地址信息，各个应用在各个时间片内的收发流量大小。UE使用时间戳信息，地址五元组信息或MAC地址信息，时间片内应用收发报文的时间和流量大小来进行样本对齐。其中， NWDAF与UE进行在线的联邦学习，更新应用报文流特征模型的具体步骤可以参见图4或图5，不再赘述。
本申请实施例除了应用更新的应用报文流特征模型提高检测结果的准确性外，还使用应用报文流特征模型确定匹配的应用标识，并利用应用标识和应用报文流的地址信息，生成PFD，从而避免通过对整个应用报文流报文执行特征匹配来检测应用，提高了UPF的处理性能。
图9是本申请实施例中另一应用检测的方法流程图。本申请实施例中，NWDAF网元中包括可以通过联邦学习进行持续更新的应用报文流特征模型，将该应用报文流特征模型应用在后续的分析服务中。
应理解，本申请实施例针对的情况是UPF中储存的PFD无法直接匹配UPF接收到的应用报文流，若UPF中储存的PFD可以直接匹配UPF接收到的应用报文流则直接检测出应用标识，本申请实施例对此不作赘述。
S910，NWDAF确定范围内的UPF。
在一种可能的实现方式中，NWDAF根据自身的服务范围，确定范围内的UPF。
在另一种可能的实现方式中，PFDF向NWDAF发送分析订阅请求，具体的可以是PFD分析订阅请求，其中携带的参数可以指定网络范围。，NWDAF根据分析订阅请求确定范围内的UPF。
S920，UPF收到某个应用的应用报文流中的报文。
S930，UPF确定无法直接检测出应用报文流对应的应用标识。具体地，UPF的快速检测模块根据自身储存的PFD对应用报文流中的报文进行快速检测，无法检测到与报文匹配的PFD，将这个应用报文流作为待检测应用报文流，交给UPF中的特征检测模块进行处理。
S940，UPF进行报文流特征检测。具体地，UPF的特征检测模块根据报文获得待检测应用报文流的特征信息和待检测应用报文流的地址信息，其中待检测应用报文流的特征信息用于描述业务的收发报文模式，待检测应用报文流的地址信息用于描述报文收发源、目的信息中的至少一个。具体的，待检测应用报文流的特征信息包括所述应用报文流的报文序列中各个报文的发送方向(即接收或发送)、各个报文的长度、各个报文的发送间隔、各个报文的安全保护机制中的至少一种。待检测应用报文流的地址信息包括承载协议、服务器侧的端口号和IP地址。
S950，UPF向NWDAF发送第一信息，第一信息包括待检测应用报文流的特征信息。
S960，NWDAF根据第一信息得到待检测应用报文流对应的应用标识。NWDAF将待检测应用报文流的特征信息输入应用报文流特征模型得到待检测应用报文流匹配的应用标识。
S970，NWDAF向UPF发送第二信息，第二信息包括待检测应用报文流对应的应用标识、待检测应用报文流匹配的应用标识和UE的通信分析结果。
S980，UPF生成待检测应用报文流匹配的PFD和PFD的老化时间。具体地，UPF根据待检测应用报文流匹配的应用标识和待检测应用报文流的地址信息生成这个应用的应用报文流对应的PFD。UPF还可以根据UE的通信分析结果中的通信预测信息，比如PDU会话的持续时间预测值，为这个PFD确定一个老化时间。等老化时间到期后，UPF会删 除这个PFD，这样可以保证应用因为版本升级等发生变化后，UPF能及时更新最新的PFD。
S990，UPF使用PFD处理上述应用的后续报文。UPF将上述应用报文流的后续报文匹配到PFD，由快速检测模型执行处理。
本申请实施例中，NWDAF还与UE进行在线的联邦学习，更新应用报文流特征模型。在此过程中，NWDAF从SMF、UPF等网元收集训练数据，其中包括UE的SUPI，UE建立的PDU会话信息、为UE分配的IP地址、UE的MAC地址，应用报文流收发流量大小变化样式，另外还包括每个应用报文流的起始时间、终止时间、承载协议、安全保护机制、报文序列中各个报文的长度、各个报文的发送间隔、每个时间片内的应用报文流的收发流量大小。UE从本地记录中获得应用活动信息，其中包括各个应用收发报文的时间，收发报文的{源IP地址，源端口，协议，目的IP地址，目的端口}五元组信息或UE的MAC地址信息，各个应用在各个时间片内的收发流量大小。UE使用时间戳信息，地址五元组信息或MAC地址信息，时间片内应用收发报文的时间和流量大小来进行样本对齐。其中，NWDAF与UE进行在线的联邦学习，更新应用报文流特征模型的具体步骤可以参见图4或图5，不再赘述。
