WO2023231898A1 - 一种通信方法、系统和通信装置 - Google Patents

一种通信方法、系统和通信装置 Download PDF

Info

Publication number
WO2023231898A1
WO2023231898A1 PCT/CN2023/096306 CN2023096306W WO2023231898A1 WO 2023231898 A1 WO2023231898 A1 WO 2023231898A1 CN 2023096306 W CN2023096306 W CN 2023096306W WO 2023231898 A1 WO2023231898 A1 WO 2023231898A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
terminal
location
threshold
network device
Prior art date
Application number
PCT/CN2023/096306
Other languages
English (en)
French (fr)
Inventor
李论
吴义壮
崔洋
孙陶然
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023231898A1 publication Critical patent/WO2023231898A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/04—Arrangements for maintaining operational condition
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/029—Location-based management or tracking services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W64/00—Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Definitions

  • Embodiments of the present application relate to the field of communications, and, more specifically, to methods, systems and devices for detecting abnormal information transmission and reception.
  • the cluster information sending and receiving platform is a device that can use software to send and receive large amounts of information. This device is often used in various scenarios where information is abnormally sent and received.
  • Abnormal information sending and receiving refers to the fact that the terminal needs to receive or send information due to abnormal business. It is characterized by the fact that the quantity and scale of sending, the sending frequency of the recipient, the sending content, and the sending device used are not in line with normal user habits.
  • the attacker deploys the cluster information sending and receiving platform to a fixed location, and then sends a large amount of malicious information and/or receives a large amount of information from the server and profits from it.
  • the processing of abnormal situations mainly involves the identification and interception of spam information through application layer detection programs, and the detection of abnormal users and analysis of communication information through network data analysis function (NWDAF) network elements.
  • NWDAAF network data analysis function
  • the application layer detection program cannot be associated with the geographical location of sending short messages on the network side.
  • the NWDAF network element cannot collect information about the short message service function (short message) in the 5G network during detection and analysis. service function, SMSF) network element-related short message content. Therefore, existing technology cannot effectively detect cluster abnormal information sending and receiving platforms.
  • Embodiments of the present application provide a method, system and device for detecting abnormal information transmission and reception.
  • a communication method which is characterized in that it includes: a network device obtains at least one location information according to at least one first information among a plurality of information, wherein each information corresponds to at least one terminal device, and each The destination device of the information is the terminal device corresponding to the information, one first information corresponds to at least one location information, and the location information corresponding to one first information is used to indicate the location of the destination device of the first information; According to the location information, at least one first location range is determined, wherein the number of first terminal devices within the first location range is greater than or equal to a first threshold, and the first terminal device is corresponding to at least one first information terminal device; and/or the quantity of second information in the plurality of information is greater than or equal to the second threshold, and the second information is that the destination device in the at least one first information is located within the first location range.
  • the third information is that the destination device in the at least one first information is located in the Information within the first location range, the length of the third information satisfies the first preset condition; and/or the number of second terminal devices within the first location range is greater than or equal to the fourth threshold, the second The terminal device is a destination device of at least one first information, and the device identification of the second terminal device satisfies the second preset condition.
  • Embodiments of the present application detect multiple pieces of information through network devices, which can effectively detect abnormal reception of information.
  • the method further includes: receiving or generating the plurality of information.
  • multiple pieces of information are received or generated by network devices, which can expand the scope of detected information.
  • the network device forwards the information sent by the first terminal to the second terminal.
  • the network device generates information and sends it out.
  • the first preset condition includes the length of the plurality of information satisfying the length of the preconfigured value.
  • the network device detects the lengths of multiple messages to determine a location range, and there is an abnormality in the information received by terminals in the location range.
  • the second preset conditions include that the device identifiers are all the same, the device identifiers are consecutive at equal intervals within the interval, and the device identifiers are repeatedly arranged within the presentation interval. at least one of them.
  • a network device detects the identifiers of devices corresponding to multiple pieces of information to determine a location range, and there is an abnormality in receiving information by terminals in the location range.
  • the first information is part of the plurality of information.
  • Network devices can reduce the amount of calculation and improve detection efficiency by detecting only part of the information among multiple pieces of information.
  • the first information is information that the destination device is located in a specific area.
  • the network device is pre-configured with a second location range, and the destination device of the first information is located within the second location range.
  • the second location range is a location range that the requesting party is interested in.
  • the reason for the interest may be : 1. The requester needs to analyze the designated area according to the needs; 2. The area that needs to be analyzed is very large, and the analysis is performed in batches; 3. Key areas determined based on big data and AI algorithms.
  • the network device only detects information in a specific area, which reduces the calculation amount of the network device and improves detection efficiency.
  • the information includes short messages, information sent by a terminal application, and the information is used for verification, notification, marketing or chatting.
  • the embodiments of the present application can realize effective detection of abnormal reception of short messages and information sent by terminal applications.
  • the information sent by the terminal application may refer to the information sent by WeChat, or it may be a verification code used to verify the user's identity when logging in or registering.
  • the first information is information whose length is greater than or equal to a fifth threshold among the plurality of information.
  • the network device only detects information whose information length exceeds a certain threshold, which reduces the calculation amount of the network device and improves the detection efficiency. In addition, it also avoids the interference of some information and improves the detection accuracy.
  • the first information is the first of the plurality of information Information sent by the application function network element to the destination device.
  • the network device only detects the information sent by a specific network element, which reduces the calculation amount of the network device and improves the detection efficiency.
  • the first information is a first type of information among the plurality of information, and the first type is corresponding to the first application function network element.
  • the type of information One application function network element corresponds to at least one type of information.
  • the network device only detects specific types of information, which reduces the calculation amount of the network device and improves detection efficiency.
  • the information includes short messages, and there is a corresponding relationship between the types of short messages and application function network elements.
  • One application function network element can correspond to multiple short message types.
  • the application function network element (AF) identifier is used to represent the application function network element that sends text messages. This application does not limit the specific form of the AF identifier.
  • the AF identifier is AF in the network.
  • the side ID or AF identifier is the number configured by the operator for sending short messages.
  • the type of short message corresponding to the application function network element with the identifier 10690001 is the verification code type
  • the type of short message corresponding to the application function network element with the identifier 10650001 is the verification code type and marketing type.
  • the method further includes: the network device generating alarm information, the alarm information being used to indicate an abnormality in the first location range; or the network device The device prohibits forwarding some or all of the plurality of information to terminals within the first location range; or the network device prohibits sending information to terminals within the first location range.
  • the network device can obtain a location range by detecting multiple pieces of information. There is an abnormality in the terminals receiving information within the location range. Furthermore, the network device can limit the terminals within the range to receive information through alarm information.
  • a communication method which is characterized in that it includes: a network device obtains at least one location information based on at least one first information among a plurality of information, wherein each information corresponds to at least one terminal device, and each The sending device of the information is the terminal device corresponding to the information, one piece of first information corresponds to at least one piece of location information, and the location information corresponding to one piece of first information is used to indicate the location of the sending device of the first information; according to The location information determines at least one first location range, wherein the number of first terminal devices within the first location range is greater than or equal to a first threshold, and the first terminal device is a sending device of at least one first information ; and/or the quantity of the second information in the plurality of information is greater than or equal to the second threshold, and the second information is the information that the sending device is located within the first location range in the at least one first information; and/or the quantity of the third information in the plurality of information is greater than or equal to the third threshold,
  • Embodiments of the present application detect multiple pieces of information through network devices, which can effectively detect abnormal transmission of information.
  • the method further includes: receiving or generating the plurality of information.
  • multiple pieces of information are received or generated by network devices, which can expand the scope of detected information.
  • the network device forwards the information sent by the first terminal to the second terminal.
  • the network device generates information and sends it out.
  • the first preset condition includes that the lengths of the plurality of information satisfy the length of the preconfigured value.
  • the network device detects the lengths of multiple messages to determine a location range, and there is an abnormality in the information sent by terminals in the location range.
  • the second preset conditions include that the device identifiers are all the same, the device identifiers are consecutive at equal intervals within the interval, and the device identifiers are repeatedly arranged within the presentation interval. at least one of them.
  • a network device detects the identifiers of devices corresponding to multiple pieces of information to determine a location range, and there is an abnormality in information sent by terminals in the location range.
  • the first information is part of the plurality of information.
  • Network devices can reduce the amount of calculation and improve detection efficiency by detecting only part of the information among multiple pieces of information.
  • the first information is information that the destination device is located in a specific area.
  • the network device is pre-configured with a second location range, which is a location range that the requesting party is interested in.
  • the reason for the interest may be: 1. The requesting party needs to analyze the specified area according to needs; 2. The area that needs to be analyzed is very large, and the analysis is performed in batches; 3. Key areas determined based on big data and AI algorithms.
  • the network device only detects information in a specific area, which reduces the calculation amount of the network device and improves detection efficiency.
  • the information includes short messages, information sent by a terminal application, and the information is used for verification, notification, marketing or chatting.
  • the embodiments of the present application can realize effective detection of abnormal transmission of short messages and information sent by terminal applications.
  • the information sent by the terminal application may refer to the information sent by WeChat, or it may be a verification code used to verify the user's identity when logging in or registering.
  • the first information is information with a length greater than or equal to a fifth threshold among the plurality of information.
  • the network device only detects information whose information length exceeds a certain threshold, which reduces the calculation amount of the network device and improves the detection efficiency. In addition, it also avoids the interference of some information and improves the detection accuracy.
  • the first information is information whose hash value is the first value among the plurality of information.
  • the network device only detects information of specific content, which reduces the calculation amount of the network device and improves the detection efficiency. In addition, it also avoids the interference of some information and improves the detection accuracy.
  • the hash value can be used to describe the content of the information.
  • the embodiment of the present application detects specific content or information with the same content.
  • the determination of the specific content is not limited in this application.
  • the specific content can be based on Obtained from previous big data information and AI algorithms on abnormal information.
  • the first information is information in which the first number of the sending device among the plurality of information is greater than or equal to the sixth threshold, and the first number Used to indicate the number of times the sending device did not receive a reply after sending a message.
  • the network device detects information that has not been responded to after timeout, which reduces the calculation amount of the network device and improves the detection efficiency.
  • the method further includes: when the network device forwards information from the sending device, starting a timer, and if the timer times out, the network device does not After receiving the reception report, the counter corresponding to the sending device is accumulated to obtain the first time number.
  • the network device can effectively count the number of times the sending device does not receive a reply after sending information, which provides a basis for the network device to detect abnormal sending of information.
  • the method further includes: the network device generates alarm information, the alarm information is used to indicate an abnormality in the first location range; or the network The device prohibits forwarding some or all of the plurality of information for terminals within the first location range; or the network device prohibits terminals within the first location range from sending information.
  • the network device can obtain a location range by detecting multiple pieces of information. There is an abnormality in the information sent by terminals within the location range. Furthermore, the network device can restrict the terminals within the range from sending information through alarm information.
  • a communication system which is characterized in that it includes: a first network device and a second network device; the first network device is used to send the plurality of information to the second network device, each time pieces of information correspond to at least one terminal device; the network device obtains at least one piece of location information based on at least one first piece of information among the plurality of pieces of information, wherein one piece of first information corresponds to at least one piece of piece of piece of location information, and one piece of first piece of information corresponds to at least one piece of location information.
  • the corresponding location information is used to indicate the location of the terminal device corresponding to the first information; according to the location information, at least one first location range is determined, wherein the number of first terminal devices within the first location range Greater than or equal to the first threshold, the first terminal device is a terminal device corresponding to at least one first information; and/or the number of second information in the plurality of information is greater than or equal to the second threshold, the second The information is information that the terminal device is located within the first location range in the at least one first information; and/or the number of third information in the plurality of information is greater than or equal to a third threshold, and the third information It is the information that the terminal device is located within the first location range in the at least one first information, the length of the third information satisfies the first preset condition; and/or the second terminal within the first location range
  • the number of devices is greater than or equal to the fourth threshold, the second terminal device is at least one terminal device corresponding to the first information, and the device identification of the second terminal device satisfies the
  • Embodiments of the present application provide a communication system, through which the network device detects multiple pieces of information, which can effectively detect abnormal transmission of information.
  • the first preset condition includes that the length of multiple pieces of information meets the length of the preconfigured value;
  • the second preset condition includes that the device identifiers are all the same, the device identifiers are continuous at equal intervals within the interval, and the device identifiers are repeated within the presentation interval. At least one item in the arrangement.
  • the first network device is further configured to receive or generate the plurality of information.
  • multiple pieces of information are received or generated by network devices, which can expand the scope of detected information.
  • the network device forwards the information sent by the first terminal to the second terminal.
  • the network device generates information and sends it out.
  • the second network device before the first network device sends the plurality of information to the second network device, the second network device sends a message to the first network device. Send the first request message, the The first request information is used to request the plurality of information from the first network device.
  • the second network device can proactively request information to be detected from the first network device, which improves the flexibility of detection.
  • the second network device before the second network device sends the first request information to the first network device, the second network device receives the second request information, and the The second request information is used to request the second network device to determine the first location range; the second request information includes a second type and/or a second location range.
  • the second network device receives the second request information, and the second request information defines the area to be detected and the type of information, which can not only reduce the amount of information detected by the second network device, improve detection efficiency, but also eliminate Some interference information improves detection accuracy.
  • the second type is used to indicate to the second network device the type of information that needs to be detected
  • the second location range is used to indicate to the second network device the area that needs to be detected.
  • the second information and the second location range can greatly reduce the number of times the second network device increase the detection volume and improve detection efficiency.
  • the second location range is a location range that the requesting party is interested in.
  • the reasons for the interest may be: 1.
  • the requesting party needs to analyze a specified area according to needs; 2.
  • the area that needs to be analyzed is large and needs to be analyzed in batches. Perform analysis; 3.
  • the second type is a type of information that the requesting party is interested in.
  • the reasons for interest may be: 1.
  • the requesting party needs to analyze the specified short message type according to the needs; 2.
  • a communication device including: a processing module configured to obtain at least one location information based on at least one first information among a plurality of information, wherein each information corresponds to at least one terminal, and each information The destination terminal is the terminal corresponding to the information, one first information corresponds to at least one location information, and the location information corresponding to one first information is used to indicate the location of the destination device of the first information; the processing Module, further configured to determine at least one first location range according to the location information, wherein the number of first terminal devices within the first location range is greater than or equal to a first threshold, and the first terminal device is at least one The terminal device corresponding to the first information; and/or the quantity of the second information in the plurality of information is greater than or equal to the second threshold, the second information is that the destination device in the at least one first information is located in the third Information within a location range; and/or the quantity of the third information in the plurality of information is greater than or equal to the third threshold, the third information is that the destination device
  • Embodiments of the present application provide a communication device that can detect multiple pieces of information and determine a location range, and can achieve effective detection of abnormal reception of information.
  • the device further includes: a transceiver module, the transceiver module is configured to receive the plurality of information.
  • the network device forwards the information sent by the first terminal to the second terminal.
  • the processing module is further configured to generate the plurality of information.
  • the network device generates information and sends it out.
  • a communication device including: a processing module configured to, according to at least one of a plurality of information, Obtain at least one location information, where each information corresponds to at least one terminal, the sending terminal of each information is the terminal corresponding to the information, one piece of information corresponds to at least one piece of location information, and the location information corresponding to one piece of information is used to indicate The location of the sending device of the information; the processing module is also configured to determine at least one first location range based on the location information, wherein the number of first terminal devices within the first location range is greater than or Equal to the first threshold, the first terminal device is the destination device of at least one first information; and/or the number of second information in the plurality of information is greater than or equal to the second threshold, the second information is the The information in the at least one first information that the destination device is located within the first location range; and/or the number of third information in the plurality of information is greater than or equal to a third threshold, and the third information is the At least one piece of first
