WO2024027427A1 - 异常检测的方法和通信装置 - Google Patents

异常检测的方法和通信装置 Download PDF

Info

Publication number
WO2024027427A1
WO2024027427A1 PCT/CN2023/105067 CN2023105067W WO2024027427A1 WO 2024027427 A1 WO2024027427 A1 WO 2024027427A1 CN 2023105067 W CN2023105067 W CN 2023105067W WO 2024027427 A1 WO2024027427 A1 WO 2024027427A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
terminal device
level
data
user plane
Prior art date
Application number
PCT/CN2023/105067
Other languages
English (en)
French (fr)
Inventor
李论
吴义壮
崔洋
孙陶然
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024027427A1 publication Critical patent/WO2024027427A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/08—Testing, supervising or monitoring using real traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control

Definitions

  • Embodiments of the present application relate to the field of communications, and more specifically, to an anomaly detection method and a communications device.
  • the network data analytics function can analyze terminal equipment on the network side (for example, access and mobility management network elements, session management Analyze the data generated by network elements, etc., and determine whether the behavior of the person being analyzed (for example, communication behavior) is abnormal by constructing a behavioral portrait of the person being analyzed.
  • NWDAF can provide data analysis results (Analytics) to functional network elements on the network side (for example, policy control functional network elements, access and mobility management network elements, etc.), so that other network elements can make quick responses based on the data analysis results.
  • Immediately block the abnormal behavior of the analyzed person for example, block the abnormal communication of the terminal device.
  • network elements for example, NWDAF
  • NWDAF network elements
  • network elements need to be analyzed to analyze the behavior of as many terminal devices in the network as possible to improve the accuracy of abnormal terminal device detection.
  • NWDAF network elements
  • Embodiments of the present application provide an anomaly detection method and a communication device, which can reduce the burden of analyzing network elements while analyzing the behavior of a large number of terminal devices.
  • an anomaly detection method includes: sending a first request message to a first user plane network element, where the first request message is used to request reporting of the transmission status of the first data of the first terminal device. ; Receive the transmission situation of the first data from the first user plane network element; and determine that the first terminal device has the first level abnormality according to the first level anomaly detection strategy and the transmission situation of the first data.
  • a second request message is sent to at least one user plane network element serving the first terminal device. The second request message is used to request reporting of the transmission status of the second data of the first terminal device; according to the second level
  • the anomaly detection strategy and the transmission situation of the second data determine whether the first terminal device has the second level of anomaly.
  • the anomaly detection method it is determined whether the terminal device is abnormal based on different levels of anomaly detection strategies and the data transmission status of the terminal device. It is possible to implement "everything that should be checked” for terminal device abnormalities, that is, to detect the abnormality of the terminal device. The behavior of the device is detected at multiple levels, which can improve the accuracy of abnormal terminal device detection, thereby reducing the scope of terminal devices analyzed for network element detection and reducing the burden of analyzing network elements.
  • the first level anomaly detection strategy includes a correspondence between the transmission situation of the first data and a first threshold used to determine whether there is the first level anomaly.
  • the second level anomaly detection strategy includes a corresponding relationship between the transmission situation of the second data and a second threshold used to determine whether the second level anomaly exists.
  • the transmission situation of the first data includes at least one of the following: a data packet of at least one session of the first terminal device in the first user plane network element
  • the number of data packets, the transmission speed of the data packets of at least one session of the first terminal device in the first user plane network element, the transmission speed of the data packets of at least one session of the first terminal device in the first user plane network element are discrete Degree, the proportion of the number of different types of data packets of the first terminal device in the first user plane network element.
  • the transmission situation of the second data includes one or more of the following: the at least one user plane network element in any user plane network element.
  • the number of data packets of at least one session of the first terminal device, the transmission speed of the data packets of at least one session of the first terminal device in any user plane network element of the at least one user plane network element, the at least one The transmission of data packets of at least one session of the first terminal device in any user plane network element is discrete Degree, or the ratio of the number of different types of data packets of the first terminal device.
  • the first analysis network element sends the first request message to the first user plane network element; the first analysis network element receives the message from the first user plane The transmission situation of the first data of the network element; the first analysis network element determines that the first terminal device has the first level of anomaly; the second analysis network element sends the second request to the at least one user plane network element message; the second analysis network element determines whether the second level of abnormality exists in the first terminal device; wherein the service range of the first analysis network element is smaller than the service range of the second analysis network element.
  • the first analysis network element sends information indicating that the first level of abnormality exists in the first terminal device to the second analysis network element.
  • the second analysis network element determines that the first terminal device has the second level of anomaly
  • the second analysis network element reports to the policy control network element or application
  • the functional network element feeds back information that the first terminal device has the second-level abnormality; or, if the second analysis network element determines that the first terminal device does not have the second-level abnormality, the second analysis network element reports to The policy control network element or the application function network element feeds back information that the first terminal device has the first-level abnormality.
  • the first analysis network element receives information requesting analysis of whether at least one terminal is abnormal, and the at least one terminal includes the first terminal device; the first analysis The network element sends the first request message to the first user plane network element based on the information used to request analysis of whether at least one terminal is abnormal.
  • the method further includes sending information for confirming whether the second level of abnormality detection needs to be performed on the first terminal device; receiving information indicating that the second level of abnormality detection needs to be performed on the first terminal device; Information that the first terminal device performs the second level of abnormality detection.
  • the method further includes determining a first-level packet detection rule PDR according to the first-level anomaly detection policy, the first-level PDR being used to detect the first-level packet detection rule PDR.
  • the first request message includes information indicating the first level PDR; the second level PDR is determined according to the second level anomaly detection strategy, the second level PDR is used to detect the second data, the The second request message includes information indicating the second level of PDR.
  • a method for anomaly detection includes a first user plane network element receiving a request message for requesting to determine the transmission status of the first data of the first terminal device; the first user plane network element based on the The first level anomaly detection strategy and the transmission situation of the first data determine that the first terminal device has the first level anomaly; the first user plane network element sends an indication to the analysis network element that the first terminal device has the first level anomaly.
  • the first user plane network element receives a second request message from the analysis network element, the second request message is used to request reporting of the transmission status of the second data of the first terminal device; the The first user plane network element reports the transmission status of the second data of the first terminal device to the analysis network element, and the transmission status of the second data is used to determine whether the second level abnormality exists in the first terminal device.
  • the first user plane network element can determine whether the terminal device is abnormal based on the anomaly detection strategy and the data transmission situation of the terminal device. When there is an abnormality in the terminal device, the first user plane network element can determine whether the terminal device is abnormal.
  • the surface network element can also send the data transmission status of the terminal equipment to the analysis network element, so that the analysis network element can determine whether there are other levels of abnormalities in the terminal equipment, and can implement "all necessary checks" for terminal equipment abnormalities, that is, to detect all abnormalities in the terminal equipment.
  • the behavior of terminal equipment is detected at multiple levels, which can improve the accuracy of abnormal terminal equipment detection, reduce the scope of terminal equipment for analysis network element detection, and reduce the burden of analyzing network elements.
  • the first-level anomaly detection strategy includes a correspondence between the transmission situation of the first data and a first threshold used to determine whether there is the first-level anomaly.
  • the transmission situation of the first data includes at least one of the following: a data packet of at least one session of the first terminal device in the first user plane network element. Quantity, transmission speed of data packets of at least one session of the first terminal device in the first user plane network element, transmission dispersion of data packets of at least one session of the first terminal device in the first user plane network element , the proportion of the number of different types of data packets of the first terminal device in the first user plane network element.
  • the request message for requesting to determine the transmission situation of the first data of the first terminal device includes information indicating the first level of packet detection rule PDR, The first level PDR is used to detect the first data, the second request message includes information indicating a second level PDR, and the second level PDR is used to detect the second data.
  • a method for anomaly detection includes: a first analysis network element sending a first request message to a first user plane network element.
  • the first request message is used to request reporting of a first error of a first terminal device. Data transmission;
  • the first analysis network element receives the transmission status of the first data from the first user plane network element; When the test strategy and the transmission situation of the first data determine that the first terminal device has the first level of abnormality, the first analysis network element sends a second second analysis network element to at least one user plane network element serving the first terminal device. Request message, the second request message is used to request to report the transmission status of the second data of the first terminal device; the first analysis network element sends the transmission status of the second data to the second analysis network element, the second data The transmission situation is used to determine whether the second level of abnormality exists in the first terminal device.
  • the first analysis network element can determine whether the terminal device is abnormal according to the anomaly detection strategy and the data transmission situation of the terminal device.
  • the first analysis network element can also send the data transmission status of the terminal device to the second analysis network element, so that the second analysis network element can determine whether there are other levels of abnormalities in the terminal device, which can realize "all necessary checks" for terminal device abnormalities. That is, multiple levels of detection are performed on the behavior of terminal equipment, thereby improving the accuracy of abnormal terminal equipment detection, reducing the scope of terminal equipment for analysis network element detection, and reducing the burden of analyzing network elements.
  • the first level anomaly detection strategy includes a correspondence between the transmission situation of the first data and a first threshold used to determine whether there is an abnormality of the first level.
  • the second level anomaly detection strategy includes a corresponding relationship between the transmission situation of the second data and a second threshold used to determine whether the second level anomaly exists.
  • the transmission situation of the first data includes at least one of the following: a data packet of at least one session of the first terminal device in the first user plane network element The number, the transmission speed of the data packets of at least one session of the first terminal device in the first user plane network element, the transmission discreteness of the data packets of at least one session of the first terminal device in the first user plane network element degree, and the proportion of the number of different types of data packets of the first terminal device in the first user plane network element.
  • the transmission situation of the second data includes one or more of the following: the at least one user plane network element in any user plane network element.
  • the number of data packets of at least one session of the first terminal device the transmission speed of the data packets of at least one session of the first terminal device in any user plane network element of the at least one user plane network element, the at least one The transmission dispersion of data packets of at least one session of the first terminal device in any user plane network element, or the proportion of the number of different types of data packets of the first terminal device.
  • the first analysis network element determines that the first terminal device has the first level of anomaly.
  • the first analysis network element sends information indicating that the first level of anomaly exists in the first terminal device to the second analysis network element.
  • the first analysis network element feeds back to the policy control network element or the second analysis network element information that the first terminal device has the second level of anomaly; Alternatively, the first analysis network element feeds back information that the first terminal device has the first level of anomaly to the policy control network element or the second analysis network element.
  • the first analysis network element receives information requesting analysis of whether at least one terminal is abnormal, and the at least one terminal includes the first terminal device; the first analysis The network element sends the first request message to the first user plane network element based on the information used to request analysis of whether at least one terminal is abnormal.
  • the first analysis network element determines the first level packet detection rule PDR according to the first level anomaly detection strategy, and the first level PDR is used to detect
  • the first data and the first request message include information indicating the first level PDR; the first analysis network element determines the second level PDR according to the second level anomaly detection strategy, and the second level PDR uses For detecting the second data, the second request message includes information indicating a second level of PDR.
  • a communication device in a fourth aspect, includes a transceiver unit and a processing unit.
  • the transceiver unit is configured to receive a request message for requesting to determine the transmission status of the first data of the first terminal device;
  • the processing unit is configured to According to the first level anomaly detection strategy and the transmission situation of the first data, it is determined that the first terminal device has the first level anomaly;
  • the transceiver unit is also used to send an instruction to the first terminal device to the analysis network element There is abnormal information of the first level;
  • the transceiver unit is also used to receive a second request message from the analysis network element, the second request message is used to request to report the transmission status of the second data of the first terminal device ;
  • the transceiver unit is also used to report the transmission status of the second data of the first terminal device to the analysis network element.
  • the transmission status of the second data is used to determine whether the first terminal device has the second level. abnormal.
  • the first level anomaly detection strategy includes a correspondence between the transmission situation of the first data and a first threshold used to determine whether the first level anomaly exists. relation.
  • the transmission situation of the first data includes at least one of the following: the number of data packets of at least one session of the first terminal device in the communication device, the The transmission speed of the data packets of at least one session of the first terminal device in the communication device, the transmission dispersion of the data packets of at least one session of the first terminal device in the communication device, The proportion of the number of different types of data packets of the first terminal device in the communication device.
  • the request message for requesting to determine the transmission situation of the first data of the first terminal device includes information indicating the first level of packet detection rule PDR.
  • the first level PDR is used to detect the first data
  • the second request message includes information indicating a second level PDR
  • the second level PDR is used to detect the second data.
  • a communication device in a fifth aspect, characterized in that the device includes a transceiver unit and a processing unit.
  • the transceiver unit is used to send a first request message to the first user plane network element.
  • the first request message is used to request Report the transmission status of the first data of the first terminal device;
  • the transceiver unit is also used to receive the transmission status of the first data from the first user plane network element; in accordance with the first level anomaly detection strategy and the third
  • the transceiver unit is also used to send a second request message to at least one user plane network element serving the first terminal device, the The second request message is used to request to report the transmission status of the second data of the first terminal device;
  • the processing unit is used to determine the first terminal device according to the second level anomaly detection strategy and the transmission status of the second data. Whether there is this second level exception.
  • the first level anomaly detection strategy includes a correspondence between the transmission situation of the first data and a first threshold used to determine whether there is the first level anomaly.
  • the second level anomaly detection strategy includes a corresponding relationship between the transmission situation of the second data and a second threshold used to determine whether the second level anomaly exists.
  • the transmission situation of the first data includes at least one of the following: a data packet of at least one session of the first terminal device in the first user plane network element The number, the transmission speed of the data packets of at least one session of the first terminal device in the first user plane network element, the transmission discreteness of the data packets of at least one session of the first terminal device in the first user plane network element degree, and the proportion of the number of different types of data packets of the first terminal device in the first user plane network element.
  • the transmission situation of the second data includes one or more of the following: the at least one user plane network element in any user plane network element.
  • the number of data packets of at least one session of the first terminal device the transmission speed of the data packets of at least one session of the first terminal device in any user plane network element of the at least one user plane network element, the at least one The transmission dispersion of data packets of at least one session of the first terminal device in any user plane network element, or the proportion of the number of different types of data packets of the first terminal device.
  • the processing unit is further configured to determine that the first terminal device has the first level of abnormality.
  • the transceiver unit is further configured to send information indicating that the first level of anomaly exists in the first terminal device to the second analysis network element.
  • the transceiver unit is further configured to: feed back to the policy control network element or the second analysis network element information that the first terminal device has the second level of anomaly. ; Or feedback information that the first terminal device has the first level of abnormality to the policy control network element or the second analysis network element.
  • the transceiver unit is further configured to: receive information requesting analysis of whether at least one terminal is abnormal, the at least one terminal including the first terminal device; the transceiver unit Specifically, it is used to send the first request message to the first user plane network element according to the information used to request analysis of whether at least one terminal is abnormal.
  • the transceiver unit is also configured to send information for confirming whether the second level of abnormality detection needs to be performed on the first terminal device; receive information for indicating the need Information for performing the second level anomaly detection on the first terminal device.
  • the processing unit is further configured to: determine a first-level packet detection rule PDR according to the first-level anomaly detection strategy, and the first-level PDR is used to: Detect the first data, and the first request message includes information indicating the first level PDR; determine the second level PDR according to the second level anomaly detection strategy, and the second level PDR is used to detect the second level.
  • the second request message includes information indicating the second level of PDR.
  • a communication device in a sixth aspect, includes a transceiver unit configured to send a first request message to a first user plane network element.
  • the first request message is used to request reporting of a first signal of a first terminal device.
  • the transmission situation of the data the transceiver unit is also used to receive the transmission situation of the first data from the first user plane network element; and determine the first level according to the first level anomaly detection strategy and the transmission situation of the first data.
  • the transceiver unit is further configured to send a second request message to at least one user plane network element serving the first terminal equipment.
  • the second request message is used to request reporting of the third level of abnormality.
  • the transmission situation of the second data of a terminal device is also used to send the transmission situation of the second data to the second analysis network element, and the transmission situation of the second data
  • the transmission situation is used to determine whether there is an abnormality of the second level in the first terminal device.
  • the first level anomaly detection strategy includes a correspondence between the transmission situation of the first data and a first threshold used to determine whether there is the first level anomaly.
  • the second level anomaly detection strategy includes a corresponding relationship between the transmission situation of the second data and a second threshold used to determine whether the second level anomaly exists.
  • the transmission situation of the first data includes at least one of the following: a data packet of at least one session of the first terminal device in the first user plane network element The number, the transmission speed of the data packets of at least one session of the first terminal device in the first user plane network element, the transmission discreteness of the data packets of at least one session of the first terminal device in the first user plane network element degree, and the proportion of the number of different types of data packets of the first terminal device in the first user plane network element.
  • the transmission situation of the second data includes one or more of the following: the at least one user plane network element in any user plane network element.
  • the number of data packets of at least one session of the first terminal device the transmission speed of the data packets of at least one session of the first terminal device in any user plane network element of the at least one user plane network element, the at least one The transmission dispersion of data packets of at least one session of the first terminal device in any user plane network element, or the proportion of the number of different types of data packets of the first terminal device.
  • the apparatus further includes a processing unit configured to determine that the first terminal device has the first level of abnormality.
  • the transceiver unit is further configured to send information indicating that the first terminal device has the first level of anomaly to the second analysis network element.
  • the transceiver unit is further configured to feed back to the policy control network element or the second analysis network element information that the first terminal device has the second level of anomaly; Alternatively, the transceiver unit is also configured to feed back to the policy control network element or the second analysis network element the information that the first terminal device has the first level of abnormality.
  • the transceiver unit is also configured to receive information requesting analysis of whether at least one terminal is abnormal, and the at least one terminal includes the first terminal device; the transceiver unit specifically The method is used to send the first request message to the first user plane network element according to the information for requesting analysis of whether at least one terminal is abnormal.
  • the processing unit is further configured to determine a first-level packet detection rule PDR according to the first-level anomaly detection strategy, and the first-level PDR is used to detect
  • the first data and the first request message include information indicating a first level PDR;
  • the processing unit is also configured to determine a second level PDR according to the second level anomaly detection strategy, and the second level PDR is For detecting the second data, the second request message includes information indicating a second level of PDR.
  • a seventh aspect provides a communication system, characterized in that the system includes a first analysis network element and a second analysis network element, and the first analysis network element is used to send a first request message to a first user plane network element.
  • the first request message is used to request to report the transmission status of the first data of the first terminal device;
  • the first analysis network element is also used to receive the transmission status of the first data from the first user plane network element;
  • the second analysis network element is used to provide services to the first terminal device.
  • At least one user plane network element of the first terminal device sends a second request message, the second request message is used to request to report the transmission status of the second data of the first terminal device; the second analysis network element is also used to request according to the second level.
  • the anomaly detection strategy and the transmission situation of the second data determine whether the first terminal device has the second level of anomaly, wherein the service range of the first analysis network element is smaller than the service range of the second analysis network element.
  • the first level anomaly detection strategy includes a correspondence between the transmission situation of the first data and a first threshold used to determine whether there is the first level anomaly.
  • the second level anomaly detection strategy includes a corresponding relationship between the transmission situation of the second data and a second threshold used to determine whether the second level anomaly exists.
  • the transmission situation of the first data includes at least one of the following: a data packet of at least one session of the first terminal device in the first user plane network element The number, the transmission speed of the data packets of at least one session of the first terminal device in the first user plane network element, the transmission discreteness of the data packets of at least one session of the first terminal device in the first user plane network element degree, and the proportion of the number of different types of data packets of the first terminal device in the first user plane network element.
  • the transmission situation of the second data includes one or more of the following: the at least one user plane network element in any user plane network element.
  • the number of data packets of at least one session of the first terminal device, the transmission speed of the data packets of at least one session of the first terminal device in any user plane network element of the at least one user plane network element, the at least one The transmission of data packets of at least one session of the first terminal device in any user plane network element is discrete degree, or the proportion of the number of different types of data packets of the first terminal device.
  • the first analysis network element is also used to determine that the first terminal device has the first level of anomaly; the first analysis network element is also used to determine Information indicating that the first terminal device has the first level of anomaly is sent to the second analysis network element.
  • the second analysis network element determines that the first terminal device has the second level of anomaly
  • the second analysis network element is also used to report to the policy control network
  • the second analysis network element or the application function network element feeds back information that the first terminal device has the second-level abnormality; or, if the second analysis network element determines that the first terminal device does not have the second-level abnormality, the second analysis network element
  • the network element is also configured to feed back to the policy control network element or the application function network element the information that the first terminal device has the first-level abnormality.
  • the first analysis network element is further configured to receive information requesting analysis of whether at least one terminal is abnormal, and the at least one terminal includes the first terminal device;
  • the first analysis network element is specifically configured to send the first request message to the first user plane network element according to the information used to request analysis of whether at least one terminal is abnormal.
  • the first analysis network element is also used to determine the first level packet detection rule PDR according to the first level anomaly detection strategy.
  • a communication device including a processor.
  • the processor is coupled to the memory and can be used to execute instructions in the memory to implement the first aspect, the second aspect, the third aspect and any of the possible implementation methods of the first aspect, the second aspect and the third aspect.
  • the communication device further includes a memory.
  • the communication device also includes a communication interface, and the processor is coupled to the communication interface.
  • the communication interface may be an input/output interface
  • the input/output interface may be an input/output circuit
  • the transceiver may be a transceiver circuit.
  • a processor including: an input circuit, an output circuit and a processing circuit.
  • the processing circuit is configured to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in any one of the possible implementations of the first to third aspects.
  • the above-mentioned processor can be one or more chips
  • the input circuit can be an input pin
  • the output circuit can be an output pin
  • the processing circuit can be a transistor, a gate circuit, a flip-flop and various logic circuits, etc.
  • the input signal received by the input circuit may be received and input by, for example, but not limited to, the receiver, and the signal output by the output circuit may be, for example, but not limited to, output to and transmitted by the transmitter, and the input circuit and the output A circuit may be the same circuit that functions as an input circuit and an output circuit at different times.
  • the embodiments of this application do not limit the specific implementation methods of the processor and various circuits.
  • a processing device including a processor and a memory.
  • the processor is used to read instructions stored in the memory, and can receive signals through a receiver and transmit signals through a transmitter to execute the method in any possible implementation manner of the first aspect to the third aspect.
  • processors there are one or more processors and one or more memories.
  • the memory may be integrated with the processor, or the memory may be provided separately from the processor.
  • the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated on the same chip as the processor, or can be set in different On the chip, the embodiment of the present application does not limit the type of memory and the arrangement of the memory and the processor.
  • ROM read-only memory
  • sending instruction information may be a process of outputting instruction information from the processor
  • receiving capability information may be a process of the processor receiving input capability information.
  • the data output by the processor can be output to the transmitter, and the input data received by the processor can be from the receiver.
  • the transmitter and receiver can be collectively called a transceiver.
  • the processing device in the tenth aspect above may be one or more chips.
  • the processor in the processing device can be implemented by hardware or software.
  • the processor can be a logic circuit, an integrated circuit, etc.;
  • the processor can be a general processor, which is implemented by reading software codes stored in a memory, and the memory can Integrated in the processor, it can be located outside the processor and exist independently.
  • a computer program product includes: a computer program (which may also be called a code). code, or instruction), when the computer program is run, causing the computer to perform the method in any of the possible implementations of the first to third aspects.
  • a computer-readable storage medium stores a computer program (which may also be called a code, or an instruction), and when run on a computer, the computer-readable storage medium enables the above-mentioned first aspect to The method in any possible implementation manner of the third aspect is executed.
  • a computer program which may also be called a code, or an instruction
  • Figure 1 is a schematic diagram of an application scenario applicable to the method of the embodiment of the present application.
  • Figure 2 is a schematic flow chart of an anomaly detection method 200 provided by this application.
  • FIG. 3 is a schematic flow chart of another anomaly detection method 300 provided by this application.
  • Figure 4 is a schematic flow chart of another anomaly detection method 400 provided by this application.
  • Figure 5 is a schematic flow chart of another anomaly detection method 500 provided by this application.
  • FIG. 6 is a schematic flow chart of an anomaly detection method 600 provided by an embodiment of the present application.
  • Figure 7 is a schematic flow chart of an anomaly detection method 700 provided by yet another embodiment of the present application.
  • Figure 8 is a schematic flow chart of an anomaly detection method 800 provided by yet another embodiment of the present application.
  • Figure 9 is a schematic diagram of a communication device provided by an embodiment of the present application.
  • Figure 10 is a schematic block diagram of a communication device provided by another embodiment of the present application.
  • Figure 11 is a schematic diagram of a chip system provided by an embodiment of the present application.
  • long term evolution long term evolution
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD time division duplex
  • WiMAX global interoperability for microwave access
  • 5th generation, 5G fifth generation
  • 6th generation, 6G vehicle-to-x, V2X
  • V2X can include vehicle-to-network (V2N), vehicle-to-vehicle (V2V), vehicle-to-infrastructure ( vehicle-to-infrastructure (V2I), vehicle-to-pedestrian (V2P), etc.
  • long term evolution-vehicle LTE-V
  • vehicle networking machine type communication
  • MTC Internet of things
  • IoT Internet of things
  • LTE-M long term evolution-machine
  • M2M machine to machine
  • FIG. 1 is a schematic diagram of a network architecture suitable for the method provided by the embodiment of this application.
  • the network architecture may specifically include the following network elements:
  • User equipment can include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to wireless modems, as well as various forms of terminals, mobile devices Mobile station (MS), terminal or soft terminal, etc. For example, water meters, electricity meters, sensors, etc.
  • MS Mobile station
  • the user equipment in the embodiment of the present application may refer to an access terminal, a user unit, a user station, a mobile station, a mobile station, a relay station, a remote station, a remote terminal, a mobile device, a user terminal (user terminal), and a terminal device.
  • terminal equipment wireless communications equipment, user agent or user device.
  • the user equipment may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a device with wireless communications Functional handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, user equipment in 5G networks or users in future evolved public land mobile communications networks (PLMN) Equipment or user equipment in future Internet of Vehicles, etc.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • PLMN public land mobile communications networks
  • a wearable device may also be called a wearable smart device, which is a general term for applying wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, Gloves, watches, clothing and shoes, etc.
  • a wearable device is a portable device that is worn directly on the body or integrated into the user's clothing or accessories. Wearable devices are not just hardware devices, they can also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly defined wearable smart devices include full-featured, large-sized devices that can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, and those that only focus on a certain type of application function and need to cooperate with other devices such as smartphones. Use, such as various smart phones for physical sign monitoring Rings, smart jewelry, etc.
  • the user equipment can also be user equipment in the Internet of Things (IoT) system.
  • IoT Internet of Things
  • Its main technical feature is to transfer items through communication technology. Connect with the network to realize an intelligent network of human-computer interconnection and physical-object interconnection.
  • IOT technology can achieve massive connections, deep coverage, and terminal power saving through, for example, narrowband (NB) technology.
  • user equipment may also include sensors such as smart printers, train detectors, and gas stations.
  • the main functions include collecting data (part of user equipment), receiving control information and downlink data of access network equipment, and Send electromagnetic waves to transmit uplink data to access network equipment.
  • (Wireless) access network equipment radio access network, (R)AN: used to provide network access functions for authorized user equipment in a specific area, and can use different quality transmissions according to the level of user equipment, business needs, etc. tunnel.
  • RAN can manage wireless resources, provide access services for user equipment, and then complete the forwarding of control signals and user equipment data between the user equipment and the core network.
  • RAN can also be understood as a base station in a traditional network.
  • the access network device in the embodiment of the present application may be any communication device with wireless transceiver functions used to communicate with user equipment.
  • the access network equipment includes but is not limited to: evolved Node B (eNB), baseband unit (BBU), access point (access point) in the wireless fidelity (wireless fidelity, WIFI) system, AP), wireless relay node, wireless backhaul node, transmission point (TP) or transmission and reception point (TRP), etc.
  • It can also be 5G, such as NR, gNB in the system, or , transmission point (TRP or TP), one or a group (including multiple antenna panels) of antenna panels of a base station in a 5G system, or it can also be a network node that constitutes a gNB or transmission point, such as a baseband unit (BBU), Or, distributed unit (DU), etc.
  • 5G such as NR, gNB in the system, or , transmission point (TRP or TP), one or a group (including multiple antenna panels) of antenna panels of a base station in a 5G system
  • TRP or TP transmission point
  • BBU baseband unit
  • DU distributed unit
  • gNB may include centralized units (CUs) and DUs.
  • the gNB may also include an active antenna unit (AAU).
  • CU implements some functions of gNB
  • DU implements some functions of gNB.
  • CU is responsible for processing non-real-time protocols and services, implementing radio resource control (RRC), and packet data convergence protocol (PDCP) layer functions.
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • DU is responsible for processing physical layer protocols and real-time services, and implementing the functions of the radio link control (RLC) layer, media access control (MAC) layer and physical (physical, PHY) layer.
  • RLC radio link control
  • MAC media access control
  • PHY physical layer
  • the access network device may be a device including one or more of a CU node, a DU node, and an AAU node.