本申请实施例除了应用更新的应用报文流特征模型提高检测结果的准确性外，还使用应用报文流特征模型确定匹配的应用标识，并利用应用标识和应用报文流的地址信息，生成PFD，从而避免通过对整个应用报文流报文执行特征匹配来检测应用，提高了UPF的处理性能。
图10为本申请实施例提供的通信装置10的示意图，如图10所示，该装置10可以为参与应用流特征信息模型更新的设备，例如，上述UE、网络设备，也可以为芯片或电路，比如可设置于上述参与应用流特征信息模型更新设备的芯片或电路。
该装置10可以包括处理器11(即，处理单元的一例)和存储器12。该存储器12用于存储指令，该处理器11用于执行该存储器12存储的指令，以使该装置10实现如图5中对应的方法中更新应用流特征信息模型的设备执行的步骤。
进一步的，该装置10还可以包括输入口13(即，通信单元的一例)和输出口14(即，通信单元的另一例)。进一步的，该处理器11、存储器12、输入口13和输出口14可以通过内部连接通路互相通信，传递控制和/或数据信号。该存储器12用于存储计算机程序，该处理器11可以用于从该存储器12中调用并运行该计算计程序，以控制输入口13接收信号，控制输出口14发送信号，完成上述方法中终端设备的步骤。该存储器12可以集成在处理器11中，也可以与处理器11分开设置。
一种可能的实现方式，若该通信装置10为通信设备，该输入口13为接收器，该输出口14为发送器。其中，接收器和发送器可以为相同或者不同的物理实体。为相同的物理实体时，可以统称为收发器。
一种可能的实现方式，若该通信装置10为芯片或电路，该输入口13为输入接口，该输出口14为输出接口。
作为一种实现方式，输入口13和输出口14的功能可以考虑通过收发电路或者收发的专用芯片实现。处理器11可以考虑通过专用处理芯片、处理电路、处理器或者通用芯片实现。
作为另一种实现方式，可以考虑使用通用计算机的方式来实现本申请实施例提供的通 信设备。即将实现处理器11、输入口13和输出口14功能的程序代码存储在存储器12中，通用处理器通过执行存储器12中的代码来实现处理器11、输入口13和输出口14的功能。
其中，通信装置10中各模块或单元可以用于执行上述方法中更新应用流特征信息模型的设备(例如，网络设备)所执行的各动作或处理过程，这里，为了避免赘述，省略其详细说明。
该装置10所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
图11为本申请实施例提供的通信装置20的示意图，如图11所示，该装置20可以为参与应用检测的设备，例如，NWDAF网元、UPF网元，也可以为芯片或电路，比如可设置于上述参与应用检测设备的芯片或电路。
该装置20可以包括处理器21(即，处理单元的一例)和存储器22。该存储器22用于存储指令，该处理器21用于执行该存储器22存储的指令，以使该装置20实现如图6-8中对应的方法中应用检测的设备执行的步骤。
进一步的，该装置20还可以包括输入口23(即，通信单元的一例)和输出口24(即，通信单元的另一例)。进一步的，该处理器21、存储器22、输入口23和输出口24可以通过内部连接通路互相通信，传递控制和/或数据信号。该存储器22用于存储计算机程序，该处理器21可以用于从该存储器22中调用并运行该计算计程序，以控制输入口23接收信号，控制输出口24发送信号，完成上述方法中终端设备的步骤。该存储器22可以集成在处理器21中，也可以与处理器21分开设置。
一种可能的实现方式，若该通信装置20为通信设备，该输入口23为接收器，该输出口24为发送器。其中，接收器和发送器可以为相同或者不同的物理实体。为相同的物理实体时，可以统称为收发器。
一种可能的实现方式，若该通信装置20为芯片或电路，该输入口23为输入接口，该输出口24为输出接口。
作为一种实现方式，输入口23和输出口24的功能可以考虑通过收发电路或者收发的专用芯片实现。处理器21可以考虑通过专用处理芯片、处理电路、处理器或者通用芯片实现。
作为另一种实现方式，可以考虑使用通用计算机的方式来实现本申请实施例提供的通信设备。即将实现处理器21、输入口23和输出口24功能的程序代码存储在存储器22中，通用处理器通过执行存储器22中的代码来实现处理器21、输入口23和输出口24的功能。
其中，通信装置20中各模块或单元可以用于执行上述方法中应用检测的设备(例如，NWDAF网元)所执行的各动作或处理过程，这里，为了避免赘述，省略其详细说明。
该装置20所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (40)