  • Embodiments of the present application provide a communication device that can detect multiple pieces of information and can effectively detect abnormal transmission of information.
  • the device further includes: a transceiver module, the transceiver module being configured to receive the plurality of information.
  • the network device forwards the information sent by the first terminal to the second terminal.
  • the processing module is further configured to generate the plurality of information.
  • the network device generates information and sends it out.
  • a communication device including: a processor configured to execute a computer program stored in a memory, so that the communication device executes the communication methods of the first and second aspects.
  • a seventh aspect provides a computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is run on a computer, it causes the computer to execute the first aspect and communication methods in the second aspect.
  • a chip system which is characterized by including: a processor for calling and running a computer program from a memory, so that a communication device installed with the chip system executes the first and second aspects. Communication methods.
  • Figure 1 is a schematic diagram of the application scenario of the application embodiment.
  • Figure 2 is a flow chart of an embodiment of the present application.
  • Figure 3 is a schematic flowchart of cluster anomaly detection in an embodiment of the present application.
  • Figure 4 is a schematic flowchart of cluster anomaly detection in an embodiment of the present application.
  • Figure 5 is a schematic flowchart of cluster anomaly detection in an embodiment of the present application.
  • Figure 6 is a schematic flowchart of AF triggering short messages in an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of sending downlink short messages in this embodiment of the present application.
  • FIG. 8 is a schematic diagram of a communication device 10 provided by an embodiment of the present application.
  • GSM global system of mobile communication
  • CDMA code division multiple access
  • WCDMA broadband code division multiple access
  • GPRS general packet radio service
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD LTE Time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX global interoperability for microwave access
  • the terminal equipment in the embodiment of this application may refer to user equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent or User device.
  • the terminal device may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a device with wireless communications Functional handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in 5G networks or terminals in future evolved public land mobile communications networks (PLMN) Equipment, etc., the embodiments of this application are not limited to this.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • the network device in the embodiment of this application may be a device used to communicate with a terminal device.
  • the network device may be a global system of mobile communication (GSM) system or a code division multiple access (ccodedivision multiple access, CDMA) system.
  • the base station base transceiver station, BTS), or the base station (NodeB, NB) in the wideband code division multiple access (WCDMA) system, or the evolutionary base station (evolutional NodeB) in the LTE system , eNB or eNodeB), or it can be a wireless controller in a cloud radio access network (CRAN) scenario, or the network device can be a relay station, access point, vehicle-mounted device, wearable device, and 5G network
  • the embodiments of this application are not limited to the network equipment in the PLMN network or the network equipment in the future evolved PLMN network.
  • Figure 1 is a schematic diagram of an application scenario of an embodiment of the present application.
  • the embodiment of the present application is applied in various scenarios of abnormal sending and receiving of information.
  • a common scenario is the abnormal sending and receiving of short messages.
  • this application uses short messages. Abnormal transmission and reception will be described as an example. It should be understood that this application does not limit the specific form of information.
  • the embodiments of the present application can detect abnormal locations for sending and receiving short messages.
  • a cluster short message sending and receiving platform is deployed at the place where short messages are abnormally sent and received.
  • the cluster short message sending and receiving platform refers to a user equipment (UE) that can use software to control the sending and receiving of short messages in batches.
  • UE user equipment
  • the cluster short message sending and receiving platform It refers to a device that has a communication module, can send and receive short messages, and supports the simultaneous use of multiple mobile phone cards.
  • the cluster short message sending and receiving platform can receive or send a large number of short messages through programs.
  • Attackers usually use illegal means to obtain a large number of mobile phone cards legally contracted with operators, and then deploy cluster devices to a fixed location to start receiving or sending short messages.
  • Attackers usually initiate two short message sending and receiving operations through cluster devices that are abnormal to normal user behavior on the network, namely abnormal sending and abnormal receiving.
  • Abnormal sending refers to abnormal group sending of short messages, which are mostly seen in abnormal malicious short messages. They are usually sent to a large number of mobile phone numbers. Generally speaking, the content is "phishing" URLs or remittance instructions. The ultimate goal is to steal legitimate users' information or money. fiscal.
  • Abnormal reception refers to the abnormal and frequent reception of a large number of information similar to verification codes sent from the server. After receiving it, it is illegally sold to others. Verification codes are often used as a black industry. This kind of platform is the "code receiving platform”. Recent research shows that some malicious attackers can make a profit by helping others receive verification codes, and the combination of sold verification codes and mobile phone numbers can help other attackers use them for malicious activities. "Code receiving platform” is a link in the current black industry chain. The sale of verification codes can be used to generate illegal accounts, as well as money laundering and other activities. Currently, almost all existing anomaly "code receiving platforms” are deployed using cluster devices. Because according to some existing anomaly detection rules, the same mobile phone number usually cannot obtain verification codes continuously.
  • the embodiment of this application comprehensively identifies abnormal cluster short message sending and receiving behavior in the network through access information, short message type, sending method and other information on the network side, and identifies the access location of the abnormal cluster short message sending and receiving platform.
  • Figure 2 is a flow chart of an embodiment of the present application.
  • the network device obtains at least one location information based on at least one first information among the plurality of information, where each information corresponds to at least one terminal, and one first information corresponds to at least one location information.
  • the plurality of information includes short messages, information sent by a terminal application, and the purpose of the information includes verification, notification, marketing, or chatting.
  • each message includes a short message sent by the AF to the user, and the destination device of each message is the device used by the terminal corresponding to the message.
  • each information includes a short message sent by the first terminal to the second terminal, where the sending device is a device used by the first terminal, and the destination device is a device used by the second terminal.
  • the first information is part of the plurality of information. By filtering out the first information to avoid detecting all information, the calculation amount of the network device can be effectively reduced and the detection efficiency can be improved.
  • the first information includes the filtered first short message.
  • the network device is pre-configured with at least one suspicious location range, and the recipient of the short message in the first information is located in the suspicious location range.
  • the network device can exclude the first case where the recipient is not in the suspicious location range. Text Message.
  • the embodiment of the present application does not limit the source and basis of the suspicious location range.
  • the suspicious location range is a certain location range that the requesting party is interested in.
  • the reason for the interest may be: 1.
  • the requesting party Specified areas need to be analyzed based on demand; 2.
  • the area that needs to be analyzed is very large, and the analysis is performed in batches; 3.
  • the network device presets short message length information, the length of the short message in the first information is greater than or equal to the preset short message length, and the network device excludes the first short message whose length is less than the preset short message length. information.
  • the network device obtains the identifier of the AF that sent the first short message, the network device is preconfigured with at least one second identifier, and the sender of the short message in the first information corresponds to the second identifier.
  • the network device excludes the first short message whose AF identifier is different from the second identifier.
  • the AF identifier is used to represent the AF that sends the text message. This application does not limit the specific form of the AF identifier.
  • the AF identifier is the ID of the AF on the network side or the AF identifier is configured by the operator for sending. SMS number.
  • the network device obtains the AF identifier corresponding to the first short message is a common technical means in this field.
  • the network device obtains the AF identifier corresponding to the first short message through the short message service center (short message service-service center,
  • the SMS-SC short message service-service center
  • the SMS-SC subscriber permanent identifier
  • the plurality of information includes short message type information
  • the short message type information is used to represent the type of short message.
  • the short message type includes verification code type, marketing type, and so on.
  • the network device obtains the identifier of the AF that sent the first short message.
  • the network device determines the short message type according to the AF identifier.
  • the network device is preconfigured with at least one second type.
  • the type of the short message in the first information is the second type.
  • the network device excludes the first short message whose short message type is different from the second type.
  • the first information includes the filtered second short message.
  • At least one suspicious location range is pre-configured in the network device.
  • the sender of the short message in the first information is in the suspicious location range.
  • the network device can exclude the second message whose sender is not in the suspicious location range. Text Message.
  • the embodiment of the present application does not limit the source and basis of the suspicious location range.
  • the suspicious location range is a certain location range that the requesting party is interested in.
  • the reason for the interest may be: 1.
  • the requesting party Specified areas need to be analyzed based on demand; 2.
  • the area that needs to be analyzed is very large, and the analysis is performed in batches; 3.
  • the network device presets short message length information, the length of the short message in the first information is greater than or equal to the preset short message length, and the network device excludes the second short message whose length is less than the preset short message length. information.
  • the network device obtains the hash value of the second short message, the network device is preconfigured with at least one first value, the hash value of the short message in the first information is the first value, and the network device excludes A second short message with a different hash value than the first value.
  • the network device determines at least one first location range based on the location information.
  • the plurality of information also includes the identification information of the first short message, the identity identification information of the terminal receiving the first short message, the At least one of the device identification information of the short message terminal and the length of the first short message.
  • the identity identification information may be SUPI
  • the device identification information may be the unique identification of the mobile device operating system (for example, the activation information identification series number of the mobile device operating system), or the international mobile equipment identification code (international mobile equipment identification code).
  • identity, IMEI or it can be the international mobile equipment identity software version (IMEISV).
  • the short message identification information refers to identification information that can uniquely represent the short message.
  • the short message identification information may include but is not limited to ⁇ short message itself/short message ID identifier/short message sending time and short message Message sending object ⁇ and other information that can identify the short message.
  • the network device determines at least one first location range based on the location information. around.
  • the number of first terminals within the first location range is greater than or equal to the first threshold, and the first terminal is a terminal corresponding to at least one piece of information in the plurality of information; and/or the plurality of information
  • the quantity of the first information in the plurality of information is greater than or equal to the second threshold, and the first information is the information that the destination device is located within the first location range among the plurality of information; and/or the first information among the plurality of information
  • the number of three pieces of information is greater than or equal to the third threshold, the third piece of information is the information that the destination device is located within the first location range in the at least one first piece of information, and the length of the third piece of information satisfies the first preset Condition; and/or the number of first devices within the first location range is greater than or equal to a third threshold, the first device is the destination device for at least one of the plurality of information, and the first The
  • the first preset condition may be that the lengths of the plurality of information satisfy the length of the preconfigured value.
  • the second preset condition may be at least one of the following: the device identifiers are all the same, the device identifiers are consecutive at equal intervals within the interval, and the device identifiers are repeatedly arranged within the interval.
  • the first information also includes the identification information of the second short message, the identity identification information of the user who sent the second short message, At least one of the device identification information of the user who sent the second short message and the hash value of the second short message.
  • the identity identification information may be SUPI
  • the device identification information may be a unique identification of the mobile device operating system (for example, the activation information identification series number of the mobile device operating system), which may be IMEI or IMEISV.
  • the short message identification information refers to identification information that can uniquely represent the short message.
  • the short message identification information may include but is not limited to ⁇ short message itself/short message ID identifier/short message sending time and short message Message sending object ⁇ and other information that can uniquely identify the short message.
  • the network device determines at least one first location range based on the location information.
  • the number of first terminals within the first location range is greater than or equal to the first threshold, and the first terminal is a terminal corresponding to at least one piece of information in the plurality of information; and/or the plurality of information
  • the quantity of the first information in is greater than or equal to the second threshold, and the first information is the information that the terminal is located within the first location range among the plurality of information; and/or the third among the plurality of information
  • the amount of information is greater than or equal to a third threshold, the third information is information in the at least one first information that the destination device is located within the first location range, and the length of the third information satisfies the first preset condition ; and/or the number of first devices within the first location range is greater than or equal to the third threshold, the first device is a sending device of at least one of the plurality of information, and the first device The device identification satisfies the second preset condition.
  • the first preset condition may be that the lengths of the plurality of information satisfy the length of the preconfigured value.
  • the second preset condition may be at least one of the following: the device identifiers are all the same, the device identifiers are consecutive at equal intervals within the interval, and the device identifiers are repeatedly arranged within the interval.
  • the network device in the embodiment of the present application may be a system composed of multiple network devices capable of realizing the above functions.
  • the network device integrates an SMSF network element and a security analysis network element, where the security analysis
  • the network element may be a network data analytics function (NWDAF) network element.
  • NWDAF network data analytics function
  • the SMSF network element obtains at least one short message and sends at least one first information to the NWDAF network element.
  • the first information is the at least one short message.
  • the NWADAF network element determines the abnormal user location information based on the first information and sends the analysis results to the SMSF network element.
  • Figure 3 is a schematic flowchart of a cluster anomaly detection in an embodiment of the present application. It should be understood that, for convenience of description, the information detected in the embodiment of the present application is a short message, and the form of the detected information is not limited in this application.
  • the service triggering direction sends the first information to the security analysis network element.
  • the first information includes suspicious access address information. list.
  • the first information also includes a short message type.
  • the short message type refers to a description or identifier of the short message content type.
  • the content type of the short message is a verification code type.
  • the short message type corresponds to 1; the content type of the short message is marketing, and the short message type corresponds to 2.
  • the first information also includes reporting rule information, and the reporting rule information is used to indicate a manner in which the security analysis network element reports detection results.
  • the reporting rule information instructs the security analysis network element to report detection results every first time period.
  • the reporting rule information instructs the security analysis network element to report detection results every time it detects the first amount of abnormal information.
  • Suspicious access address information refers to places with a high probability of cluster anomalies.
  • the method for determining suspicious access address information is not limited in this application.
  • the suspicious access address information is obtained by analyzing a large number of past
  • the cluster abnormal access address information is obtained through big data analysis.
  • the access address information can be user location information (ULI), a specific global positioning system (GPS) coordinates, or a cell ID (CELL ID), location area code (LAC) (ULI), a specific global positioning system (GPS) coordinates, or a cell ID (CELL ID), location area code (LAI).
  • UCI user location information
  • GPS global positioning system
  • CELL ID cell ID
  • location area code LAC
  • the security analysis network element receives the first information and parses the first information to obtain a parsed suspicious address information list.
  • the parsed suspicious address information is information that can be identified by network elements in the communication network.
  • the security analysis network element sends second information to the SMSF, where the second information includes the parsed suspicious address information list.
  • the second information also includes the short message type.
  • the second information also includes LAC.
  • the second information also includes a cell identifier.
  • the AF triggered short message sends the short message to the terminal through the downlink short message process, and the SMS-SC can obtain the AF identifier.
  • the terminal After receiving the short message, the terminal sends reception confirmation information to the SMSF.
  • the reception confirmation information includes the terminal identity and ULI.
  • the SMSF determines whether to record the short message information associated with the reception confirmation information based on the second information and the reception confirmation information and generates a to-be-detected list.
  • the SMSF records the information of the short message associated with the reception confirmation information and places it in the list to be detected; if the suspicious address in the second information If the information list does not include the ULI in the reception confirmation information, the SMSF does not record the information of the short message associated with the reception confirmation information.
  • the list to be detected includes the ULI, the identity of the terminal and the identification information of the short message.
  • the to-be-detected list also includes the length of the short message.
  • the SMSF sends a to-be-detected list to the security analysis network element.
  • the to-be-detected list includes the ULI, the terminal's identity identifier, and the short message identifier information.
  • the list to be detected also includes short message length.
  • the security analysis network element can use the short message length to exclude some short and repeated normal short messages that are often sent by ordinary terminals, such as "Okay”, "TD” ”, “OK” and other information to prevent misjudgment and improve detection accuracy.
  • the list to be detected also includes the short message length dispersion, and the security analysis network element can use the short message length dispersion to determine the similarity of short messages under the same ULI.
  • the list to be tested is shown in Table 1.
  • the short message identification information in this application refers to an identification that can uniquely represent a short message.
  • the embodiments of this application do not limit the specific content of the short message identification information.
  • the short message identification information includes at least one of the short message itself, the short message ID identifier, the short message sending time and the short message sending object.
  • the embodiment of the present application does not limit the manner in which the SMSF sends the list to be detected to the security analysis network element.
  • the SMSF sends a list to be detected to the security analysis network element according to preset rules.
  • the SMSF sends the to-be-detected list to the security analysis network element at regular intervals or the SMSF records a certain amount of data and then sends the to-be-detected list to the security analysis network element.
  • the security analysis network element excludes short messages that do not need to be checked after receiving the list to be checked.
  • the security analysis network element excludes short messages that do not need to be checked based on the subscription information in the unified data management (UDM) network element. For example, if the subscription information in the UDM is displayed as high priority, short messages sent to the user terminal will not be checked.
  • UDM unified data management