  • the CU can be divided into access network equipment in the access network (radio access network, RAN), or the CU can be divided into access network equipment in the core network (core network, CN). This application does not Make limitations.
  • Access and mobility management function (AMF) network element mainly used for mobility management and access management, etc., and can be used to implement mobility management entity (mobility management entity, MME) functions in addition to Other functions besides session management, such as access authorization/authentication and other functions.
  • MME mobility management entity
  • Session management function (SMF) network element mainly used for session management, Internet protocol (IP) address allocation and management of terminal devices, selection and management of user plane functions, policy control and charging function interfaces Endpoints and downstream data notifications, etc.
  • IP Internet protocol
  • PCF Policy control function
  • UPF User plane function
  • QoS quality of service
  • User data can be accessed to the data network (DN) through UPF.
  • UPF can be used to implement the functions of user plane network elements.
  • Application function (AF) network element used for data routing affected by applications, access to network open function network elements, and interaction with the policy framework for policy control, etc.
  • Data network used to provide a network for transmitting data.
  • DN Data network
  • the operator's business network Internet network, third-party business network, etc.
  • NWDAF can have at least one of the following functions:
  • the data collection function can refer to NWDAF collects data from network functional network elements, third-party servers, terminal equipment or network management systems
  • the model training function can refer to NWDAF analyzing and training the model (for example, machine learning model) based on relevant input data
  • the model feedback function can refer to NWDAF Send the trained machine learning model to the network element that supports the inference function
  • the analysis result inference function can refer to NWDAF making inferences based on the trained machine learning model and inference data to determine the data analysis results
  • the analysis result feedback function can refer to NWDAF to the network function
  • Network elements, third-party servers, terminal equipment or network management systems provide data analysis results, which can assist the network in selecting service QoS parameters, performing traffic routing, selecting background traffic transmission strategies, etc.
  • NWDAF collects user information such as connection management, mobility management, session management, and accessed services, and uses reliable analysis and prediction models to evaluate and analyze different types of users, build user portraits, and determine the user's movement trajectory and services. Usage habits, optimize user mobility management parameters, wireless resource management parameters, etc.
  • NWDAF can also identify whether there are abnormalities in the terminal device based on the constructed user portrait.
  • the NWDAF may be a separate network element or may be co-located with other network elements.
  • NWDAF network elements can be co-located with AMF or co-located with SMF.
  • the above network architecture may also include network exposure function (NEF) network elements.
  • NEF network exposure function
  • 3GPP 3rd Generation Partnership Project
  • the N2 interface is the interface between RAN and AMF network elements and is used for sending wireless parameters, non-access stratum (NAS) signaling, etc.
  • the N3 interface is the interface between RAN and UPF network elements. The interface between them is used to transmit user plane data, etc.
  • the N4 interface is the interface between the SMF network element and the UPF network element, and is used to transmit business policies, tunnel identification information of the N3 connection, data cache indication information, and downlink Data notifications and other information.
  • the N6 interface is the interface between the DN and UPF network elements and is used to transmit user plane data.
  • network elements can interact with each other through service-oriented interfaces.
  • NWDAF can collect data generated by terminals on network elements through service-oriented interfaces (such as Namf, Nsmf, etc.) provided by other network elements (such as AMF, SMF, etc.); NWDAF can also use Nnwdaf interfaces to other network elements.
  • Network elements such as AMF, PCF, etc.
  • AMF, PCF, etc. provide data analysis results, models, data, etc.
  • network architecture applicable to the embodiments of the present application is not limited to this, and any network architecture that can realize the functions of each of the above network elements is applicable to the embodiments of the present application.
  • each network element and interface in this application are just examples. This application does not rule out the possibility that each network element will have other names in the future, and the functions between each network element will be merged. With the evolution of technology, any device or network element that can realize the functions of each of the above network elements is within the scope of protection of this application.
  • the above network elements can also be called entities, equipment, devices or modules, etc., which are not specifically limited in this application.
  • the description of "network element” is omitted in some descriptions.
  • the NWDAF network element is referred to as NWDAF.
  • NWDAF the NWDAF network element
  • NWDAF the NWDAF network element
  • the analysis network element can analyze the data generated by the terminal device on the network side (for example, access and mobility management network element, session management network element, etc.), and then identify the behavior of the terminal device (for example, communication behavior ) is abnormal.
  • the analysis network element can provide data analysis results to other network-side network elements (for example, policy control function network elements, etc.), so that other network elements can promptly block abnormal behaviors of terminal equipment, for example, block communication of abnormal terminal equipment.
  • the analysis network element may be the NWDAF in the network architecture shown in Figure 1, or other network elements with data analysis functions, which is not limited in this application.
  • this application proposes a communication method that enables the analysis network element to analyze the behavior of a large number of terminal devices and at the same time reduces the burden of the analysis network element.
  • the analysis network element can provide the data analysis results to other network elements on the network side (for example, policy control function network elements, access and mobility management network elements, etc.), so that other network elements can respond quickly and timely based on the data analysis results. Block abnormal behavior of terminal devices.
  • the first, second and various numerical numbers for example, "#1", “#2”, etc.
  • the objects distinguished are not used to limit the scope of the embodiments of the present application. For example, distinguish different core network elements, etc. It is not used to describe a specific order or sequence. It is to be understood that objects so described are interchangeable where appropriate to enable description of aspects other than the embodiments of the present application.
  • the "preset”, “preconfiguration”, etc. involved in the embodiments of this application can be realized by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in the device (for example, network device) , this application does not limit its specific implementation, such as the preset anomaly detection strategy, preset thresholds, etc. in the embodiments of this application.
  • the term "and/or" in this article is just an association relationship that describes related objects, indicating that there can be three relationships.
  • a and/or B can mean: A alone exists, and A and B exist simultaneously. , there are three situations of B alone.
  • the character "/" in this article generally indicates that the related objects are an "or" relationship.
  • FIG. 2 is a schematic diagram of an anomaly detection method 200 provided by an embodiment of the present application.
  • Method 200 may include the following steps.
  • the first analysis network element sends a first request message to the first user plane network element.
  • the first request message is used to request to report the transmission status of the first data of the first terminal device.
  • the first user plane network element receives the first request message from the first analysis network element.
  • the first data may include a data packet of at least one session of the first terminal device in the first user plane network element.
  • the transmission situation of the first data of the first terminal device may include at least one of the following items: the number of data packets of at least one session of the first terminal device in the first user plane network element, the first user plane network element The transmission speed of the data packets of at least one session of the first terminal device in the first user plane network element, the transmission dispersion of the data packets of at least one session of the first terminal device in the first user plane network element, the first user plane network element The proportion of the number of different types of data packets in the first terminal device, and the different types of data packets are different types of data packets in the data packets of the at least one session.
  • At least one session of the first terminal device may include a session initiated by the first terminal device.
  • the first terminal device initiates a call to at least one called terminal device, and the first terminal device initiates a call to the called terminal device by initiating a first session, then at least one session of the first terminal device includes the first Session; at least one session of the first terminal device may also include a session initiated by other terminal devices to the first terminal device, and the number of other terminal devices may be one or more.
  • another terminal device initiates a call to the first terminal device, and the other terminal device initiates a call to the first terminal device by initiating a second session, then at least one session of the first terminal device includes the second session.
  • This application does not limit the specific type of the at least one session.
  • this application does not limit the first session to a session initiated by the first terminal device.
  • the first session may also be other types of sessions initiated by the first terminal device.
  • Session for example, the first terminal device initiates a short message session to other terminal devices; similarly, this application does not limit the specific type of the second session.
  • the second session can also be used for other terminal devices to send short messages to the first terminal device. The device initiates a short message session.
  • the data packet of the at least one session of the first terminal device is transmitted by the first user plane network element.
  • the first user plane network element after receiving the data packet of at least one session from the first terminal device, forwards the data packet of the at least one session according to the destination address carried in the data packet of the at least one session.
  • the data packet of at least one session can be sent to the network side device through the N6 interface, or the data packet of the at least one session can also be sent to other devices through the N19 interface.
  • the first user plane network element may also transmit data packets from at least one session of the terminal device in the first user plane network element, or data packets from at least one session of the network side device, or from The data packet of at least one session of other user plane functional network elements is forwarded to the first terminal device.
  • the following describes the transmission of the first data by taking the at least one session including the first session as an example.
  • the first session is a session in which the first terminal device initiates a call to the opposite terminal device.
  • the data of the first session is recorded as first data.
  • the first data may include a data packet instructing the first terminal device to initiate a call to the opposite terminal device, which is recorded as a first data packet; the first data packet is recorded as a first data packet.
  • One piece of data may also include a data packet sent by the peer terminal device in response to the call initiated by the first terminal device, which is recorded as a second data packet.
  • the transmission situation of the first data may include at least one of the following items:
  • the number of first data packets may reflect the number of times the first terminal device initiates calls to the other terminal devices.
  • the transmission speed of the first data packet can be understood as the number of transmissions of the first data packet within a preset time period.
  • the transmission dispersion of the first data packet can be understood as the dispersion of an object represented by a certain field in the first data packet.
  • a field of the first data packet indicates the destination address of the transmission, that is, the transmission dispersion of the first data packet may include the dispersion of the destination address of the first data packet.
  • another field of the first data packet indicates the mobile equipment (ME) used by the first terminal device, that is, the transmission dispersion of the first data packet may include the identification of the ME of the first data packet. span.
  • ME mobile equipment
  • the partial data packets may indicate that the opposite terminal device rejects the call initiated by the first terminal device, and the number of the partial data packets may reflect the number of times the call initiated by the first terminal device is canceled.
  • the partial data packets may instruct the opposite terminal device to hang up the call initiated by the first terminal device, and the number of the partial data packets may reflect the number of times the call initiated by the first terminal device is hung up (bye).
  • the ratio of the number of different types of data packets in the first data may be, for example, the ratio of the number of the first data packets to the second data packets.
  • the ratio of the number of partial data packets in the second data packet to the total number of the first data packet may indicate that some peer terminal devices reject the request initiated by the first terminal device.
  • the ratio of the number of partial data packets in the second data packet to the total number of the first data packets can represent the number of rejections of calls initiated by the first terminal device and the total number of calls initiated by the first terminal device proportion.
  • the partial data packets in the second data packet may instruct part of the peer terminal device to hang up the call initiated by the first terminal device, then the number of partial data packets in the second data packet is equal to that of the first data packet.
  • the ratio of the total number may represent the ratio of the number of times calls initiated by the first terminal device are hung up to the total number of times calls initiated by the first terminal device.
  • the first data in the embodiment of the present application is not limited to the data of the first session.
  • the first data may also include data of the second session, and the transmission situation of the data of the second session is similar to the transmission situation of the first data of the first session, which will not be described again for the sake of brevity.
  • the transmission status of the first data of the first terminal device can be used to determine whether there is a first level abnormality in the first terminal device.
  • the first-level abnormality can be understood as an abnormality determined according to the transmission situation of the first data.
  • the transmission situation of the first data includes the transmission number of the first data packet.
  • the transmission number of the first data packet is greater than a threshold, it can be determined that the first terminal device may have the first level of abnormality.
  • the number of transmissions of the first data packet may reflect the number of times the first terminal device initiates calls to the other terminal devices, that is, when the number of times the first terminal device initiates calls to the other terminal devices is greater than a threshold, the There may be a first-level abnormality in the first terminal device.
  • the transmission status of the first data includes the number of partial data packets in the second data packet.
  • the partial data packets may indicate that some peer terminal devices reject calls initiated by the first terminal device.
  • the number of the partial data packets is greater than the threshold, it may be determined that the first terminal device may have the first level of anomaly. That is, when the number of times calls initiated by the first terminal device to the other terminal device are rejected is greater than the threshold, the first terminal device may have a first-level abnormality.
  • the first analysis network element may be a session management network element, and for convenience of distinction, it is denoted as the first session management network element. That is, the first session management network element sends the first request message to the first user plane network element, requesting to report the transmission status of the first data of the first terminal device.
  • the first request message may carry information indicating a first-level packet detection rule (PDR).
  • PDR packet detection rule
  • the first-level PDR is used for the first user plane network element to match the first terminal device.
  • One data In other words, it is used for the first user plane network element to detect the first data.
  • the first level PDR may be pre-configured in the first user plane network element, or may be sent by the first session management network element to the first user plane network element through the first request message.
  • the first session management network element receives a third request message from the second analysis network element before sending the first request message to the first user plane network element.
  • the third request The message is used to request to detect whether there is an abnormality in at least one terminal device, and the at least one terminal device includes the first terminal device.
  • the first session management network element sends the first request message to the first user plane network element according to the third request message.
  • the second analysis network element may be a network data analysis function network element, and for convenience of distinction, it is denoted as a first network data analysis function network element.
  • the first network data analysis function network element can analyze data on at least one session management network element, and the at least one session management network element includes the first session management network element.
  • the third request message may carry the identity of the at least one terminal device; or, the third request message may carry indication information indicating whether the at least one terminal device managed by the first session management network element is abnormal. At least one terminal device managed by the first session management network element includes the first terminal device.
  • the third request message may also carry indication information indicating an abnormality level for abnormality detection of the at least one terminal device.
  • the abnormality level may include the first level and the second level.
  • the indication information indicates that the level of detection of the at least one terminal device is a high level, such as the second level
  • the first session management network element may start low-level abnormality detection by default, such as the first level.
  • S220 The first user plane network element sends the transmission status of the first data to the first analysis network element.
  • the first analysis network element receives the transmission status of the first data from the first user plane network element.
  • the first analysis network element determines whether there is a first level abnormality in the first terminal device according to the transmission situation of the first data.
  • the first analysis network element may determine whether the first level of anomaly exists in the first terminal device according to the first level of anomaly detection strategy and the transmission situation of the first data.
  • the first level anomaly detection strategy includes a corresponding relationship between the transmission situation of the first data and a first threshold used to determine whether the first level anomaly exists.
  • the corresponding relationship between the transmission status of the first data and the first threshold may be that the transmission status of the first data is greater than, equal to, or less than the first threshold.
  • the transmission situation of the first data includes the number of the first data packets, and the number of the first data packets can represent the number of times the first terminal device initiates calls to the other terminal devices;
  • the first threshold can be a preset The upper limit of the number of calls initiated by the terminal device;
  • the corresponding relationship between the transmission situation of the first data and the first threshold may be: the number of the first data packets is greater than or equal to the first threshold.
  • the related description of the first data packet and the second data packet may refer to the description in S210.
  • the anomaly detection strategy refers to the strategy for detecting anomalies.
  • the anomaly detection strategy may include the correspondence between the data transmission situation and the threshold. That is, by determining the correspondence between the data transmission situation and the threshold, it can be determined whether the terminal device is abnormal.
  • the anomaly detection policy may also be called a security policy, and its naming does not limit the protection scope of the embodiments of the present application.
  • the first analysis network element sends a second request message to at least one user plane network element serving the first terminal device.
  • the second request message is used to request to report the transmission status of the second data of the first terminal device.
  • the second user plane network element receives the second analysis network element from the first analysis network element. Request message.
  • the second request message may carry information indicating a second level of PDR.
  • the second level of PDR is used for the second user plane network element to match the second data of the first terminal device, or in other words, for the second level of PDR.
  • the second user plane network element detects the second data.
  • At least one user plane network element serving the first terminal device can be understood that the second data of the first terminal device is transmitted by the at least one user plane network element.
  • the second user plane network element serving the first terminal device means that the data sent by the first terminal device can be transmitted through the second user plane network element, or the data received by the first terminal device Transmission can be carried out through the second user plane network element.
  • the second data may include data packets of at least one session of the first terminal device in the second user plane network element.
  • the transmission situation of the second data of the first terminal device may include at least one of the following items: the number of data packets of at least one session of the first terminal device in the second user plane network element, the second user plane network element The transmission speed of the data packets of at least one session of the first terminal device in the second user plane network element, the transmission dispersion of the data packets of at least one session of the first terminal device in the second user plane network element, the second user plane network element The proportion of the number of different types of data packets in the first terminal device, and the different types of data packets are different types of data packets in the data packets of the at least one session.
  • the transmission situation of the second data is similar to the transmission situation of the first data and will not be described again.
  • the data of the first terminal device (including the first data and the second data) is transmitted by at least one user plane network element.
  • the first The analysis network element may send the first request message to a user plane network element serving the first terminal device (for example, the first user plane network element) to request the transmission status of the first data of the first terminal device.
  • a piece of data may include a data packet of at least one session of the first terminal device in the first user plane network element.
  • the first analysis network element may provide information to at least one server serving the first terminal device.
  • the user plane network element sends the second request message to request the transmission status of the second data of the first terminal device.
  • the second data includes data of at least one session of the first terminal device in the at least one user plane network element. Bag.
  • the transmission of the second data may come from a wider source, that is, the transmission of the second data may come from serving the first terminal device. of multiple user plane network elements.
  • the difficulty of analyzing whether the first terminal device is abnormal based on the transmission situation of the second data may be greater than the difficulty of analyzing whether the first terminal device is abnormal based on the transmission situation of the first data.
  • the difficulty of analyzing anomalies can be measured, for example, by the amount of calculation, the size of the resources required, etc.
  • the transmission situation of the second data may be more complicated than the first data. For example, when the transmission situation includes the total number of data packets, the total number of data packets of the second data may be greater than the total number of data packets. The total number of packets of first data.
  • the at least one user plane network element includes the first user plane network element.
  • the first analysis network element requests the transmission situation of the first data of the first terminal device through the first user plane network element, and the first user plane network element determines the transmission situation of the first data according to the transmission situation of the first data.
  • the first analysis network element may request the transmission status of the second data of the first terminal device from at least one user plane network element including the first user plane network element.
  • the first analysis network element may send a request message to the first user plane network element, the request message being used to request the transmission status of the first data of the first terminal device and the The transmission status of the second data.
  • the first request message may also be used to request the transmission of the second data by the first terminal device.
  • the at least one user plane network element does not include the first user plane network element.
  • the first analysis network element requests the transmission situation of the first data of the first terminal device through the first user plane network element, and the first user plane network element determines the transmission situation of the first data according to the transmission situation of the first data.
  • the first analysis network element may request the second data of the first terminal device from other user plane network elements other than the first user plane network element that serve the first terminal device. transmission situation.
  • the first analysis network element before the first analysis network element sends the second request message to the second user plane network element, the first analysis network element sends a message to the first network element for determining whether to send the request message to the first terminal.
  • the request may carry information indicating that the first terminal device has the first level of anomaly.
  • the first analysis network element receives an instruction from the first network element to perform the second level on the first terminal device.
  • the first analysis network element sends the second request message to the second user plane network element according to the indication information.
  • the first network element may include at least one of the second analysis network element and the consumption network element.
  • the second analysis network element may be the first network data analysis function network element in S210; the consumption network element may be an application function network element or a policy control function network element.
  • S260 when the second analysis network element determines to perform second level abnormality detection on the first terminal device, the second analysis network element sends the second user plane network element to the second user plane network element. Request message. It can be understood that in this case, S240 may not be executed.
  • the second analysis network element may send the second request message to the second user plane network element through the first analysis network element.
  • the first analysis network element determines whether there is a second-level anomaly in the first terminal device based on the second-level anomaly detection strategy and the transmission situation of the second data.
  • the first analysis network element may receive the second request message from the second user plane function network element.
  • the transmission situation of the second data the first analysis network element determines whether there is an abnormality of the second level in the first terminal device according to the second-level anomaly detection strategy and the transmission situation of the second data.
  • the first analysis network element may determine whether the second level anomaly exists in the first terminal device according to the second level anomaly detection strategy and the transmission situation of the second data.
  • the second level anomaly detection strategy includes a corresponding relationship between the transmission situation of the second data and a second threshold used to determine whether there is an abnormality of the second level.
  • the transmission situation of the second data includes the transmission dispersion of the first data packet from the at least one user plane network element.
  • the transmission dispersion of the first data packet may include the dispersion of the destination address of the first data packet. degree, when the dispersion degree of the destination address of the first data packet is greater than the second threshold, it may be determined that the first terminal device may have a second level of abnormality.
  • the transmission situation of the second data includes the ratio of the number of partial data packets in the second data packet from the at least one user plane network element to the total number of first data packets.
  • the ratio of the quantity to the total quantity of the first data packet can be expressed as represents the ratio of the number of times calls initiated by the first terminal device are rejected to the total number of times calls initiated by the first terminal device, when the number of times calls initiated by the first terminal device is rejected is
  • the proportion of the total number of calls is greater than the second threshold, it may be determined that the first terminal device may have a second level of abnormality.
  • the related description of the first data packet and the second data packet may refer to the description in S210.
  • the second analysis network element determines whether there is a second-level abnormality in the first terminal device according to the second-level anomaly detection strategy and the transmission situation of the second data.
  • the second analysis network element may receive the second request message from the second user plane function network element.
  • the transmission situation of the second data the second analysis network element determines whether there is an abnormality of the second level in the first terminal device according to the anomaly detection strategy of the second level and the transmission situation of the second data.
  • the first analysis network element may send the transmission status of the second data of the first terminal device to the second analysis network element, and the second analysis network element may use the second analysis network element according to the second level anomaly detection strategy and the second analysis network element.
  • the data transmission situation determines whether the first terminal device has the second-level abnormality.
  • subsequent steps may include two situations:
  • the first analysis network element sends information indicating that there is an abnormality in the first terminal device to the second analysis network element.
  • the information indicating that the first terminal device has an abnormality may include at least one of information indicating that the first terminal device has the second level of abnormality, and information indicating that the first terminal device has the first level of abnormality.
  • the information indicating that the first terminal device has the second level of abnormality may include indicating that the first terminal device has the second level of abnormality.
  • the abnormal information, or the information indicating that the first terminal device has an abnormality may include information indicating that the first terminal device has the second level of abnormality, and information indicating that the first terminal device has the first level of abnormality; If the first analysis network element determines that the first terminal device does not have the second level of abnormality, the information indicating that the first terminal device has the abnormality may include information indicating that the first terminal device has the first level of abnormality.
  • S290a The second analysis network element determines whether there are other levels of abnormalities in the first terminal device.
  • the second analysis network element can determine whether there is an abnormality in the first terminal device according to the existing technology.
  • the second analysis network element can refer to the description in 3GPP TS 23.288 for the abnormality determination process.
  • the second analysis function network element may request access data, location data, etc. of the first terminal device from the access and mobility management network element, and the second analysis network element determines the access data, location data, etc. based on the access data, location data, etc. Whether there are other levels of abnormalities in the first terminal device.
  • the second analysis network element may also determine whether there are other levels of anomalies in the first terminal device according to other levels of anomaly detection strategies.
  • the second analysis network element determines whether the first terminal device is abnormal based on the third-level anomaly detection strategy and the transmission situation of the second data.
  • the third level anomaly detection strategy may include a correspondence between the transmission situation of the second data of the first terminal device and a threshold for determining whether the terminal device is abnormal.
  • the transmission situation of the second data included in the third-level anomaly detection strategy may be different from the transmission situation of the second data included in the second-level anomaly detection strategy.
  • the second-level anomaly detection strategy includes the third data The number of packets, the transmission speed of the third data packet; the third level anomaly detection strategy may include the transmission dispersion of the third data packet, wherein the third data packet may be at least one of the devices serving the first terminal device Data packets of at least one session of any user plane network element among the user plane network elements.
  • the transmission status of the second data of the first terminal device may be sent by the first analysis network element to the second analysis network element.
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • the consuming network element may include at least one of an application function network element and a policy control function network element.
  • the second analysis network element may send information indicating that the first terminal device has other levels of abnormalities to the consuming network element.
  • the second analysis network element may also send at least one of information indicating that the second level of abnormality exists in the first terminal device and information indicating the first level of abnormality to the consuming network element.
  • S280a-S2100a are optional steps.
  • the first analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • the information indicating that the first terminal device is abnormal may refer to the information indicating that the first terminal device is abnormal and sent by the first analysis network element to the second analysis network element in S280a, which will not be described again.
  • the first analysis network element when the first analysis network element determines that the first terminal device is abnormal, the first analysis network element can feed back information indicating that the first terminal device is abnormal to the second analysis network element, by The second analysis network element further analyzes whether there are other levels of abnormalities in the first terminal device, and the second analysis network element feeds back information indicating that the first terminal device has abnormalities to the consumer network element; or, the first The analysis network element can directly feed back information indicating that the terminal device is abnormal to the consumer network element.
  • subsequent steps may include three situations:
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the third analysis network element.
  • the third analysis network element may be a network data analysis function network element.
  • the second analysis network element is managed by the third analysis network element, or in other words, the service scope of the third analysis network element is greater than that of the third analysis network element. 2. Analyze the service scope of network elements.
  • S290b The third analysis network element analyzes whether there are other levels of abnormalities in the first terminal device.
  • This step is similar to S290a and will not be described again.
  • the third analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • This step is similar to S2100a and will not be described again.
  • S280c, S290b and S2100b are optional steps.
  • S280d The second analysis network element determines whether there are other levels of abnormalities in the first terminal device.
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • This step is similar to S2100a and will not be described again.
  • S280d and S290c are optional steps.
  • the second analysis network element sends information indicating an abnormality in the first terminal device to the consumer network element.
  • the information indicating that the first terminal device is abnormal may refer to the information indicating that the first terminal device is abnormal and sent by the first analysis network element to the second analysis network element in S280a, which will not be described again.
  • the second analysis network element can feed back information indicating that the first terminal device is abnormal to the third analysis network element, by The third analysis network element further analyzes whether there are other levels of abnormalities in the first terminal device, and the third analysis network element feeds back information indicating that the first terminal device has abnormalities to the consumer network element; or, in the third analysis network element
  • the second analysis network element determines that there is an abnormality in the first terminal equipment
  • the second analysis network element further analyzes whether there are other levels of abnormalities in the first terminal equipment, and the second analysis network element instructs the first The information that the terminal device is abnormal is fed back to the consumer network element; or, when the second analysis network element determines that the first terminal device is abnormal, the second analysis network element directly sends the information indicating that the terminal device is abnormal. Feedback to consumer network elements.
  • At least one of the first analysis network element and the second analysis network element can determine whether the terminal device is abnormal based on different levels of anomaly detection strategies and the data transmission conditions of the terminal device; in the terminal When there is an abnormality in the equipment, at least one of the first analysis network element and the second analysis network element can feed back information about the abnormality in the terminal equipment to the third analysis network element, so that the third analysis network element can further analyze the terminal. Whether there are other levels of abnormalities in the equipment; or the second analysis network element analyzes whether there are other levels of abnormalities in the terminal equipment.
  • the analysis network element for example, the third analysis network element or the second analysis network element
  • the analysis network element needs to "check all necessary checks" whether the terminal equipment in the network is abnormal
  • the number of terminal equipment detected by the analysis network element can be reduced. range, thereby reducing the burden of analyzing network elements.
  • FIG. 3 is a schematic diagram of an anomaly detection method 300 provided by an embodiment of the present application.
  • the analysis network element in the method 300 may be a network data analysis function network element, and the method 300 may include the following steps.
  • the first analysis network element sends a first request message to the first user plane network element.
  • the first request message is used to request to report the transmission status of the first data of the first terminal device.
  • the first user plane network element receives the first request message from the first analysis network element.
  • the first data may include a data packet of at least one session of the first terminal device in the first user plane network element.
  • For the transmission of the first data of the first terminal device please refer to the description in S210.
  • the first data of the first terminal device is transmitted by the first user plane network element.
  • the transmission status of the first data of the first terminal device may be used to determine whether there is a first-level abnormality in the first terminal device.
  • the first-level abnormality can be understood as an abnormality determined according to the transmission situation of the first data.
  • the first analysis network element may be a network data analysis function network element.
  • it is denoted as a second network data analysis function network element. That is, the second network data analysis function network element sends the first request message to the first user plane network element, requesting to report the transmission status of the first data of the first terminal device.
  • the second network data analysis function network element can communicate with the first user plane network through the session management network element. element sends the first request message.
  • the second network data analysis function network element before the second network data analysis function network element sends the first request message to the first user plane network element, the second network data analysis function network element receives a message from the second analysis network element or The fourth request message of the consumer network element. The second network data analysis function network element sends the first request message to the first user plane network element according to the fourth request message.
  • the second analysis network element may be a network data analysis function network element, and for convenience of distinction, it is recorded as a third network data analysis function network element.
  • the consuming network element may be an application function network element or a policy management function network element.
  • the fourth request message may be used to request to detect whether at least one terminal device is abnormal, and the at least one terminal device includes the first terminal device.
  • the fourth request message may carry the identity of the at least one terminal device, and the at least one terminal device includes the first terminal device; or the fourth request message may carry indication information indicating detection of the second network data analysis. Whether at least one terminal device supported by the functional network element for analysis is abnormal. The at least one terminal device supported by the second network data analysis functional network element for analysis includes the first terminal device.