  1. 一种通信方法，其特征在于，包括：
    网络设备获取第一数据，所述第一数据是根据第一应用报文流确定的；
    所述网络设备向终端设备发送第一模型或者所述第一模型的部分，所述第一模型用于确定所述第一应用报文流的应用对应的应用标识；
    所述网络设备向所述终端设备发送所述第一数据；
    所述网络设备接收来自所述终端设备的校正因子，所述校正因子是根据所述第一数据确定的；
    所述网络设备根据所述校正因子对所述第一模型进行调整。
  2. 根据权利要求1所述的方法，其特征在于，所述网络设备是网络数据分析功能网元或用户面功能网元。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一数据包括：
    所述第一应用报文流的地址信息，和/或
    用于指示所述第一应用报文流的传输时段的时间戳。
  4. 根据权利要求3所述的方法，其特征在于，所述第一数据还包括：
    所述第一应用报文流的特征信息。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述第一数据是经过所述网络设备加密后的数据。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一模型是所述网络设备和所述终端设备进行纵向联邦学习的模型。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述校正因子包括：
    所述第一模型的梯度和/或损失。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述方法还包括：
    所述网络设备将第二数据输入调整后的所述第一模型，获得第一标识；
    所述第二数据是根据第二应用报文流确定的，所述第二数据包括所述第二应用报文流的特征信息。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    所述网络设备确定所述第二应用报文流的特征信息和所述第一标识的第一对应关系。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    所述网络设备向用户面功能网元发送所述第一对应关系。
  11. 根据权利要求9或10所述的方法，其特征在于，所述方法还包括：
    所述网络设备根据所述第一对应关系确定所述第二应用报文流对应的第一报文流描述。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    如果在第一时段内接收到第三应用报文流，则根据所述第一报文流描述，将所述第一标识确定为所述第三应用报文流对应的应用标识，所述第一时段为所述第一应用关系的有效时段，所述第三应用报文流的地址信息与所述第二应用报文流的地址信息相同。
  13. 根据权利要求8所述的方法，其特征在于，所述第二数据还包括所述第二应用报文流的地址信息，所述第二应用报文流的地址信息包括所述第二应用报文流携带的终端设备的地址信息。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    所述网络设备确定所述第二应用报文流的地址信息和所述第一标识的第二对应关系。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    所述网络设备向用户面功能网元发送所述第二对应关系。
  16. 根据权利要求14或15所述的方法，其特征在于，所述方法还包括：
    所述网络设备根据所述第二对应关系确定第二报文流描述，所述第二报文流描述包括所述终端设备的地址信息。
  17. 一种通信方法，其特征在于，包括：
    终端设备接收来自网络设备的第一数据，所述第一数据是根据第一应用报文流确定的；
    所述终端设备接收来自网络设备的第一模型或者所述第一模型的部分，所述第一模型用于确定所述第一应用报文流的应用对应的应用标识；
    所述终端设备根据所述第一数据确定第一标识；
    所述终端设备根据所述第一标识确定校正因子，所述校正因子用于调整所述第一模型；
    所述终端设备向所述网络设备发送所述校正因子。
  18. 根据权利要求17所述的方法，其特征在于，所述第一数据是经过所述网络设备加密的数据。
  19. 根据权利要求17或18所述的方法，其特征在于，所述第一数据包括：
    所述第一应用报文流的地址信息，和/或
    用于指示所述第一应用报文流的传输时段的时间戳。
  20. 根据权利要求19所述的方法，其特征在于，所述第一数据还包括：
    所述第一应用报文流的特征信息。
  21. 根据权利要求17至20所述的方法，其特征在于，所述终端设备根据所述第一数据得到所述第一标识包括：
    所述终端设备根据所述第一数据确定第一特征，所述第一特征是所述终端设备数据和所述网络设备数据共有的特征；
    所述终端设备根据所述第一特征确定与第一数据对应的第二数据，所述第二数据包括所述第一标识。
  22. 根据权利要求21所述的方法，其特征在于，所述第一特征包括：
    所述时间戳和/或所述第一应用报文流的地址信息。
  23. 根据权利要求20所述的方法，其特征在于，根据所述第一标识得到所述校正因子包括：
    若所述终端设备接收所述第一模型，则所述终端设备根据所述第一标识和所述第一应用报文流的特征信息确定所述第一模型的所述校正因子；或者