  • the security analysis network element excludes short messages that do not need to be checked based on the length of the short message. For example, if the length of the short message is less than a certain threshold, the short message is not checked.
  • the security analysis network element sends AF identifier request information to the SMS-SC.
  • the AF identifier request information includes SUPI and short message identification information.
  • SMS-SC sends AF identifier response information to the security analysis network element.
  • the AF identifier response information includes short message identification information and AF identifier.
  • the SMS-SC notifies the security analysis network element of the information. If the security analysis network element receives the notification, the short message will not be checked.
  • the security analysis network element determines the short message type.
  • the security analysis network element sends short message type request information to the corresponding AF according to the AF identifier.
  • the short message type request information includes short message identification information and SUPI.
  • AF sends a short message to the security analysis network element.
  • Message type response information, short message type response information includes short message type.
  • AF can be configured with a table preconfigured by the operator or application layer, corresponding to the short message type and AF identifier. If an AF identifier corresponds to multiple short message types, then the short message is Identified as multiple short message types.
  • the security analysis network element obtains the AF type from the UDM based on the AF identifier, and the security analysis network element determines the short message type by itself based on the AF type.
  • the security analysis network element determines the short messages that require further analysis based on the AF identifier.
  • the security analysis network element determines the short message that needs further analysis based on the AF identifier and the short message type.
  • the collected short messages are all of the verification code type, and the verification codes are all sent in the form of AF trigger. If a short message does not have an AF identifier, it means that the short message is not AF triggered, and the short message does not need to be detected. Through this item, you can further exclude short messages that do not need to be detected.
  • the security analysis network element sends access information request information to the SMSF according to the short message that needs further analysis.
  • the access information request information is used to request the access information of each short message recipient.
  • the access information request information includes the short message. List of identifying information.
  • the access information request information also includes a SUPI list.
  • the SMSF sends access information response information to the security analysis network element.
  • the access information response information includes the device list when receiving each short message, for example, the IMEISV list.
  • the security analysis network element obtains the access information of each short message recipient through SMSF.
  • the security analysis network element can also obtain the access information of each short message recipient through the session management function (SMF).
  • SMSF session management function
  • the access information of each short message recipient is obtained.
  • the acquisition process is the same as the above steps, which will not be described in detail in the embodiment of this application.
  • the security analysis network element further determines the short message sent by the terminal in the area by determining the number of occurrences of the same terminal in all the short messages that need to be detected in the ULI, the total number of short message lists, the regularity of the device identification used by the terminal, and the dispersion of short message lengths. Are there any abnormalities?
  • the device identifier used by the terminal can be IMEI, IMEISV, or the activation information identifier of the mobile device operating system.
  • the regularity of the device identifiers used by the terminal can refer to the fact that the device identifiers are all the same, the device identifiers are continuous at equal intervals within the interval, and the device identifier presentation interval Repeat at least one item in the arrangement.
  • the security analysis network element reports the abnormality of the address and the list of terminals that send short messages to the AF.
  • the content includes but is not limited to ULI and SUPI lists.
  • the reported content also includes a short message identification list.
  • the reported content also includes an AF identifier, where the AF identifier refers to the identifier of the short message that triggers AF.
  • the security analysis network element is pre-configured with trigger conditions. For example, the security analysis If the network element reports regularly or if the security analysis network element detects that the number of short messages that need to be reported exceeds the specified number, the reporting action will be triggered.
  • the security analysis network element adopts the existing NWDAF network element data collection mode to detect abnormal short messages.
  • the service triggering party issues detection requirements.
  • the security analysis network element parses, it collects information directly related to the short message from the SMSF, obtains the AF identifier from the SMS-SC, and then determines the short message type, and reports it to the access and mobility management network element.
  • AMF access and mobility management function
  • SMSSF obtains the access information and IMEISV of the short message receiving terminal.
  • Figure 4 is a schematic flow chart of cluster anomaly detection in this embodiment of the present application. It should be understood that, for convenience of description, the information detected in this embodiment of the present application is a short message, and this application does not limit the specific form of the information.
  • S410 The operator configures the collection and triggering threshold policies to the SMSF, SMS-SC and security analysis network elements through pre-configuration and waits for triggering.
  • the threshold refers to the threshold that triggers reporting. The specific configuration is beyond the scope of this application.
  • S420 AF queries UDM for terminal information and sending policy.
  • AF sends a short message submission trigger (submit trigger) to SMS-SC.
  • the short message submission trigger includes the terminal's identity, SUPI, and AF identifier.
  • the short message submission trigger also includes a short message type identifier, and the short message type is used to describe the type of the short message, such as verification code type, marketing type, and notification type.
  • SMS-SC sends a reply to AF in response.
  • SMS-SC sends a downlink short message to the SMSF, including the short message itself, target terminal information and AF identifier.
  • the SMS-SC sends a downlink short message to the SMSF, and also includes a short message type identifier.
  • the short message type identifier may be sent by the AF to the SMS-SC, or may be pre-configured in the SMS-SC, which is not limited in this application.
  • the SMSF determines the type identifier of the short message.
  • the SMSF determines and queries the subscription data in the UDM based on the AF identifier, and determines the type identifier of the short message.
  • the security analysis network element has a configured table, as shown in Table 3. After receiving the AF identifier, the SMSF queries the security analysis network element for the type of short message based on the AF identifier.
  • the AF triggered short message sends the short message to the terminal through the downlink short message process, and the SMS-SC can obtain the AF identifier.
  • the terminal After receiving the short message, the terminal sends reception confirmation information to the SMSF.
  • the reception confirmation information includes the terminal identity, ULI and identification of the device used by the terminal.
  • the SMSF checks the type identifier of the corresponding short message. If the type needs to be detected, the ULI's current suspected abnormal short message counter is progressive.
  • the SMSF locally maintains a table of suspected abnormal terminals.
  • Table 4 A possible example is shown in Table 4, where the identifier of the device used by the terminal is IMEISV. It should be understood that the terminal in the embodiment of this application The identification of the device used can also be IMEI and operating system activation code, which is not limited in this application.
  • SMSF sends a ULI exception event to the security analysis network element.
  • the content sent includes ULI, short message type identifier, triggered SUPI list, and triggered device identifier. List, short message count when triggered.
  • the sent content also includes the AF identifier.
  • the security analysis network element determines whether the identification needs to continue by determining the short message type identifier, the AF registration type, and whether the triggered terminal is in the white list.
  • the security analysis network element updates the SMSF detection rules.
  • the security analysis network element receives the reported information and determines that the number is too large or too small based on the preconfigured information. The security analysis network element determines that changes need to be made to collect statistics on the specified ULI. The security analysis network element can update the detection rules and send them to the SMSF. ULIs and whitelisted ULIs.
  • the security analysis network element also sends the AF identifier to the SMSF.
  • the security analysis network element also sends a short message type identifier to the SMSF.
  • SMSF will take targeted actions after receiving the update.
  • the specific operation content includes: if a ULI and a short message type identifier are received, the SMSF will perform statistics on the new short message type of the ULI; if a whitelist ULI is received, the SMSF will send the geographical location of the whitelist ULI. Short messages, related short messages will not be counted in the future; if ULI and AF identifier are received, SMSF will count suspected short messages based on the ULI and AF identifier.
  • the security analysis network element analyzes and determines the information reported by the SMSF. After each SMSF report is received, the security analysis network element comprehensively determines whether the ULI has clustered short messages by analyzing the number of device identification switching times with the same SUPI, the regularity of the device identification used by the terminal, the number of SUPIs, and the total number of short messages triggered per unit time.
  • the regularity of the device identifiers used by the terminal may refer to at least one of the following: the device identifiers are all the same, the device identifiers are continuous at equal intervals within the interval, and the device identifiers are arranged repeatedly within the interval.
  • S4140 When the security analysis network element determines that the ULI is a cluster abnormal location, the security analysis network element sends the corresponding terminal SUPI list to the SMSF, and recommends that the SMSF limit the short message permissions of the terminals in the SUPI list and restrict the sending and receiving of short messages.
  • the security analysis network element stores the ULI address in the UDM, thereby recommending that the SMSF restricts subsequent short message service registration of terminals in this area.
  • the form of passive triggering is adopted.
  • the signaling and parameters enable real-time detection of cluster deployment anomalies that may exist at a certain access location (ULI) in the network. It is a receiving platform for receiving AF-triggered short messages (for example: verification code), and can recommend that the network respond to relevant terminals. Real-time restrictions on sending and receiving short messages or restricting subsequent short message service registration at the access location.
  • Figure 5 is a schematic flow chart of cluster anomaly detection in this embodiment of the present application. It should be understood that, for convenience of description, the information detected in this embodiment of the present application is a short message, and this application does not limit the specific form of the information.
  • S510 The operator configures the collection and triggering threshold policies to the SMSF and security analysis network elements through pre-configuration and waits for triggering.
  • the threshold refers to the threshold that triggers reporting. The specific configuration is beyond the scope of this application.
  • S520 The terminal establishes a NAS signaling connection with the AMF.
  • S530 The terminal sends a short message to the AMF.
  • the terminal constructs a short message to be sent.
  • the short message consists of CP-DATA/RP-DATA/TPDU/SMS-SUBMIT parts.
  • the short message is encapsulated in a NAS message, and the NAS message is used for short message transmission.
  • the terminal sends a NAS message to the AMF.
  • the AMF sends the first information to the SMSF.
  • the first information includes the identity of the terminal that sends the short message, the content of the short message, the device identifier used by the terminal that sends the short message.
  • the first information includes the location information of the terminal that sends the short message, and the SMS. size, SMS hash.
  • the device identifier used by the terminal is used to identify the device that sends the short message, which can be IMEI, IMEISV, or the activation information identifier of the mobile device operating system. This application does not limit this; SMS size represents the volume of the short message, which can also be understood is the length; SMS hash represents the hash value of the short message, which is mainly used to determine whether the content is consistent.
  • SMSF uses SMS hash as the benchmark. After receiving a new short message, it compares and counts the SMS hash and SMS size.
  • SMS size can exclude some short and repeated normal short messages that are often sent by ordinary terminals, such as "OK”, “TD”, “OK” and other information, to prevent misjudgment. Therefore, SMSF can only count short messages whose SMS size exceeds a certain value. SMSF maintains a table locally and collects statistics per unit time. An example content is shown in Table 5 below.
  • the SMSF reports the abnormal event corresponding to the SMS hash to the security analysis network element.
  • the reported content includes but is not limited to (SMS hash, SUPI list, IMEISV list, ULI list).
  • S570 after receiving the reported SMS hash, the security analysis network element goes to the UDM to query whether the SMS hash is in the blacklist, as a basis for subsequent judgment.
  • SMSF counts each SUPI as a unit and sets a "flag (timer)", that is, after sending the uplink short message, wait for the network side to reply to the peer receiving report (submit report) within the threshold time. If the threshold If no response is received within the time, the counter of the SUPI not receiving a response will be accumulated.
  • the SMSF should maintain a table. A possible example is shown in Table 6.
  • SMSF reports the event to the security analysis network element.
  • the security analysis network element comprehensively determines whether there is a ULI through the number of SUPIs sending the same SMS hash, the regularity of the device identification used by the terminal, whether the ULIs sent by different SUPIs of the same SMS hash are the same, the total number of short messages triggered per unit time, etc.
  • the security analysis network element determines that the ULI is an abnormal location in the cluster.
  • the device identifier used by the terminal can be IMEI, IMEISV, or the activation information identifier of the mobile device operating system.
  • the regularity of the device identifiers used by the terminal can refer to the fact that the device identifiers are all the same, the device identifiers are continuous at equal intervals within the interval, and the device identifier presentation interval Repeat at least one item in the arrangement.
  • the security analysis network element sends the SUPI list of all the SMS hashes to the SMSF to restrict communication on the short message session permissions of SUPI(s).
  • the SMSF stores the cluster ULI address in the UDM, stores the SMS hash value in the UDM, and restricts subsequent short message service registration of the terminal at this ULI location.
  • the embodiment of this application adopts the form of passive triggering.
  • the abnormal receiving platform for sending short messages that may exist in a cluster deployment (ULI) in a certain access location (ULI) in the network is detected in real time, and It may be recommended that the network impose real-time restrictions on the sending and receiving of short messages by relevant terminals or restrict subsequent short message service registration at the access location.
  • Figure 6 is a schematic flowchart of AF triggering short messages in an embodiment of the present application.
  • S620 AF sends trigger request information to the network exposure function (NEF) network element, and the trigger request information is used to request to trigger the short message.
  • NEF network exposure function
  • NEF sends identifier conversion request information to UDM.
  • the identifier conversion request information is used to request that GPSI be parsed into SUPI.
  • the identifier conversion request information includes GPSI and AF identifiers.
  • UDM sends identifier conversion response information to NEF, and the identifier conversion response information is the SUPI corresponding to the GPSI.
  • NEF sends retrieval request information to UDM.
  • the retrieval request information is used to request retrieval of SMSF.
  • Retrieval request Requested information includes GPSI and short messages.
  • S680 UDM sends retrieval response information to NEF, and the retrieval response information includes the SMSF identifier.
  • NEF determines the appropriate SMS-SC according to the configuration information.
  • NEF sends submission trigger information to SMS-SC.
  • submission trigger information includes GPSI, SUPI, AF identifier, trigger reference number, validity period, priority, SMSF service node ID, short message application port number, trigger load, trigger instruct. If the NEF indicates that an "absent subscriber" has been received from the UDM, the SMS-SC should not submit the information, but should store the information directly and send routing information for the short message, requesting the UDM to add the SMS-SC address to the information waiting list.
  • SMS-SC sends submission trigger confirmation information to NEF to confirm that the submission of the short message has been accepted by SMS-SC.
  • NEF sends trigger response information to AF to indicate whether the device trigger request has been accepted for delivery to the terminal.
  • SMS-SC sends a downlink short message.
  • the specific sending steps are shown in Figure 7.
  • SMS-SC should send a message delivery report (reason code, trigger reference number, AF identifier) to NEF.
  • NEF provides a notification message to AF, which contains a delivery report indicating the trigger delivery result (such as success, unknown, or failure and failure reason). NEF generates the necessary bill information, including GPSI and AF identifiers.
  • the terminal takes a specific action in response to the received device trigger and may consider the content of the trigger payload. This operation typically involves communicating with the AF immediately or later.
  • FIG. 7 is a schematic flowchart of sending downlink short messages in this embodiment of the present application.
  • SMS-SC sends message transfer (message transfer) information to short message service-gateway mobile switch center (SMS-GMSC).
  • SMS-GMSC short message service-gateway mobile switch center
  • SMS-GMSC sends a short message to UDM to send path request information.
  • S730 UDM sends short message sending path information to SMS-GMSC.
  • the terminal has two AMFs, one for 3GPP access and the other for non-3GPP access, then two SMSF addresses are stored in the UDM/UDR. UDM should return two SMSF addresses.
  • SMS-GMSC forwards the downlink short message to SMSF.
  • SMSF sends target terminal request information to AMF, requesting to find the target terminal to which the SMS message is to be sent.
  • the requested signaling can be Namf_MT_EnableReachability_Req, or any other message, which is not limited by this application.
  • AMF starts the program of paging the terminal, and the terminal responds after the paging is successful.
  • SMSF sends a short message to AMF.
  • the short message consists of CPDATA/RPDATA/TPDU/DELIVER parts.
  • AMF forwards the short message to the terminal.
  • S790 The terminal sends the uplink unit data information to the AMF.
  • AMF forwards the message to SMSF.
  • the AMF also comes with the IMEISV, the terminal's current location information (ULI) and, in addition, if the short message is delivered to the terminal through 3GPP access, the AMF comes with the local time zone (time zone).
  • S7110 The terminal returns a delivery success report to the AMF. Delivery reports are encapsulated in NAS messages.
  • AMF forwards the delivery success report to SMSF.
  • SMSF sends short message confirmation information to AMF.
  • AMF encapsulates the short message through the NAS message and sends it to the terminal.
  • SMSF and AMF forward subsequent short messages/short message confirmation/delivery reports in the same manner as steps S760-S7140. If the SMSF knows that the short message acknowledgment message is the last set of messages to be transmitted for the terminal, the SMSF should indicate the last message so that the AMF knows that no more short message data will be forwarded to the terminal.
  • Figure 8 is a schematic diagram of a communication device 10 provided by an embodiment of the present application.
  • the device 10 can be a device involved in detecting abnormal short message sending and receiving, such as the above-mentioned network equipment, SMSF network element and security analysis network element. It may also be a chip or a circuit, such as a chip or circuit that may be provided in the above-mentioned device involved in detecting abnormal short message sending and receiving.
  • the device 10 may include a processor 11 (ie, an example of a processing unit) and a memory 12 .
  • the memory 12 is used to store instructions
  • the processor 11 is used to execute the instructions stored in the memory 12, so that the device 10 implements the steps performed by the device for detecting abnormal short message sending and receiving in the corresponding method in Figures 2-7.
  • the device 10 may also include an input port 13 (ie, an example of a communication unit) and an output port 14 (ie, another example of a communication unit).
  • the processor 11, the memory 12, the input port 13 and the output port 14 can communicate with each other through internal connection paths to transmit control and/or data signals.
  • the memory 12 is used to store computer programs.
  • the processor 11 can be used to call and run the computer program from the memory 12 to control the input port 13 to receive signals and the output port 14 to send signals to complete the terminal equipment in the above method.
  • the memory 12 may be integrated into the processor 11 or may be provided separately from the processor 11 .
  • the input port 13 is a receiver
  • the output port 14 is a transmitter.
  • the receiver and transmitter may be the same or different physical entities. When they are the same physical entity, they can be collectively called transceivers.
  • the input port 13 is an input interface
  • the output port 14 is an output interface
  • the functions of the input port 13 and the output port 14 can be implemented through a transceiver circuit or a dedicated chip for transceiver.
  • the processor 11 may be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.
  • a general-purpose computer may be considered to implement the communication device provided by the embodiments of the present application.
  • the program code that implements the functions of the processor 11, the input port 13, and the output port 14 is stored in the memory 12, and the general processor implements the functions of the processor 11, the input port 13, and the output port 14 by executing the code in the memory 12.
  • Each module or unit in the communication device 10 may be used to perform each action or process performed by a device (for example, a network device) that detects abnormal short message transmission and reception in the above method. To avoid redundancy, detailed description is omitted here.
  • a device for example, a network device
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供了一种通信方法、系统和装置，该方法包括：网络设备根据多个信息中的至少一个第一信息，获取至少一个位置信息，其中，每个信息对应至少一个终端，一个第一信息对应至少一个位置信息；网络设备根据所述位置信息，确定至少一个第一位置范围，其中所述第一位置范围内的终端收发信息存在异常。本申请实施例通过使用网络设备对信息进行检测可以确定异常收发信息的区域，并且可以进一步限制该异常区域内终端的信息收发。