  • the fourth request message may also carry indication information indicating an abnormality level for abnormality detection on the at least one terminal device.
  • the abnormality level may include the first level and the second level.
  • the indication information indicates that the level of detection of the at least one terminal device is a high level, such as the second level
  • the first session management network element may start low-level abnormality detection by default, such as the first level.
  • S320 The first user plane network element sends the transmission status of the first data to the first analysis network element.
  • the first analysis network element receives the transmission status of the first data from the first user plane network element.
  • the first user plane network element may send the transmission status of the first data to the first analysis network element through the session management network element.
  • the first analysis network element determines whether there is a first-level abnormality in the first terminal device according to the transmission situation of the first data.
  • the first analysis network element may determine whether the first level of anomaly exists in the first terminal device according to the first level of anomaly detection strategy and the transmission situation of the first data. For the first analysis network element to determine whether the first terminal device has a first-level abnormality based on the transmission situation of the first data, reference may be made to the description in S230.
  • the first analysis network element sends a second request message to at least one user plane network element serving the first terminal device.
  • the second request message is used to request reporting of the transmission status of the second data of the first terminal device.
  • the second user plane network element receives the second analysis network element from the first analysis network element. Request message.
  • the data of the first terminal device is transmitted by at least one user plane network element.
  • the first analysis network element can serve the first terminal device.
  • a user plane network element (for example, a first user plane network element) sends the first request message to request the transmission status of the first data of the first terminal device.
  • the first analysis network element may provide a service to the first terminal device.
  • At least one user plane network element sends the second request message to request the first terminal The transmission situation of the second data of the terminal device can be used to analyze whether there is a second level abnormality in the first terminal device.
  • the at least one user plane network element may include the first user plane network element.
  • the first analysis network element may send a request message to the first user plane network element, the request message being used to request the transmission status of the first data of the first terminal device and the The transmission status of the second data.
  • the at least one user plane network element may not include the first user plane network element.
  • the first analysis network element requests the transmission situation of the first data of the first terminal device through the first user plane network element, and the first user plane network element determines the transmission situation of the first data according to the transmission situation of the first data.
  • the first analysis network element may request the second data of the first terminal device from other user plane network elements other than the first user plane network element that serve the first terminal device. transmission situation.
  • the first analysis network element may send to the first network element whether to perform processing on the first terminal device. Second level anomaly detection requests.
  • the request may carry information indicating that the first terminal device has the first level of anomaly.
  • the first analysis network element receives an instruction from the first network element to perform the second level on the first terminal device.
  • the first analysis network element sends the second request message to the second user plane network element according to the indication information.
  • the first network element may be at least one of the second analysis network element and the consumption network element.
  • the second analysis function network element may also send to the second user plane network element the second request message. It is understandable that in this case, S340 may not be executed.
  • the second analysis network element may send the second request message to the second user plane network element through the first analysis network element; or, when the second analysis network element is not connected to the second user plane network In the case of direct communication with the second user plane network element, the second analysis network element may also send the second request message to the second user plane network element through the first analysis network element and the session management network element.
  • the first analysis network element determines whether there is a second-level anomaly in the first terminal device based on the second-level anomaly detection strategy and the transmission situation of the second data.
  • the first analysis network element can receive the second data from the second user plane function network element.
  • the first analysis network element determines whether there is a second-level abnormality in the first terminal device according to the second-level anomaly detection strategy and the transmission situation of the second data.
  • the first analysis network element determines whether there is a second-level abnormality in the first terminal device based on the second-level anomaly detection strategy and the transmission situation of the second data, please refer to the description of S270a.
  • the second analysis network element determines whether there is a second-level anomaly in the first terminal device according to the second-level anomaly detection strategy and the transmission situation of the second data.
  • the second analysis network element shall, according to the second level anomaly detection strategy and the transmission situation of the received second data, Determine whether the second level of abnormality exists in the first terminal device.
  • the first analysis network element may send the transmission status of the second data of the first terminal device to the second analysis network element, and the second analysis network element may use the second analysis network element according to the second level anomaly detection strategy and the second analysis network element.
  • the data transmission situation determines whether the first terminal device has the second-level abnormality.
  • subsequent steps may include three situations:
  • the first analysis network element sends information indicating that there is an abnormality in the first terminal device to the second analysis network element.
  • S390a The second analysis network element determines whether there are other levels of abnormalities in the first terminal device.
  • This step is similar to S290a and will not be described again.
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • S380a-S3100a are optional steps.
  • S380b The first analysis network element determines whether there are other levels of abnormalities in the first terminal device.
  • the first analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • This step is similar to S2100a and will not be described again.
  • S380b-S390b are optional steps.
  • the first analysis network element may directly send information indicating that the first terminal device is abnormal to the consumer network element.
  • the first analysis network element when the first analysis network element determines that the first terminal device is abnormal, the first analysis network element can feed back information indicating that the first terminal device is abnormal to the second analysis network element, by The second analysis network element further analyzes whether there are other levels of abnormalities in the first terminal device, and the second analysis network element feeds back information indicating that the first terminal device has abnormalities to the consumer network element; or, in the third
  • the first analysis network element determines that there is an abnormality in the first terminal equipment
  • the first analysis network element further analyzes whether there are other levels of abnormalities in the first terminal equipment, and the first analysis network element will indicate the first Information that the terminal device is abnormal is fed back to the consumer network element; or, the first analysis network element can directly feed back information indicating that the terminal device is abnormal to the consumer network element.
  • subsequent steps may also include three situations:
  • the second analysis network element sends information indicating that the first terminal device is abnormal to the third analysis network element.
  • the third analysis network element may be a network data analysis function network element.
  • the second analysis network element is managed by the third analysis network element, or in other words, the service scope of the third analysis network element is greater than that of the third analysis network element. 2. Analyze the service scope of network elements.
  • S390c The third analysis network element analyzes whether there are other levels of abnormalities in the first terminal device.
  • This step is similar to S290a and will not be described again.
  • the third analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • This step is similar to S2100a and will not be described again.
  • S380d, S390c and S3100b are optional steps.
  • S380e The second analysis network element determines whether there are other levels of abnormalities in the first terminal device.
  • the second analysis network element sends the information that the first terminal device is abnormal to the consumer network element.
  • This step is similar to S2100a and will not be described again.
  • the second analysis network element directly sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • At least one of the first analysis network element and the second analysis network element can determine whether the terminal device is abnormal based on different levels of anomaly detection strategies and the data transmission conditions of the terminal device; in the terminal When there is an abnormality in the equipment, at least one of the first analysis network element and the second analysis network element can feed back information about the abnormality in the terminal equipment to the third analysis network element, so that the third analysis network element can further analyze the terminal. Whether there are other levels of abnormalities in the equipment; or the second analysis network element analyzes whether there are other levels of abnormalities in the terminal equipment.
  • the analysis network element for example, the third analysis network element or the second analysis network element
  • the analysis network element needs to "check all necessary checks" whether the terminal equipment in the network is abnormal
  • the number of terminal equipment detected by the analysis network element can be reduced. range, thereby reducing the burden of analyzing network elements.
  • FIG. 4 is a schematic diagram of an anomaly detection method 400 provided by an embodiment of the present application.
  • the first user may The network element determines whether there is a first-level abnormality in the terminal device.
  • Method 400 may include the following steps.
  • the first analysis network element sends a fifth request message to the first user plane network element.
  • the fifth request message is used to request to determine the transmission status of the first data of the first terminal device.
  • the first user plane network element receives the fifth request message from the first analysis network element.
  • the transmission situation of the first data of the first terminal device can be used to determine whether there is a first-level abnormality in the first terminal device. That is, when the first user plane network element determines the transmission of the first data, the first user plane can determine whether the first terminal device has the first level of abnormality.
  • the first-level abnormality can be understood as an abnormality determined according to the transmission situation of the first data.
  • the first analysis network element is a session management network element, and for the convenience of distinction, it is recorded as the first session management network element. That is, the first session management network element sends the fifth request message to the first user plane network element, requesting to determine the transmission status of the first data of the first terminal device.
  • the fifth request message may carry information indicating the first level of PDR.
  • the first level of PDR is used for the first user plane network element to match the first data of the first terminal device, or in other words, for the first level of PDR.
  • a user plane network element detects the first data.
  • the first level PDR may be pre-configured in the first user plane network element, or may be sent by the first session management network element to the first user plane network element through the first request message.
  • the fifth request message may also carry indication information instructing the first user plane network element to determine whether the first level of anomaly exists in the first terminal device according to the first anomaly detection strategy and the transmission situation of the first data. Accordingly, the fifth request message may include the first level anomaly detection policy.
  • the first session management network element before the first session management network element sends the fifth request message to the first user plane network element, the first session management network element receives the third request message from the second analysis network element, and the first session management network element receives the third request message from the second analysis network element.
  • the third request message is used to request to detect whether there is an abnormality in at least one terminal device, and the at least one terminal device includes the first terminal device.
  • the first session management network element sends the fifth request message to the first user plane network element according to the third request message.
  • S210 For the third request message, reference can be made to S210, which will not be described again.
  • the second analysis network element may be a network data analysis function network element, and for convenience of distinction, it is denoted as a first network data analysis function network element.
  • the first network data analysis function network element may refer to the description in S210.
  • the first user plane network element determines whether there is a first level abnormality in the first terminal device according to the transmission situation of the first data.
  • the first user plane network element may determine whether the first level of anomaly exists in the first terminal device according to the first level anomaly detection strategy and the transmission situation of the first data.
  • the first level anomaly detection strategy includes a corresponding relationship between the transmission situation of the first data and a first threshold used to determine whether the first level anomaly exists.
  • the corresponding relationship between the transmission status of the first data and the first threshold may be that the transmission status of the first data is greater than, equal to, or less than the first threshold.
  • the transmission situation of the first data includes the number of the first data packets, and the number of the first data packets can represent the number of times the first terminal device initiates calls to the other terminal devices;
  • the first threshold can be a preset The upper limit of the number of calls initiated by the terminal device;
  • the corresponding relationship between the transmission situation of the first data and the first threshold may be: the number of the first data packets is greater than or equal to the first threshold.
  • the first data-related description may refer to the description in S210.
  • the first user plane network element sends information indicating that the first level of abnormality exists in the first terminal device to the first analysis network element.
  • the first analysis network element receives information from the first user plane network element indicating that the first terminal device has the first level of anomaly.
  • the information indicating that the first terminal device has the first level of abnormality may include the transmission status of the first data of the first terminal device.
  • the first analysis network element sends a second request message to at least one user plane network element serving the first terminal device.
  • the second request message is used to request to report the transmission status of the second data of the first terminal device.
  • the second user plane network element receives the second analysis network element from the first analysis network element. Request message.
  • the first analysis network element may send a message to the first network element for determining whether to A request for the terminal device to perform second-level anomaly detection.
  • the first analysis network element receives an instruction from the first network element to perform the second level on the first terminal device.
  • the first analysis network element sends the second request message to the second user plane network element according to the indication information. For this step, please refer to the description in S250.
  • the first network element includes at least one of the second analysis network element and a policy analysis network element.
  • the second analysis network element when the second analysis network element determines to perform second-level abnormality detection on the first terminal device, the second analysis network element may also send the second user plane network element to the second user plane network element. Second request message. It is understandable that in this case, S440 may not be executed.
  • S470a The first analysis network element determines whether there is a second-level anomaly in the first terminal device based on the second-level anomaly detection strategy and the transmission situation of the second data.
  • the second analysis network element determines whether there is a second-level abnormality in the first terminal device according to the second-level anomaly detection strategy and the transmission situation of the second data.
  • subsequent steps may include two situations.
  • the first analysis network element sends information indicating that there is an abnormality in the first terminal device to the second analysis network element.
  • S490a The second analysis network element analyzes whether there are other levels of abnormalities in the first terminal device.
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • S480a-S4100a are similar to S280a-S2100a and will not be described again; S480a-S4100a are optional steps.
  • the first analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • This step is similar to S280b and will not be described again.
  • subsequent steps may include three situations:
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the third analysis network element.
  • S490b The third analysis network element analyzes whether there are other levels of abnormalities in the first terminal device.
  • the third analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • S480c, S490b and S4100b are optional steps.
  • S480c, S490b and S4100b are similar to S280c, S290b and S2100b respectively and will not be described again.
  • the second analysis network element determines whether there are other levels of abnormalities in the first terminal device.
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • S480d and S490c are optional steps. S480d and S490c are similar to S280c and S290c respectively, and will not be described again.
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • This step is similar to S280e and will not be described again.
  • the first user plane network element can determine whether there is a first-level anomaly in the terminal device based on the first-level anomaly detection strategy and the data transmission situation of the terminal device; in the terminal device When a first-level abnormality exists, the first user plane network element may feed back information that the terminal device has an abnormality to the analysis network element (for example, the first analysis network element or the second analysis network element), so that the analysis network element At least one of the network elements can detect different levels of anomalies and transmit signals from terminal devices.
  • the analysis network element for example, the first analysis network element or the second analysis network element
  • the input situation determines whether there is an abnormality in the terminal equipment; at least one of the first analysis network element and the second analysis network element can feed back information about the abnormality in the terminal equipment to the third analysis network element, so that the third analysis network element can further analyze Whether there are other levels of abnormalities in the terminal equipment; or the second analysis network element analyzes whether there are other levels of abnormalities in the terminal equipment. Therefore, when the analysis network element (at least one of the first analysis network element, the second analysis network element and the third analysis network element) needs to "check all necessary checks" whether the terminal equipment in the network is abnormal, it can be reduced. The range of the detected terminal equipment is small, thereby reducing the burden of the analysis network element or the second analysis network element.
  • FIG. 5 is a schematic diagram of an anomaly detection method 500 provided by an embodiment of the present application. Similar to method 400, in method 500, the first user plane network element determines whether there is a first-level abnormality in the terminal device.
  • the analysis network element in the method 500 may be a network data analysis function network element, and the method 500 may include the following steps.
  • the first analysis network element sends a fifth request message to the first user plane network element.
  • the fifth request message is used to request to determine the transmission status of the first data of the first terminal device.
  • the first user plane network element receives the fifth request message from the first analysis network element.
  • the transmission situation of the first data of the first terminal device can be used to determine whether there is a first-level abnormality in the first terminal device. That is, when the first user plane network element determines the transmission of the first data, the first user plane can determine whether the first terminal device has the first level of abnormality.
  • the first-level abnormality can be understood as an abnormality determined according to the transmission situation of the first data.
  • the first analysis network element is a network data analysis function network element, and for convenience of distinction, it is recorded as a second network data analysis function network element. That is, the second network data analysis function network element sends the fifth request message to the first user plane network element, requesting to determine the transmission status of the first data of the first terminal device.
  • the second network data analysis function network element can forward the fifth request message through the session management network element.
  • the second network data analysis function network element may receive a fourth request message from the consuming network element.
  • the fourth request message is used to request to detect whether at least one terminal device is abnormal, and the at least one terminal device includes the first terminal device.
  • the consuming network element may be an application function network element or a policy management function network element.
  • the fourth request message may carry indication information, the indication information being used to indicate an abnormality level for abnormality detection of the at least one terminal device, and the abnormality level may include the first level and the second level.
  • the second network data analysis function network element may start low-level abnormality detection by default, for example, the first-level abnormality detection .
  • the second network data analysis function network element may send the fifth request message to the first user plane network element according to the fourth request message.
  • the first user plane network element determines whether there is a first level abnormality in the first terminal device according to the transmission situation of the first data.
  • This step is similar to S420 and will not be described again.
  • the first user plane network element sends information indicating that the first level of abnormality exists in the first terminal device to the first analysis network element.
  • the first analysis network element receives information from the first user plane network element indicating that the first terminal device has the first level of anomaly.
  • This step is similar to S430.
  • the first analysis network element sends a second request message to at least one user plane network element serving the first terminal device.
  • the second request message is used to request to report the transmission status of the second data of the first terminal device.
  • the second user plane network element receives the second analysis network element from the first analysis network element. Request message.
  • the first analysis network element may also send to the first network element whether to request the first terminal.
  • a request for the device to perform second-level anomaly detection may also be sent to the first network element whether to request the first terminal.
  • the first analysis network element receives an instruction from the first network element to perform the second level on the first terminal device.
  • Level anomaly detection indication information the first analysis network element root Send the second request message to the second user plane network element according to the indication information.
  • the first network element includes at least one of the second analysis network element and the policy analysis network element
  • the second analysis network element may be a third network data analysis function network element.
  • the second analysis function network element may also provide a notification to the second user plane network element. Send the second request message.
  • S570a The first analysis network element determines whether there is a second-level anomaly in the first terminal device based on the second-level anomaly detection strategy and the transmission situation of the second data.
  • the second analysis network element determines whether there is a second-level abnormality in the first terminal device according to the second-level anomaly detection strategy and the transmission situation of the second data.
  • subsequent steps may include three situations:
  • the first analysis network element sends information indicating that there is an abnormality in the first terminal device to the second analysis network element.
  • S590a The second analysis network element determines whether there are other levels of abnormalities in the first terminal device.
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • S580a-S5100a are similar to S380a-S3100a and will not be described again; S580a-S5100a are optional steps.
  • S580b The first analysis network element determines whether there are other levels of abnormalities in the first terminal device.
  • the first analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • S580b-S590b are similar to S380b-S390b and will not be described again; S580b-S590b are optional steps.
  • the first analysis network element may directly send information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • subsequent steps may also include three situations:
  • the second analysis network element sends information indicating that there is an abnormality in the first terminal device to the third analysis network element.
  • S590c The third analysis network element analyzes whether there are other levels of abnormalities in the first terminal device.
  • the third analysis network element sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • S580d, S590c and S5100b are optional steps.
  • S580d, S590c and S5100b are similar to S380d, S390c and S3100b respectively and will not be described again.
  • S580e The second analysis network element determines whether there are other levels of abnormalities in the first terminal device.
  • the second analysis network element sends the information that the first terminal device is abnormal to the consumer network element.
  • S580e and S590d are optional steps. S580e and S590d are similar to S380e and S390d respectively, and will not be described again.
  • the second analysis network element directly sends information indicating that there is an abnormality in the first terminal device to the consumer network element.
  • the first user plane network element can determine whether there is a first-level anomaly in the terminal device based on the first-level anomaly detection strategy and the transmission situation of the terminal device; In the case of a first-level abnormality, the first user plane network element may feed back information that the terminal device is abnormal to the analysis network element (for example, the first analysis network element or the second analysis network element), so that the analysis network element At least one of the elements can determine whether there is an abnormality in the terminal device based on different levels of abnormality detection and the transmission situation of the terminal device; at least one of the first analysis network element and the second analysis network element can feedback the terminal to the third analysis network element There is abnormal information about the device, so that the third analysis network element further analyzes whether there are other levels of abnormalities in the terminal device; or the second analysis network element analyzes whether there are other levels of abnormalities in the terminal device.
  • the analysis network element for example, the first analysis network element or the second analysis network element
  • the scope of the terminal equipment to be detected can be reduced, thereby easing the analysis network element or the second analysis network element.
  • FIG. 6 is a schematic diagram of an anomaly detection method 600 provided by an embodiment of the present application.
  • Method 600 may include the following steps.
  • NWDAF#1 receives request message #1 from the consuming network element. This request message #1 is used to request NWDAF#1 to analyze whether the UEs in UE list #1 are abnormal.
  • the NWDAF#1 may be an example of the second analysis network element in S210; the consuming network element may be a functional network element in the network, for example, a PCF network element; the consuming network element may also be an application function network element AF.
  • the AF can belong to the operator network or a third party.
  • NWDAF#1 can receive the request message #1 from the AF through NEF.
  • the request message #1 may include the UE list #1, and the UE list #1 includes the identity of at least one UE.
  • the UEs supported by NWDAF#1 for analysis include the at least one UE.
  • the request message #1 may carry indication information #1, which instructs NWDAF#1 to analyze all UEs that NWDAF#1 supports analysis. That is, the UE list #1 includes all UEs that the NWDAF #1 supports analysis.
  • the UE list #1 can be determined by the consuming network element and sent to NWDAF#1 by the consuming network element through the request message #1; or, the UE list #1 can be determined by NWDAF#1 according to the instruction information sent by the consuming network element. #1 determines that the UE list #1 includes all UEs that the NWDAF#1 supports analysis.
  • the consuming network element can request NWDAF#1 to analyze whether the UE in UE list #1 is abnormal in the form of subscription or notification. That is, the request message #1 sent by the consuming network element can be a subscription request message. After receiving the subscription request message, NWDAF #1 can periodically update and send the list of abnormal UEs to the consuming network element; the request message #1 It can also be a notification request message. After receiving the request message, NWDAF#1 can notify (send) a list of abnormal UEs to the consuming network element.
  • NWDAF#1 sends request message #2 to SMF#1. This request message #2 is used to request SMF#1 to analyze whether the UEs in UE list #2 are abnormal.
  • the SMF#1 receives the request message #2 from the NWDAF#1.
  • SMF#1 may be an example of the first session management network element in S210
  • request message #2 may be an example of the third request message in S210.
  • the UE list #2 includes at least one UE, and the UE list #2 belongs to the UE list #1. In other words, the UEs in the UE list #2 are all or part of the UEs in the UE list #1.
  • the SMF#1 is the session management network element to which the UE in the UE list #2 belongs.
  • NWDAF#1 can respectively send the request message #2 to the session management network element to which the UE belongs in the UE list #1.
  • the session management network element to which the UE in the UE list #1 belongs includes at least one session management network element, and the at least one session management network element includes the SMF#1.
  • SMF#1 is the session management network element to which at least one UE in the UE list #1 belongs.
  • NWDAF#1 after receiving the request message #1 from the consuming network element, NWDAF#1 sends the request message #2 to the session management network element to which the UE belongs in the UE list #1 by default to request the UE.
  • the list of UEs in List #1 is reduced.
  • NWDAF#1 can determine through the judgment process to send the request message #2 to the session management network element to which the UE in the UE list #1 belongs, so as to reduce the list of UEs in the UE list #1. .
  • NWDAF#1 receives the request message #1. If the request message #1 carries the indication information #1, NWDAF#1 sends the request message #2 to the session management network element to which the UE in the UE list #1 belongs. Specifically, the NWDAF#1 learns that the NWDAF#1 needs to analyze all the UEs it supports according to the instruction information #1, and then the NWDAF#1 sends the request message to the session management network element to which the UE in the UE list #1 belongs. 2.
  • the session management network element to which the UE belongs in the UE list #1 includes the SMF#1.
  • NWDAF#1 may determine whether to send the request message #2 to the session management network element to which the UE in the UE list #1 belongs based on the number of UEs in the UE list #1. Specifically, if the number of UEs in the UE list #1 is greater than the threshold #1, the NWDAF #1 sends the request message #2 to the session management network element to which the UE in the UE list #1 belongs.
  • the session management network element to which the UE belongs includes the SMF#1.
  • the threshold #1 may be a preset upper limit of the number of UEs that the NWDAF #1 supports analysis.
  • NWDAF#1 reduces the list of UEs in UE List #1, which can be understood as NWDAF#1 requesting other network elements to analyze whether the UEs in UE List #1 are abnormal, thereby narrowing down the UEs analyzed by NWDAF#1 range, or in other words, the list of abnormal UEs in the UE list #1 obtained by analysis of other network elements is the reduced list of UEs.
  • the other network elements may include the session management network element to which the UE in the UE list #1 belongs. By narrowing the range of end devices analyzed by NWDAF#1, you can To reduce the burden on NWDAF#1 network element.
  • the request message #2 may include the identity of the UE in the UE list #2; or the request message #2 may carry indication information #2, which instructs the SMF#1 to determine the analysis supported by the SMF#1. Whether all UEs are abnormal, that is, all UEs supported by the SMF#1 for analysis constitute the UE list #2.
  • the request message #2 may also carry indication information #3, and the indication information #3 may be used to indicate the abnormality level of SMF#1 to perform abnormality detection on the UEs in the UE list #2.
  • At least one policy group (or called “anomaly detection policy group”) can be pre-configured in the analysis network element (for example, NWDAF, SMF, UPF), and each policy group in the at least one policy group corresponds to a policy group level. (Alternatively, it can also be called exception level).
  • Each policy group may include at least one anomaly detection policy, and the at least one anomaly detection policy is used to detect whether the UE is abnormal.
  • Each anomaly detection strategy may include analysis items (or may also be called analysis parameters), thresholds corresponding to the analysis parameters, and abnormal expected results.
  • a weight can also be configured for each anomaly detection policy. The weight is used to analyze multiple anomaly detection policies in a policy group associated with the network element to determine whether the UE has anomalies of this anomaly level.
  • judging whether the UE is abnormal according to the anomaly detection strategy #1 can be understood as judging whether the relationship between the statistical value of the analysis entry #1 of the UE and its corresponding threshold #1 satisfies the abnormal expected result #1, and if so, then It can be determined that the UE may be abnormal.
  • analysis item #1, threshold #1, and abnormal threshold result #1 are the analysis parameters, thresholds, and abnormal expected results corresponding to the anomaly detection strategy #1.
  • the statistical value of the analysis entry (parameter) corresponding to the anomaly detection strategy is related to the data transmission situation of the terminal device.
  • the UE can be said to have triggered the anomaly detection strategy #1; or , the corresponding relationship between the data transmission situation #1 of the terminal device and the corresponding threshold #1 satisfies the abnormal expected result #1, then the UE is said to have triggered the anomaly detection strategy. Explanation of the same case is omitted below.
  • different anomaly detection strategies can be divided into different anomaly levels according to anomaly detection complexity.
  • the complexity of the anomaly detection strategy can be determined based on the size, calculation amount, duration, etc. of the resources required to execute the anomaly detection strategy.
  • Table 1 is an example of dividing different anomaly detection strategies into different anomaly levels.
  • the anomaly detection policy can be divided into three policy groups.
  • the three policy groups correspond to three policy group levels (for example, level #1, level #2 and level #3).
  • Each policy group For corresponding anomaly detection strategies refer to Table 1.
  • Different anomaly detection strategies can be identified by strategy numbers (for example, strategy numbers “1” to “9”).
  • the analysis items of the Level #1 anomaly detection strategy include: the number of times the UE initiates calls, and the number of times the calls initiated by the UE are hung up.
  • the call initiated by UE#1 may be a call initiated by UE#1 to the called UE, which includes at least one UE; the rejection of the call initiated by UE#1 may refer to the call initiated by UE#1 Rejected by the called UE.
  • the analysis items of Level #2 anomaly detection strategy include: the number of times the UE is called, the number of times the calls initiated by the UE are hung up, the ratio of the number of times the calls initiated by the UE are rejected to the number of calls initiated by the UE, the number of times the calls initiated by the UE are hung up.
  • the call being called to UE#1 may be a call initiated by the called UE to UE#1, and the called UE includes at least one UE; the hangup of the call initiated by UE#1 may refer to the call initiated by UE#1 Hang up by the called UE; UE#1 initiates a call to the called UE, then UE#1 acts as the calling party, otherwise, UE#1 acts as the called party; the ratio of UE#1 acting as the calling party and UE#1 acting as the called party It can be understood as the ratio of the number of times UE#1 initiates calls to the number of times UE#1 is called; UE#1 can initiate different times of calls to multiple called UEs, for example, UE#1 initiates 5 calls to called UE#2 times calls, and 7 calls are made to the called UE#3, then the average number of calls made by UE#1 to each called party is 6.
  • the analysis items of Level #3 anomaly detection strategy include: the frequency of UE switching mobile equipment (mobile euipment, ME), the identification span of ME switched by UE, the dispersion of UE call target area, the dispersion of UE call duration interval, UE initiation Dispersion of call times, etc.
  • UE#1 can switch multiple MEs.
  • the frequency of UE#1 switching MEs can be determined by the number of times UE#1 switches MEs within a preset time period; these multiple MEs have ME identifiers, for example, international Mobile Equipment Identity (International Mobile Equipment Identity, IMEI), the identity span of the ME switched by UE#1 can refer to the span of the multiple IMEIs; the spans of the multiple IMEIs can be determined by the content of the IMEI, for example, if multiple IMEI If the content of the IMEI is continuous, it can be considered that the span of the IMEI is small; if the content of the IMEI is random and irregular, the span of multiple IMEIs can be considered large; the dispersion of the target area for UE#1's call can mean that UE#1 calls multiple destinations.
  • IMEI International Mobile Equipment Identity
  • the dispersion of the regional locations of the multiple called UEs; the dispersion of the call duration of UE#1 can refer to the dispersion of the call duration between UE#1 and other UEs.
  • the other UEs can be the calling UE, or It may be the called UE; UE#1 may initiate calls to different called UEs at multiple times, and the dispersion of the time when UE#1 initiates the call may refer to the dispersion of the multiple times.
  • the complexity of the anomaly detection strategies at each level in Table 1 can be determined based on the size, calculation amount, duration, etc. of the resources required to execute the anomaly detection strategy.