    若所述终端设备接收所述第一模型的部分，则所述终端设备根据所述第一标识和所述第一特征确定所述第一模型的所述校正因子。
  24. 一种通信装置，其特征在于，包括：
    处理模块，用于获取应用相关的第一数据，所述第一数据是根据第一应用报文流确定的；
    收发模块，用于向终端设备发送所述第一数据和第一模型或者所述第一模型的部分，所述第一模型用于确定所述第一应用报文流应用对应的应用标识，所述第一数据用于确定第一模型的校正因子；
    所述收发模块，还用于接收来自所述终端设备的所述校正因子；
    所述处理模块，还用于根据所述校正因子对所述第一模型进行调整。
  25. 根据权利要求24所述的装置，其特征在于，
    所述收发模块，还用于获取第二数据；
    所述处理模块，还用于将所述第二数据输入调整后的所述第一模型，得到第一标识。
  26. 一种通信装置，其特征在于，包括：
    收发模块，用于接收来自网络设备的第一数据、第一模型或者所述第一模型的部分，所述第一数据是根据第一应用报文流确定的，所述第一模型用于确定所述第一应用报文流应用对应的应用标识，所述第一数据用于确定第一模型的校正因子；
    处理模块，用于根据所述第一数据得到第一标识并根据所述第一标识和所述第一特征得到校正因子，所述校正因子用于调整所述第一模型；
    所述收发模块，还用于向所述网络设备发送所述校正因子。
  27. 根据权利要求26所述的装置，其特征在于，根据所述第一数据得到所述第一标识包括：
    所述处理模块根据所述第一数据确定第一特征，所述第一特征是所述终端设备和所述网络设备数据共有的特征；
    所述处理模块根据所述第一特征确定与第一数据对应的第二数据，所述第二数据包括所述第一应用的应用标识。
  28. 根据权利要求26或27所述的装置，其特征在于，根据所述第一标识得到所述校正因子包括：
    若所述收发模块接收所述第一模型，则所述处理模块根据所述第一标识和所述第一应用报文流的特征信息得到所述第一模型的所述校正因子；
    若所述接收模块接收所述第一模型的部分，则所述处理模块根据所述第一标识和所述第一特征得到所述第一模型的所述校正因子。
  29. 一种通信系统，其特征在于，包括：第一网络设备和第二网络设备；
    所述第一网络设备用于获取并向所述第二网络设备发送应用相关的第一数据，所述第一数据是根据第一应用报文流确定的；
    所述第一网络设备用于向第二网络设备发送第一模型或第一模型的部分，所述第一模型用于确定所述应用对应的应用标识；
    所述第二网路设备用于接收并向所述终端设备发送所述第一数据和所述第一模型或所述第一模型的部分，所述第一数据用于确定第一模型的校正因子；所述第二网络设备还用于接收并向所述第一网络设备发送所述校正因子；
    所述第一网络设备还用于根据所述校正因子调整所述第一模型。
  30. 根据权利要求29所述的系统，其特征在于，所述第一网络设备还用于使用调整 过的所述第一模型得到第一标识。
  31. 根据权利要求30所述的系统，其特征在于，所述第一网络设备还用于得到应用报文流的特征信息和所述第一标识的第一对应关系或应用报文流的地址信息和所述第一标识的第二对应关系。
  32. 根据权利要求31所述的系统，其特征在于，所述第一网络设备还用于向所述第二网络设备发送所述第一对应关系或所述第二对应关系。
  33. 根据权利要求31或32所述的系统，其特征在于，所述第一网络设备还用于确定所述第一对应关系或所述第二对应关系的有效时间。
  34. 根据权利要求29至33中任一项所述的系统，其特征在于，所述第一网络设备是网络数据分析功能网元；所述第二网络设备是用户面功能网元。
  35. 一种通信装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机程序，以使得所述通信装置执行权利要求1至16中任一项所述的通信方法。
  36. 一种通信装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机程序，以使得所述通信装置执行权利要求17至23中任一项所述的通信方法。
  37. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行如权利要求1至23中任意一项所述的通信方法。
  38. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序，当所述计算机程序被运行时，使得计算机执行如权利要求1至23中任意一项所述的通信方法。
  39. 一种芯片系统，其特征在于，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片系统的通信设备执行如权利要求1至23中任意一项所述的通信方法。
  40. 一种通信系统，其特征在于，包括如权利要求35所述的通信装置，如权利要求36所述的通信装置。
PCT/CN2023/080431 2022-05-06 2023-03-09 一种通信方法和装置 WO2023213133A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210488344.6 2022-05-06
CN202210488344.6A CN117082564A (zh) 2022-05-06 2022-05-06 一种通信方法和装置