Description

一种通信方法、系统和通信装置
本申请要求于2022年6月1日提交中国专利局、申请号为202210621213.0、申请名称为“一种通信方法、系统和通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信领域，并且，更具体地，涉及用于检测信息异常收发的方法、系统和装置。
背景技术
集群信息收发平台是一种可以利用软件大量收发信息的设备，该设备经常被使用在各种信息异常发送和接收的场景中。信息异常发送和接收指的是终端因为非正常业务需要接收或者发送信息，其特征在于发送的数量规模、接收者发送频率、发送内容、使用的发送设备存在不符合正常用户习惯的情况。攻击者将集群信息收发平台部署到固定位置，然后大量发送恶意信息和/或大量接收用来自服务器的信息并从中获利。
目前，针对异常情况的处理主要是通过应用层检测程序的方式进行垃圾信息的识别和拦截以及通过网络数据分析功能(network data analytics function，NWDAF)网元进行异常用户的检测和通讯信息的分析。
但是，以短消息为例，应用层检测程序无法与网络侧的发送短消息的地理位置相关联，NWDAF网元在进行检测和分析时无法收集到在5G网络中有关短消息服务功能(short message service function，SMSF)网元相关的短消息内容。因此，现有的技术无法有效检测出集群异常信息收发平台。
在此情况下，如何检测异常集群信息收发，成为业界亟需解决的问题。
发明内容
本申请实施例提供了一种用于检测信息异常收发的方法、系统和装置。
第一方面，提供了一种通信方法，其特征在于，包括：网络设备根据多个信息中的至少一个第一信息，获取至少一个位置信息，其中，每个信息对应至少一个终端设备，每个信息的目的设备是所述信息所对应的终端设备，一个第一信息对应至少一个位置信息，并且，一个第一信息对应的位置信息用于指示所述第一信息的目的设备所处于的位置；根据所述位置信息，确定至少一个第一位置范围，其中所述第一位置范围内的第一终端设备的数量大于或等于第一阈值，所述第一终端设备是至少一个第一信息对应的终端设备；和/或所述多个信息中的第二信息的数量大于或等于第二阈值，所述第二信息是所述至少一个第一信息中目的设备位于所述第一位置范围内的信息；和/或所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中目的设备位于所述 第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或所述第一位置范围内的第二终端设备的数量大于或等于第四阈值，所述第二终端设备是至少一个第一信息的目的设备，且所述第二终端设备的设备标识满足第二预设条件。
本申请实施例通过网络设备对多个信息进行检测，可以实现对信息异常接收的有效检测。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：接收或生成所述多个信息。
本申请实施例通过多个信息是网络设备接收或生成的，可以扩大检测信息的范围。
在一种可能的实现方式中，网络设备转发第一终端发送给第二终端的信息。
在一种可能的实现方式中，网络设备生成信息向外发送。
结合第一方面，在第一方面的某些实现方式中，所述第一预设条件包括多个信息的长度满足预配值的长度。
本申请实施例通过网络设备检测多个信息的长度确定一个位置范围，该位置范围中的终端接收信息存在异常。
结合第一方面，在第一方面的某些实现方式中，所述第二预设条件包括设备标识均相同、所述设备标识在区间内等间距连续和所述设备标识呈现区间内重复排布中的至少一项。
本申请实施例通过网络设备检测多个信息对应的设备的标识确定一个位置范围，该位置范围中的终端接收信息存在异常。
结合第一方面，在第一方面的某些实现方式中，所述第一信息是所述多个信息中的部分信息。
网络设备通过只检测多个信息中的部分信息可以减少运算量，提高检测效率。
在一种可能的实现方式中，第一信息是目的设备位于特定区域内的信息。示例性地，网络设备中预先配置有第二位置范围，第一信息的目的设备位于第二位置范围内，该第二位置范围是请求方感兴趣的某个位置范围，感兴趣的原因可能是：1、请求方根据需求就需要分析指定区域；2、需要分析的区域很大，分批次执行分析；3、根据大数据以及AI算法确定的重点区域。
本申请实施例中网络设备只检测特定区域内的信息，减少了网络设备的计算量，提高检测效率。
结合第一方面，在第一方面的某些实现方式中，所述信息包括短消息、终端应用程序所发送的信息，所述信息用于验证、通知、营销或聊天。
本申请实施例可以实现对短消息、终端应用程序所发送的信息异常接收的有效检测。
示例性地，终端应用程序所发送的信息可以指的是微信发送的信息，也可以是用户登录或注册时用于验证身份的验证码。
应理解，本申请中信息的用途包括但不限于验证、通知、营销或聊天。
结合第一方面，在第一方面的某些实现方式中，所述第一信息是所述多个信息中长度大于或等于第五阈值的信息。
本申请实施例中网络设备只检测信息长度超过一定阈值的信息，减少了网络设备的计算量，提高检测效率，此外，还避免了一些信息的干扰，提高了检测精度。
结合第一方面，在第一方面的某些实现方式中，所述第一信息是所述多个信息中第一 应用功能网元发送给所述目的设备的信息。
本申请实施例中，网络设备只检测特定网元发送的信息，减少了网络设备的计算量，提高检测效率。
结合第一方面，在第一方面的某些实现方式中，所述第一信息是所述多个信息中第一类型的信息，所述第一类型是所述第一应用功能网元对应的信息的类型，一个应用功能网元对应至少一个信息的类型。
本申请实施例中，网络设备只检测特定类型的信息，减少了网络设备的计算量，提高检测效率。
在一种可能的实现方式中，信息包括短消息，短消息的类型和应用功能网元存在对应关系，一个应用功能网元可以对应多个短消息的类型。
应理解，应用功能网元(application function，AF)标识符用于表示发送短信的应用功能网元，本申请对AF标识符的具体形式不做限定，示例性地，AF标识符是AF在网络侧的ID或者AF标识符是运营商配置的用于发送短消息的号码。
示例性地，标识符为10690001的应用功能网元对应的短消息的类型是验证码类，标识符为10650001的应用功能网元对应的短消息的类型是验证码类和营销类。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：所述网络设备生成告警信息，所述告警信息用于指示所述第一位置范围出现异常；或者所述网络设备禁止向所述第一位置范围内的终端转发所述多个信息中的部分或全部信息；或者所述网络设备禁止向所述第一位置范围内的终端发送信息。
本申请实施例中，网络设备可以通过检测多个信息得到一个位置范围，在该位置范围内的终端接收信息存在异常，进一步地，网络设备通过告警信息可以限制该范围内终端接收信息。
第二方面，提供了一种通信方法，其特征在于，包括：网络设备根据多个信息中的至少一个第一信息，获取至少一个位置信息，其中，每个信息对应至少一个终端设备，每个信息的发送设备是所述信息对应的终端设备，一个第一信息对应至少一个位置信息，并且，一个第一信息对应的位置信息用于指示所述第一信息的发送设备所处于的位置；根据所述位置信息，确定至少一个第一位置范围，其中所述第一位置范围内的第一终端设备的数量大于或等于第一阈值，所述第一终端设备是至少一个第一信息的发送设备；和/或所述多个信息中的第二信息的数量大于或等于第二阈值，所述第二信息是所述至少一个第一信息中发送设备位于所述第一位置范围内的信息；和/或所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中发送设备位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或所述第一位置范围内的第二终端设备的数量大于或等于第四阈值，所述第二终端设备是至少一个第一信息的发送设备，且所述第二终端设备的设备标识满足第二预设条件。
本申请实施例通过网络设备对多个信息进行检测，可以实现对信息异常发送的有效检测。
结合第二方面，在第二方面的某些实现方式中，所述方法还包括：接收或生成所述多个信息。
本申请实施例通过多个信息是网络设备接收或生成的，可以扩大检测信息的范围。
在一种可能的实现方式中，网络设备转发第一终端发送给第二终端的信息。
在一种可能的实现方式中，网络设备生成信息向外发送。
结合第二方面，在第二方面的某些实现方式中，所述第一预设条件包括多个信息的长度满足预配值的长度。
本申请实施例通过网络设备检测多个信息的长度确定一个位置范围，该位置范围中的终端发送信息存在异常。
结合第二方面，在第二方面的某些实现方式中，所述第二预设条件包括设备标识均相同、所述设备标识在区间内等间距连续和所述设备标识呈现区间内重复排布中的至少一项。
本申请实施例通过网络设备检测多个信息对应的设备的标识确定一个位置范围，该位置范围中的终端发送信息存在异常。
结合第二方面，在第二方面的某些实现方式中，所述第一信息是所述多个信息中的部分信息。
网络设备通过只检测多个信息中的部分信息可以减少运算量，提高检测效率。
在一种可能的实现方式中，第一信息是目的设备位于特定区域内的信息。示例性地，网络设备中预先配置有第二位置范围，该第二位置范围是请求方感兴趣的某个位置范围，感兴趣的原因可能是：1、请求方根据需求就需要分析指定区域；2、需要分析的区域很大，分批次执行分析；3、根据大数据以及AI算法确定的重点区域。
本申请实施例中网络设备只检测特定区域内的信息，减少了网络设备的计算量，提高检测效率。
结合第二方面，在第二方面的某些实现方式中，所述信息包括短消息、终端应用程序所发送的信息，所述信息用于验证、通知、营销或聊天。
本申请实施例可以实现对短消息、终端应用程序所发送的信息异常发送的有效检测。
示例性地，终端应用程序所发送的信息可以指的是微信发送的信息，也可以是用户登录或注册时用于验证身份的验证码。
应理解，本申请中信息的用途包括但不限于验证、通知、营销或聊天。
结合第二方面，在第二方面的某些实现方式中，所述第一信息是所述多个信息中长度大于或等于第五阈值的信息。
本申请实施例中网络设备只检测信息长度查过一定阈值的信息，减少了网络设备的计算量，提高检测效率，此外，还避免了一些信息的干扰，提高了检测精度。
结合第二方面，在第二方面的某些实现方式中，所述第一信息是所述多个信息中散列值为第一值的信息。
本申请实施例中网络设备只检测特定内容的信息，减少了网络设备的计算量，提高检测效率，此外，还避免了一些信息的干扰，提高了检测精度。
需要说明的是，散列值可以用于描述信息的内容，本申请实施例对于特定内容或内容相同的信息进行检测，特定内容的确定本申请不做限定，示例性地，特定内容可以是根据以往的关于异常信息的大数据资料和AI算法得到的。
结合第二方面，在第二方面的某些实现方式中，所述第一信息是所述多个信息中发送设备的第一次数大于或等于第六阈值的信息，所述第一次数用于表示发送设备发送信息后未收到回复的次数。
本申请实施例中网络设备检测超时未回复的信息，减少了网络设备的计算量，提高检测效率。
结合第二方面，在第二方面的某些实现方式中，所述方法还包括：所述网络设备转发来自所述发送设备的信息时，启动定时器，若定时器超时，所述网络设备未接收到接收回报，则累加对应所述发送设备的计数器，得到所述第一次数。
本申请实施例中网络设备可以有效统计发送设备发送信息后未收到回复的次数，为网络设备检测信息异常发送提供了依据。
结合第二方面，在第二方面的某些实现方式中，所述方法还包括：所述网络设备生成告警信息，所述告警信息用于指示所述第一位置范围出现异常；或者所述网络设备禁止为所述第一位置范围内的终端转发所述多个信息中的部分或全部信息；或者所述网络设备禁止所述第一位置范围内的终端发送信息。
本申请实施例中，网络设备可以通过检测多个信息得到一个位置范围，在该位置范围内的终端发送信息存在异常，进一步地，网络设备通过告警信息可以限制该范围内终端发送信息。
第三方面，提供了一种通信系统，其特征在于，包括：第一网络设备和第二网络设备；所述第一网络设备用于向所述第二网络设备发送所述多个信息，每个信息对应至少一个终端设备；所述网络设备根据所述多个信息中的至少一个第一信息，获取至少一个位置信息，其中，一个第一信息对应至少一个位置信息，并且，一个第一信息对应的位置信息用于指示所述第一信息对应的终端设备所处于的位置；根据所述位置信息，确定至少一个第一位置范围，其中所述第一位置范围内的第一终端设备的数量大于或等于第一阈值，所述第一终端设备是至少一个第一信息对应的终端设备；和/或所述多个信息中的第二信息的数量大于或等于第二阈值，所述第二信息是所述至少一个第一信息中终端设备位于所述第一位置范围内的信息；和/或所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中终端设备位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或所述第一位置范围内的第二终端设备的数量大于或等于第四阈值，所述第二终端设备是至少一个第一信息对应的终端设备，且所述第二终端设备的设备标识满足第二预设条件。
本申请实施例提供了一种通信系统，通过该系统网络设备对多个信息进行检测，可以实现对信息异常发送的有效检测。
其中，第一预设条件包括多个信息的长度满足预配值的长度；第二预设条件包括设备标识均相同、所述设备标识在区间内等间距连续和所述设备标识呈现区间内重复排布中的至少一项。
结合第三方面，在第三方面的某些实现方式中，所述第一网络设备还用于接收或生成所述多个信息。
本申请实施例通过多个信息是网络设备接收或生成的，可以扩大检测信息的范围。
在一种可能的实现方式中，网络设备转发第一终端发送给第二终端的信息。
在一种可能的实现方式中，网络设备生成信息向外发送。
结合第三方面，在第三方面的某些实现方式中，所述第一网络设备向所述第二网络设备发送所述多个信息前，所述第二网络设备向所述第一网络设备发送第一请求信息，所述 第一请求信息用于向所述第一网络设备请求所述多个信息。
本申请实施例中，第二网络设备可以主动向第一网络设备请求待检测的信息，提高了检测的灵活性。
结合第三方面，在第三方面的某些实现方式中，所述第二网络设备向所述第一网络设备发送第一请求信息前，所述第二网络设备接收第二请求信息，所述第二请求信息用于请求所述第二网络设备确定所述第一位置范围；所述第二请求信息包括第二类型和/或第二位置范围。
本申请实施例中，第二网络设备接收第二请求信息，第二请求信息限定了待检测的区域和信息类型，既可以减少第二网络设备检测的信息的数量，提高检测效率，又可以排除一些干扰的信息，提高检测的精确度。
第二类型用于向第二网络设备指示需要检测的信息的类型，第二位置范围用于向第二网络设备指示需要检测的区域，第二信息和第二位置范围可以大大减少第二网络设备的检测量，提高检测效率。
示例性地，第二位置范围是请求方感兴趣的某个位置范围，感兴趣的原因可能是：1、请求方根据需求就需要分析指定区域；2、需要分析的区域很大，分批次执行分析；3、根据大数据以及AI算法确定的重点区域。
第二类型是请求方感兴趣的某个信息的类型，感兴趣的原因可能是：1、请求方根据需求就需要分析指定的短消息类型；2、需要分析的短消息很多，分批次执行分析；3、根据大数据以及AI算法确定的重点类型。
第四方面，提供了一种通信装置，包括：处理模块，用于根据多个信息中的至少一个第一信息，获取至少一个位置信息，其中，每个信息对应至少一个终端，每个信息的目的终端是所述信息所对应的终端，一个第一信息对应至少一个位置信息，并且，一个第一信息对应的位置信息用于指示所述第一信息的目的设备所处于的位置；所述处理模块，还用于根据所述位置信息，确定至少一个第一位置范围，其中所述第一位置范围内的第一终端设备的数量大于或等于第一阈值，所述第一终端设备是至少一个第一信息对应的终端设备；和/或所述多个信息中的第二信息的数量大于或等于第二阈值，所述第二信息是所述至少一个第一信息中目的设备位于所述第一位置范围内的信息；和/或所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中目的设备位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或所述第一位置范围内的第二终端设备的数量大于或等于第四阈值，所述第二终端设备是至少一个第一信息的目的设备，且所述第二终端设备的设备标识满足第二预设条件。
本申请实施例提供了一种通信装置，该装置可以对多个信息进行检测并确定一个位置范围，可以实现对信息异常接收的有效检测。
结合第四方面，在第四方面的某些实现方式中，所述装置还包括：收发模块，所述收发模块用于接收所述多个信息。
在一种可能的实现方式中，网络设备转发第一终端发送给第二终端的信息。
结合第四方面，在第四方面的某些实现方式中，处理模块还用于生成所述多个信息。
在一种可能的实现方式中，网络设备生成信息向外发送。
第五方面，提供了一种通信装置，包括：处理模块，用于根据多个信息中的至少一个， 获取至少一个位置信息，其中，每个信息对应至少一个终端，每个信息的发送终端是所述信息所对应的终端，一个信息对应至少一个位置信息，并且，一个信息对应的位置信息用于指示所述信息的发送设备所处于的位置；所述处理模块，还用于根据所述位置信息，确定至少一个第一位置范围，其中所述第一位置范围内的第一终端设备的数量大于或等于第一阈值，所述第一终端设备是至少一个第一信息的目的设备；和/或所述多个信息中的第二信息的数量大于或等于第二阈值，所述第二信息是所述至少一个第一信息中目的设备位于所述第一位置范围内的信息；和/或所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中目的设备位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或所述第一位置范围内的第二终端设备的数量大于或等于第四阈值，所述第二终端设备是至少一个第一信息的目的设备，且所述第二终端设备的设备标识满足第二预设条件。
本申请实施例提供了一种通信装置，该装置可以对多个信息进行检测，可以实现对信息异常发送的有效检测。
结合第五方面，在第五方面的某些实现方式中，所述装置还包括：收发模块，所述收发模块用于接收所述多个信息。
在一种可能的实现方式中，网络设备转发第一终端发送给第二终端的信息。