  • the analysis network element may determine that the UE may have a level #1 anomaly. If the analysis network element counts that the number of times the UE has been called in the second preset time period is less than the threshold, the analysis network element can determine that the UE may have level #2 anomalies, where the duration of the second preset time period (the first Duration) can be set to a duration (second duration) greater than the first preset time period.
  • the preset duration for counting the number of times the UE is called needs to be greater than the statistical time.
  • the default duration for calls initiated by the UE. Therefore, the anomaly detection policy that counts calls initiated by the UE and/or the number of calls initiated by the UE can be divided into a policy group, and the policy group corresponds to a policy group level (level #1).
  • the anomaly detection policy that counts the number of times the UE is called can be divided into another policy group, which corresponds to another policy group level (level #2).
  • the anomaly detection complexity of level #1 and level #2 can be based on the detected Measured by preset duration (first duration and second duration).
  • the analyzing network element can determine whether the UE has level #2 anomalies by counting the number of calls initiated by the UE and/or the number of times the calls initiated by the UE are hung up; the analyzing network element can also count the number of times the calls initiated by the UE are hung up.
  • the ratio to the number of calls initiated by the UE determines whether the UE has level #2 anomalies. It can be understood that the calculation complexity of analyzing the network element statistics of the ratio of the number of times calls initiated by the UE are hung up to the number of times the calls initiated by the UE may be greater than the calculation complexity of analyzing the network element statistics of the number of calls initiated by the UE and/or the number of times the calls initiated by the UE are hung up.
  • the anomaly detection policy that counts calls initiated by the UE and/or the number of calls initiated by the UE can be divided into a policy group, and the policy group corresponds to a policy group level (level #1).
  • the anomaly detection policy that counts the ratio of the number of hangups of calls initiated by the UE to the number of calls initiated by the UE can be divided into a policy group, which corresponds to a policy group level (level #2), level #1 and level #2
  • the anomaly detection complexity of can be measured in terms of computational effort.
  • the anomaly detection strategy that analyzes the network element to determine whether the UE is abnormal may also include the anomaly detection strategy corresponding to level #3 in the statistical table 1 (for example, statistics of the UE call target area dispersion, UE call duration interval dispersion, etc. ), it takes longer and requires more calculations to analyze the anomaly detection strategy in network element execution level #3 than in the execution level #1 and level #2.
  • the statistical table 1 for example, statistics of the UE call target area dispersion, UE call duration interval dispersion, etc.
  • the anomaly detection strategy corresponding to this policy group level can be any combination of the anomaly detection strategies in Table 1.
  • some of the anomaly detection strategies in level #2 can be divided into level #3; for another example, the anomaly detection strategies in level #2 or level #3 can be divided into more levels.
  • At least one level of policy group may be preconfigured in the SMF#1, and the at least one level of policy group includes at least one anomaly detection policy.
  • At least one level of policy group preconfigured in SMF#1 may include the lowest level policy group, for example, the anomaly detection policy of level #1 (an example of the first level in S230).
  • the lowest level anomaly detection policy may not be configured in SMF#1.
  • the statistical value of the analysis entry of the level #1 anomaly detection policy can be determined by counting the number of data packets of at least one session related to the UE. For example, UE#1 initiates a call to UE#2, then UE#1 sends data packet #1 to UE#2. This data packet #1 carries the information that UE#1 initiates a call to UE#2. Through the statistics packet #1 The number of can determine the number of times UE#1 initiates calls to UE#2. Therefore, this level #1 anomaly detection policy can be configured in other network elements that can count UE session data packets, such as UPF.
  • SMF#1 can determine the level of abnormality detection for the UEs in the UE list #2 based on the indication information #3. If the indication information #3 indicates that SMF performs abnormality detection on UEs in UE list #2 at a higher level (for example, indicating at least one of level #2 and level #3 in table 1), then SMF #1 can be enabled first by default. Anomaly detection at the lowest level (e.g., level #1 in Table 1).
  • the request message #2 may also include a policy number or analysis entry. That is, NWDAF#1 can specify the anomaly detection strategy for SMF#1 to perform anomaly detection.
  • the request message #2 may also include a threshold corresponding to the analysis entry. It can be understood that when the request message #2 carries the threshold corresponding to the analysis entry, SMF #2 can detect whether the UE is abnormal based on the threshold carried in the request message #2, instead of detecting based on the preconfigured threshold.
  • the lowest level (for example, level #1) anomaly detection policy is not configured in SMF#1, please refer to S603a to S606a for specific steps in which SMF#1 determines whether there is an anomaly of level #1 in UE#1.
  • SMF#1 sends request message #3 to UPF#1.
  • This request message #3 is used to request UPF#1 to determine the transmission status of the first data of UE#1.
  • the UPF#1 receives the request message #3 from the SMF#1.
  • the UE#1 is any UE in the UE list #2, and the UE#1 may be an example of the first terminal device in S210; the UPF#1 is the UPF to which UE#1 belongs, and the UPF#1 may be the first terminal device in S210.
  • the request message #3 may be an example of the fifth request message in S410.
  • the first data includes data packets of at least one session of the UE#1 in the UPF#1.
  • the statistical value of the analysis entry in level #1 can be determined by determining the transmission status of data packets of at least one session of the UE #1 in the UPF #1.
  • the at least one session includes session #1, and the session #1 is a session in which the UE #1 initiates a call.
  • the data packet of session #1 may include data packet #1, and data packet #1 indicates that UE#1 initiates a call to at least one UE; the data packet of session #1 may also include data packet #2, and data packet #2 includes A data packet sent by at least one UE in response to a call initiated by UE#1.
  • the request message #3 may carry packet detection rule (PDR) #1.
  • the PDR#1 may be an example of the first-level PDR in S210, and the PDR#1 is used to match the first data.
  • PDR#1 may contain a packet detection information (PDI) parameter.
  • the PDI parameter contains one or several matching fields, which are used to match the data packets received by the UPF and identify the data packets.
  • UPF#1 determines whether UE#1 has an abnormality of level #1 based on the request message #3.
  • UPF#1 counts the first data matching the PDR#1 according to the request message #3, and determines the transmission situation of the first data; the UPE#1 counts the transmission situation and level # of the first data.
  • the anomaly detection strategy of 1 determines whether the UE#1 has an abnormality of level #1. For example, UPF#1 determines whether the UE#1 has an abnormality of level #1 based on the relationship between the transmission situation of the first data and the first threshold.
  • UPF#1 PDR#1 matches packet #1 (an example of the first packet) of a call initiated by UE#1. Specifically, after UPF#1 receives a data packet, it matches the data packet with the PDR#1. If the source address of the data packet is the address of UE#1, and the content type of the data packet is signaling for establishing a session, Then the counter of UPF#1 statistics packet #1 is incremented by 1, that is, UPF#1 determines that the number of calls initiated by UE#1 is incremented by 1. Within the preset time period, if UPF#1 counts that the number of calls initiated by UE#1 is greater than or equal to threshold #1 (for example, T 1 in Table 1), UPF#1 determines that UE#1 may have level #1. abnormal.
  • threshold #1 for example, T 1 in Table 1
  • UPF#1 executes policy #2 in Table 1 (the "policy number" is "2")
  • UPF#1 matches the data packet # indicating that the call initiated by UE#1 is rejected based on the PDR#1 2 (an example of the first data packet).
  • UPF#1 receives a data packet from AF
  • UPF#1 matches the data packet with the PDR#1.
  • the destination address of the data packet is the address of UE#1, and the content type of the data packet is signaling to cancel the session
  • UPF#1 counts the counter of data packet #2 incremented by 1, that is, UPF#1 determines the call of UE#1
  • the number of rejected calls is increased by 1.
  • threshold #2 for example, T 2 in Table 1
  • UPF#1 determines whether UE#1 has an abnormality of Level #1 in combination with multiple anomaly detection strategies of Level #1.
  • UPF#1 can configure the total weight W of the UE with level #1 anomalies.
  • W t may be the accumulation of thresholds corresponding to the UE triggering policy.
  • UPF#1 sends indication information #1 to SMF#1; accordingly, SMF#1 receives the indication information #1 from UPF#1.
  • This indication information #1 is information indicating that UE #1 has an abnormality of level #1.
  • the indication information #1 may be an example of the first user plane network element sending information indicating that the first terminal device has the first level of anomaly to the first analysis network element in S430.
  • the indication information #1 may include identification information of UE#1.
  • the indication information #1 may also include information on the policy triggered by UE #1.
  • the information about the triggered policy may include: the identifier of the triggered policy, the identifier of the event, the number of times the event was triggered, the time of the event being triggered, etc.
  • the triggering event may be an event corresponding to at least one session of UE#1. For example, if UE#1 initiates a call to UE#2, then UE#1 initiates session #1, and UE#1 initiates a call to UE#2. An event corresponding to session #1.
  • UPF#1 can determine the event triggered by UE#1 by determining the data packet of session #1. For example, data packet #1 instructs UE#1 to initiate a call to UE#2. If UPF#1 detects data packet #1, UPF#1 determines that UE#1 triggers event #1, and event #1 is UE#1 calling UE#2. #2 initiates the call.
  • the information of the policy triggered by UE#1 is as shown in Table 2. This information may be used by SMF#1 to determine whether there is an abnormality of other levels (eg, level #2) of UE#1.
  • the specific steps for SMF#1 to determine whether there is an anomaly of level #1 in UE#1 refer to S603b to S606b.
  • S603b SMF#1 sends request message #4 to UPF#1. This request message #4 is used to request to report the transmission status of the first data of UE#1.
  • the request message #4 may be an example of the first request message in S210.
  • the request message #4 may carry PDR#1.
  • PDR#1 For the specific content of PDR#1, please refer to the description in S603a.
  • UPF#1 sends the transmission status of the first data of UE#1 to the SMF#1.
  • UPF#1 sends the transmission status of the first data of UE#1 to the SMF#1 according to the request message.
  • the transmission status of the first data of UE#1 may include the identification of the UE and the identification of the event.
  • the transmission situation of the first data of UE#1 is as shown in Table 3.
  • UPF#1 may send the transmission status of the first data of UE#1 to SMF#1 according to a preconfigured reporting rule, where the reporting rule may be, for example, UE triggering event reporting, or periodic reporting.
  • the reporting rule may be, for example, UE triggering event reporting, or periodic reporting.
  • S605b SMF#1 determines whether there is an abnormality in UE#1 based on the transmission situation of the first data of UE#1.
  • SMF#1 determines whether there is an abnormality of level #1 in the UE#1 based on the abnormality detection policy of level #1 and the transmission situation of the first data of the UE#1. For the specific way in which SMF#1 determines whether UE#1 has an abnormality of level #1, you may refer to the description of UPF#1 determining whether UE#1 is abnormal in S604a.
  • SMF#1 may determine whether to continue to perform other levels of abnormality detection on the UE in the first UE. SMF#1 determines whether to continue to perform other levels of abnormality detection on the UE in the first UE, including three situations.
  • S606a SMF#1 determines by itself whether to continue to perform other levels of abnormality detection on the UE in the first UE.
  • SMF#1 may perform other levels of abnormality detection on the first UE by default, and the other levels may be levels configured in SMF#1 (eg, level #2).
  • SMF#1 may determine whether to enable level #2 abnormality detection for the first UE based on the number of first UEs. For example, when the number of the first UE is greater than threshold #3, SMF#1 turns on abnormality detection of level #2 for the first UE.
  • SMF#1 can determine whether to continue to perform other levels of abnormality detection on the UE in the first UE through NWDAF. Specifically, the following steps may be included.
  • SMF sends a request message to NWDAF#2; accordingly, NWDAF#2 receives the request message.
  • the request message is used to request to determine whether to perform level #2 abnormality detection on the first UE.
  • This NWDAF#2 and NWDAF#1 in the above steps may be the same NWDAF, or they may not be the same.
  • the NWDAF#2 may be the NWDAF that manages NWDAF#1.
  • the request message may carry information indicating that the first UE has an abnormality of level #1.
  • the request message may include the identity of each UE in the first UE.
  • the request message may also include the level of each UE triggering policy in the first UE and the total weight of each UE triggering policy.
  • SMF#1 may send the request message to NWDAF#2 regularly according to preconfigured reporting rules, or after the list of the first UE is updated, or after the number of first UEs reaches a threshold.
  • NWDAF#2 determines whether to enable level #2 abnormality detection for the first UE.
  • NWDAF#2 may directly issue a request for level #2 anomaly detection to SMF#1 according to the operator policy, requesting SMF#2 to enable level #2 anomaly detection for the first UE.
  • NWDAF#2 may determine to send a request for level #2 anomaly detection to SMF#1 based on information such as the number of first UEs and the total weight of each UE triggering policy in the first UE, and request SMF#1 to enable the level #2 anomaly detection request. Anomaly detection for level #2 of the first UE.
  • NWDAF#2 may also send a request message to the PCF, where the request message is used to request the PCF to determine whether to perform the detection on the first UE. Level #2 anomaly detection. Accordingly, PCF receives the request message from NWDAF#2.
  • the request message sent by NWDAF#2 to the PCF may carry the identity of the first UE.
  • the request message may also carry the level of each UE triggering policy in the first UE and the total weight of each UE triggering policy.
  • the PCF may query the policy information of the first UE according to the request message.
  • S609 The PCF determines whether to perform level #2 abnormality detection on the first UE according to the policy information of the first UE.
  • the PCF can query whether the first UE is a UE in the "white list", and the UE in the "white list” can be understood as a UE that does not need to be determined to be abnormal. If there is a UE in the "white list" in the first UE (for example, UE#1), the PCF deletes the UE from the first UE. Except UE#1, that is, the PCF modifies the list of the first UE.
  • the PCF can also determine whether there is a UE in the "blacklist” in the first UE.
  • the UEs in the "blacklist” can be understood as UEs that are more likely to be abnormal. . If there is a UE in the "blacklist” (for example, UE#2) in the first UE, the PCF deletes the UE#2 from the first UE. For another example, if a certain UE in the first UE triggers a policy with a larger weight, the PCF can also add the UE to the "blacklist" to further manage the UE.
  • the PCF may also specify anomaly detection strategies for some or all UEs in the first UE list according to the request message, weights corresponding to the strategies, and thresholds corresponding to the analysis entries under the strategies.
  • the part of UEs may be UEs added by the PCF and UEs with a higher triggering policy weight among the first UEs.
  • the PCF sends a threshold and weight corresponding to policy #3 for this part of UEs.
  • the threshold corresponding to policy #3 can be less than the threshold T 3 , and the weight can be greater than W 3 , thereby increasing the intensity of abnormality detection for this part of UEs. .
  • the PCF sends information #1 indicating performing level #2 abnormality detection on the first UE to NWDAF#2. Accordingly, NWDAF #2 receives this information #1 from PCF.
  • the information #1 may carry the list of UEs that need to perform level #2 abnormality detection, that is, the modified list of the first UE.
  • the information #1 may also carry an anomaly detection strategy for anomaly detection of UEs in the modified first UE list, a weight corresponding to the strategy, and a threshold corresponding to the analysis entry under the strategy.
  • NWDAF#2 sends a request message for Level #2 anomaly detection to SMF#1.
  • This request message is used to request SMF#1 to enable Level #2 anomaly detection for the first UE, or to request SMF#1 to enable Level #2 anomaly detection for the first UE.
  • the first UE turns on abnormality detection of level #2. Accordingly, SMF#1 receives the request message from NWDAF#2.
  • SMF#1 can directly use the PCF to determine whether to continue to perform other levels of abnormality detection on the UE in the first UE.
  • SMF#1 sends a request message to the PCF.
  • the request message is used to request the PCF to determine whether to perform level #2 abnormality detection on the first UE; accordingly, the PCF receives the request message from the PCF.
  • S607b The PCF determines whether to perform level #2 abnormality detection on the first UE.
  • the PCF may refer to the description in S609b to determine whether to perform level #2 abnormality detection on the first UE.
  • S608b The PCF sends information #1 instructing the first UE to perform level #2 abnormality detection to SMF#1. Accordingly, SMF#1 receives this information #1 from PCF.
  • SMF#1 can determine the abnormality detection of the first UE to enable level #2. Furthermore, SMF#1 determines whether there is an abnormality of Level #2 in the first UE according to the abnormality detection policy of Level #2.
  • SMF may refer to S612 to S615 to determine whether the UE#1 has an abnormality of level #2.
  • SMF#1 sends a request message #5 to at least one UPF serving the UE#1.
  • the request message #5 is used to request the at least one UPF to report the transmission status of the second data of the UE#1.
  • the at least one UPF receives the request message #5 from SMF#1.
  • the request message #5 may be an example of the second request message in S240.
  • the request message #5 may carry PDR#2, and the PDR#2 is used to match the second data.
  • the second data includes data packets of at least one session of the UE#1 in the at least one UPF.
  • the statistical value of the analysis entry in level #2 can be determined by determining the transmission situation of data packets of at least one session of the UE #1 in the at least one UPF.
  • the at least one session includes session #2, which is a session in which at least one UE initiates a call to the UE #1.
  • the data packet of the session #2 may include data packet #2, and the data packet #2 indicates at least one The UE initiates a call to UE#1.
  • UPF#2 sends the transmission status of the second data of UE#1 to SMF#1.
  • the SMF#1 receives the transmission status of the second data of the UE#1 from the UPF#2.
  • the UPF#2 is any one of the at least one UPF.
  • the at least one UPF includes the UPF#1. That is, UPF#2 and UPF#1 may be the same UPF.
  • the at least one UPF does not include the UPF#1. That is, the UPF#2 is any one of at least one UPF serving the UE#1 except UPF#1.
  • UPF#2 counts the second data matching the PDR#2 according to the request message #5, and determines the transmission status of the second data.
  • SMF#1 to execute policy #3 in Table 1 the "policy number" is "3"
  • UPF#2 matches the called party of UE#1 based on the PDR#2.
  • Packet #2 an example of second data.
  • UPF#2 After UPF#2 receives a data packet, it Matching this PDR#2, if the destination address of the data packet is the address of UE#1, and the content type of the data packet is signaling of a session initiated by other terminal equipment to UE#1, then UPF#2 determines that UE#1 be called.
  • the transmission status of the second data of UE#1 may include the identity of the UE and the identity of the event.
  • the identifier of the event includes the identifier of event #2, where UE#3 initiates a call to UE#1.
  • UPF#2 may determine that UE#3 initiates a call to UE#1 by determining the second data of session #2.
  • the second data of session #2 includes data packet #2, and data packet #2 instructs UE#3 to initiate a call to UE#1. If UPF#2 detects the data packet #2, UPF#2 determines that UE#1 When event #2 is triggered, UPF#2 sends the identifier of event #2 to SMF#1.
  • S614 SMF#1 determines whether UE#1 has an abnormality of level #2 based on the transmission situation of the second data of UE#1.
  • SMF#1 determines whether there is an abnormality of Level #2 in the UE#1 based on the abnormality detection strategy of Level #2 and the transmission situation of the first data of the UE#1. For the specific way in which SMF#1 determines whether UE#1 has an abnormality of level #1, you may refer to the description of UPF#1 determining whether UE#1 is abnormal in S432a.
  • the transmission status of the second data of UE#1 includes the identification of UE#1 and the identification of event #2.
  • the SMF receives the transmission status of the second data of UE#1, it can accumulate a counter locally. #1, this counter #1 is used to count the number of times UE#1 is called.
  • SMF#1 determines that UE#1 may have an abnormality of level #2.
  • the transmission status of the second data of UE#1 includes the identifier of UE#1 and the identifier of event #3.
  • Event #3 indicates that the call initiated by UE#1 was hung up.
  • SMF#1 may also count the number of times calls initiated by UE#1 are hung up based on the transmission status of the second data of UE#1. Within the preset time period, if the number of events in which calls initiated by UE#1 are hung up received by SMF#1 is less than threshold #2, SMF#1 determines that UE#1 may have an abnormality of level #2.
  • the transmission status of the second data of UE#1 may also include an identifier of event #1, and event #1 represents a call initiated by UE#1.
  • SMF#1 may also determine the ratio of the number of times UE#1's calls are hung up to the number of times UE#1 initiates calls based on the transmission situation of the second data of UE#1. If the ratio of the number of times UE#1's calls are hung up to the number of times UE#1 initiates calls is less than the threshold, the SMF determines that UE#1 has an abnormality of level #2. In the same way, SMF can also determine whether UE#1 has a level #2 abnormality based on the relationship between the ratio of the number of calls rejected by UE#1 to the number of calls initiated by UE#1 and the threshold.
  • SMF#1 may combine multiple items in the Level #2 anomaly detection strategy to determine whether UE#1 has Level #2 anomalies. Specifically, it is similar to how UPF#1 combines multiple items in the level #1 anomaly detection strategy in S604a to determine whether UE#1 has level #1 anomalies.
  • SMF#1 may receive the UE#1 from at least one UPF serving the UE#1.
  • the transmission situation of the second data may directly send the transmission status of the second data of UE#1 to the SMF#1 without a request from SMF#1.
  • Analyzing whether the first UE has level #2 anomalies through SMF#1 can further narrow down the list of abnormal UEs, and at the same time reduce the false alarm rate of abnormal UEs, or in other words, improve the accuracy of abnormal terminal device detection.
  • SMF#1 sends response message #2 to NWDAF#1.
  • the response message #2 includes the identification of the second UE, and the second UE is an abnormal UE in the UE list #2.
  • the response message #2 may be a response to the request message #2 in S602.
  • the response message #2 may also carry first information, which may include a set of UE triggering strategy identifiers and the total weight of the UE triggering strategy.
  • the first information is used by NWDAF#1 to further determine the second UE Are there other level (for example, Level #3) exceptions?
  • the information included in the response message #2 may be as shown in the first row of Table 4.
  • the response message #2 may also include information about the UE triggering policy (including policies in level #1 and level #2).
  • the information of the UE-triggered policy can be used by NWDAF#1 to determine whether there is an abnormality in the second UE.
  • the response message #2 includes information as shown in the first row of Table 5.
  • SMF#1 may send the NWADF#1 to the NWADF#1 every time the list of the second UE is updated, or regularly, periodically, or when the number of the second UE exceeds a threshold according to the preconfigured sending conditions. This response message #2.
  • S616, NWDAF#1 determines whether other levels of abnormalities exist in the second UE.
  • the level of anomaly determined by NWDAF#1 may be different from the level of anomaly determined by SMF#1.
  • NWDAF#1 can determine whether there is an abnormality in the second UE according to the existing technology.
  • the detection process of NWDAF#1 can refer to the description in 3GPP TS 23.288.
  • NWDAF#1 may request third data of the second UE from the AMF.
  • the third data may be, for example, access data and location data.
  • NWDAF#1 determines whether the second UE is abnormal based on the third data.
  • the specific method of NWDAF#1 determining anomalies can refer to the existing relevant descriptions and will not be described again here.
  • NWDAF#1 determines whether there is a configuration-level abnormality in the second UE according to the anomaly detection strategy analyzed by NWDAF#1. For example, SMF#1 determines that the second UE has an abnormality of level #2, and NWDAF#1 may further determine whether the second UE has an abnormality of level #3.
  • NWDAF#1 determines whether the second UE has an abnormality of level #3 based on the response message #2 reported by SMF#1.
  • the information included in the response message #2 may be as shown in Table 4.
  • SMF#1 reports that the time when UE#1 initiated a call to UE#2 in the second UE is t 2 and the time when UE#1's call was hung up by UE#2 is t 2 , then NWDAF#1 can respond based on the Message #2 determines the duration of the conversation between UE#1 and UE#2; NWDAF#1 can also determine the duration of the conversation between UE#1 and other UEs based on the response message #2, so that NWDAF#1 can determine the discrete duration of the conversation between UE#1 and UE#1.
  • NWDAF#1 can also determine whether UE#1 triggers other policies in level #3 based on the response message #2, and determine whether UE#1 determines whether there is an abnormality in level #3 in the UE based on the policy triggered by UE#1.
  • NWDAF#1 may determine whether UE#1 has an abnormality of level #3 in combination with multiple policies triggered by UE#1.
  • NWDAF#1 sends an event exposure subscription request (Event Exposure Subscribe Request) to SMF#1 for the reduced UE (second UE) list.
  • Event Exposure Subscribe Request This subscription request is used to request SMF#1 to report the second UE’s number.
  • the transmission status of the second data of the second UE reported by SMF#1 can be obtained through at least one UPF serving the second UE.
  • SMF#1 may directly report the transmission status of the second data of the second UE to NWDAF#1 through the N4 interface.
  • NWDAF#1 may refer to the first example of this possible implementation to determine whether the second UE has an abnormality of level #3.
  • NWDAF#1 when NWDAF#1 needs to "check all the UEs in the network", that is, when it needs to analyze the behavior of as many UEs in the network as possible, NWDAF#1 can pass at least one of SMF and UPF
  • the network element reduces the list of UEs that need to be detected, reducing the burden on NWDAF#1; at the same time, SMF and UPF reduce the UE list according to the configured anomaly detection policy, which can improve the accuracy of abnormal UE detection.
  • FIG. 7 is a schematic diagram of another anomaly detection method 700 provided by an embodiment of the present application.
  • NWDAF initiates a request to narrow the range of terminal equipment to be analyzed, and other network elements (for example, SMF, UPF) reduce the scope of the terminal equipment after The range is sent to the NWDAF; in the method shown in Figure 7, other network elements (for example, SMF, UPF) can send the reduced range of the terminal device to the NWDAF.
  • Method 700 may include the following steps.
  • S701 Configure anomaly detection strategies at each level in relevant NFs (for example, SMF, AMF, and NWDAF) in advance.
  • the anomaly detection strategies at each level are as shown in Table 1.
  • an anomaly detection policy of level #1 can be configured in UPF
  • an anomaly detection policy of level #2 can be configured in SMF
  • an anomaly detection policy of level #3 can be configured in NWDAF.
  • the above configurations of each network element are only examples, and this application does not impose any restrictions on the specific levels of configuration of each network element.
  • a level #3 anomaly detection policy can also be configured in SMF.
  • the SMF receives the session establishment request message from UE#1.
  • the SMF may receive the session establishment request message from UE#1 through the AMF, and the session establishment request message is used to request the SMF to establish a session of UE#1.
  • the SMF may select the UPF serving UE#1 according to the session establishment request message.
  • the UPF serving UE#1 includes at least one UPF. How SMF selects the UPF that serves UE#1 can refer to the relevant description in the protocol 3GPP TS 23.501.
  • the SMF sends a request message to the UPF#1.
  • the request message is used to request the UPF#1 to determine the transmission status of the first data of UE#1; accordingly, the UPF#1 receives the request message# from the SMF.
  • the UPF#1 is one of at least one UPF serving UE#1, and the UPF#1 may be an example of the first user plane network element in S210.
  • the request message and the first data reference can be made to the description in S603a, which will not be described again here.
  • UPF#1 determines whether UE#1 has an abnormality of level #1 based on the request message.
  • UPF#1 sends indication information #1 to SMF; accordingly, SMF receives the indication information #1 from UPF#1.
  • This indication information #1 is used to indicate that UE #1 has an abnormality of level #1.
  • the content included in the indication information #1 may refer to the description in S605a.
  • the SMF may receive session request messages from multiple UEs within a preset time.
  • the SMF's analysis of whether the multiple UEs have level #1 exceptions is similar to the SMF's analysis of whether UE#1 has level #1 exceptions. That is to say, the SMF can determine that at least one UE (recorded as the first UE) has an abnormality of level #1 through at least one UPF within a preset time.
  • SMF#1 may determine whether to continue to perform other levels of abnormality detection on the UE in the first UE. SMF#1 determines whether to continue to perform other levels of abnormality detection on the UE in the first UE, including three situations.
  • SMF#1 can determine by itself whether to continue to perform other levels of abnormality detection on the UE in the first UE.
  • Scenario 2 SMF#1 can use NWDAF to determine whether to continue to perform other levels of abnormality detection on the UE in the first UE. For details, refer to the descriptions of S606b, S607a to S608a, and S609 to S611.
  • Scenario 3 SMF#1 can use the PCF to determine whether to continue to perform other levels of abnormality detection on the UE in the first UE. For details, refer to the descriptions of S606c, S607b and S608b.
  • SMF#1 determines whether the first UE has level #2 anomalies based on the anomaly detection policy of level #2.
  • the process may include S706 to S709.
  • the SMF sends a request message to at least one UPF serving the UE#1.
  • the request message is used to request the at least one UPF to report the transmission status of the second data of the UE#1.
  • the at least one UPF receives the request message from the SMF.
  • UPF#2 sends the transmission status of the second data of UE#1 to SMF#1.
  • the SMF#1 receives the transmission status of the second data of the UE#1 from the UPF#2.
  • the UPF#2 is any one of the at least one UPF.
  • the at least one UPF includes the UPF#1. That is, UPF#2 and UPF#1 may be the same UPF.
  • the at least one UPF does not include the UPF#1. That is, the UPF#2 is any one of at least one UPF serving the UE#1 except UPF#1.