Publications (1)

Publication Number Publication Date
WO2023213133A1 true WO2023213133A1 (zh) 2023-11-09

Family

ID=88646202

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/080431 WO2023213133A1 (zh) 2022-05-06 2023-03-09 一种通信方法和装置

Country Status (2)

Country Link
CN (1) CN117082564A (zh)
WO (1) WO2023213133A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022033115A1 (zh) * 2020-08-12 2022-02-17 华为技术有限公司 一种通信方法和通信装置
WO2022053168A1 (en) * 2020-09-11 2022-03-17 Telefonaktiebolaget Lm Ericsson (Publ) Traffic classification rules based on analytics
WO2022062362A1 (zh) * 2020-09-25 2022-03-31 华为技术有限公司 通信方法、装置及系统
US20220108214A1 (en) * 2020-08-13 2022-04-07 Electronics And Telecommunications Research Institute Management method of machine learning model for network data analytics function device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022033115A1 (zh) * 2020-08-12 2022-02-17 华为技术有限公司 一种通信方法和通信装置
US20220108214A1 (en) * 2020-08-13 2022-04-07 Electronics And Telecommunications Research Institute Management method of machine learning model for network data analytics function device
WO2022053168A1 (en) * 2020-09-11 2022-03-17 Telefonaktiebolaget Lm Ericsson (Publ) Traffic classification rules based on analytics
WO2022062362A1 (zh) * 2020-09-25 2022-03-31 华为技术有限公司 通信方法、装置及系统

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Architecture enhancements for 5G System (5GS) to support network data analytics services (Release 17)", 3GPP STANDARD; 3GPP TS 23.288, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, no. V17.4.0, 23 March 2022 (2022-03-23), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, pages 1 - 205, XP052144750 *
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study of Enablers for Network Automation for 5G 5G System (5GS); Phase 3 (Release 18)", 3GPP STANDARD; TECHNICAL REPORT; 3GPP TR 23.700-81, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, no. V0.2.1, 20 April 2022 (2022-04-20), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, pages 1 - 85, XP052146048 *
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on 5G System Support for AI/ML-based Services (Release 18)", 3GPP STANDARD; TECHNICAL REPORT; 3GPP TR 23.700-80, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, no. V0.2.0, 20 April 2022 (2022-04-20), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, pages 1 - 93, XP052146044 *
HUAWEI, HISILICON: "new Solution for KI#2: NWDAF-assisted application detection", 3GPP DRAFT; S2-2202123, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. e-meeting; 20220406 - 20220412, 29 March 2022 (2022-03-29), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052132968 *

Also Published As

Publication number Publication date
CN117082564A (zh) 2023-11-17

Similar Documents

Publication Publication Date Title
US11811873B2 (en) Distribution hub for internet-of-things data
US11855864B2 (en) Method and apparatus for collecting network traffic in wireless communication system
EP4192184A1 (en) Pdu session establishment method, terminal device, and chip system
WO2017051069A1 (en) Method and system of identifying an access request of an application on a mobile device in a telecommunication network
WO2017070838A1 (zh) 资源调度方法、基站、调度器、节目源服务器和系统
WO2022026649A1 (en) Synchronization for multiple data flows
US10986495B2 (en) Interception method and apparatus based on local breakout
US20240179647A1 (en) Timing Service Type for Timing Resiliency Service
Moustafa et al. Security and Privacy in 4G/LTE Network
US20190200207A1 (en) Techniques for providing subscriber-specific routing of a roaming user equipment in a visited communication network
CN117793688A (zh) 针对af会话的外部参数提供的新方法
WO2023213177A1 (zh) 一种通信方法及装置
WO2023213133A1 (zh) 一种通信方法和装置
KR20210015002A (ko) 네트워크 노드 제어 방법 및 장치
CN114363966A (zh) 接入网设备、接入网络的方法及终端
KR20210048836A (ko) 네트워크 기능 통합방법 및 장치
KR20200044592A (ko) 다중 경로 전송 시스템, 그리고 이의 다중 경로 전송 방법
WO2024179262A1 (zh) 通信方法和通信装置
WO2023221604A1 (zh) 一种通信方法和装置
US20240283714A1 (en) Data collection method and communication apparatus
WO2022174780A1 (zh) DDoS攻击检测的方法和装置
CN117082527A (zh) 通信方法、通信装置及通信系统
Sathi et al. A Novel Approach to Slice Selection in Private 5G-and-Beyond Networks for Industrial IoT
Li et al. Sparse code multiple access
Wang et al. Situation Awareness in Smart Grids

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23799122

Country of ref document: EP

Kind code of ref document: A1