结合第五方面，在第五方面的某些实现方式中，处理模块还用于生成所述多个信息。
在一种可能的实现方式中，网络设备生成信息向外发送。
第六方面，提供了一种通信装置，包括：处理器，用于执行存储器中存储的计算机程序，以使得所述通信装置执行上述第一方面和第二方面的通信方法。
第七方面，提供了一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行第一方面和第二方面的通信方法。
第八方面，提供了一种芯片系统，其特征在于，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片系统的通信设备执行第一方面和第二方面的通信方法。
附图说明
图1是申请实施例的应用场景的示意图。
图2是本申请一实施例的流程图。
图3是本申请实施例中一集群异常检测的流程示意图。
图4是本申请实施例中一集群异常检测的流程示意图。
图5是本申请实施例中一集群异常检测的流程示意图。
图6是本申请实施例中AF触发短消息的流程示意图。
图7是本申请实施例中发送下行短消息的流程示意图。
图8为本申请实施例提供的通信装置10的示意图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通讯(global system of mobile communication，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)系统、新无线(new radio，NR)、固移融合网络系统或未来的第六代(6th generation，6G)等。
本申请实施例中的终端设备可以指用户设备、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。终端设备还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等，本申请实施例对此并不限定。
本申请实施例中的网络设备可以是用于与终端设备通信的设备，该网络设备可以是全球移动通讯(global system of mobile communication，GSM)系统或码分多址(ccodedivision multiple access，CDMA)中的基站(base transceiver station，BTS)，也可以是宽带码分多址(wideband code division multiple access，WCDMA)系统中的基站(NodeB，NB)，还可以是LTE系统中的演进型基站(evolutional NodeB，eNB或eNodeB)，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该网络设备可以为中继站、接入点、车载设备、可穿戴设备以及5G网络中的网络设备或者未来演进的PLMN网络中的网络设备等，本申请实施例并不限定。
图1是本申请实施例的应用场景的示意图，本申请实施例应用在各种信息异常发送和接收的场景中，常见的场景是短消息的异常收发，为了便于描述，本申请以短消息的异常收发为例进行阐述，应理解，本申请对于信息的具体形式不做限定。
本申请实施例可以检测出异常收发短消息的地点。异常收发短消息的地点部署有集群短信息收发平台，集群短信息收发平台指一种可以利用软件成批量控制短信息收发的用户设备(user equipment，UE)，具体地，集群短信息收发平台指有通信模块、可收发短信息、支持多张手机卡同时使用的设备，集群短信息收发平台可以通过程序接收或者发送大量的短信息。
攻击者通常采用非法手段获得大量的与运营商合法签约的手机卡，然后将集群设备部署到某个固定的位置，开始接收或者发送短消息。
攻击者通过集群设备，通常会发起两种对网络正常用户行为来说是异常的短消息收发操作，分别为异常发送和异常接收。
异常发送，指的是异常群发短消息，多见于异常恶意短消息，通常发送给大量的手机号码，一般来说内容为“钓鱼”网址或汇款指令，最终目的是窃取合法用户的信息或者钱 财。
异常接收，指的是异常大量频繁接收类似于验证码等来自于服务器发送的信息，接收之后非法出售给其他人，验证码往往被用作黑色产业。这种平台即“接码平台”。近来研究表明，通过帮别人接收验证码，一些恶意攻击者可以获利，而出售的验证码与手机号的消息组合，可以帮其他攻击者用于恶意行为。“接码平台”是目前黑色产业链中的一环，验证码出售可以用于非法账号的生成，以及洗钱等活动。目前现有的异常“接码平台”几乎全部使用集群设备部署，因为根据现有的一些异常检测规则，同一个手机号通常不能连续获得验证码，因此攻击者通过集群设备的方式大量获得验证码配合手机号告知后续黑色产业环节，实施网络中的恶意活动。目前所有的验证码等信息都采用了AF网元触发的方式下发短消息，以中国国内为例，大部分验证码类的短消息都采用了“1065””1069”等号段下发，这些号码的发送方可以看做是一种特殊的AF，通过触发短消息服务中心(short message service-service center，SMS-SC)发送短消息。
本申请实施例在网络侧通过接入信息、短消息类型和发送方式等信息来综合识别出网络中的集群异常短消息收发行为，识别出异常的集群短消息收发平台的接入位置。
图2是本申请一实施例的流程图。
S210，网络设备根据多个信息中的至少一个第一信息，获取至少一个位置信息，其中，每个信息对应至少一个终端，一个第一信息对应至少一个位置信息。示例性地，多个信息包括短消息、终端应用程序所发送的信息，所述信息的用途包括验证、通知、营销或聊天。
需要说明的是，为了方便描述，本申请实施例以短消息为例进行阐述，应理解，本申请对此不做限定。
在一种可能的实现方式中，每个信息中包括AF发送给用户的短消息，每个信息的目的设备是所述信息对应的终端所用的设备。
在另一种可能的实现方式中，每个信息中包括第一终端发送给第二终端的短消息，其中发送设备是第一终端所用的设备，目的设备是第二终端所用的设备。
第一信息是所述多个信息中的部分信息，通过筛选出第一信息避免检测所有信息可以有效减少网络设备的计算量，提高检测效率。
示例性地，第一信息中包括经过筛选的第一短消息。
在一种可能的实现方式中，网络设备中预先配置有至少一个可疑位置范围，第一信息中短消息的接收方位于可疑位置范围中，网络设备可以排除接收方不在可疑位置范围中的第一短信息。
需要说明的是，本申请实施例对可疑位置范围的来源和依据不做限定，示例性地，可疑位置范围是请求方感兴趣的某个位置范围，感兴趣的原因可能是：1、请求方根据需求就需要分析指定区域；2、需要分析的区域很大，分批次执行分析；3、根据大数据以及AI算法确定的重点区域。
在一种可能的实现方式中，网络设备预设短消息长度信息，第一信息中短消息的长度大于或等于预设短消息长度，网络设备排除长度小于预设的短消息长度的第一短消息。
在一种可能的实现方式中，网络设备获取发送第一短消息的AF的标识符，网络设备预先配置有至少一个第二标识符，第一信息中短消息的发送方是第二标识符对应的AF，网络设备排除AF标识符与第二标识符不同的第一短消息。
AF标识符用于表示发送短信的AF，本申请对AF标识符的具体形式不做限定，示例性地，AF标识符是AF在网络侧的ID或者AF标识符是运营商配置的用于发送短消息的号码。
需要说明的是，本申请实施例中网络设备获取第一短消息对应的AF标识符是本领域常用的技术手段，示例性地，网络设备通过向短消息服务中心(short message service-service center，SMS-SC)网元发送第一短消息和第一短消息接收方的用户永久标识(subscription permanent identifier，SUPI)获得对应的AF标识符，本申请实施例对于具体实现过程不做赘述。
在一种可能的实现方式中，多个信息包括短消息类型信息，短消息类型信息用于表示短消息的类型，短消息类型包括验证码类、营销类等等。短消息标识信息与AF标识符存在对应关系，一个AF标识符可能对应多个短消息类型。
网络设备获取发送第一短消息的AF的标识符，网络设备根据AF标识符确定短消息类型，网络设备预先配置有至少一个第二类型，第一信息中短消息的类型是第二类型，网络设备排除短消息类型与第二类型不同的第一短消息。
示例性地，第一信息中包括经过筛选的第二短消息。
在一种可能的实现方式中，网络设备中预先配置有至少一个可疑位置范围，第一信息中短消息的发送方在可疑位置范围中，网络设备可以排除发送方不在可疑位置范围中的第二短信息。
需要说明的是，本申请实施例对可疑位置范围的来源和依据不做限定，示例性地，可疑位置范围是请求方感兴趣的某个位置范围，感兴趣的原因可能是：1、请求方根据需求就需要分析指定区域；2、需要分析的区域很大，分批次执行分析；3、根据大数据以及AI算法确定的重点区域。
在一种可能的实现方式中，网络设备预设短消息长度信息，第一信息中短消息的长度大于或等于预设短消息长度，网络设备排除长度小于预设的短消息长度的第二短消息。
在一种可能的实现方式中，网络设备获取第二短消息的散列值，网络设备预先配置有至少一个第一值，第一信息中短消息的散列值为第一值，网络设备排除散列值与第一值不同的第二短消息。
S220，网络设备根据所述位置信息，确定至少一个第一位置范围。
在本申请实施例中，若第一短消息是AF发送给用户的短消息，则多个信息还包括第一短消息的标识信息、接收第一短信息的终端的身份标识信息、接收第一短信息的终端的设备标识信息、第一短信息的长度中至少一项。其中，示例性地，身份标识信息可以是SUPI，设备标识信息可以是移动设备操作系统的唯一标识(例如移动设备操作系统的激活信息标识series number)，可以是国际移动设备识别码(international mobile equipment identity，IMEI)，也可以是国际移动设备识别码软件版(international mobile equipment identity software version，IMEISV)。
需要说明的是，短消息标识信息是指可以唯一表示短消息的标识信息，示例性地，短消息标识信息可以包括但不限于{短消息本身/短消息ID标识符/短消息发送时间和短消息发送对象}等任何可以识别该条短消息的信息。
本申请实施例中网络设备根据网络设备根据所述位置信息，确定至少一个第一位置范 围。其中，所述第一位置范围内的第一终端的数量大于或等于第一阈值，所述第一终端是所述多个信息中的至少一个信息对应的终端；和/或所述多个信息中的第一信息的数量大于或等于第二阈值，所述第一信息是所述多个信息中目的设备位于所述第一位置范围内的信息；和/或所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中目的设备位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或所述第一位置范围内的第一设备的数量大于或等于第三阈值，所述第一设备是所述多个信息中的至少一个信息的目的设备，且所述第一设备的设备标识满足第二预设条件，目的设备是所述信息对应的终端所用的设备。
示例性地，第一预设条件可以是多个信息的长度满足预配值的长度。
示例性地，第二预设条件可以是设备标识均相同、所述设备标识在区间内等间距连续和所述设备标识呈现区间内重复排布中的至少一项。
在本申请实施例中，若第二短消息是一个终端发送给另一个终端的短消息，则第一信息还包括第二短消息的标识信息、发送第二短信息的用户的身份标识信息、发送第二短信息的用户的设备标识信息、第二短信息散列值中的至少一项。其中，示例性地，身份标识信息可以是SUPI，设备标识信息可以是移动设备操作系统的唯一标识(例如移动设备操作系统的激活信息标识series number)，可以是IMEI，也可以是IMEISV。
需要说明的是，短消息标识信息是指可以唯一表示短消息的标识信息，示例性地，短消息标识信息可以包括但不限于{短消息本身/短消息ID标识符/短消息发送时间和短消息发送对象}等任何可以唯一识别该条短消息的信息。
本申请实施例中网络设备根据所述位置信息，确定至少一个第一位置范围。其中，所述第一位置范围内的第一终端的数量大于或等于第一阈值，所述第一终端是所述多个信息中的至少一个信息对应的终端；和/或所述多个信息中的第一信息的数量大于或等于第二阈值，所述第一信息是所述多个信息中终端位于所述第一位置范围内的信息；和/或所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中目的设备位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或所述第一位置范围内的第一设备的数量大于或等于第三阈值，所述第一设备是所述多个信息中的至少一个信息的发送设备，且所述第一设备的设备标识满足第二预设条件。
示例性地，第一预设条件可以是多个信息的长度满足预配值的长度。
示例性地，第二预设条件可以是设备标识均相同、所述设备标识在区间内等间距连续和所述设备标识呈现区间内重复排布中的至少一项。
应理解，本申请实施例中的网络设备可以是能够实现上述功能的多个网络设备组成的系统，示例性地，所述网络设备上集成了SMSF网元和安全分析网元，其中，安全分析网元可以是网络数据分析功能(network data analytics function，NWDAF)网元，SMSF网元获取至少一个短消息并向NWDAF网元发送至少一个第一信息，所述第一信息是所述至少一个短消息的相关信息，NWADAF网元根据第一信息判断出异常用户位置信息并将分析结果发送给SMSF网元。
图3是本申请实施例中一集群异常检测的流程示意图，应理解，为方便描述，本申请实施例中检测的信息是短消息，本申请对被检测信息的形式不做限定。
S310，业务触发方向安全分析网元发送第一信息，该第一信息包括可疑接入地址信息 列表。
在一种可能的实现方式中，第一信息还包括短消息类型，短消息类型指的是短消息内容类型的描述或者标识符，示例性地，短消息的内容类型为验证码类，短消息类型对应为1；短消息的内容类型为营销类，短消息类型对应为2。
在一种可能的实现方式中，第一信息还包括上报规则信息，上报规则信息用于指示安全分析网元上报检测结果的方式。
示例性地，上报规则信息指示安全分析网元每隔第一时间段上报检测结果。
示例性地，上报规则信息指示安全分析网元每检测出第一数量的异常信息就上报检测结果。
可疑接入地址信息指的是出现集群异常概率较高的地方，可疑接入地址信息的确定方式本申请不做限定，在一种可能的实现方式中，可疑接入地址信息是通过对过去大量集群异常接入地址信息进行大数据分析得到的。
其中，接入地址信息可以是用户位置信息(user location information，ULI)，可以是某个具体的全球定位系统(global positioning system，GPS)坐标，或者是小区标识(CELL ID)、位置区域代码(location area code，LAC)等信息，本申请不做限制的原因是因为AF作为应用层网元发送位置信息的形式比较灵活。
S320，安全分析网元接收第一信息并对第一信息进行解析，得到解析后的可疑地址信息列表，解析后的可疑地址信息是通信网络中的网元可以识别的信息。
S330，安全分析网元向SMSF发送第二信息，第二信息包括解析后的可疑地址信息列表。
在一种可能的实现方式中，若SMSF中配置有短消息类型和短消息的内容类型的映射关系，则第二信息还包括短消息类型。
在一种可能的实现方式中，第二信息还包括LAC。
在一种可能的实现方式中，第二信息还包括小区标识。
S340，AF触发短消息通过下行短消息流程发送短消息到终端，SMS-SC可以获得AF标识符。
具体地，AF触发短消息的流程如图6所示。
S350，终端接收短消息后向SMSF发送接收确认信息，接收确认信息包括终端身份标识和ULI。
S360，SMSF根据第二信息和接收确认信息判断是否记录该接收确认信息关联的短消息的信息并生成待检测名单。
具体地，若第二信息中的可疑地址信息列表包括接收确认信息中的ULI，则SMSF记录该接收确认信息关联的短消息的信息并放置在待检测名单中；若第二信息中的可疑地址信息列表不包括接收确认信息中的ULI，则SMSF不记录该接收确认信息关联的短消息的信息。
需要说明的是，待检测名单中包括ULI、终端的身份标识和短消息的标识信息。
在一种可能的实现方式中，待检测名单中还包括短消息的长度。
S370，SMSF向安全分析网元发送待检测名单，待检测名单包括ULI、终端的身份标识和短消息标识信息。
在一种可能的实现方式中，待检测名单还包括短消息长度，安全分析网元可以利用短消息长度排除一些普通终端经常发送的简短且重复的正常短消息，诸如“好的”、“TD”、“OK”等信息，防止误判，提高检测的准确性。
表1
在一种可能的实现方式中，待检测名单还包括短消息长度离散度，安全分析网元可以利用短消息长度离散度判断出同一ULI下短消息的相似度。示例性地，待检测名单如表1所示。
需要说明的是，本申请中短消息标识信息指可以唯一表示短消息的标识，本申请实施例对于短消息标识信息的具体内容不做限定。示例性地，短消息标识信息包括短消息本身、短消息ID标识符、短消息发送时间和短消息发送对象中的至少一项。
需要说明的是，本申请实施例对SMSF向安全分析网元发送待检测名单的方式不做限定。
在一种可能的实现方式中，SMSF根据预先设定的规则向安全分析网元发送待检测名单。
示例性地，SMSF每隔一段时间向安全分析网元发送待检测名单或SMSF记录一定量的数据就向安全分析网元发送待检测名单。
可选地，S380，安全分析网元收到待检测名单后排除不需要检查的短消息。
在一种可能的实现方式中，安全分析网元根据统一数据管理(unified data management，UDM)网元中的签约信息排除不要检查的短消息，示例性地，若UDM中的签约信息显示为高优先级，则不检查发送目标为该用户终端的短消息。
在一种可能的实现方式中，安全分析网元根据短消息长度排除不要检查的短消息，示例性地，若短消息长度小于一定阈值，则不检查该短消息。
S390，安全分析网元向SMS-SC发送AF标识符请求信息，AF标识符请求信息中包括SUPI和短消息标识信息。
S3100，SMS-SC向安全分析网元发送AF标识符响应信息，AF标识符响应信息包括短消息标识信息和AF标识符。
需要说明的是，若该短消息不是通过AF触发的，则SMS-SC告知安全分析网元该信息，若安全分析网元收到告知，则不检查该短消息。
可选地，S3110，安全分析网元确定短消息类型。