  • the transmission status of the second data of UE#1 may include the identity of the UE and the identity of the event. For details, refer to the relevant description of S453.
  • S708 The SMF determines whether there are other levels of abnormalities in UE#1 based on the transmission situation of the second data of UE#1.
  • the SMF sends notification message #1 to NWDAF#1.
  • the notification message #1 includes the identity of the second UE, and the second UE is the abnormal UE among the first UEs.
  • the notification message #3 may refer to the response message #2 in S616.
  • the SMF sends the notification message #3 to NWDAF#1 in the first cycle.
  • the first period can be set according to actual conditions. That is to say, the SMF determines that the first UE is abnormal within a preset time period, and the SMF sends the information that the first UE is abnormal to NWDAF#1.
  • NWDAF#1 determines whether there are other levels of abnormalities in the second UE.
  • SMF can analyze whether the UE is abnormal when the UE establishes a session, and report the abnormal UE in the network to NWDAF.
  • NWDAF further determines whether the abnormal UE in the network has other abnormalities, which can reduce the burden of NWDAF and improve the accuracy of abnormal UE detection.
  • FIG. 8 is a schematic diagram of another anomaly detection method 800 provided by an embodiment of the present application.
  • the AF can specify the abnormality level for abnormality analysis of the terminal device.
  • Method 800 may include the following steps.
  • S801 Configure anomaly detection strategies at each level in relevant NFs (for example, SMF, AMF, and NWDAF) in advance.
  • the anomaly detection strategies at each level are as shown in Table 1.
  • an anomaly detection policy of level #1 can be configured in UPF
  • an anomaly detection policy of level #2 can be configured in SMF
  • an anomaly detection policy of level #3 can be configured in NWDAF.
  • the above configurations of each network element are only examples, and this application does not impose any restrictions on the specific levels of configuration of each network element.
  • a level #3 anomaly detection policy can also be configured in SMF.
  • S802 AF sends request message #1 to NWDAF.
  • This request message #1 is used to request NWDAF to analyze whether the UE in UE list #1 is abnormal.
  • the AF can belong to the operator network or a third party.
  • the AF can send the request message #1 to the NWDAF through NEF.
  • the request message #1 may include the identity of the UE in the UE list #1, that is, the identity of the terminal device specified by the AF for NWDAF analysis.
  • the request message also includes indication information #4, which indicates the abnormality level.
  • the abnormality level of the terminal device and the abnormality detection strategy corresponding to each abnormality level can be pre-configured in AF.
  • the anomaly level and anomaly detection strategy can be referred to the description in S602.
  • the request message #1 also includes at least one of a threshold corresponding to each anomaly detection strategy and a weight corresponding to the anomaly detection strategy.
  • the AF can specify the terminal device analyzed by NWDAF and the abnormality level analyzed.
  • AF can also specify the threshold and weight of the anomaly detection strategy corresponding to the anomaly level.
  • NWDAF determines whether the UE in the UE list #1 is abnormal.
  • NWDAF analyzes whether the UE in UE list #1 has abnormality and can be divided into two situations.
  • the NWDAF sends a request message to the SMF according to the specified level.
  • the request message is used to request the SMF to determine whether the UE in the UE list #1 has an abnormality of the specified level.
  • the exception level specified by AF may be an exception level supported by SMF or UPF analysis (for example, level #1 or level #2).
  • the AF may specify the NWDAF to analyze whether the UEs in the UE list #1 have level #1 and/or level #2 abnormalities.
  • the NWDAF determines whether the UE in the UE #1 list #1 has level #1 and/or level #2 abnormalities by referring to the descriptions in S602 to S616 in Figure 6 , which will not be described again.
  • NWDAF will perform the anomaly detection according to the anomaly detection strategy, the threshold corresponding to the anomaly detection strategy, and the anomaly detection specified by AF.
  • the weight corresponding to the strategy is used for anomaly detection.
  • NWDAF analyzes whether the UE in the UE list #1 is abnormal according to the specified abnormality level.
  • the abnormality level indicated by the AF is the level supported by the NWDAF.
  • the AF may instruct the NWDAF to analyze whether the UE in the UE list #1 has an abnormality of level #3.
  • the NWDAF can enable level #1 and level #2 exceptions by default for the UE in the UE list #1.
  • the instruction received by the NWDAF is to analyze whether the UE in the UE list #1 has an abnormality of level #3, and the NWDAF starts the abnormality detection of level #3 for the UE in the UE list #1; for details, please refer to Figure Description in S617 of 6.
  • the NWDAF sends a notification message to the AF.
  • the notification message includes the identifier of the second UE, and the second UE is an abnormal UE in the UE list #1. Accordingly, the AF receives the notification message from the NWDAF.
  • the notification message may also include the exception level of the exception triggered by the second UE, the identification of the anomaly detection strategy corresponding to the exception level, the threshold corresponding to the anomaly detection strategy, and the total weight of each UE triggering strategy in the second UE. .
  • S805 AF determines whether to perform abnormality detection on the second UE.
  • the AF may determine whether to perform abnormality detection on the second UE according to the notification message.
  • the AF determines to perform abnormality detection on the second UE.
  • the AF may also determine whether to perform abnormality detection on the second UE according to the requirements of the application layer.
  • the AF is instructed to perform level #1 analysis on the UE in the UE list #1.
  • the second UE is a UE with level #1 abnormality in the UE list #1; the AF determines according to The requirements of the application layer may also request the NWDAF to detect whether the second UE has abnormalities of other levels (for example, level #2 or level #3).
  • the AF can also determine the weight of the triggering strategy of each UE in the second UE based on the notification message, and the AF instructs the NWDAF to perform anomaly detection on the UE with a higher triggering strategy weight in the second UE, that is, the AF can detect the triggering strategy of the UE in the second UE.
  • Some of the two UEs perform abnormality detection.
  • the AF can also add a list of UEs that require abnormality detection according to instructions from the application layer. That is, the AF can modify the list of the second UE (add or delete some UEs).
  • the AF may further specify an anomaly detection strategy in each anomaly level, a threshold corresponding to the anomaly detection, and a weight corresponding to the anomaly detection strategy.
  • NWDAF performs detection according to the anomaly detection strategy specified by AF, the threshold corresponding to the anomaly detection strategy, and the weight corresponding to the anomaly detection strategy.
  • the AF request to determine whether the second UE is abnormal is similar to the AF request to analyze whether the UE in the UE list #1 is abnormal, and will not be described again.
  • the information about abnormal UEs may include the number of abnormal UEs, the abnormality level triggered by abnormal UEs, the weight of the policy triggered by abnormal UEs, etc.
  • NWDAF when NWDAF needs to detect anomalies on UEs designated by the AF, NWDAF can reduce the list of UEs that need to be detected through at least one network element in SMF and UPF, reducing the burden on NWDAF; at the same time, SMF and UPF can use at least one network element in SMF and UPF to detect abnormalities.
  • the anomaly detection strategy reduces the UE list, which can improve the accuracy of abnormal UE detection.
  • the method implemented by the communication device can also be implemented by components (such as chips or circuits) that can be configured inside the communication device.
  • each network element includes a corresponding hardware structure and/or software module to perform each function.
  • each network element includes a corresponding hardware structure and/or software module to perform each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving the hardware depends on the specific application and design constraints of the technical solution. Experts may use different methods to implement the described functions for each specific application, but such implementations should not be considered excessive. out of the scope of this application.
  • Figure 9 is a schematic block diagram of a communication device 900 provided by an embodiment of the present application.
  • the communication device 900 may include: a transceiver unit 910 and a processing unit 920.
  • the communication device 900 may be the first user plane network element in the above method embodiment, or may be a chip used to implement the functions of the first user plane network element in the above method embodiment. .
  • the communication device 900 may correspond to the first user plane network element in methods 200 to 500 according to embodiments of the present application, or correspond to the UPF in methods 600, 700, and 800.
  • the communication device 900 may include a method unit for executing the first user plane network element in the methods in FIGS. 2 to 5 .
  • each unit in the communication device 900 and the above-mentioned other operations and/or functions are respectively intended to implement the corresponding processes of the method 200 in FIG. 2 to the method 800 in FIG. 8 . It should be understood that the specific process of each unit performing the above corresponding steps has been described in detail in the above method embodiments, and will not be described again for the sake of brevity.
  • the communication device 900 may be the first session management network element in the above method embodiment, or may be used to implement the functions of the first session management network element in the above method embodiment. chip.
  • the communication device 900 may correspond to the first session management network element in methods 200 to 500 according to embodiments of the present application, or correspond to the SMF in methods 600, 700, and 800.
  • the communication device 900 may include a method unit for performing the first session management network element in the method 200 in FIG. 2 to the method 500 in FIG. 5 .
  • each unit in the communication device 900 and the above-mentioned other operations and/or functions are respectively intended to implement the corresponding processes of the method 200 in FIG. 2 to the method 800 in FIG. 8 . It should be understood that the specific process of each unit performing the above corresponding steps has been described in detail in the above method embodiments, and will not be described again for the sake of brevity.
  • the communication device 900 may be the network data analysis function network element in the above method embodiment, or may be used to implement the functions of the network data analysis function network element in the above method embodiment. chip.
  • the communication device 900 may correspond to the first network data analysis function network element, the second network data analysis function network element or the third network data analysis function network element in the methods 200 to 500 according to the embodiments of the present application, Or correspond to NWDAF in methods 600 to 800.
  • the communication device 900 may include a method unit for performing NWDAF execution in the method 200 in FIG. 2 to the method 800 in FIG. 8 .
  • each unit in the communication device 900 and the above-mentioned other operations and/or functions are respectively intended to implement the corresponding processes of the method 200 in FIG. 2 to the method 800 in FIG. 8 . It should be understood that the specific process of each unit performing the above corresponding steps has been described in detail in the above method embodiments, and will not be described again for the sake of brevity.
  • transceiver unit 910 in the communication device 900 may correspond to the transceiver 1020 in the communication device 1000 shown in FIG. 10 .
  • the processing unit 920 in the communication device 900 may correspond to the processor 1010 in the communication device 1000 shown in FIG. 10 .
  • the chip when the communication device 900 is a chip, the chip includes a transceiver unit.
  • the chip may also include a processing unit.
  • the transceiver unit may be an input-output circuit or a communication interface; the processing unit may be a processor, microprocessor, or integrated circuit integrated on the chip.
  • the transceiver unit 910 is used to implement the signal transceiver operation of the communication device 900
  • the processing unit 920 is used to implement the signal processing operation of the communication device 900 .
  • the communication device 900 further includes a storage unit 930, which is used to store instructions.
  • Figure 10 is a schematic block diagram of a communication device 1000 provided by an embodiment of the present application.
  • the communication device 1000 includes: at least one processor 1010 and a communication interface 1020 .
  • the processor 1010 is coupled to the memory and is used to execute instructions stored in the memory to control the communication interface 1020 to send and/or receive signals.
  • the communication device 1000 further includes a memory 1030 for storing instructions.
  • processor 1010 and the memory 1030 can be combined into one processing device, and the processor 1010 is used to execute the program code stored in the memory 1030 to implement the above functions.
  • the memory 1030 can also be integrated in the processor 1010 or independent of the processor 1010 .
  • the communication interface 1020 may include a receiver (or receiver) and a transmitter (or transmitter).
  • the communication interface 1020 may further include an antenna, and the number of antennas may be one or more.
  • Communication interface 1020 may also be an interface circuit.
  • the chip When the communication device 1000 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input-output circuit or a communication interface;
  • the processing unit may be a processor, microprocessor, or integrated circuit integrated on the chip.
  • FIG 11 is a schematic diagram of a chip system according to an embodiment of the present application.
  • the chip system here may also be a system composed of circuits.
  • the chip system 1100 shown in Figure 11 includes: a logic circuit 1110 and an input/output interface (input/output interface) 1120.
  • the logic circuit is used to couple with the input interface and transmit data (such as a first input interface) through the input/output interface. instruction information) to perform the methods described in Figures 2 to 8.
  • An embodiment of the present application also provides a processing device, including a processor and an interface.
  • the processor may be used to execute the method in the above method embodiment.
  • the above processing device may be a chip.
  • the processing device may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or a system on chip (SoC), or It can be a central processing unit (CPU), a network processor (NP), a digital signal processing circuit (DSP), or a microcontroller unit , MCU), it can also be a programmable logic device (PLD) or other integrated chip.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • CPU central processing unit
  • NP network processor
  • DSP digital signal processing circuit
  • MCU microcontroller unit
  • PLD programmable logic device