在一种可能的实现方式中，安全分析网元根据AF标识符向对应AF发送短消息类型请求信息，短消息类型请求信息包括短消息标识信息和SUPI。AF向安全分析网元发送短 消息类型响应信息，短消息类型响应信息包括短消息类型。
示例性地，如表2所示，AF可以配置由运营商或者应用层预配置表格，对应短消息类型和AF标识符，如果一个AF标识符对应多个短消息类型，那么，该短消息被标识为多个短消息类型。
在一种可能的实现方式中，安全分析网元根据AF标识符从UDM获得AF类型，安全分析网元根据AF类型自行判断短消息类型。
表2
S3120，安全分析网元根据AF标识符判断需要进一步分析的短消息。
在一种可能的实现方式中，安全分析网元根据AF标识符和短消息类型判断需要进一步分析的短消息。
示例性地，假设收集的短消息都是验证码类型的，验证码均通过AF触发形式发送，如果某个短消息没有AF标识符则表示该短消息不是AF触发的，该短消息无需检测，通过此项，可以进一步排除不需要检测的短消息。
S3130，安全分析网元根据需要进一步分析的短消息，向SMSF发送接入信息请求信息，接入信息请求信息用于请求每个短消息接收人的接入信息，接入信息请求信息包括短消息标识信息名单。
在一种可能的实现方式中，接入信息请求信息还包括SUPI名单。
S3140，SMSF向安全分析网元发送接入信息响应信息，接入信息响应信息包括每个短消息接收时的设备名单，示例性地，IMEISV名单。
需要说明的是，在S3130和S3140中，安全分析网元通过SMSF获取每个短消息接收人的接入信息，实际上，安全分析网元也可以通过会话管理网元(session management function，SMF)获取每个短消息接收人的接入信息，获取过程与上述步骤相同，本申请实施例对此不做赘述。
S3150，安全分析网元通过判断该ULI所有需要检测的短消息中，相同终端出现次数，短消息名单总数，终端所用设备标识的规律性，短消息长度离散度进一步判断该区域的终端发送短消息是否有异常。
其中，终端所用设备标识可以是IMEI、IMEISV、移动设备操作系统的激活信息标识，终端所用设备标识的规律性可以指的是设备标识均相同、设备标识在区间内等间距连续和设备标识呈现区间内重复排布中的至少一项。
S3160，安全分析网元上报该地址的异常发送短消息的终端的名单给AF，内容包括但不限于ULI，SUPI名单。
在一种可能的实现方式中，上报内容还包括短消息标识列表。
在另一种可能的实现方式中，上报内容还包括AF标识符，AF标识符指的是短消息触发AF的标识符。
需要说明的是，本申请实施例对于安全分析网元上报的触发条件不做限制。
在一种可能的实现方式中，安全分析网元中预配置有触发条件，示例性地，安全分析 网元定时上报或安全分析网元检测出的需要上报的短消息超过指定数量则触发上报动作。
本申请实施例中安全分析网元采用现有的NWDAF网元收集数据的模式来检测异常短消息。首先由业务触发方下发检测需求，安全分析网元解析后，向SMSF收集短消息直接相关的信息，向SMS-SC获得AF标识符，继而判断短消息类型，向接入和移动管理网元(access and mobility management function，AMF)/SMSF获得短消息接收终端的接入信息和IMEISV。通过本申请实施例可以识别并且检测指定地点是否存在异常集群接收短消息的平台。
图4是本申请实施例中一集群异常检测的流程示意图，应理解，为方便描述，本申请实施例中检测的信息是短消息，本申请对信息的具体形式不做限定。
S410，运营商通过预配置的方式，向SMSF、SMS-SC和安全分析网元配置收集和触发的阈值策略，等待触发。阈值指的是触发上报的阈值，具体如何配置不在本申请的讨论范围内。
S420，AF向UDM查询终端的信息和发送策略。
S430，AF向SMS-SC发送短消息的提交触发(submit trigger)，短消息提交触发包括终端的身份标识，SUPI，AF标识符。
在一种可能的实现方式中，短消息提交触发还包括短消息类型标识符，短消息类型用于表述这个短消息是什么类型的，例如验证码类、营销类、通知类。
S440，SMS-SC发送回复给AF作为响应。
S450，SMS-SC发送下行短消息给SMSF，包括短消息本身、目标终端信息和AF标识符。
在一种可能的实现方式中，SMS-SC发送下行短消息给SMSF，还包括短消息类型标识符。需要说明的是，短消息类型标识符可能是AF向SMS-SC发送的，也可能是SMS-SC中预先配置的，本申请对此不做限定。
可选地，当S450中未传递短消息类型标识符时，S460，SMSF判断短消息的类型标识符。
在一种可能的实现方式中，SMSF收到AF标识符后，根据AF标识符确定查询UDM中的签约数据，判断短消息的类型标识符。
在另一种可能的实现方式中，安全分析网元处具有配置的表格，如表3所示，SMSF收到AF标识符后，根据AF标识符向安全分析网元查询短信的类型。
表3
S470，AF触发短消息通过下行短消息流程发送短消息到终端，SMS-SC可以获得AF标识符。
具体地，AF触发短消息的流程如图6所示。
S480，终端接收短消息后向SMSF发送接收确认信息，接收确认信息包括终端身份标识、ULI和终端所用设备的标识。
S490，SMSF收到ULI后，检查对应短消息的类型标识，如为需要检测类型时，该 ULI当前疑似异常短消息计数器累进。
在一种可能的实现方式中，SMSF在本地维护一个疑似异常终端的表格，一种可能的示例如表4所示，其中，终端所用设备的标识是IMEISV，应理解，本申请实施例中终端所用设备的标识还可以是IMEI、操作系统激活码，本申请做此不做限定。
表4
S4100，当某个ULI的疑似短消息计数器超过阈值时，SMSF向安全分析网元发送ULI异常事件给安全分析网元，发送内容包括ULI，短消息类型标识，触发的SUPI名单，触发的设备标识名单，触发时短消息计数。
在一种可能的实现方式中，发送内容还包括AF标识符。
可选地，S4110，安全分析网元通过判断短消息类型标识，AF的注册类型，以及触发的终端是否在白名单中，判断是否需要继续识别。
可选地，S4120，安全分析网元更新SMSF的检测规则。
示例性地，安全分析网元收到上报的信息根据预配置信息判断数量过多或过少，安全分析网元判断需要更改对指定ULI进行统计，安全分析网元可更新检测规则，向SMSF发送ULI和白名单ULI。
在一种可能的实现方式中，安全分析网元还向SMSF发送AF标识符。
在另一种可能的实现方式中，安全分析网元还向SMSF发送短消息类型标识。
SMSF收到更新之后针对性进行操作。具体操作内容包括：如果收到的是ULI和短消息类型标识，则SMSF针对该ULI的新的短消息类型进行统计；如果收到的是白名单ULI，则SMSF发送地理位置为白名单ULI的短消息，后续不再统计相关短消息；如果收到的是ULI和AF标识符，则SMSF针对该ULI和该AF标识符进行疑似短消息计数。
S4130，安全分析网元分析判断SMSF上报的信息。每次收到SMSF的上报后，安全分析网元通过分析同SUPI的设备标识切换次数、终端所用设备标识的规律性、SUPI数量、单位时间触发短消息总数等综合判断ULI是否有集群短消息收发系统，其中，终端所用设备标识的规律性可以指的是设备标识均相同、设备标识在区间内等间距连续和设备标识呈现区间内重复排布中的至少一项。
S4140，当安全分析网元判断ULI为集群异常地点，安全分析网元向SMSF发送对应的终端SUPI列表，建议SMSF对SUPI列表中的终端的短消息权限进行限制，限制短消息的收发。
可选地，S4150，安全分析网元存储该ULI地址到UDM中，从而建议SMSF限制后续在该区域的终端的短消息服务注册。
本申请实施例中采用了被动触发的形式，在AF触发形式短消息流程中，通过新增加 的信令和参数，实现实时检测网络中某个接入位置(ULI)可能存在的集群部署的异常接收AF触发类短消息(例如：验证码类)的接收平台，并可以建议网络对相关终端收发短消息进行实时限制或限制该接入位置后续的短消息服务注册。
图5是本申请实施例中一集群异常检测的流程示意图，应理解，为方便描述，本申请实施例中检测的信息是短消息，本申请对信息的具体形式不做限定。
S510，运营商通过预配置的方式，向SMSF和安全分析网元配置收集和触发的阈值策略，等待触发。阈值指的是触发上报的阈值，具体如何配置不在本申请的讨论范围内。
S520，终端建立与AMF的NAS信令连接。
S530，终端向AMF发送短消息。
具体地，终端构建要发送的短消息，短消息由CP-DATA/RP-DATA/TPDU/SMS-SUBMIT部分组成，短消息被封装在NAS消息中，NAS消息用于短消息传输。终端向AMF发送NAS消息。
S540，AMF向SMSF发送第一信息，第一信息包括发送短消息的终端的身份标识、短消息内容、发送短消息的终端所用设备标识、第一信息包括发送短消息的终端的位置信息、SMS size、SMS hash。其中，终端所用设备标识用于标识发送短消息的设备，可以是IMEI、IMEISV、移动设备操作系统的激活信息标识，本申请对此不做限定；SMS size表示该短消息的体积，也可理解为长度；SMS hash表示为短消息的散列值，主要用来判断内容是否一致。
S550，SMSF以SMS hash为基准，收到新的短消息之后对SMS hash和SMS size进行对比和计数。
具体地，首先，SMS size可以排除一些普通终端经常发送的简短且重复的正常短消息，诸如“好的”、“TD”、“OK”等信息，防止误判。因此SMSF可以只对SMS size超过一定数值的短消息进行统计。SMSF在本地维护一张表格，在单位时间内统计，一种示例内容如下表5所示。
表5
S560，如果单位时间内，size和hash满足特定条件，则SMSF向安全分析网元上报该SMS hash对应的异常事件，示例性地，上报内容包括但是不限于(SMS hash，SUPI名单，IMEISV名单，ULI名单)。
在一种可能的实现方式中，S570，安全分析网元收到上报的SMS hash之后，到UDM查询该SMS hash是否在黑名单中，作为后续判断的依据。
可选地，S580，SMSF对每个SUPI为单位统计，设置“旗标(timer)”，即发送上行短消息之后，等待网络侧在阈值时间内回复对端接收回报(submit report)，如果阈值时间内未收到回报，则累加该SUPI未收到回复的计数器，SMSF应当维护一张表格，一种可能的示例如表6所示。
表6
当统计“超时未收到回复次数”满足次数阈值时，则SMSF上报事件给安全分析网元。
需要说明的是，S580与S550、S570之间没有先后关系，也就是说本申请对于先执行S580还是S550不做限制。
S590，安全分析网元通过发送相同SMS hash的SUPI的数量、终端所用设备标识的规律性、同一个SMS hash的不同SUPI发送的ULI是否相同、单位时间触发短消息总数等综合判断ULI是否有集群短消息发送平台，如果每次的条目数量超过一定阈值，则安全分析网元判断ULI为集群异常地点。其中，终端所用设备标识可以是IMEI、IMEISV、移动设备操作系统的激活信息标识，终端所用设备标识的规律性可以指的是设备标识均相同、设备标识在区间内等间距连续和设备标识呈现区间内重复排布中的至少一项。
S5100，安全分析网元向SMSF发送步骤所有该SMS hash的SUPI列表，对SUPI(s)的短消息会话权限进行限制通信。
可选地，S5110，SMSF存储集群ULI地址到UDM中，存储SMS hash值到UDM中，限制后续在此ULI地点处的终端的短消息服务注册。
本申请实施例中采用了被动触发的形式，在终端正常发送上行短消息的流程中，实时检测网络中某个接入位置(ULI)可能存在的集群部署的异常发送短消息的接收平台，并可以建议网络对相关终端收发短消息进行实时限制或限制该接入位置后续的短消息服务注册。
图6是本申请实施例中AF触发短消息的流程示意图。
S610，AF确定触发设备所需的必要条件。
S620，AF向网络曝光功能(network exposure function，NEF)网元发送触发请求信息，触发请求信息用于请求触发短消息。
S630，NEF向UDM发送标识符转换请求信息，标识符转换请求信息用于请求将GPSI解析为SUPI，标识符转换请求信息包括GPSI和AF标识符。
S640，UDM进行标识符转换。
S650，UDM向NEF发送标识符转换响应信息，标识符转换响应信息GPSI对应的SUPI。
S660，NEF向UDM发送检索请求信息，检索请求信息用于请求检索SMSF，检索请 求信息包括GPSI和短消息。
S670，UDM进行检索，得到SMSF标识。
S680，UDM向NEF发送检索响应信息，检索响应信息包括SMSF标识。
S690，NEF根据配置信息确定合适的SMS-SC。
S6100，NEF向SMS-SC发送提交触发器信息，提交触发器信息包括GPSI，SUPI，AF标识符、触发参考号、有效期、优先级、SMSF服务节点ID、短消息应用端口号、触发负载、触发指示。如果NEF指示从UDM接收到“缺席订阅者”，SMS-SC不应提交信息，而应直接存储信息，并为短消息发送路由信息，请求UDM将SMS-SC地址添加到信息等待列表中。
S6110，SMS-SC向NEF发送提交触发确认信息，确认短消息的提交已被SMS-SC接受。
S6120，NEF向AF发送触发响应信息，以指示设备触发请求是否已被接受以传递给终端。
S6130，SMS-SC发送下行短消息，具体的发送步骤如图7所示。
S6140，如果消息下发失败(直接或触发消息有效期到期)或消息下发成功，SMS-SC应向NEF发送消息下发报告(原因码、触发参考号、AF标识符)。
S6150，NEF向AF提供通知消息，其中包含指示触发交付结果的传递报告(例如成功、未知或失败以及失败原因)。NEF生成必要的话单信息，包括GPSI和AF标识符。
S6160，终端响应于接收到的设备触发，采取特定的动作，并可以考虑触发有效载荷的内容。此操作通常包括立即或稍后与AF进行通信。
图7是本申请实施例中发送下行短消息的流程示意图。
S710，SMS-SC向短消息服务网关移动交换中心(short message service-gateway mobile switch center，SMS-GMSC)发送消息传递(message transfer)信息。
S720，SMS-GMSC向UDM发送短消息发送路径请求信息。
S730，UDM向SMS-GMSC发送短消息发送路径信息。
如果终端有两个AMF，一个用于3GPP接入，另一个用于非3GPP接入，则UDM/UDR中存储了两个SMSF地址。UDM应返回两个SMSF地址。
S740，SMS-GMSC向SMSF转发下行短消息。
S750，SMSF向AMF发送目标终端请求信息，请求寻找短信要发送的目标终端，请求的信令可以是Namf_MT_EnableReachability_Req，或者任何其他的消息，本申请不做限制。
S760，AMF启动寻呼终端的程序，寻呼成功后终端进行响应。
S770，SMSF向AMF发送短消息，短消息由CPDATA/RPDATA/TPDU/DELIVER部分组成。
S780，AMF将短消息转发给终端。
S790，终端向AMF发送上行单元数据信息。
S7100，AMF将消息转发给SMSF。为了允许SMSF创建准确的计费记录，AMF还附带IMEISV、终端当前位置信息(ULI)以及此外，如果短消息是通过3GPP接入下发给终端的，则AMF附带当地时区(time zone)。
S7110，终端向AMF返回递送成功报告。递送报告封装在NAS消息中。
S7120，AMF将递送成功报告转发给SMSF。
S7130，SMSF向AMF发送短消息确认信息。
S7140，AMF通过NAS消息封装短消息并发送给终端。
需要说明的是，如果SMSF有多条短消息分段要发送，SMSF和AMF转发后续短消息/短消息确认/递送报告的方式与步骤S760-S7140相同。如果SMSF知道短消息确认信息是要为终端传输的最后一组消息，则SMSF应指示最后一条消息，以便AMF知道不再有短消息数据转发给终端。
图8为本申请实施例提供的通信装置10的示意图，如图8所示，该装置10可以为参与检测异常短消息收发的设备，例如，上述网络设备、SMSF网元和安全分析网元，也可以为芯片或电路，比如可设置于上述参与检测异常短消息收发的设备的芯片或电路。
该装置10可以包括处理器11(即，处理单元的一例)和存储器12。该存储器12用于存储指令，该处理器11用于执行该存储器12存储的指令，以使该装置10实现如图2-7中对应的方法中检测异常短消息收发的设备执行的步骤。
进一步的，该装置10还可以包括输入口13(即，通信单元的一例)和输出口14(即，通信单元的另一例)。进一步的，该处理器11、存储器12、输入口13和输出口14可以通过内部连接通路互相通信，传递控制和/或数据信号。该存储器12用于存储计算机程序，该处理器11可以用于从该存储器12中调用并运行该计算计程序，以控制输入口13接收信号，控制输出口14发送信号，完成上述方法中终端设备的步骤。该存储器12可以集成在处理器11中，也可以与处理器11分开设置。
可选地，若该通信装置10为通信设备，该输入口13为接收器，该输出口14为发送器。其中，接收器和发送器可以为相同或者不同的物理实体。为相同的物理实体时，可以统称为收发器。
可选地，若该通信装置10为芯片或电路，该输入口13为输入接口，该输出口14为输出接口。
作为一种实现方式，输入口13和输出口14的功能可以考虑通过收发电路或者收发的专用芯片实现。处理器11可以考虑通过专用处理芯片、处理电路、处理器或者通用芯片实现。
作为另一种实现方式，可以考虑使用通用计算机的方式来实现本申请实施例提供的通信设备。即将实现处理器11、输入口13和输出口14功能的程序代码存储在存储器12中，通用处理器通过执行存储器12中的代码来实现处理器11、输入口13和输出口14的功能。
其中，通信装置10中各模块或单元可以用于执行上述方法中检测短消息异常收发的设备(例如，网络设备)所执行的各动作或处理过程，这里，为了避免赘述，省略其详细说明。
该装置10所涉及的与本申请实施例提供的技术方案相关的概念，解释和详细说明及其他步骤请参见前述方法或其他实施例中关于这些内容的描述，此处不做赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可 以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (30)