  • each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the processor.
  • the steps of the method provided in conjunction with the embodiments of the present application can be directly implemented by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other mature storage media in this field.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.
  • the processor in the embodiment of the present application may be an integrated circuit chip with signal processing capabilities.
  • each step of the above method embodiment can be completed through an integrated logic circuit of hardware in the processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field programmable gate array
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically removable memory. Erase electrically programmable read-only memory (EPROM, EEPROM) or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • the present application also provides a computer program product.
  • the computer program product includes: computer program code.
  • the computer program code When the computer program code is run on a computer, it causes the computer to execute the steps shown in Figures 2 to 6. The method of any one of the embodiments is shown.
  • the present application also provides a computer-readable medium.
  • the computer-readable medium stores program code.
  • the program code When the program code is run on a computer, it causes the computer to execute the steps shown in Figures 2 to 6. The method of any one of the embodiments is shown.
  • the present application also provides a communication system, which includes the aforementioned first analysis network element and the first user plane network element.
  • the first analysis network element may be a session management network element, for example, the aforementioned first session management network element; the first analysis network element may be a network data analysis function network element, for example, the aforementioned second network data analysis function network element; the communication system may also include a second analysis network element Network element, for example, the second analysis network element may be a network data analysis function network element, for example, the aforementioned first network data analysis function network element; the communication system may also include a third analysis network element, an application function network element The third analysis network element may also be a network data analysis function network element, such as the aforementioned third network data analysis function network element.
  • the communication system may further include at least one user plane network element serving a first terminal device, which is any terminal device among the terminal devices that need to perform abnormality detection.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种异常检测的方法和通信装置，该方法包括向第一用户面网元发送请求上报终端设备的第一数据的传输情况的请求消息；接收来自第一用户面网元的第一数据的传输情况；在根据第一级别的异常检测策略和第一数据的传输情况确定该终端设备存在第一级别的异常的情况下，向服务该终端设备的至少一个用户面网元发送请求上报该终端设备的第二数据的传输情况的请求消息；根据第二级别的异常检测策略和第二数据的传输情况，确定该终端设备是否存在第二级别的异常。通过不同级别的异常检测策略以及终端设备的数据传输情况确定终端设备是否异常，可以实现对终端设备异常的"应检尽检"，提高异常终端设备检测的精准度，进而可以减轻分析网元的负担。

Description

异常检测的方法和通信装置
本申请要求于2022年7月30日提交中国专利局、申请号为202210912458.9、申请名称为“异常检测的方法和通信装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信领域，并且更具体地，涉及一种异常检测的方法和通信装置。
背景技术
在第五代(the 5th generation，5G)通信系统中，网络数据分析功能网元(network data analytics function，NWDAF)可以对终端设备在网络侧(例如，接入与移动管理网元、会话管理网元等)产生的数据进行分析，并通过构建被分析者的行为画像来确定被分析者的行为(例如，通信行为)是否异常。NWDAF可以向网络侧的功能网元(例如，策略控制功能网元，接入与移动管理网元等)提供数据分析结果(Analytics)，以便其他网元根据该数据分析结果做出快速的响应，及时阻断被分析者的异常行为，例如，阻断终端设备的异常通信。
为了尽可能地阻断网络中终端设备的异常行为，需要分析网元(例如，NWDAF)对网络中的终端设备做到“应检尽检”。即需要分析网元分析网络中尽可能多的终端设备的行为，提高异常终端设备检测的精准度。然而，在对大量终端设备的行为进行分析时，如何降低分析网元的负担成为一个亟待解决的问题。
发明内容
本申请实施例提供一种异常检测的方法和通信装置，该方法可以在对大量终端设备的行为进行分析的同时，降低分析网元的负担。
第一方面，提供了一种异常检测的方法，该方法包括：向第一用户面网元发送第一请求消息，该第一请求消息用于请求上报第一终端设备的第一数据的传输情况；接收来自该第一用户面网元的该第一数据的传输情况；在根据第一级别的异常检测策略以及该第一数据的传输情况确定该第一终端设备存在该第一级别的异常的情况下，向服务该第一终端设备的至少一个用户面网元发送第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况；根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
在本申请实施例提供的异常检测的方法中，根据不同级别的异常检测策略以及终端设备的数据传输情况确定终端设备是否异常，可以实现对终端设备异常的“应检尽检”，即对终端设备的行为，进行多个级别的检测，从而可以提高异常终端设备检测的精准度，进而可以减小分析网元检测的终端设备的范围，减轻分析网元的负担。
结合第一方面，在第一方面的某些实现方式中，该第一级别的异常检测策略包括该第一数据的传输情况与用于确定是否存在该第一级别的异常的第一阈值的对应关系，该第二级别的异常检测策略包括该第二数据的传输情况与用于确定是否存在该第二级别的异常的第二阈值的对应关系。
结合第一方面，在第一方面的某些实现方式中，该第一数据的传输情况包括以下中的至少一个：该第一用户面网元中该第一终端设备的至少一个会话的数据包的数量，该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输速度，该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输离散度，该第一用户面网元中该第一终端设备的不同类型的数据包的数量的比例。
结合第一方面，在第一方面的某些实现方式中，该第二数据的传输情况包括以下中的一个或多个：该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的数量，该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输速度，该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输离散 度，或该第一终端设备的不同类型的数据包的数量的比例。
结合第一方面，在第一方面的某些实现方式中，由第一分析网元向该第一用户面网元发送该第一请求消息；该第一分析网元接收来自该第一用户面网元的该第一数据的传输情况；该第一分析网元确定该第一终端设备存在该第一级别的异常；由第二分析网元向该至少一个用户面网元发送该第二请求消息；该第二分析网元确定该第一终端设备是否存在该第二级别的异常；其中，该第一分析网元的服务范围小于该第二分析网元的服务范围。
结合第一方面，在第一方面的某些实现方式中，该第一分析网元向该第二分析网元发送指示该第一终端设备存在该第一级别的异常的信息。
结合第一方面，在第一方面的某些实现方式中，若该第二分析网元确定该第一终端设备存在该第二级别的异常，该第二分析网元向策略控制网元或者应用功能网元反馈该第一终端设备存在该第二级别的异常的信息；或者，若该第二分析网元确定该第一终端设备不存在该第二级别的异常，该第二分析网元向策略控制网元或者应用功能网元反馈该第一终端设备存在该第一级别的异常的信息。
结合第一方面，在第一方面的某些实现方式中，该第一分析网元接收用于请求分析至少一个终端是否异常的信息，该至少一个终端包括该第一终端设备；该第一分析网元根据该用于请求分析至少一个终端是否异常的信息，向该第一用户面网元发送该第一请求消息。
结合第一方面，在第一方面的某些实现方式中，该方法还包括发送用于确认是否需要对该第一终端设备进行该第二级别的异常检测的信息；接收用于指示需要对该第一终端设备进行该第二级别的异常检测的信息。
结合第一方面，在第一方面的某些实现方式中，该方法还包括根据第一级别的异常检测策略确定第一级别的数据包检测规则PDR，该第一级别的PDR用于检测该第一数据，该第一请求消息包括用于指示第一级别的PDR的信息；根据第二级别的异常检测策略确定第二级别的PDR，该第二级别的PDR用于检测该第二数据，该第二请求消息包括用于指示第二级别的PDR的信息。
第二方面，提供一种异常检测的方法，该方法包括第一用户面网元接收用于请求确定第一终端设备的第一数据的传输情况的请求消息；该第一用户面网元根据该第一级别的异常检测策略和该第一数据的传输情况，确定该第一终端设备存在该第一级别的异常；该第一用户面网元向分析网元发送指示该第一终端设备存在该第一级别的异常的信息；该第一用户面网元接收来自该分析网元的第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况；该第一用户面网元向该分析网元上报该第一终端设备的该第二数据的传输情况，该第二数据的传输情况用于确定该第一终端设备是否存在该第二级别的异常。
在本申请实施例提供的异常检测的方法中，第一用户面网元可以根据异常检测策略以及终端设备的数据传输情况确定终端设备是否异常，在终端设备存在异常的情况下，该第一用户面网元还可以向分析网元发送该终端设备的数据传输情况，以使分析网元确定该终端设备是否存在其他级别的异常，可以实现对终端设备异常的“应检尽检”，即对终端设备的行为，进行多个级别的检测，从而可以提高异常终端设备检测的精准度，减小分析网元检测的终端设备的范围，减轻分析网元的负担。
结合第二方面，在二方面的某些实现方式中，该第一级别的异常检测策略包括该第一数据的传输情况与用于确定是否存在该第一级别的异常的第一阈值的对应关系。
结合第二方面，在二方面的某些实现方式中，该第一数据的传输情况包括以下中的至少一个：该第一用户面网元中该第一终端设备的至少一个会话的数据包的数量，该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输速度，该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输离散度，该第一用户面网元中该第一终端设备的不同类型的数据包的数量的比例。
结合第二方面，在二方面的某些实现方式中，该用于请求确定第一终端设备的第一数据的传输情况的请求消息包括用于指示第一级别的数据包检测规则PDR的信息，该第一级别的PDR用于检测该第一数据，该第二请求消息包括用于指示第二级别的PDR的信息，该第二级别的PDR用于检测该第二数据。
第三方面，提供一种异常检测的方法，该方法包括：第一分析网元向第一用户面网元发送第一请求消息，该第一请求消息用于请求上报第一终端设备的第一数据的传输情况；
该第一分析网元接收来自该第一用户面网元的该第一数据的传输情况；在根据第一级别的异常检 测策略以及该第一数据的传输情况确定该第一终端设备存在该第一级别的异常的情况下，该第一分析网元向服务该第一终端设备的至少一个用户面网元发送第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况；该第一分析网元向第二分析网元发送该第二数据的传输情况，该第二数据的传输情况用于确定该第一终端设备是否存在该第二级别的异常。
在本申请实施例提供的异常检测的方法中，第一分析网元可以根据异常检测策略以及终端设备的数据传输情况确定终端设备是否异常，在终端设备存在异常的情况下，该第一分析网元还可以向第二分析网元发送该终端设备的数据传输情况，以使第二分析网元确定该终端设备是否存在其他级别的异常，可以实现对终端设备异常的“应检尽检”，即对终端设备的行为，进行多个级别的检测，从而可以提高异常终端设备检测的精准度，减小分析网元检测的终端设备的范围，减轻分析网元的负担。
结合第三方面，在第三方面的某些实现方式中，该第一级别的异常检测策略包括该第一数据的传输情况与用于确定是否存在该第一级别的异常的第一阈值的对应关系，该第二级别的异常检测策略包括该第二数据的传输情况与用于确定是否存在该第二级别的异常的第二阈值的对应关系。
结合第三方面，在第三方面的某些实现方式中，该第一数据的传输情况包括以下中的至少一个：该第一用户面网元中该第一终端设备的至少一个会话的数据包的数量、该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输速度、该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输离散度、该第一用户面网元中该第一终端设备的不同类型的数据包的数量的比例。
结合第三方面，在第三方面的某些实现方式中，该第二数据的传输情况包括以下中的一个或多个：该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的数量、该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输速度、该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输离散度、或该第一终端设备的不同类型的数据包的数量的比例。
结合第三方面，在第三方面的某些实现方式中，该第一分析网元确定该第一终端设备存在该第一级别的异常。
结合第三方面，在第三方面的某些实现方式中，该第一分析网元向第二分析网元发送指示该第一终端设备存在该第一级别的异常的信息。
结合第三方面，在第三方面的某些实现方式中，该第一分析网元向策略控制网元或该第二分析网元反馈该第一终端设备存在该第二级别的异常的信息；或者，该第一分析网元向策略控制网元或该第二分析网元反馈该第一终端设备存在该第一级别的异常的信息。
结合第三方面，在第三方面的某些实现方式中，该第一分析网元接收用于请求分析至少一个终端是否异常的信息，该至少一个终端包括该第一终端设备；该第一分析网元根据该用于请求分析至少一个终端是否异常的信息，向该第一用户面网元发送该第一请求消息。
结合第三方面，在第三方面的某些实现方式中，该第一分析网元根据第一级别的异常检测策略确定第一级别的数据包检测规则PDR，该第一级别的PDR用于检测该第一数据，该第一请求消息包括用于指示第一级别的PDR的信息；该第一分析网元根据第二级别的异常检测策略确定第二级别的PDR，该第二级别的PDR用于检测该第二数据，该第二请求消息包括用于指示第二级别的PDR的信息。
第四方面，提供一种通信装置，该装置包括收发单元和处理单元，该收发单元用于接收用于请求确定第一终端设备的第一数据的传输情况的请求消息；该处理单元，用于根据该第一级别的异常检测策略和该第一数据的传输情况，确定该第一终端设备存在该第一级别的异常；该收发单元，还用于向分析网元发送指示该第一终端设备存在该第一级别的异常的信息；该收发单元，还用于接收来自该分析网元的第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况；该收发单元，还用于向该分析网元上报该第一终端设备的该第二数据的传输情况，该第二数据的传输情况用于确定该第一终端设备是否存在该第二级别的异常。
结合第四方面，在第四方面的某些实现方式中，该第一级别的异常检测策略包括该第一数据的传输情况与用于确定是否存在该第一级别的异常的第一阈值的对应关系。
结合第四方面，在第四方面的某些实现方式中，该第一数据的传输情况包括以下中的至少一个：该通信装置中该第一终端设备的至少一个会话的数据包的数量，该通信装置中该第一终端设备的至少一个会话的数据包的传输速度，该通信装置中该第一终端设备的至少一个会话的数据包的传输离散度， 通信装置中该第一终端设备的不同类型的数据包的数量的比例。
结合第四方面，在第四方面的某些实现方式中，该用于请求确定第一终端设备的第一数据的传输情况的请求消息包括用于指示第一级别的数据包检测规则PDR的信息，该第一级别的PDR用于检测该第一数据，该第二请求消息包括用于指示第二级别的PDR的信息，该第二级别的PDR用于检测该第二数据。
第五方面，提供一种通信装置，其特征在于，该装置包括收发单元和处理单元，该收发单元，用于向第一用户面网元发送第一请求消息，该第一请求消息用于请求上报第一终端设备的第一数据的传输情况；该收发单元，还用于接收来自该第一用户面网元的该第一数据的传输情况；在根据第一级别的异常检测策略以及该第一数据的传输情况确定该第一终端设备存在该第一级别的异常的情况下，该收发单元，还用于向服务该第一终端设备的至少一个用户面网元发送第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况；该处理单元，用于根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
结合第五方面，在第五方面的某些实现方式中，该第一级别的异常检测策略包括该第一数据的传输情况与用于确定是否存在该第一级别的异常的第一阈值的对应关系，该第二级别的异常检测策略包括该第二数据的传输情况与用于确定是否存在该第二级别的异常的第二阈值的对应关系。
结合第五方面，在第五方面的某些实现方式中，该第一数据的传输情况包括以下中的至少一个：该第一用户面网元中该第一终端设备的至少一个会话的数据包的数量、该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输速度、该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输离散度、该第一用户面网元中该第一终端设备的不同类型的数据包的数量的比例。
结合第五方面，在第五方面的某些实现方式中，该第二数据的传输情况包括以下中的一个或多个：该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的数量、该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输速度、该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输离散度、或该第一终端设备的不同类型的数据包的数量的比例。
结合第五方面，在第五方面的某些实现方式中，该处理单元还用于确定该第一终端设备存在该第一级别的异常。
结合第五方面，在第五方面的某些实现方式中，该收发单元还用于向第二分析网元发送指示该第一终端设备存在该第一级别的异常的信息。
结合第五方面，在第五方面的某些实现方式中，该收发单元还用于：向策略控制网元或该第二分析网元反馈该第一终端设备存在该第二级别的异常的信息；或者向策略控制网元或该第二分析网元反馈该第一终端设备存在该第一级别的异常的信息。
结合第五方面，在第五方面的某些实现方式中，该收发单元还用于：接收用于请求分析至少一个终端是否异常的信息，该至少一个终端包括该第一终端设备；该收发单元具体用于根据该用于请求分析至少一个终端是否异常的信息，向该第一用户面网元发送该第一请求消息。
结合第五方面，在第五方面的某些实现方式中，该收发单元还用于发送用于确认是否需要对该第一终端设备进行该第二级别的异常检测的信息；接收用于指示需要对该第一终端设备进行该第二级别的异常检测的信息。
结合第五方面，在第五方面的某些实现方式中，该处理单元还用于：根据第一级别的异常检测策略确定第一级别的数据包检测规则PDR，该第一级别的PDR用于检测该第一数据，该第一请求消息包括用于指示第一级别的PDR的信息；根据第二级别的异常检测策略确定第二级别的PDR，该第二级别的PDR用于检测该第二数据，该第二请求消息包括用于指示第二级别的PDR的信息。
第六方面，提供一种通信装置，该装置包括收发单元，该收发单元用于向第一用户面网元发送第一请求消息，该第一请求消息用于请求上报第一终端设备的第一数据的传输情况；该收发单元还用于接收来自该第一用户面网元的该第一数据的传输情况；在根据第一级别的异常检测策略以及该第一数据的传输情况确定该第一终端设备存在该第一级别的异常的情况下，该收发单元还用于向服务该第一终端设备的至少一个用户面网元发送第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况；该收发单元还用于向第二分析网元发送该第二数据的传输情况，该第二数据的 传输情况用于确定该第一终端设备是否存在该第二级别的异常。
结合第六方面，在第六方面的某些实现方式中，该第一级别的异常检测策略包括该第一数据的传输情况与用于确定是否存在该第一级别的异常的第一阈值的对应关系，该第二级别的异常检测策略包括该第二数据的传输情况与用于确定是否存在该第二级别的异常的第二阈值的对应关系。
结合第六方面，在第六方面的某些实现方式中，该第一数据的传输情况包括以下中的至少一个：该第一用户面网元中该第一终端设备的至少一个会话的数据包的数量、该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输速度、该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输离散度、该第一用户面网元中该第一终端设备的不同类型的数据包的数量的比例。
结合第六方面，在第六方面的某些实现方式中，该第二数据的传输情况包括以下中的一个或多个：该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的数量、该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输速度、该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输离散度、或该第一终端设备的不同类型的数据包的数量的比例。
结合第六方面，在第六方面的某些实现方式中，该装置还包括处理单元，该处理单元用于确定该第一终端设备存在该第一级别的异常。
结合第六方面，在第六方面的某些实现方式中，该收发单元还用于向第二分析网元发送指示该第一终端设备存在该第一级别的异常的信息。
结合第六方面，在第六方面的某些实现方式中，该收发单元还用于向策略控制网元或该第二分析网元反馈该第一终端设备存在该第二级别的异常的信息；或者，该收发单元还用于向策略控制网元或该第二分析网元反馈该第一终端设备存在该第一级别的异常的信息。
结合第六方面，在第六方面的某些实现方式中，该收发单元还用于接收用于请求分析至少一个终端是否异常的信息，该至少一个终端包括该第一终端设备；该收发单元具体用于根据该用于请求分析至少一个终端是否异常的信息，向该第一用户面网元发送该第一请求消息。
结合第六方面，在第六方面的某些实现方式中，该处理单元还用于根据第一级别的异常检测策略确定第一级别的数据包检测规则PDR，该第一级别的PDR用于检测该第一数据，该第一请求消息包括用于指示第一级别的PDR的信息；该处理单元还用于根据第二级别的异常检测策略确定第二级别的PDR，该第二级别的PDR用于检测该第二数据，该第二请求消息包括用于指示第二级别的PDR的信息。
第七方面，提供一种通信系统，其特征在于，该系统包括第一分析网元和第二分析网元，该第一分析网元，用于向第一用户面网元发送第一请求消息，该第一请求消息用于请求上报第一终端设备的第一数据的传输情况；该第一分析网元，还用于接收来自该第一用户面网元的该第一数据的传输情况；在根据第一级别的异常检测策略以及该第一数据的传输情况确定该第一终端设备存在该第一级别的异常的情况下，该第二分析网元，用于向服务该第一终端设备的至少一个用户面网元发送第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况；该第二分析网元，还用于根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常，其中，该第一分析网元的服务范围小于该第二分析网元的服务范围。
结合第七方面，在第七方面的某些实现方式中，该第一级别的异常检测策略包括该第一数据的传输情况与用于确定是否存在该第一级别的异常的第一阈值的对应关系，该第二级别的异常检测策略包括该第二数据的传输情况与用于确定是否存在该第二级别的异常的第二阈值的对应关系。
结合第七方面，在第七方面的某些实现方式中，该第一数据的传输情况包括以下中的至少一个：该第一用户面网元中该第一终端设备的至少一个会话的数据包的数量、该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输速度、该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输离散度、该第一用户面网元中该第一终端设备的不同类型的数据包的数量的比例。
结合第七方面，在第七方面的某些实现方式中，该第二数据的传输情况包括以下中的一个或多个：该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的数量、该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输速度、该至少一个用户面网元中的任一用户面网元中的该第一终端设备的至少一个会话的数据包的传输离散 度、或该第一终端设备的不同类型的数据包的数量的比例。
结合第七方面，在第七方面的某些实现方式中，该第一分析网元，还用于确定该第一终端设备存在该第一级别的异常；该第一分析网元，还用于向该第二分析网元发送指示该第一终端设备存在该第一级别的异常的信息。
结合第七方面，在第七方面的某些实现方式中，若该第二分析网元确定该第一终端设备存在该第二级别的异常，该第二分析网元还用于向策略控制网元或者应用功能网元反馈该第一终端设备存在该第二级别的异常的信息；或者，若该第二分析网元确定该第一终端设备不存在该第二级别的异常，该第二分析网元还用于向策略控制网元或者应用功能网元反馈该第一终端设备存在该第一级别的异常的信息。
结合第七方面，在第七方面的某些实现方式中，该第一分析网元还用于接收用于请求分析至少一个终端是否异常的信息，该至少一个终端包括该第一终端设备；该第一分析网元具体用于根据该用于请求分析至少一个终端是否异常的信息，向该第一用户面网元发送该第一请求消息。
结合第七方面，在第七方面的某些实现方式中，该第一分析网元还用于根据第一级别的异常检测策略确定第一级别的数据包检测规则PDR，该第一级别的PDR用于检测该第一数据，该第一请求消息包括用于指示第一级别的PDR的信息；该第二分析网元还用于根据第二级别的异常检测策略确定第二级别的PDR，该第二级别的PDR用于检测该第二数据，该第二请求消息包括用于指示第二级别的PDR的信息。
第八方面，提供了一种通信装置，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第一方面，第二方面，第三方面以及第一方面，第二方面，第三方面中任一种可能实现方式中的方法。示例性地，该通信装置还包括存储器。该通信装置还包括通信接口，处理器与通信接口耦合。
示例性地，该通信接口可以是输入/输出接口，该输入/输出接口可以为输入/输出电路。该收发器可以为收发电路。
第九方面，提供了一种处理器，包括：输入电路、输出电路和处理电路。所述处理电路用于通过所述输入电路接收信号，并通过所述输出电路发射信号，使得所述处理器执行第一方面至第三方面中任一种可能实现方式中的方法。
在具体实现过程中，上述处理器可以为一个或多个芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是由例如但不限于接收器接收并输入的，输出电路所输出的信号可以是例如但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电路，该电路在不同的时刻分别用作输入电路和输出电路。本申请实施例对处理器及各种电路的具体实现方式不做限定。
第十方面，提供了一种处理装置，包括处理器和存储器。该处理器用于读取存储器中存储的指令，并可通过接收器接收信号，通过发射器发射信号，以执行第一方面至第三方面中任一种可能实现方式中的方法。
示例性地，所述处理器为一个或多个，所述存储器为一个或多个。
示例性地，所述存储器可以与所述处理器集成在一起，或者所述存储器与处理器分离设置。
在具体实现过程中，存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
应理解，相关的数据交互过程例如发送指示信息可以为从处理器输出指示信息的过程，接收能力信息可以为处理器接收输入能力信息的过程。具体地，处理器输出的数据可以输出给发射器，处理器接收的输入数据可以来自接收器。其中，发射器和接收器可以统称为收发器。
上述第十方面中的处理装置可以是一个或多个芯片。该处理装置中的处理器可以通过硬件来实现也可以通过软件来实现。当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现，该存储器可以集成在处理器中，可以位于该处理器之外，独立存在。
第十一方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序(也可以称为代 码，或指令)，当所述计算机程序被运行时，使得计算机执行上述第一方面至第三方面中任一种可能实现方式中的方法。
第十二方面，提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得上述第一方面至第三方面中任一种可能实现方式中的方法被执行。
附图说明
图1是本申请实施例方法适用的应用场景的示意图。
图2是本申请提供的一种异常检测的方法200的示意性流程图。
图3是本申请提供的另一种异常检测的方法300的示意性流程图。
图4是本申请提供的另一种异常检测的方法400的示意性流程图。
图5是本申请提供的另一种异常检测的方法500的示意性流程图。
图6是本申请实施例提供的一种异常检测的方法600的示意性流程图。
图7是本申请又一实施例提供的一种异常检测的方法700的示意性流程图。
图8是本申请又一实施例提供的一种异常检测的方法800的示意性流程图。
图9是本申请实施例提供的通信装置的示意图。
图10是本申请另一实施例提供的通信装置的示意性框图。
图11是本申请实施例提供的一种芯片系统的示意图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)通信系统或未来通信系统，例如，第六代(6th generation，6G)通信系统，车到其它设备(vehicle-to-x，V2X)，其中V2X可以包括车到互联网(vehicle-to-network，V2N)、车到车(vehicle-to-vehicle，V2V)、车到基础设施(vehicle-to-infrastructure，V2I)、车到行人(vehicle-to-pedestrian，V2P)等、车间通信长期演进技术(long term evolution-vehicle，LTE-V)、车联网、机器类通信(machine type communication，MTC)、物联网(internet of things，IoT)、机器间通信长期演进技术(long term evolution-machine，LTE-M)，机器到机器(machine to machine，M2M)等。
图1是适用于本申请实施例提供的方法的网络架构示意图。该网络架构具体可以包括下列网元：
1、用户设备(user equipment，UE)：可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备，以及各种形式的终端、移动台(mobile station，MS)、终端(terminal)或软终端等等。例如，水表、电表、传感器等。
示例性地，本申请实施例中的用户设备可以指接入终端、用户单元、用户站、移动站、移动台、中继站、远方站、远程终端、移动设备、用户终端(user terminal)、终端设备(terminal equipment)、无线通信设备、用户代理或用户装置。用户设备还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的用户设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的用户设备或者未来车联网中的用户设备等，本申请对此并不限定。
作为示例而非限定，在本申请实施例中，可穿戴设备也可以称为穿戴式智能设备，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，还可以通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手 环、智能首饰等。
此外，在本申请实施例中，用户设备还可以是物联网(internet of Things，IoT)系统中的用户设备，IoT是未来信息技术发展的重要组成部分，其主要技术特点是将物品通过通信技术与网络连接，从而实现人机互连，物物互连的智能化网络。在本申请实施例中，IOT技术可以通过例如窄带(narrow band，NB)技术，做到海量连接，深度覆盖，终端省电。此外，在本申请实施例中，用户设备还可以包括智能打印机、火车探测器、加油站等传感器，主要功能包括收集数据(部分用户设备)、接收接入网设备的控制信息与下行数据，并发送电磁波，向接入网设备传输上行数据。
2、(无线)接入网设备(radio access network，(R)AN)：用于为特定区域的授权用户设备提供入网功能，并能够根据用户设备的级别，业务的需求等使用不同质量的传输隧道。