  1. 一种通信方法，其特征在于，包括：
    网络设备根据多个信息中的至少一个第一信息，获取至少一个位置信息，其中，每个信息对应至少一个终端，每个信息的目的终端是所述信息所对应的终端，一个第一信息对应至少一个位置信息，并且，一个第一信息对应的位置信息用于指示所述第一信息的目的终端所处于的位置；
    根据所述位置信息，确定至少一个第一位置范围，其中
    所述第一位置范围内的第一终端的数量大于或等于第一阈值，所述第一终端是至少一个第一信息的目的终端；和/或
    所述多个信息中的第二信息的数量大于或等于第二阈值，所述第二信息是所述至少一个第一信息中目的终端位于所述第一位置范围内的信息；和/或
    所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中目的终端位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或
    所述第一位置范围内的第一设备的数量大于或等于第四阈值，所述第一设备是至少一个第一信息的目的终端对应的设备，且所述第一设备的设备标识满足第二预设条件。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    接收或生成所述多个信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一预设条件包括多个信息的长度满足预配值的长度。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述第二预设条件包括设备标识均相同、所述设备标识在区间内等间距连续和所述设备标识呈现区间内重复排布中的至少一项。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述第一信息是所述多个信息中的部分信息。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述信息包括短消息、终端应用程序所发送的信息，所述信息用于验证、通知、营销或聊天。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述第一信息是所述多个信息中长度大于或等于第五阈值的信息。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述第一信息是所述多个信息中第一应用功能网元发送给所述目的终端的信息。
  9. 根据权利要求8所述的方法，其特征在于，所述第一信息是所述多个信息中第一类型的信息，所述第一类型是所述第一应用功能网元对应的信息的类型，一个应用功能网元对应至少一个信息的类型。
  10. 根据权利要求1-9中任一项所述的方法，其特征在于，所述方法还包括：
    所述网络设备生成告警信息，所述告警信息用于指示所述第一位置范围出现异常；或者
    所述网络设备禁止向所述第一位置范围内的终端转发所述多个信息中的部分或全部信息；或者
    所述网络设备禁止向所述第一位置范围内的终端发送信息。
  11. 一种通信方法，其特征在于，包括：
    网络设备根据多个信息中的至少一个第一信息，获取至少一个位置信息，其中，每个信息对应至少一个终端，每个信息的发送终端是所述信息所对应的终端，一个第一信息对应至少一个位置信息，并且，一个第一信息对应的位置信息用于指示所述第一信息的发送终端所处于的位置；
    根据所述位置信息，确定至少一个第一位置范围，其中
    所述第一位置范围内的第一终端的数量大于或等于第一阈值，所述第一终端是至少一个第一信息的发送终端；和/或
    所述多个信息中的第二信息的数量大于或等于第二阈值，所述第二信息是所述至少一个第一信息中发送终端位于所述第一位置范围内的信息；和/或
    所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中发送终端位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或
    所述第一位置范围内的第一设备的数量大于或等于第四阈值，所述第一设备是至少一个第一信息的发送终端所对应的设备，且所述第一设备的设备标识满足第二预设条件。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    接收或生成所述多个信息。
  13. 根据权利要求11或12所述的方法，其特征在于，所述第一预设条件包括多个信息的长度满足预配值的长度。
  14. 根据权利要求11至13中任一项所述的方法，其特征在于，所述第二预设条件包括设备标识均相同、所述设备标识在区间内等间距连续和所述设备标识呈现区间内重复排布中的至少一项。
  15. 根据权利要求11至14中任一项所述的方法，其特征在于，所述第一信息是所述多个信息中的部分信息。
  16. 根据权利要求11至15中任一项所述的方法，其特征在于，所述信息包括短消息、终端应用程序所发送的信息，所述信息用于验证、通知、营销或聊天。
  17. 根据权利要求11至16中任一项所述的方法，其特征在于，所述第一信息是所述多个信息中长度大于或等于第五阈值的信息。
  18. 根据权利要求11至17中任一项所述的方法，其特征在于，所述第一信息是所述多个信息中散列值为第一值的信息。
  19. 根据权利要求11至18中任一项所述的方法，其特征在于，所述第一信息是所述多个信息中发送终端的第一次数大于或等于第六阈值的信息，所述第一次数用于表示发送终端发送信息后未收到回复的次数。
  20. 根据权利要求19所述的方法，其特征在于，所述方法还包括：
    所述网络设备转发来自发送终端的信息时，启动定时器，若定时器超时，所述网络设备未接收到接收回报，则累加对应所述发送终端的计数器，得到所述第一次数。
  21. 根据权利要求11-20中任一项所述的方法，其特征在于，所述方法还包括：
    所述网络设备生成告警信息，所述告警信息用于指示所述第一位置范围出现异常；或者
    所述网络设备禁止为所述第一位置范围内的终端转发所述多个信息中的部分或全部信息；或者
    所述网络设备禁止所述第一位置范围内的终端发送信息。
  22. 一种通信系统，其特征在于，包括：
    第一网络设备和第二网络设备；
    所述第一网络设备用于向所述第二网络设备发送多个信息；
    所述第二网络设备用于根据所述多个信息中的至少一个第一信息，获取至少一个位置信息，其中，每个信息对应至少一个终端，一个第一信息对应至少一个位置信息，并且，一个第一信息对应的位置信息用于指示所述第一信息对应的终端所处于的位置；
    所述第二网络设备还用于根据所述位置信息，确定至少一个第一位置范围，其中
    所述第一位置范围内的第一终端的数量大于或等于第一阈值，所述第一终端是至少一个第一信息对应的终端；和/或
    所述多个信息中的第二信息的数量大于或等于第二阈值，所述第二信息是所述至少一个第一信息中终端位于所述第一位置范围内的信息；和/或
    所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中终端位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或
    所述第一位置范围内的第一设备的数量大于或等于第四阈值，所述第一设备是至少一个第一信息对应的终端所对应的设备，且所述第一设备的设备标识满足第二预设条件。
  23. 根据权利要求22所述的系统，其特征在于，所述第一网络设备还用于接收或生成所述多个信息。
  24. 根据权利要求22或23所述的系统，其特征在于，所述第一网络设备向所述第二网络设备发送所述多个信息前，所述第二网络设备向所述第一网络设备发送第一请求信息，所述第一请求信息用于向所述第一网络设备请求所述多个信息。
  25. 根据权利要求24所述的系统，其特征在于，所述第二网络设备向所述第一网络设备发送第一请求信息前，所述第二网络设备接收第二请求信息，所述第二请求信息用于请求所述第二网络设备确定所述第一位置范围；
    所述第二请求信息包括第二类型和/或第二位置范围。
  26. 一种通信装置，其特征在于，包括：
    处理模块，用于根据多个信息中的至少一个第一信息，获取至少一个位置信息，其中，每个信息对应至少一个终端，每个信息的目的终端是所述信息所对应的终端，一个第一信息对应至少一个位置信息，并且，一个第一信息对应的位置信息用于指示所述第一信息的目的终端所处于的位置；
    所述处理模块，还用于根据所述位置信息，确定至少一个第一位置范围，其中
    所述第一位置范围内的第一终端的数量大于或等于第一阈值，所述第一终端是至少一个第一信息的目的终端；和/或
    所述多个信息中的第二信息的数量大于或等于第二阈值，所述第二信息是所述至少一个第一信息中目的终端位于所述第一位置范围内的信息；和/或
    所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中目的终端位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或
    所述第一位置范围内的第一设备的数量大于或等于第四阈值，所述第一设备是至少一个第一信息的目的终端所对应的设备，且所述第一设备的设备标识满足第二预设条件。
  27. 一种通信装置，其特征在于，包括：
    处理模块，用于根据多个信息中的至少一个，获取至少一个位置信息，其中，每个信息对应至少一个终端，每个信息的发送终端是所述信息所对应的终端，一个信息对应至少一个位置信息，并且，一个信息对应的位置信息用于指示所述信息的发送终端所处于的位置；
    所述处理模块，还用于根据所述位置信息，确定至少一个第一位置范围，其中
    所述第一位置范围内的第一终端的数量大于或等于第一阈值，所述第一终端是至少一个第一信息的发送终端；和/或
    所述多个信息中的第二信息的数量大于或等于第二阈值，所所述第二信息是所述至少一个第一信息中发送终端位于所述第一位置范围内的信息；和/或
    所述多个信息中的第三信息的数量大于或等于第三阈值，所述第三信息是所述至少一个第一信息中发送终端位于所述第一位置范围内的信息，所述第三信息的长度满足第一预设条件；和/或
    所述第一位置范围内的第一设备的数量大于或等于第四阈值，所述第一设备是至少一个第一信息的发送终端所对应的设备，且所述第一设备的设备标识满足第二预设条件。
  28. 一种通信装置，其特征在于，包括：
    处理器，用于执行存储器中存储的计算机程序，以使得所述通信装置执行权利要求1至21中任一项所述的通信方法。
  29. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行如权利要求1至21中任意一项所述的通信方法。
  30. 一种芯片系统，其特征在于，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片系统的通信设备执行如权利要求1至21中任意一项所述的通信方法。
PCT/CN2023/096306 2022-06-01 2023-05-25 一种通信方法、系统和通信装置 WO2023231898A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210621213.0A CN117202098A (zh) 2022-06-01 2022-06-01 一种通信方法、系统和通信装置
CN202210621213.0 2022-06-01