RAN能够管理无线资源，为用户设备提供接入服务，进而完成控制信号和用户设备数据在用户设备和核心网之间的转发。RAN也可以理解为传统网络中的基站。
示例性地，本申请实施例中的接入网设备可以是用于与用户设备通信的任意一种具有无线收发功能的通信设备。该接入网设备包括但不限于：演进型节点B(evolved Node B，eNB)、基带单元(baseBand unit，BBU)，无线保真(wireless fidelity，WIFI)系统中的接入点(access point，AP)、无线中继节点、无线回传节点、传输点(transmission point，TP)或者发送接收点(transmission and reception point，TRP)等，还可以为5G，如，NR，系统中的gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)等。
在一些部署中，gNB可以包括集中式单元(centralized unit，CU)和DU。gNB还可以包括有源天线单元(active antenna unit，AAU)。CU实现gNB的部分功能，DU实现gNB的部分功能。比如，CU负责处理非实时协议和服务，实现无线资源控制(radio resource control，RRC)，分组数据汇聚层协议(packet data convergence protocol，PDCP)层的功能。DU负责处理物理层协议和实时服务，实现无线链路控制(radio link control，RLC)层、媒体接入控制(media access control，MAC)层和物理(physical，PHY)层的功能。AAU实现部分物理层处理功能、射频处理及有源天线的相关功能。由于RRC层的信息最终会变成PHY层的信息，或者，由PHY层的信息转变而来，因而，在这种架构下，高层信令，如RRC层信令，也可以认为是由DU发送的，或者，由DU+AAU发送的。可以理解的是，接入网设备可以为包括CU节点、DU节点、AAU节点中一项或多项的设备。此外，可以将CU划分为接入网(radio access network，RAN)中的接入网设备，也可以将CU划分为核心网(core network，CN)中的接入网设备，本申请对此不做限定。
3、接入和移动管理功能(access and mobility management function，AMF)网元：主要用于移动性管理和接入管理等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，接入授权/鉴权等功能。
4、会话管理功能(session management function，SMF)网元：主要用于会话管理、终端设备的互联网协议(internet protocol，IP)地址分配和管理、选择和管理用户面功能、策略控制和收费功能接口的终结点以及下行数据通知等。
5、策略控制功能(policy control function，PCF)网元：用于指导网络行为的统一策略框架，为网络中的其他功能网元(例如AMF，SMF等)或终端设备提供策略规则等。
6、用户面功能(user plane function，UPF)网元：用于分组路由和转发以及用户面数据的服务质量(quality of service，QoS)处理等。用户数据可通过UPF接入到数据网络(data network，DN)。在本申请实施例中，UPF可用于实现用户面网元的功能。
7、应用功能(application function，AF)网元：用于进行应用影响的数据路由，接入网络开放功能网元，与策略框架交互进行策略控制等。
8、数据网络(data network，DN)：用于提供传输数据的网络。例如，运营商业务的网络、因特(Internet)网、第三方的业务网络等。
9、网络数据分析功能(network data analytics function，NWDAF)网元：NWDAF可以具备以下至少一种功能：
数据收集、模型训练、模型反馈、分析结果推理、分析结果反馈等。其中，数据收集功能可以指 NWDAF收集来自网络功能网元、第三方服务器、终端设备或网管系统中的数据；模型训练功能可以指NWDAF基于相关输入数据做分析训练得到模型(例如，机器学习模型)；模型反馈功能可以指NWDAF将训练好的机器学习模型发送给支持推理功能的网元；分析结果推理功能可以指NWDAF基于训练好的机器学习模型以及推理数据做推理确定数据分析结果；分析结果反馈功能可以指NWDAF向网络功能网元、第三方服务器、终端设备或网管系统提供数据分析结果，该数据分析结果可协助网络选择业务的QoS参数，执行流量路由，选择背景流量传输策略等。
NWDAF的一个应用场景是：终端参数的定制或优化。即NWDAF通过收集用户的连接管理、移动性管理、会话管理、接入的业务等信息，利用可靠分析和预测模型，对不同类型用户进行评估和分析，构建用户画像，确定用户的移动轨迹和业务使用习惯，优化用户的移动性管理参数、无线资源管理参数等。此外，NWDAF还可以根据构建的用户画像识别终端设备是否存在异常。
在本申请的实施例中，NWDAF可以是一个单独的网元，也可以与其他网元合设。例如，NWDAF网元可以与AMF合设或者与SMF合设。
另外，上述网络架构还可以包括网络开放功能(network exposure function，NEF)网元。NEF用于安全地向外部开放由第三代合作伙伴计划(3GPP)网络功能提供的业务和能力等。应理解，以上列举的通信系统包括的网元仅仅为示例性说明，本申请并未限定于此。
在上述网络架构中，N2接口为RAN和AMF网元之间的接口，用于无线参数、非接入层(non-access stratum，NAS)信令的发送等；N3接口为RAN和UPF网元之间的接口，用于传输用户面的数据等；N4接口为SMF网元和UPF网元之间的接口，用于传输例如业务策略、N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知等信息。N6接口为DN和UPF网元之间的接口，用于传输用户面的数据。
应理解，在上述网络架构中，网元之间可以通过服务化接口进行信息交互。例如，NWDAF可以通过其他网元(如AMF、SMF等)提供的服务化接口(如Namf、Nsmf等)，从这些网元收集终端在网元上产生的数据；NWDAF还可以通过Nnwdaf接口向其他网元(如AMF、PCF等)提供数据分析结果、模型以及数据(data)等。
应理解，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
需要说明的是，本申请中各个网元、接口的名称只是示例，本申请不排除以后各个网元为其它名称，以及各个网元之间的功能合并的情况。随着技术的演进，任何能够实现上述各个网元的功能的设备或者网元，都在本申请的保护范围之内。其次，上述网元也可以称为实体、设备、装置或模块等，本申请并未特别限定。并且，在本申请中，为了便于理解和说明，在部分描述中省略“网元”这一描述，例如，将NWDAF网元简称为NWDAF，在此情况下，“NWDAF”应理解为NWDAF网元，以下，省略对相同或相似情况的说明。
在5G通信系统中，分析网元可以对终端设备在网络侧(例如，接入与移动管理网元、会话管理网元等)产生的数据进行分析，进而识别终端设备的行为(例如，通信行为)是否异常。分析网元可以向其他网络侧网元(例如，策略控制功能网元等)提供数据分析结果，以便其他网元能够及时阻断终端设备的异常行为，例如，阻断异常终端设备的通信。
为了尽可能地阻断网络中终端设备的异常行为，需要分析网元对网络中的终端设备做到“应检尽检”。即需要分析网元分析网络中尽可能多的终端设备的行为，提高异常终端设备检测的精准度。然而，在对大量终端设备的行为进行分析时，如何降低分析网元的负担成为一个亟待解决的问题。
其中，该分析网元可以是图1所示的网络架构中的NWDAF，或者是其他具有数据分析功能的网元，本申请对此不作限定。
有鉴于此，本申请提出了一种通信方法，使得分析网元可以对大量终端设备的行为进行分析，同时，降低分析网元的负担。分析网元可以将数据分析结果提供给网络侧的其他网元(例如，策略控制功能网元，接入与移动管理网元等)，以便其他网元根据该数据分析结果做出快速响应，及时阻断终端设备的异常行为。
为了便于理解本申请实施例，做出以下几点说明。
第一，在本申请中示出的第一、第二以及各种数字编号(例如，“#1”、“#2”等)仅为描述方便，用 于区分的对象，并不用来限制本申请实施例的范围。例如，区分不同的核心网网元等。而不是用于描述特定的顺序或先后次序。应该理解这样描述的对象在适当情况下可以互换，以便能够描述本申请的实施例以外的方案。
第二，本申请实施例中涉及的“预先设定”、“预先配置”等可以通过在设备(例如，网络设备)中预先保存相应的代码、表格或其他可用于指示相关信息的方式来实现，本申请对于其具体的实现方式不做限定，例如本申请实施例中预设的异常检测策略、预设的阈值等。
第三，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
下文将结合附图详细说明本申请实施例提供的方法。本申请提供的实施例可以应用于上述图1所示的网络架构中，不作限定。
图2是本申请实施例提供的一种异常检测的方法200的示意图。方法200可以包括如下步骤。
S210，第一分析网元向第一用户面网元发送第一请求消息，该第一请求消息用于请求上报第一终端设备的第一数据的传输情况。
相应地，该第一用户面网元接收来自该第一分析网元的该第一请求消息。
该第一数据可以包括该第一用户面网元中该第一终端设备的至少一个会话的数据包。
第一终端设备的第一数据的传输情况可以包括以下项中的至少一项：该第一用户面网元中该第一终端设备的至少一个会话的数据包的数量，该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输速度，该第一用户面网元中该第一终端设备的至少一个会话的数据包的传输离散度，该第一用户面网元中该第一终端设备的不同类型的数据包的数量的比例，该不同类型的数据包为该至少一个会话的数据包中不同类型的数据包。
示例性地，该第一终端设备的至少一个会话可以包括由该第一终端设备发起的会话。例如，该第一终端设备向至少一个被叫终端设备发起呼叫，且该第一终端设备通过发起第一会话向被叫终端设备发起呼叫，则该第一终端设备的至少一个会话包括该第一会话；该第一终端设备的至少一个会话还可以包括由其他终端设备向该第一终端设备发起的会话，该其他终端设备可以为一个或多个。例如，其他终端设备向该第一终端设备发起呼叫，且其他终端设备通过发起第二会话向该第一终端设备发起呼叫，则该第一终端设备的至少一个会话包括该第二会话。
本申请不限制该至少一个会话的具体类型，例如，本申请不限制该第一会话为该第一终端设备发起呼叫的会话，该第一会话还可以是该第一终端设备发起的其他类型的会话，例如，该第一终端设备向其他终端设备发起短信息的会话；同样，本申请不限制该第二会话的具体类型，该第二会话还可以是用于其他终端设备向该第一终端设备发起短信息的会话。
可以理解，该第一终端设备的该至少一个会话的数据包由该第一用户面网元传输。
示例性地，该第一用户面网元收到来自该第一终端设备的至少一个会话的数据包后，根据该至少一个会话的数据包携带的目的地址，将该至少一个会话的数据包转发到该第一用户面网元内的目的终端设备，或者经过N6接口将该至少一个会话的数据包发送到网络侧设备，或者，也可以经过N19接口将该至少一个会话的数据包发送到其他用户面功能网元上。同理，该第一用户面网元还可以将来自该第一用户面网元内的终端设备的至少一个会话的数据包，或者，来自网络侧设备的至少一个会话的数据包，或者，来自其他用户面功能网元的至少一个会话的数据包转发至该第一终端设备。
以下以该至少一个会话包括该第一会话为例说明该第一数据的传输情况，该第一会话为该第一终端设备向对端终端设备发起呼叫的会话。为了方面描述，将该第一会话的数据记为第一数据，该第一数据可以包括指示该第一终端设备向该对端终端设备发起呼叫的数据包，记为第一数据包；该第一数据还可以包括对端终端设备发送的用于对该第一终端设备发起的呼叫作出响应的数据包，记为第二数据包。
该第一数据的传输情况可以包括以下项中的至少一项：
(1)该第一数据包的数量。
该第一数据包的数量可以反映该第一终端设备向该其他终端设备发起呼叫的次数。
(2)该第一数据包的传输速度。
该第一数据包的传输速度可以理解为预设时间段内该第一数据包的传输数量。
(3)该第一数据包的传输离散度。
该第一数据包的传输离散度可以理解为该第一数据包中某个字段表示的对象的离散度。
例如，该第一数据包的一个字段指示传输的目的地址，即该第一数据包的传输离散度可以包括该第一数据包的目的地址的离散度。
再如，该第一数据包的另一个字段指示该第一终端设备所使用的移动设备(mobile equipment，ME)，即该第一数据包的传输离散度可以包括第一数据包的ME的标识的跨度。
(4)该第二数据包中部分数据包的数量。
例如，该部分数据包可以指示对端终端设备拒接该第一终端设备发起的呼叫，该部分数据包的数量可以反映该第一终端设备发起的呼叫被拒接(cancel)的次数。
再如，该部分数据包可以指示对端终端设备挂断该第一终端设备发起的呼叫，该部分数据包的数量可以反映该第一终端设备发起的呼叫被挂断(bye)的次数。
(5)该第一数据中不同类型数据包的数量的比例。
该第一数据中不同类型数据包的数量的比例例如可以为该第一数据包与该第二数据包的数量比例。
例如，第二数据包中部分数据包的数量与该第一数据包总数量的比例，该第二数据包中的该部分数据包可以指示部分对端终端设备拒接该第一终端设备发起的呼叫，该第二数据包中部分数据包的数量与该第一数据包总数量的比例可以表示，该第一终端设备发起的呼叫被拒接的次数与该第一终端设备发起呼叫的总次数的比例。
再如，该第二数据包中的该部分数据包可以指示部分对端终端设备挂断该第一终端设备发起的呼叫，则该第二数据包中部分数据包的数量与该第一数据包总数量的比例可以表示，该第一终端设备发起的呼叫被挂断的次数与该第一终端设备发起呼叫的总次数的比例。
以上仅以第一会话的第一数据为例说明本申请实施例中第一数据的传输情况，可以理解，本申请实施例中该第一数据不限制为该第一会话的数据，示例性地，该第一数据还可以包括该第二会话的数据，该第二会话的数据的传输情况与该第一会话的第一数据的传输情况类似，为了简洁，不再赘述。
可以理解，该第一终端设备的第一数据的传输情况可以用于判断该第一终端设备是否存在第一级别的异常。该第一级别的异常可以理解为根据该第一数据的传输情况确定的异常。
例如，该第一数据的传输情况包括该第一数据包的传输数量，在该第一数据包的传输数量大于阈值的情况下，可以判断该第一终端设备可能存在该第一级别的异常。其中，该第一数据包的传输数量可以反映该第一终端设备向该其他终端设备发起呼叫的次数，即在该第一终端设备向该其他终端设备发起呼叫的次数大于阈值的情况下，该第一终端设备可能存在第一级别的异常。
再如，该第一数据的传输情况包括该第二数据包中部分数据包的数量，例如，该部分数据包可以指示部分对端终端设备拒接该第一终端设备发起的呼叫。在该部分数据包的数量大于阈值的情况下，可以判断该第一终端设备可能存在该第一级别的异常。即在该第一终端设备向该其他终端设备发起的呼叫被拒接的次数大于阈值的情况下，该第一终端设备可能存在第一级别的异常。
该第一分析网元可以为会话管理网元，为了便于区分，记为第一会话管理网元。即由第一会话管理网元向该第一用户面网元发送该第一请求消息，请求上报该第一终端设备的第一数据的传输情况。
该第一请求消息可以携带指示第一级别的数据包检测规则(packet detection rule，PDR)的信息，该第一级别的PDR用于该第一用户面网元匹配该第一终端设备的该第一数据。或者说，用于该第一用户面网元检测该第一数据。该第一级别的PDR可以预先配置在第一用户面网元中，或者可以由该第一会话管理网元通过该第一请求消息发送至该第一用户面网元。
一种可能的实现方式中，该第一会话管理网元在向该第一用户面网元发送该第一请求消息之前，接收到来自第二分析网元的第三请求消息，该第三请求消息用于请求检测至少一个终端设备是否存在异常，该至少一个终端设备包括该第一终端设备。该第一会话管理网元根据该第三请求消息向该第一用户面网元发送该第一请求消息。
其中，该第二分析网元可以是网络数据分析功能网元，为了便于区分，记为第一网络数据分析功能网元。该第一网络数据分析功能网元可以对至少一个会话管理网元上的数据进行分析，该至少一个会话管理网元包括该第一会话管理网元。
示例性地，该第三请求消息可以携带该至少一个终端设备的标识；或者，该第三请求消息携带指示检测该第一会话管理网元所管理的至少一个终端设备是否异常的指示信息，该第一会话管理网元所管理的至少一个终端设备包括该第一终端设备。
该第三请求消息还可以携带指示对该至少一个终端设备进行异常检测的异常级别的指示信息，例如，该异常级别可以包括该第一级别和第二级别。当该指示信息指示对该至少一个终端设备进行检测的级别为高级别时，例如为该第二级别，该第一会话管理网元可以默认先开始低级别的异常检测，例如该第一级别。
S220，该第一用户面网元向该第一分析网元发送该第一数据的传输情况。
相应地，该第一分析网元接收来自该第一用户面网元的该第一数据的传输情况。
S230，该第一分析网元根据该第一数据的传输情况确定该第一终端设备是否存在第一级别的异常。
具体地，该第一分析网元可以根据第一级别的异常检测策略和该第一数据的传输情况确定该第一终端设备是否存在该第一级别的异常。
该第一级别的异常检测策略包括该第一数据的传输情况与用于确定是否存在该第一级别的异常的第一阈值的对应关系。该第一数据的传输情况与第一阈值对应关系可以是，该第一数据的传输情况大于、等于或小于该第一阈值。
例如，该第一数据的传输情况包括该第一数据包的数量，该第一数据包的数量可以表征该第一终端设备向该其他终端设备发起呼叫的次数；该第一阈值可以是预设的终端设备发起呼叫的次数的上限；该第一数据的传输情况与第一阈值对应关系可以是：该第一数据包的数量大于或等于该第一阈值。当第一终端设备向该其他终端设备发起呼叫的次数大于或等于该第一阈值时，可以确定该第一终端设备可能存在第一级别的异常。
以上示例中，该第一数据包和该第二数据包的相关描述可以参考S210中的描述。
在本申请实施例中，异常检测策略即表示用于检测异常的策略。在本申请实施例中，异常检测策略可以包括数据的传输情况与阈值的对应关系，即通过确定数据的传输情况与阈值的对应关系可以确定终端设备是否异常。应理解，异常检测策略，也可以称为安全策略，其命名不对本申请实施例的保护范围造成限定。
S240，第一分析网元向服务该第一终端设备的至少一个用户面网元发送第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况。
相应地，以该至少一个用户面网元中的任一个用户面网元(例如第二用户面网元)为例，该第二用户面网元接收来自该第一分析网元的该第二请求消息。
该第二请求消息可以携带指示第二级别的PDR的信息，该第二级别的PDR用于该第二用户面网元匹配该第一终端设备的该第二数据，或者说，用于该第二用户面网元检测该第二数据。
其中，服务该第一终端设备的至少一个用户面网元可以理解为该第一终端设备的该第二数据由该至少一个用户面网元传输。以第二用户面网元为例，第二用户面网元服务于第一终端设备意味着第一终端设备发送的数据可以通过第二用户面网元进行传输，或者第一终端设备接收的数据可以通过第二用户面网元进行传输。
该第二数据可以包括第二用户面网元中该第一终端设备的至少一个会话的数据包。
第一终端设备的第二数据的传输情况可以包括以下项中的至少一项：该第二用户面网元中该第一终端设备的至少一个会话的数据包的数量、该第二用户面网元中该第一终端设备的至少一个会话的数据包的传输速度、该第二用户面网元中该第一终端设备的至少一个会话的数据包的传输离散度、该第二用户面网元中该第一终端设备的不同类型的数据包的数量的比例，该不同类型的数据包为该至少一个会话的数据包中不同类型的数据包。
该第一终端设备的至少一个会话可以参考S210中的描述，该第二数据的传输情况和第一数据的传输情况类似，不再赘述。
也就是说，第一终端设备的数据(包括第一数据和该第二数据)由至少一个用户面网元传输，当需要确定该第一终端设备是否存在第一级别的异常时，该第一分析网元可以向服务该第一终端设备的一个用户面网元(例如第一用户面网元)发送该第一请求消息，以请求该第一终端设备的第一数据的传输情况，该第一数据可以包括该第一用户面网元中该第一终端设备的至少一个会话的数据包。在根据 该第一数据的传输情况以及该第一级别的异常检测策略确定该第一终端设备存在该第一级别的异常的情况下，该第一分析网元可以向服务该第一终端设备的至少一个用户面网元发送该第二请求消息，以请求该第一终端设备的第二数据的传输情况，该第二数据包括该至少一个用户面网元中该第一终端设备的至少一个会话的数据包。
可以理解，相较于来自第一用户面网元的该第一数据的传输情况，该第二数据的传输情况来源可能更广，即该第二数据的传输情况可能来自服务该第一终端设备的多个用户面网元。或者说，基于该第二数据的传输情况分析该第一终端设备是否异常的难度可能大于，基于该第一数据的传输情况分析该第一终端设备是否异常的难度。其中，分析异常的难度例如可以通过计算量，需要的资源的大小等衡量。或者说，该第二数据的传输情况相较于该第一数据可能更复杂，例如，在该传输情况包括数据包的总数量的情况下，该第二数据的数据包的总数量可能大于该第一数据的数据包的总数量。
一种可能的情况，该至少一个用户面网元包括该第一用户面网元。
也就是说，第一分析网元通过该第一用户面网元请求该第一终端设备的第一数据的传输情况，在该第一用户面网元根据该第一数据的传输情况确定该第一终端设备存在异常的情况下，该第一分析网元可以向包括该第一用户面网元的至少一个用户面网元请求该第一终端设备的第二数据的传输情况。
在此情况下，可选地，该第一分析网元可以向该第一用户面网元发送一个请求消息，该一个请求消息用于请求该第一终端设备的第一数据的传输情况和该第二数据的传输情况。或者说，在S210中，该第一请求消息还可以用于请求该第一终端设备的该第二数据的传输情况。
另一种可能的情况，该至少一个用户面网元不包括该第一用户面网元。
也就是说，第一分析网元通过该第一用户面网元请求该第一终端设备的第一数据的传输情况，在该第一用户面网元根据该第一数据的传输情况确定该第一终端设备存在异常的情况下，该第一分析网元可以向除该第一用户面网元以外的服务该第一终端设备的其他用户面网元请求该第一终端设备的第二数据的传输情况。
可选地，S250，在该第一分析网元向该第二用户面网元发送该第二请求消息之前，该第一分析网元向第一网元发送用于确定是否对该第一终端设备进行第二级别的异常检测的请求。
该请求可以携带指示该第一终端设备存在该第一级别的异常的信息。
在该第一网元确定对该第一终端设备进行第二级别的异常检测的情况下，该第一分析网元接收来自该第一网元的用于指示对该第一终端设备进行第二级别的异常检测的指示信息；该第一分析网元根据该指示信息向该第二用户面网元发送该第二请求消息。
其中，该第一网元可以包括该第二分析网元和消费网元中的至少一个。该第二分析网元可以是S210中的第一网络数据分析功能网元；该消费网元可以是应用功能网元或策略控制功能网元。
可选地，S260，在该第二分析网元确定对该第一终端设备进行第二级别的异常检测的情况下，由该第二分析网元向该第二用户面网元发送该第二请求消息。可以理解的是，该情况下，S240可以不予执行。
示例性地，该第二分析网元可以通过该第一分析网元向该第二用户面网元发送该第二请求消息。
S270a，该第一分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
示例性地，若由该第一分析网元向该第二用户面网元发送该第二请求消息(S240)，则该第一分析网元可以接收来自该第二用户面功能网元的该第二数据的传输情况；该第一分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
具体地，该第一分析网元可以根据第二级别的异常检测策略和该第二数据的传输情况确定该第一终端设备是否存在该第二级别的异常。其中，该第二级别的异常检测策略包括该第二数据的传输情况与用于确定是否存在该第二级别的异常的第二阈值的对应关系。
例如，该第二数据的传输情况包括来自该至少一个用户面网元的该第一数据包的传输离散度，该第一数据包的传输离散度可以包括该第一数据包的目的地址的离散度，当该第一数据包的目的地址的离散度大于第二阈值时，可以确定该第一终端设备可能存在第二级别的异常。
又如，该第二数据的传输情况包括来自该至少一个用户面网元的第二数据包中部分数据包的数量与第一数据包总数量的比例，该第二数据包中部分数据包的数量与该第一数据包总数量的比例可以表 示，该第一终端设备发起的呼叫被拒接的次数与该第一终端设备发起呼叫的总次数的比例，当该第一终端设备发起的呼叫被拒接的次数与该第一终端设备发起呼叫的总次数的比例大于第二阈值时，可以确定该第一终端设备可能存在第二级别的异常。
以上示例中，该第一数据包和该第二数据包的相关描述可以参考S210中的描述。
或者，S270b，该第二分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
示例性地，若由第二分析网元向该第二用户面网元发送该第二请求消息(S260)，则该第二分析网元可以接收来自该第二用户面功能网元的该第二数据的传输情况；该第二分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。或者，可以由第一分析网元向该第二分析网元发送该第一终端设备的该第二数据的传输情况，由该第二分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
第二分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常的具体过程可以参考S270a，不再赘述。
若由该第一分析网元确定该第一终端设备是否存在该第二级别的异常(S270a)，后续的步骤可以包括两种情况：
情况一
S280a，该第一分析网元向该第二分析网元发送指示该第一终端设备存在异常的信息。
指示该第一终端设备存在异常的信息可以包括指示该第一终端设备存在该第二级别的异常的信息，指示该第一终端设备存在第一级别的异常的信息中的至少一种。
示例性地，若该第一分析网元确定该第一终端设备存在该第二级别的异常，则该指示第一终端设备存在异常的信息可以包括指示该第一终端设备存在该第二级别的异常的信息，或者，该指示第一终端设备存在异常的信息可以包括指示该第一终端设备存在该第二级别的异常的信息，以及指示该第一终端设备存在第一级别的异常的信息；若该第一分析网元确定该第一终端设备不存在该第二级别的异常，则该指示第一终端设备存在异常的信息可以包括指示该第一终端设备存在该第一级别的异常的信息。
S290a，该第二分析网元确定该第一终端设备是否存在其他级别的异常。
示例性地，该第二分析网元可以根据现有技术的方式确定该第一终端设备是否存在异常，该第二分析网元确定是否异常流程可以参考3GPP TS 23.288中的描述。
例如，该第二分析功能网元可以向接入与移动管理网元请求该第一终端设备的接入数据、位置数据等，该第二分析网元根据该接入数据、位置数据等确定该第一终端设备是否存在其他级别的异常。
该第二分析网元还可以根据其他级别的异常检测策略确定该第一终端设备是否存在其他级别的异常。
例如，该第二分析网元根据第三级别的异常检测策略和该第二数据的传输情况确定该第一终端设备是否异常。该第三级别的异常检测策略可以包括该第一终端设备的第二数据的传输情况与确定终端设备是否异常的阈值的对应关系。其中，第三级别的异常检测策略包括的该第二数据的传输情况可以和第二级别的异常检测策略包括的第二数据的传输情况不同，例如，第二级别的异常检测策略包括第三数据包的数量，该第三数据包的传输速度；第三级别的异常检测策略可以包括该第三数据包的传输离散度，其中，该第三数据包可以为服务该第一终端设备的至少一个用户面网元中任一个用户面网元的至少一个会话的数据包。该第一终端设备的第二数据的传输情况可以由该第一分析网元发送至该第二分析网元。
S2100a，该第二分析网元向消费网元发送指示该第一终端设备存在异常的信息。
其中，该消费网元可以包括应用功能网元和策略控制功能网元中的至少一个。
在该第一终端设备存在其他级别的异常的情况下，该第二分析网元可以向该消费网元发送指示该第一终端设备存在其他级别的异常的信息，可选地，该第二分析网元还可以向该消费网元发送指示该第一终端设备存在该第二级别的异常的信息，指示该第一级别的异常的信息中的至少一种。
需要注意的是，S280a-S2100a为可选步骤。
情况二
可选地，S280b，该第一分析网元向消费网元发送指示该第一终端设备存在异常的信息。
指示该第一终端设备存在异常的信息可以参考S280a中该第一分析网元向该第二分析网元发送的指示该第一终端设备存在异常的信息，不再赘述。
也就是说，在该第一分析网元确定该第一终端设备存在异常的情况下，该第一分析网元可以将指示该第一终端设备存在异常的信息反馈至第二分析网元，由该第二分析网元进一步分析该第一终端设备是否存在其他级别的异常，并由该第二分析网元将指示该第一终端设备存在异常的信息反馈至消费网元；或者，该第一分析网元可以直接将指示该终端设备存在异常的信息反馈至消费网元。
若由该第二分析网元确定该第一终端设备是否存在该第二级别的异常(S270b)，后续的步骤可以包括三种情况：
情况一
S280c，该第二分析网元向第三分析网元发送指示该第一终端设备存在异常的信息。
该第三分析网元可以是网络数据分析功能网元，在此情况下，该第二分析网元被该第三分析网元管理，或者说，该第三分析网元的服务范围大于该第二分析网元的服务范围。
指示该第一终端设备存在异常的信息参考S280a中的描述。
S290b，该第三分析网元分析该第一终端设备是否存在其他级别的异常。
该步骤和S290a类似，不再赘述。
S2100b，该第三分析网元向消费网元发送指示该第一终端设备存在异常的信息。
该步骤和S2100a类似，不再赘述。
需要注意的是，S280c、S290b和S2100b为可选步骤。
情况二
S280d，该第二分析网元确定该第一终端设备是否存在其他级别的异常。
该第二分析网元确定该第一终端设备是否存在其他级别的异常可以参考S290a中第二分析网元确定该第一终端设备是否存在其他级别的异常的描述。
S290c，该第二分析网元向消费网元发送指示该第一终端设备存在异常的信息。
该步骤和S2100a类似，不再赘述。
需要注意的是，S280d和S290c为可选步骤。
情况三
可选地，S280e，该第二分析网元向消费网元发送指示该第一终端设备存在异常的信息。
指示该第一终端设备存在异常的信息可以参考S280a中该第一分析网元向该第二分析网元发送的指示该第一终端设备存在异常的信息，不再赘述。
也就是说，在该第二分析网元确定该第一终端设备存在异常的情况下，该第二分析网元可以将指示该第一终端设备存在异常的信息反馈至第三分析网元，由该第三分析网元进一步分析该第一终端设备是否存在其他级别的异常，并由该第三分析网元将指示该第一终端设备存在异常的信息反馈至消费网元；或者，在该第二分析网元确定该第一终端设备存在异常的情况下，由该第二分析网元进一步分析该第一终端设备是否存在其他级别的异常，并由该第二分析网元将指示该第一终端设备存在异常的信息反馈至消费网元；或者，在该第二分析网元确定该第一终端设备存在异常的情况下，由该第二分析网元直接将指示该终端设备存在异常的信息反馈至消费网元。
根据本申请实施例提供的异常检测的方法，第一分析网元和第二分析网元中的至少一个可以根据不同级别的异常检测策略以及终端设备的数据传输情况确定终端设备是否异常；在终端设备存在异常的情况下，该第一分析网元和第二分析网元中的至少一个可以向第三分析网元反馈终端设备存在异常的信息，以使该第三分析网元进一步分析该终端设备是否存在其他级别的异常；或者由该第二分析网元分析该终端设备是否存在其他级别的异常。从而当分析网元(例如该第三分析网元或该第二分析网元)需要对网络中的终端设备是否异常做到“应检尽检”时，可以减小分析网元检测的终端设备的范围，进而减轻分析网元的负担。
图3是本申请实施例提供的一种异常检测的方法300的示意图。方法300中的分析网元可以是网络数据分析功能网元，方法300可以包括如下步骤。
S310，第一分析网元向第一用户面网元发送第一请求消息，该第一请求消息用于请求上报第一终端设备的第一数据的传输情况。
相应地，该第一用户面网元接收来自该第一分析网元的该第一请求消息。
该第一数据可以包括该第一用户面网元中该第一终端设备的至少一个会话的数据包。该第一终端设备的第一数据的传输情况可以参考S210中的描述。
可以理解，该第一终端设备的该第一数据由该第一用户面网元传输。该第一终端设备的第一数据的传输情况可以用于判断该第一终端设备是否存在第一级别的异常。该第一级别的异常可以理解为根据该第一数据的传输情况确定的异常。
该第一分析网元可以为网络数据分析功能网元，为了方便描述，记为第二网络数据分析功能网元。即由该第二网络数据分析功能网元向第一用户面网元发送该第一请求消息，请求上报该第一终端设备的第一数据的传输情况。
可以理解，在该第二网络数据分析功能网元不能与该第一用户面网元直接通信的情况下，该第二网络数据分析功能网元可以通过会话管理网元向该第一用户面网元发送该第一请求消息。
该第一请求消息携带的信息可以参考S210中的描述，不再赘述。
一种可能的实现方式中，该第二网络数据分析功能网元向该第一用户面网元发送该第一请求消息之前，该第二网络数据分析功能网元接收来自第二分析网元或消费网元的第四请求消息。该第二网络数据分析功能网元根据该第四请求消息向该第一用户面网元发送该第一请求消息。
其中，该第二分析网元可以是网络数据分析功能网元，为了便于区分，记为第三网络数据分析功能网元。该消费网元可以是应用功能网元或策略管理功能网元。
该第四请求消息可以用于请求检测至少一个终端设备是否异常，该至少一个终端设备包括该第一终端设备。
该第四请求消息可以携带该至少一个终端设备的标识，该至少一个终端设备包括该第一终端设备；或者，该第四请求消息可以携带指示信息，该指示信息指示检测该第二网络数据分析功能网元所支持分析的至少一个终端设备是否异常，该第二网络数据分析功能网元所支持分析的至少一个终端设备包括该第一终端设备。
该第四请求消息还可以携带指示对该至少一个终端设备进行异常检测的异常级别的指示信息。例如，该异常级别可以包括该第一级别和第二级别。当该指示信息指示对该至少一个终端设备进行检测的级别为高级别时，例如为该第二级别，该第一会话管理网元可以默认先开始低级别的异常检测，例如该第一级别。
S320，该第一用户面网元向该第一分析网元发送该第一数据的传输情况。
相应地，该第一分析网元接收来自该第一用户面网元的该第一数据的传输情况。
示例性地，该第一用户面网元可以通过会话管理网元向该第一分析网元发送该第一数据的传输情况。
S330，该第一分析网元根据该第一数据的传输情况确定该第一终端设备是否存在第一级别的异常。
具体地，该第一分析网元可以根据第一级别的异常检测策略和该第一数据的传输情况确定该第一终端设备是否存在该第一级别的异常。该第一分析网元根据该第一数据的传输情况确定该第一终端设备是否存在第一级别的异常可以参考S230中的描述。
S340，第一分析网元向服务该第一终端设备的至少一个用户面网元发送第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况。
相应地，以该至少一个用户面网元中的任一个用户面网元(例如第二用户面网元)为例，该第二用户面网元接收来自该第一分析网元的该第二请求消息。
该第二请求消息携带的信息以及该第二数据的传输情况可以参考S240中的描述。
也就是说，第一终端设备的数据由至少一个用户面网元传输，当需要确定该第一终端设备是否存在第一级别的异常时，该第一分析网元可以向服务该第一终端设备的一个用户面网元(例如第一用户面网元)发送该第一请求消息，以请求该第一终端设备的第一数据的传输情况。在根据该第一数据的传输情况以及该第一级别的异常检测策略确定该第一终端设备存在该第一级别的异常的情况下，该第一分析网元可以向服务该第一终端设备的至少一个用户面网元发送该第二请求消息，以请求该第一终 端设备的第二数据的传输情况，该第二数据的传输情况可以用于分析该第一终端设备是否存在第二级别的异常。
一种可能的情况，该至少一个用户面网元可以包括该第一用户面网元。
在此情况下，可选地，该第一分析网元可以向该第一用户面网元发送一个请求消息，该一个请求消息用于请求该第一终端设备的第一数据的传输情况和该第二数据的传输情况。
另一种可能的情况，该至少一个用户面网元也可以不包括该第一用户面网元。
也就是说，第一分析网元通过该第一用户面网元请求该第一终端设备的第一数据的传输情况，在该第一用户面网元根据该第一数据的传输情况确定该第一终端设备存在异常的情况下，该第一分析网元可以向除该第一用户面网元以外的服务该第一终端设备的其他用户面网元请求该第一终端设备的第二数据的传输情况。
可选地，S350，在该第一分析网元向该第二用户面网元发送该第二请求消息之前，该第一分析网元可以向第一网元发送是否对该第一终端设备进行第二级别的异常检测的请求。
该请求可以携带指示该第一终端设备存在该第一级别的异常的信息。
在该第一网元确定对该第一终端设备进行第二级别的异常检测的情况下，该第一分析网元接收来自该第一网元的用于指示对该第一终端设备进行第二级别的异常检测的指示信息；该第一分析网元根据该指示信息向该第二用户面网元发送该第二请求消息。
其中，该第一网元可以是该第二分析网元和该消费网元中的至少一个。
可选地，S360，在该第二分析网元确定对该第一终端设备进行第二级别的异常检测的情况下，还可以由该第二分析功能网元向该第二用户面网元发送该第二请求消息。可以理解的是，该情况下，S340可以不予执行。
示例性地，该第二分析网元可以通过该第一分析网元向该第二用户面网元发送该第二请求消息；或者，在该第二分析网元不与该第二用户面网元直接通信的情况下，该第二分析网元还可以通过该第一分析网元以及会话管理网元向该第二用户面网元发送该第二请求消息。