Publications (1)

Publication Number Publication Date
WO2023231898A1 true WO2023231898A1 (zh) 2023-12-07

Family

ID=89004013

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/096306 WO2023231898A1 (zh) 2022-06-01 2023-05-25 一种通信方法、系统和通信装置

Country Status (2)

Country Link
CN (1) CN117202098A (zh)
WO (1) WO2023231898A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117998570A (zh) * 2024-04-03 2024-05-07 荣耀终端有限公司 通信方法和通信装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012113191A1 (zh) * 2011-02-24 2012-08-30 中兴通讯股份有限公司 一种短消息监控方法和装置
CN103188635A (zh) * 2011-12-29 2013-07-03 上海粱江通信系统股份有限公司 一种基于频次和被叫分布规则识别垃圾短信源的方法
CN103906227A (zh) * 2012-12-26 2014-07-02 中国移动通信集团河南有限公司 一种垃圾短信群发器的定位方法及装置
CN106255119A (zh) * 2016-09-13 2016-12-21 宇龙计算机通信科技(深圳)有限公司 伪基站消息识别方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012113191A1 (zh) * 2011-02-24 2012-08-30 中兴通讯股份有限公司 一种短消息监控方法和装置
CN103188635A (zh) * 2011-12-29 2013-07-03 上海粱江通信系统股份有限公司 一种基于频次和被叫分布规则识别垃圾短信源的方法
CN103906227A (zh) * 2012-12-26 2014-07-02 中国移动通信集团河南有限公司 一种垃圾短信群发器的定位方法及装置
CN106255119A (zh) * 2016-09-13 2016-12-21 宇龙计算机通信科技(深圳)有限公司 伪基站消息识别方法及系统

Also Published As

Publication number Publication date
CN117202098A (zh) 2023-12-08

Similar Documents

Publication Publication Date Title
US11516239B2 (en) System, device, and method of adaptive network protection for managed internet-of-things services
US11323884B2 (en) System, device, and method of detecting, mitigating and isolating a signaling storm
US9813433B2 (en) System and method for embedded mobile (EM)/machine to machine (M2M) security, pattern detection, mitigation
KR101657443B1 (ko) 디바이스 트리거 메시지를 효율적으로 전송하기 위한 장치 및 방법
US9781137B2 (en) Fake base station detection with core network support
EP2742711B1 (en) Detection of suspect wireless access points
US20120198020A1 (en) Content distribution within a service provider network
US9384471B2 (en) Spam reporting and management in a communication network
US9300685B2 (en) Detecting altered applications using network traffic data
WO2023231898A1 (zh) 一种通信方法、系统和通信装置
EP3783856B1 (en) System, device, and method of detecting, mitigating and isolating a signaling storm
US11310669B2 (en) Systems and methods for intercepting network traffic
US20230262098A1 (en) Packet flow descriptor provisioning
US20140323145A1 (en) Base station paging based on traffic content type
US20230141028A1 (en) Traffic control server and method
CN116232615A (zh) 检测网络攻击的方法和通信装置
CN110958638A (zh) 一种无线通信方法、装置、用户设备和无线接入网元

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23815081

Country of ref document: EP

Kind code of ref document: A1