S370a，该第一分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
示例性地，若由该第一分析网元向该第二用户面网元发送该第二请求消息，则该第一分析网元可以接收来自该第二用户面功能网元的该第二数据的传输情况，该第一分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
该第一分析网元根据第二级别的异常检测策略和该第二数据的传输情况确定该第一终端设备是否存在该第二级别的异常的具体方式可以参考S270a的描述。
或者，S370b，该第二分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
示例性地，若由第二分析网元向该第二用户面网元发送该第二请求消息，该第二分析网元根据第二级别的异常检测策略以及接收的第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。或者，可以由第一分析网元向该第二分析网元发送该第一终端设备的该第二数据的传输情况，由该第二分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
第二分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常的具体过程可以参考S270a，不再赘述。
若由该第一分析网元确定该第一终端设备是否存在该第二级别的异常(S370a)，后续的步骤可以包括三种情况：
情况一
S380a，该第一分析网元向该第二分析网元发送指示该第一终端设备存在异常的信息。
指示该第一终端设备存在异常的信息可以参考S280a中的描述。
S390a，该第二分析网元确定该第一终端设备是否存在其他级别的异常。
该步骤和S290a类似，不再赘述。
S3100a，该第二分析网元向该消费网元发送指示该第一终端设备存在异常的信息。
指示该第一终端设备存在异常的信息参考S2100a的描述。
需要注意的是，S380a-S3100a为可选步骤。
情况二
S380b，该第一分析网元确定该第一终端设备是否存在其他级别的异常。
该第一分析网元确定该第一终端设备是否存在其他级别的异常可以参考S290a中第二分析网元确定该第一终端设备是否存在其他级别的异常的描述。
S390b，该第一分析网元向消费网元发送指示该第一终端设备存在异常的信息。
该步骤和S2100a类似，不再赘述。
需要注意的是，S380b-S390b为可选步骤。
情况三
可选地，S380c，该第一分析网元可以直接向消费网元发送指示该第一终端设备存在异常的信息。
也就是说，在该第一分析网元确定该第一终端设备存在异常的情况下，该第一分析网元可以将指示该第一终端设备存在异常的信息反馈至第二分析网元，由该第二分析网元进一步分析该第一终端设备是否存在其他级别的异常，并由该第二分析网元将指示该第一终端设备存在异常的信息反馈至消费网元；或者，在该第一分析网元确定该第一终端设备存在异常的情况下，由该第一分析网元进一步分析该第一终端设备是否存在其他级别的异常，并由该第一分析网元将指示该第一终端设备存在异常的信息反馈至消费网元；或者，该第一分析网元可以直接将指示该终端设备存在异常的信息反馈至消费网元。
若由该第二分析网元确定该第一终端设备是否存在该第二级别的异常(S370b)，后续的步骤也可以包括三种情况：
情况一
S380d，该第二分析网元向第三分析网元发送指示该第一终端设备存在异常的信息。
该第三分析网元可以是网络数据分析功能网元，在此情况下，该第二分析网元被该第三分析网元管理，或者说，该第三分析网元的服务范围大于该第二分析网元的服务范围。
指示该第一终端设备存在异常的信息参考S280a中的描述。
S390c，该第三分析网元分析该第一终端设备是否存在其他级别的异常。
该步骤和S290a类似，不再赘述。
S3100b，该第三分析网元向消费网元发送指示该第一终端设备存在异常的信息。
该步骤和S2100a类似，不再赘述。
需要注意的是，S380d，S390c和S3100b为可选步骤。
情况二
S380e，该第二分析网元确定该第一终端设备是否存在其他级别的异常。
该第二分析网元确定该第一终端设备是否存在其他级别的异常可以参考S290a中第二分析网元确定该第一终端设备是否存在其他级别的异常的描述。
S390d，该第二分析网元向消费网元发送该第一终端设备存在异常的信息。
该步骤和S2100a类似，不再赘述。
需要注意的是，S380e和S390d为可选步骤。
情况三
可选地，S380f，该第二分析网元直接向消费网元发送指示该第一终端设备存在异常的信息。
根据本申请实施例提供的异常检测的方法，第一分析网元和第二分析网元中的至少一个可以根据不同级别的异常检测策略以及终端设备的数据传输情况确定终端设备是否异常；在终端设备存在异常的情况下，该第一分析网元和第二分析网元中的至少一个可以向第三分析网元反馈终端设备存在异常的信息，以使该第三分析网元进一步分析该终端设备是否存在其他级别的异常；或者由该第二分析网元分析该终端设备是否存在其他级别的异常。从而当分析网元(例如该第三分析网元或该第二分析网元)需要对网络中的终端设备是否异常做到“应检尽检”时，可以减小分析网元检测的终端设备的范围，进而减轻分析网元的负担。
图4是本申请实施例提供的一种异常检测的方法400的示意图。在方法400中，可以由第一用户 面网元确定终端设备是否存在第一级别的异常。方法400可以包括如下步骤。
S410，第一分析网元向第一用户面网元发送第五请求消息，该第五请求消息用于请求确定第一终端设备的第一数据的传输情况。
相应地，该第一用户面网元接收来自该第一分析网元的该第五请求消息。
第一终端设备的第一数据的传输情况可以参考S210中的描述，不再赘述。
可以理解，该第一终端设备的第一数据的传输情况可以用于判断该第一终端设备是否存在第一级别的异常。即在该第一用户面网元确定该第一数据的传输情况下，该第一用户面可以确定该第一终端设备是否存在该第一级别的异常。该第一级别的异常可以理解为根据该第一数据的传输情况确定的异常。
该第一分析网元为会话管理网元，为了便于区分，记为第一会话管理网元。即由第一会话管理网元向该第一用户面网元发送该第五请求消息，请求确定该第一终端设备的第一数据的传输情况。
该第五请求消息可以携带指示第一级别的PDR的信息，该第一级别的PDR用于该第一用户面网元匹配该第一终端设备的该第一数据，或者说，用于该第一用户面网元检测该第一数据。该第一级别的PDR可以预先配置在第一用户面网元中，或者可以由该第一会话管理网元通过该第一请求消息发送至该第一用户面网元。
该第五请求消息还可以携带指示该第一用户面网元根据第一异常检测策略与该第一数据的传输情况，确定该第一终端设备是否存在该第一级别的异常的指示信息。相应地，第五请求消息可以包括第一级别的异常检测策略。
可选地，在该第一会话管理网元向该第一用户面网元发送该第五请求消息之前，该第一会话管理网元接收来自第二分析网元的第三请求消息，该第三请求消息用于请求检测至少一个终端设备是否存在异常，该至少一个终端设备包括该第一终端设备。该第一会话管理网元根据该第三请求消息向该第一用户面网元发送该第五请求消息。该第三请求消息可以参考S210中，不再赘述。
其中，该第二分析网元可以是网络数据分析功能网元，为了便于区分，记为第一网络数据分析功能网元。该第一网络数据分析功能网元可以参考S210中的描述。
S420，该第一用户面网元根据该第一数据的传输情况确定该第一终端设备是否存在第一级别的异常。
具体地，该第一用户面网元可以根据第一级别的异常检测策略和该第一数据的传输情况确定该第一终端设备是否存在该第一级别的异常。该第一级别的异常检测策略包括该第一数据的传输情况与用于确定是否存在该第一级别的异常的第一阈值的对应关系。
该第一数据的传输情况与第一阈值对应关系可以是，该第一数据的传输情况大于、等于或小于该第一阈值。
例如，该第一数据的传输情况包括该第一数据包的数量，该第一数据包的数量可以表征该第一终端设备向该其他终端设备发起呼叫的次数；该第一阈值可以是预设的终端设备发起呼叫的次数的上限；该第一数据的传输情况与第一阈值对应关系可以是：该第一数据包的数量大于或等于该第一阈值。当第一终端设备向该其他终端设备发起呼叫的次数大于或等于该第一阈值时，可以确定该第一终端设备可能存在第一级别的异常。
以上示例中，该第一数据相关描述可以参考S210中的描述。
S430，该第一用户面网元向该第一分析网元发送指示该第一终端设备存在该第一级别的异常的信息。
相应地，该第一分析网元接收来自该第一用户面网元的指示该第一终端设备存在该第一级别的异常的信息。
指示该第一终端设备存在该第一级别的异常的信息可以包括该第一终端设备的第一数据的传输情况。
S440，第一分析网元向服务该第一终端设备的至少一个用户面网元发送第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况。
相应地，以该至少一个用户面网元中的任一个用户面网元(例如第二用户面网元)为例，该第二用户面网元接收来自该第一分析网元的该第二请求消息。
该步骤的具体过程和S240中类似，不再赘述。
可选地，S450，在该第一分析网元向该第二用户面网元发送该第二请求消息之前，该第一分析网元可以向第一网元发送用于确定是否对该第一终端设备进行第二级别的异常检测的请求。
在该第一网元确定对该第一终端设备进行第二级别的异常检测的情况下，该第一分析网元接收来自该第一网元的用于指示对该第一终端设备进行第二级别的异常检测的指示信息；该第一分析网元根据该指示信息向该第二用户面网元发送该第二请求消息。该步骤具体参考S250中的描述。
其中，该第一网元包括该第二分析网元和策略分析网元中的至少一个。
可选地，S460，在该第二分析网元确定对该第一终端设备进行第二级别的异常检测的情况下，还可以由该第二分析网元向该第二用户面网元发送该第二请求消息。可以理解的是，该情况下，S440可以不予执行。
该步骤具体参考S260中的描述。
S470a，该第一分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
该步骤可以参考S270a中的描述，不再赘述。
或者，S470b，第二分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
该步骤可以参考S270b中的描述，不再赘述。
若由该第一分析网元确定该第一终端设备是否存在该第二级别的异常(S470a)，后续的步骤可以包括两种情况。
情况一
S480a，该第一分析网元向该第二分析网元发送指示该第一终端设备存在异常的信息。
S490a，该第二分析网元分析该第一终端设备是否存在其他级别的异常。
S4100a，该第二分析网元向消费网元发送指示该第一终端设备存在异常的信息。
S480a-S4100a与S280a-S2100a类似，不再赘述；S480a-S4100a为可选步骤。
情况二
可选地，S480b，该第一分析网元向消费网元发送指示该第一终端设备存在异常的信息。
该步骤与S280b类似，不再赘述。
若由该第二分析网元确定该第一终端设备是否存在该第二级别的异常(S470b)，后续的步骤可以包括三种情况：
情况一
S480c，该第二分析网元向第三分析网元发送指示该第一终端设备存在异常的信息。
S490b，该第三分析网元分析该第一终端设备是否存在其他级别的异常。
S4100b，该第三分析网元向消费网元发送指示该第一终端设备存在异常的信息。
需要注意的是，S480c、S490b和S4100b为可选步骤。S480c、S490b和S4100b分别与S280c、S290b和S2100b类似，不再赘述。
情况二
S480d，该第二分析网元确定该第一终端设备是否存在其他级别的异常。
S490c，该第二分析网元向消费网元发送指示该第一终端设备存在异常的信息。
需要注意的是，S480d和S490c为可选步骤。S480d和S490c分别与S280c、S290c类似，不再赘述。
情况三
可选地，S480e，该第二分析网元向消费网元发送指示该第一终端设备存在异常的信息。
该步骤与S280e类似，不再赘述。
根据本申请实施例提供的异常检测的方法，第一用户面网元可以根据第一级别的异常检测策略以及终端设备的数据传输情况确定该终端设备是否存在第一级别的异常；在该终端设备存在第一级别的异常的情况下，该第一用户面网元可以向分析网元(例如，第一分析网元或第二分析网元)反馈该终端设备存在异常的信息，以使该分析网元中的至少一个可以根据不同级别的异常检测以及终端设备的传 输情况确定终端设备是否存在异常；该第一分析网元和第二分析网元中的至少一个可以向第三分析网元反馈终端设备存在异常的信息，以使该第三分析网元进一步分析该终端设备是否存在其他级别的异常；或者由该第二分析网元分析该终端设备是否存在其他级别的异常。从而当分析网元(第一分析网元、第二分析网元以及该第三分析网元中的至少一个)需要对网络中的终端设备是否异常做到“应检尽检”时，可以减小检测的终端设备的范围，进而减轻分析网元或该第二分析网元的负担。
图5是本申请实施例提供的一种异常检测的方法500的示意图。与方法400类似，在方法500中由第一用户面网元确定终端设备是否存在第一级别的异常。方法500中的分析网元可以是网络数据分析功能网元，方法500可以包括如下步骤。
S510，第一分析网元向第一用户面网元发送第五请求消息，该第五请求消息用于请求确定第一终端设备的第一数据的传输情况。
相应地，该第一用户面网元接收来自该第一分析网元的该第五请求消息。
第一终端设备的第一数据的传输情况可以参考S210中的描述，不再赘述。
可以理解，该第一终端设备的第一数据的传输情况可以用于判断该第一终端设备是否存在第一级别的异常。即在该第一用户面网元通过确定该第一数据的传输情况下，该第一用户面可以确定该第一终端设备是否存在该第一级别的异常。该第一级别的异常可以理解为根据该第一数据的传输情况确定的异常。
该第一分析网元为网络数据分析功能网元，为了便于区分，记为第二网络数据分析功能网元。即由该第二网络数据分析功能网元向第一用户面网元发送该第五请求消息，请求确定该第一终端设备的第一数据的传输情况。
可以理解，在该第二网络数据分析功能网元不能与该第一用户面网元直接通信的情况下，该第二网络数据分析功能网元可以通过会话管理网元转发该第五请求消息。
可选地，在该第二网络数据分析功能网元向该第一用户面网元发送该第一请求消息之前，该第二网络数据分析功能网元可以接收来自消费网元的第四请求消息，该第四请求消息用于请求检测至少一个终端设备是否异常，该至少一个终端设备包括该第一终端设备。其中，该消费网元可以是应用功能网元或策略管理功能网元。
可选地，该第四请求消息可以携带指示信息，该指示信息用于指示对该至少一个终端设备进行异常检测的异常级别，该异常级别可以包括该第一级别和第二级别。当该指示信息指示对该至少一个终端设备进行检测的级别为该第二级别时，该第二网络数据分析功能网元可以默认先开始低级别的异常检测，例如，该第一级别的异常检测。该第二网络数据分析功能网元可以根据该第四请求消息向该第一用户面网元发送该五请求消息。
S520，该第一用户面网元根据该第一数据的传输情况确定该第一终端设备是否存在第一级别的异常。
该步骤和S420类似，不再赘述。
S530，该第一用户面网元向该第一分析网元发送指示该第一终端设备存在该第一级别的异常的信息。
相应地，该第一分析网元接收来自该第一用户面网元的指示该第一终端设备存在该第一级别的异常的信息。
该步骤和S430类似。
S540，第一分析网元向服务该第一终端设备的至少一个用户面网元发送第二请求消息，该第二请求消息用于请求上报该第一终端设备的第二数据的传输情况。
相应地，以该至少一个用户面网元中的任一个用户面网元(例如第二用户面网元)为例，该第二用户面网元接收来自该第一分析网元的该第二请求消息。
该步骤的具体过程和S440中类似，不再赘述。
可选地，S550，在该第一分析网元向该第二用户面网元发送该第二请求消息之前，该第一分析网元也可以向该第一网元发送是否对该第一终端设备进行第二级别的异常检测的请求。
在该第一网元确定对该第一终端设备进行第二级别的异常检测的情况下，该第一分析网元接收来自该第一网元的用于指示对该第一终端设备进行第二级别的异常检测的指示信息；该第一分析网元根 据该指示信息向该第二用户面网元发送该第二请求消息。
其中，该第一网元包括该第二分析网元和策略分析网元中的至少一个，该第二分析网元可以是第三网络数据分析功能网元。该步骤具体参考S350中的描述。
可选地，S560，在该第二分析功能网元确定对该第一终端设备进行第二级别的异常检测的情况下，还可以由该第二分析功能网元向该第二用户面网元发送该第二请求消息。
具体参考S360中的描述。
S570a，该第一分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
该步骤可以参考S370a中的描述，不再赘述。
或者，S570b，第二分析网元根据第二级别的异常检测策略以及该第二数据的传输情况，确定该第一终端设备是否存在该第二级别的异常。
该步骤可以参考S370b中的描述，不再赘述。
若由该第一分析网元确定该第一终端设备是否存在该第二级别的异常(S570a)，后续的步骤可以包括三种情况：
情况一
S580a，该第一分析网元向该第二分析网元发送指示该第一终端设备存在异常的信息。
S590a，该第二分析网元确定该第一终端设备是否存在其他级别的异常。
S5100a，该第二分析网元向该消费网元发送指示该第一终端设备存在异常的信息。
S580a-S5100a与S380a-S3100a类似，不再赘述；S580a-S5100a为可选步骤。
情况二
S580b，该第一分析网元确定该第一终端设备是否存在其他级别的异常。
S590b，该第一分析网元向消费网元发送指示该第一终端设备存在异常的信息。
S580b-S590b与S380b-S390b类似，不再赘述；S580b-S590b为可选步骤。
情况三
可选地，S580c，该第一分析网元可以直接向消费网元发送指示该第一终端设备存在异常的信息。
若由该第二分析网元确定该第一终端设备是否存在该第二级别的异常(S570b)，后续的步骤也可以包括三种情况：
情况一
S580d，该第二分析网元向第三分析网元发送指示该第一终端设备存在异常的信息。
S590c，该第三分析网元分析该第一终端设备是否存在其他级别的异常。
S5100b，该第三分析网元向消费网元发送指示该第一终端设备存在异常的信息。
需要注意的是，S580d，S590c和S5100b为可选步骤。S580d、S590c和S5100b分别与S380d、S390c和S3100b类似，不再赘述。
情况二
S580e，该第二分析网元确定该第一终端设备是否存在其他级别的异常。
S590d，该第二分析网元向消费网元发送该第一终端设备存在异常的信息。
需要注意的是，S580e和S590d为可选步骤。S580e和S590d分别与S380e、S390d类似，不再赘述。
情况三
可选地，S580f，该第二分析网元直接向消费网元发送指示该第一终端设备存在异常的信息。
根据本申请实施例提供的异常检测的方法，第一用户面网元可以根据第一级别的异常检测策略以及终端设备的传输情况确定该终端设备是否存在第一级别的异常；在该终端设备存在第一级别的异常的情况下，该第一用户面网元可以向分析网元(例如，第一分析网元或第二分析网元)反馈该终端设备存在异常的信息，以使该分析网元中的至少一个可以根据不同级别的异常检测以及终端设备的传输情况确定终端设备是否存在异常；该第一分析网元和第二分析网元中的至少一个可以向第三分析网元反馈终端设备存在异常的信息，以使该第三分析网元进一步分析该终端设备是否存在其他级别的异常；或者由该第二分析网元分析该终端设备是否存在其他级别的异常。从而当分析网元(第一分析网元、 第二分析网元以及该第三分析网元中的至少一个)需要对网络中的终端设备是否异常做到“应检尽检”时，可以减小检测的终端设备的范围，进而减轻分析网元或该第二分析网元的负担。
图6是本申请实施例提供的一种异常检测的方法600的示意图。方法600可以包括如下步骤。
S601，NWDAF#1接收来自消费网元的请求消息#1，该请求消息#1用于请求NWDAF#1分析UE列表#1中的UE是否异常。
其中，该NWDAF#1可以是S210中第二分析网元的一例；该消费网元可以是网络中的功能网元，例如，PCF网元；该消费网元还可以是应用功能网元AF。
需要说明的是，该AF可以归属于运营商网络或者第三方。当该AF属于第三方时，NWDAF#1可以通过NEF接收来自该AF的该请求消息#1。
一个示例中，该请求消息#1可以包括该UE列表#1，该UE列表#1中包括至少一个UE的标识。该NWDAF#1支持分析的UE包括该至少一个UE。
另一个示例中，该请求消息#1可以携带指示信息#1，该指示信息#1指示NWDAF#1分析该NWDAF#1支持分析的全部UE。即，该UE列表#1包括该NWDAF#1支持分析的全部UE。
即，该UE列表#1可以由消费网元确定，并由消费网元通过请求消息#1发送至NWDAF#1；或者，该UE列表#1可以由NWDAF#1根据消费网元发送的指示信息#1确定，该UE列表#1包括该NWDAF#1支持分析的全部UE。
需要说明的是，消费网元可以通过订阅(subscribe)形式或通知(notify)形式请求NWDAF#1分析UE列表#1中的UE是否异常。即消费网元发送的该请求消息#1可以是订阅请求消息，NWDAF#1在接收到该订阅请求消息后，可以周期性地更新并向消费网元发送异常UE的名单；该请求消息#1还可以是通知(notify)请求消息，NWDAF#1在接收到请求消息后，可以向消费网元通知(发送)一次异常UE的名单。
S602，NWDAF#1向SMF#1发送请求消息#2，该请求消息#2用于请求SMF#1分析UE列表#2中的UE是否异常。
相应地，该SMF#1接收来自NWDAF#1的该请求消息#2。
其中，SMF#1可以是S210中第一会话管理网元的一例，请求消息#2可以是S210中第三请求消息的一例。
该UE列表#2中包括至少一个UE，该UE列表#2属于该UE列表#1。或者说，该UE列表#2中的UE为UE列表#1中UE的全部或部分。该SMF#1为该UE列表#2中UE所属的会话管理网元。
可以理解，NWDAF#1可以分别向UE列表#1中UE所属的会话管理网元发送该请求消息#2。该UE列表#1中UE所属的会话管理网元包括至少一个会话管理网元，该至少一个会话管理网元包括该SMF#1。或者说，SMF#1是该UE列表#1中的至少一个UE所属的会话管理网元。
一种可能的实现方式中，NWDAF#1在接收到来自消费网元的请求消息#1后，默认向UE列表#1中UE所属的会话管理网元发送该请求消息#2，以对该UE列表#1中UE的名单进行缩减。
另一种可能的实现方式中，NWDAF#1可以通过判断流程确定向UE列表#1中UE所属的会话管理网元发送该请求消息#2，以对该UE列表#1中UE的名单进行缩减。
例如，NWDAF#1接收该请求消息#1，若该请求消息#1携带该指示信息#1，则NWDAF#1向该UE列表#1中UE所属的会话管理网元发送该请求消息#2。具体地，该NWDAF#1根据该指示信息#1获知该NWDAF#1需对其支持的全部UE进行分析，则该NWDAF向该UE列表#1中UE所属的会话管理网元发送该请求消息#2，该UE列表#1中UE所属的会话管理网元包括该SMF#1。
又如，NWDAF#1可以根据该UE列表#1中UE的数量确定是否向该UE列表#1中UE所属的会话管理网元发送该请求消息#2。具体地，若该UE列表#1中UE的数量大于阈值#1，则该NWDAF#1向该UE列表#1中UE所属的会话管理网元发送该请求消息#2，该UE列表#1中UE所属的会话管理网元包括该SMF#1。其中，该阈值#1可以是预设的该NWDAF#1支持分析的UE的数量的上限。
需要说明的是，NWDAF#1对该UE列表#1中UE的名单进行缩减可以理解为，NWDAF#1请求其他网元分析该UE列表#1中UE是否异常，进而缩小NWDAF#1分析的UE的范围，或者说，由其他网元分析得到的该UE列表#1中存在异常的UE的名单即为缩减后的UE的名单。其中，该其他网元可以包括该UE列表#1中UE所属的会话管理网元。通过缩小NWDAF#1分析的终端设备的范围，可 以减轻NWDAF#1网元的负担。
该请求消息#2可以包括该UE列表#2中UE的标识；或者，该请求消息#2可以携带指示信息#2，该指示信息#2指示该SMF#1确定该SMF#1所支持分析的全部UE是否异常，即由该SMF#1所支持分析的全部UE组成该UE列表#2。
可选地，该请求消息#2还可以携带指示信息#3，该指示信息#3可以用于指示SMF#1对该UE列表#2中UE进行异常检测的异常级别。
分析网元(例如，NWDAF，SMF，UPF)中可以预配置至少一个策略组(或者，称为“异常检测策略组”)，该至少一个策略组中的每个策略组分别对应一个策略组级别(或者，也可以称为异常级别)。该每个策略组中可以包括至少一个异常检测策略，该至少一个异常检测策略用于检测UE是否异常。
其中，每个异常检测策略可以包括分析条目(或者，也可以称为分析参数)、分析参数对应的阈值，以及异常预期结果。可选地，还可以为每个异常检测策略配置权重，该权重用于分析网元关联一个策略组中的多个异常检测策略判断UE是否存在该异常级别的异常。
示例性地，根据异常检测策略#1判断UE是否异常可以理解为，判断该UE的分析条目#1的统计值与其对应的阈值#1的大小关系是否满足异常预期结果#1，如果满足，则可以确定UE可能存在异常。其中，分析条目#1、阈值#1以及异常阈值结果#1为该异常检测策略#1对应的分析参数、阈值以及异常预期结果。
其中，异常检测策略对应的分析条目(参数)的统计值与终端设备的数据的传输情况相关。
为了方便描述，如果UE的分析条目#1的统计值与分析条目#1对应的阈值#1的大小关系满足异常预期结果#1，则可以称该UE触发了该异常检测策略#1；或者说，终端设备的数据传输情况#1与对应的阈值#1的对应关系满足异常预期结果#1，则称该UE触发了该异常检测策略。以下省略对相同情况的说明。
示例性地，可以根据异常检测复杂度将不同的异常检测策略划分为不同的异常级别。例如，异常检测策略的复杂度可以根据执行异常检测策略所需的资源的大小、计算量、时长等确定。
表1为将不同的异常检测策略划分为不同的异常级别的一个示例。如表1中所示，可以将异常检测策略划分为三个策略组，三个策略组分别对应三个策略组级别(例如，级别#1，级别#2以及级别#3)，每个策略组对应的异常检测策略参考表1，不同的异常检测策略可以通过策略号(例如。策略号“1”至“9”)标识。
表1

如表1中所示，其中，级别#1异常检测策略的分析条目包括：UE发起呼叫的次数，UE发起的呼叫被挂断的次数。
以UE#1为例，UE#1发起呼叫可以是UE#1向被叫UE发起呼叫，该被叫UE包括至少一个UE；UE#1发起的呼叫被拒接可以指UE#1发起的呼叫被该被叫UE拒接。
级别#2异常检测策略的分析条目包括：UE被呼叫的次数、UE发起的呼叫被挂断的次数、UE发起的呼叫被拒接的次数与UE发起呼叫次数的比例、UE发起的呼叫被挂断的次数与UE发起呼叫次数的比例、UE充当主叫与UE充当被叫的比例以及UE平均向每个被叫UE发起呼叫的次数。
以UE#1为例，UE#1被呼叫可以是被叫UE向UE#1发起呼叫，该被叫UE包括至少一个UE；UE#1发起的呼叫被挂断可以指UE#1发起的呼叫被该被叫UE挂断；UE#1向被叫UE发起呼叫，则UE#1充当主叫，反之，UE#1充当被叫；UE#1充当主叫与UE#1充当被叫的比例可以理解为UE#1发起呼叫的次数与UE#1被呼叫的次数的比例；UE#1可以向多个被叫UE发起不同次数的呼叫，例如，UE#1向被叫UE#2发起5次呼叫，向被叫UE#3发起7次呼叫，则UE#1平均向每被叫发起呼叫的次数为6。
级别#3异常检测策略的分析条目包括：UE切换移动设备(mobile euipment，ME)的频率、UE切换的ME的标识跨度、UE呼叫目标地区的离散度、UE通话时长区间的离散度、UE发起呼叫的时间的离散度等。
以UE#1为例，UE#1可以切换多个ME，UE#1切换ME的频率可以通过预设时长内UE#1切换ME的次数确定；该多个ME具有ME的标识，例如，国际移动设备识别码(International Mobile Equipment Identity，IMEI)，UE#1切换的ME的标识跨度可以指该多个IMEI的跨度；该多个IMEI的跨度可以通过IMEI的内容确定，例如，如果多个IMEI的内容连续，则可以认为IMEI的跨度较小；如果IMEI的内容随机且无规律，则可以认为多IMEI的跨度较大；UE#1呼叫目标地区的离散度可以指UE#1向多个被叫UE发起呼叫时，该多个被叫UE区域位置的离散度；UE#1通话时长离散度可以指UE#1与其他UE通话的时长的离散度，该其他UE可以为主叫UE，也可以为被叫UE；UE#1可以在多个时刻向不同的被叫UE发起呼叫，UE#1发起呼叫的时间的离散度可以指该多个时刻的离散度。
表1中各级别的异常检测策略的复杂度可以是根据执行异常检测策略所需的资源的大小、计算量、时长等确定的。
例如，如果分析网元在第一预设时间段中统计UE发起呼叫和/或UE发起的呼叫被挂断的次数大于阈值，则分析网元可以确定UE可能存在级别#1的异常。如果分析网元在第二预设时间段中统计UE被呼叫的次数小于阈值，则分析网元可以确定UE可能存在级别#2的异常，其中，该第二预设时间段的时长(第一时长)可以设置大于该第一预设时间段的时长(第二时长)。
可以理解，正常UE与异常UE在短时间内发起呼叫的次数可能相差较大，而被呼叫的次数可能相差较小，为了检测UE是否异常，统计UE被呼叫的次数的预设时长需大于统计UE发起呼叫的预设时长。因此，可以将统计UE发起呼叫和/或UE发起呼叫的次数的异常检测策略划分为一个策略组，该策略组对应一个策略组级别(级别#1)。可以将统计UE被呼叫的次数的异常检测策略划分为另一个策略组，该策略组对应另一个策略组级别(级别#2)，级别#1和级别#2的异常检测复杂度可以根据检测的预设时长(第一时长和第二时长)来衡量。
又如，分析网元可通过统计UE发起呼叫和/或UE发起的呼叫被挂断的次数确定UE是否存在级别#2的异常；分析网元还可以通过统计UE发起的呼叫被挂断的次数与UE发起呼叫次数的比例确定UE是否存在级别#2的异常。可以理解，分析网元统计UE发起的呼叫被挂断的次数与UE发起呼叫次数的比例的计算复杂度，可能大于分析网元统计UE发起呼叫和/或UE发起的呼叫被挂断的次数的复杂度，因此，可以将统计UE发起呼叫和/或UE发起呼叫的次数的异常检测策略划分为一个策略组，该策略组对应一个策略组级别(级别#1)。可以将统计UE发起的呼叫被挂断的次数与UE发起呼叫次数的比例的异常检测策略划分为一个策略组，该策略组对应一个策略组级别(级别#2)，级别#1和级别#2的异常检测复杂度可以根据计算量来衡量。
再如，进一步地，分析网元确定UE是否异常的异常检测策略还可以包括统计表1中级别#3对应的异常检测策略(例如，统计UE呼叫目标地区离散度、UE通话时长区间离散度等)，分析网元执行级别#3中异常检测策略相较于执行级别#1、级别#2中异常检测策略，所需的时长更长、计算量更大。
应理解，以上对策略组级别的划分仅为示例，该策略组级别对应的异常检测策略可以是表1中异常检测策略的任意组合。例如，可以将级别#2中的部分异常检测策略划分至级别#3；再如，将级别#2或级别#3中的异常检测策略划分为更多的级别。
该SMF#1中可以预配置至少一个级别的策略组，该至少一个级别的策略组包括至少一个异常检测策略。
一种可能的情况中，SMF#1中预配置的至少一个级别的策略组可以包括最低级别的策略组，例如，级别#1(S230中第一级别的一例)的异常检测策略。
另一种可能的情况中，SMF#1中可以不配置最低级别的异常检测策略。
可以理解，级别#1异常检测策略的分析条目的统计值可通过统计与UE相关的至少一个会话的数据包的数量确定。例如，UE#1向UE#2发起呼叫，则UE#1向UE#2发送数据包#1，该数据包#1携带UE#1向UE#2发起呼叫的信息，通过统计数据包#1的数量可确定UE#1向UE#2发起呼叫的次数。因此，该级别#1的异常检测策略可以配置在可以统计UE会话数据包的其他网元中，例如UPF中。
SMF#1在接收到该请求消息#2后，可以根据该指示信息#3确定对UE列表#2中UE进行异常检测的级别。若该指示信息#3指示SMF对UE列表#2中UE进行异常检测的级别较高(例如，指示表1中级别#2和级别#3中的至少一个)，则SMF#1可以默认先开启最低级别(例如，表1中的级别#1)的异常检测。
可选地，该请求消息#2中还可以包括策略号或分析条目。即NWDAF#1可以指定SMF#1进行异常检测的异常检测策略。
可选地，该请求消息#2中还可以包括分析条目对应的阈值。可以理解，当该请求消息#2携带分析条目对应的阈值时，SMF#2可以根据该请求消息#2中携带的阈值检测UE是否异常，而不根据预配置的阈值进行检测。
一个示例中，若SMF#1中未配置最低级别(例如，级别#1)的异常检测策略，SMF#1确定UE#1是否存在级别#1的异常的具体步骤参考S603a至S606a。
S603a，SMF#1向UPF#1发送请求消息#3，该请求消息#3用于请求该UPF#1确定UE#1的第一数据的传输情况。
相应地，该UPF#1接收来自该SMF#1的该请求消息#3。
该UE#1为UE列表#2中任一UE，该UE#1可以是S210中第一终端设备的一例；该UPF#1为UE#1所属的UPF，该UPF#1可以是S210中第一用户面网元的一例。该请求消息#3可以是S410中第五请求消息的一例。
该第一数据包括该UPF#1中该UE#1的至少一个会话的数据包。通过确定该UPF#1中该UE#1的至少一个会话的数据包的传输情况可以确级别#1中分析条目的统计值。
示例性地，该至少一个会话包括会话#1，该会话#1为该UE#1发起呼叫的会话。该会话#1的数据包可以包括数据包#1，数据包#1指示该UE#1向至少一个UE发起呼叫；该会话#1的数据包还可以包括数据包#2，数据包#2包括至少一个UE发送的用于对该UE#1发起的呼叫作出响应的数据包。
具体地，该请求消息#3可以携带数据包检测规则(packet detection rule，PDR)#1。该PDR#1可以是S210中第一级别的PDR的一例，该PDR#1用于匹配该第一数据。
示例性地，PDR#1内可以包含一个包探测信息(packet detection information，PDI)参数，PDI参数包含一个或若干个匹配字段，用于与UPF收到的数据包进行匹配，识别数据包。
S604a，UPF#1根据该请求消息#3确定UE#1是否存在级别#1的异常。
具体地，UPF#1根据该请求消息#3统计与该PDR#1相匹配的第一数据，并确定该第一数据的传输情况；该UPE#1根据该第一数据的传输情况以及级别#1的异常检测策略确定该UE#1是否存在级别#1的异常。例如，UPF#1根据第一数据的传输情况与第一阈值的大小关系确定该UE#1是否存在级别#1的异常。
以UPF#1执行表1中的异常检测策略#1，以下简称策略#1(“策略号”为“1”)为例，UPF#1根据该 PDR#1匹配UE#1发起呼叫的数据包#1(第一数据包的一例)。具体地，UPF#1收到一个数据包后，将数据包与该PDR#1相匹配，如果该数据包的源地址为UE#1的地址，且数据包内容类型为建立会话的信令，则UPF#1统计数据包#1的计数器加1，即UPF#1确定UE#1发起呼叫的次数加1。在预设时间段内，如果UPF#1统计UE#1发起呼叫的次数大于或等于阈值#1(例如，表1中的T1)，则UPF#1确定UE#1可能存在级别#1的异常。
类似地，如果UPF#1执行表1中的策略#2(“策略号”为“2”)，则UPF#1根据该PDR#1匹配指示UE#1发起的呼叫被拒接的数据包#2(第一数据包的一例)。具体地，UPF#1收到一个来自AF的数据包后，UPF#1将数据包与该PDR#1相匹配。如果该数据包的目标地址为UE#1的地址，且数据包内容类型为取消会话的信令，则UPF#1统计数据包#2的计数器加1，即UPF#1确定UE#1的呼叫被拒接的次数加1。在预设时间段内，如果UPF#1统计UE#1发起的呼叫被拒接的次数大于或等于阈值#2(例如，表1中的T2)，则UPF#1确定UE#1可能存在级别#1的异常。
可选地，UPF#1结合级别#1的多个异常检测策略确定UE#1是否存在级别#1的异常。UPF#1可以配置UE存在级别#1异常的总权重W，当UE当前的总权重Wt大于等于W时，UPF#1确定UE存在级别#1的异常。其中，Wt可以为UE触发策略对应的阈值的累加。
示例性地，UPF#1结合该策略#1和策略#2确定UE是否存在级别#1的异常。若UE#1发起呼叫的次数大于阈值T1，则Wt＝W1；在UE#1发起呼叫的次数大于T1的同时，若UE#1发起的呼叫被拒接的次数大于T2，则Wt＝W1+W2；若Wt大于等于W，则UPF#1可以确定UE#1存在级别#1的异常。
S605a，UPF#1向SMF#1发送指示信息#1；相应地，SMF#1接收来自UPF#1的该指示信息#1。
该指示信息#1用于指示UE#1存在级别#1的异常的信息。该指示信息#1可以是S430中该第一用户面网元向该第一分析网元发送指示该第一终端设备存在该第一级别的异常的信息的一例。
该指示信息#1可以包括UE#1的标识信息。
可选地，该指示信息#1还可以包括UE#1触发的策略的信息。示例性地，该触发的策略的信息可以包括：触发策略的标识，事件的标识，触发事件的次数、触发事件的时间等。
其中，触发事件可以是UE#1的至少一个会话对应的事件，例如，UE#1向UE#2发起呼叫，则UE#1发起会话#1，UE#1向UE#2发起呼叫可以称为会话#1对应的一个事件。UPF#1可以通过确定会话#1的数据包确定UE#1触发的事件。例如，数据包#1指示UE#1向UE#2发起呼叫，若UPF#1检测到数据包#1，则UPF#1确定UE#1触发事件#1，事件#1为UE#1向UE#2发起呼叫。
示例性地，UE#1触发的策略的信息如表2中所示。该信息可以用于SMF#1确定UE#1是否存在其他级别(例如，级别#2)的异常。
表2
另一个示例中，若SMF#1中配置了最低级别(例如，级别#1)的异常检测策略，则SMF#1确定UE#1是否存在级别#1的异常的具体步骤参考S603b至S606b。
S603b，SMF#1向UPF#1发送请求消息#4，该请求消息#4用于请求上报UE#1的第一数据的传输情况。
该请求消息#4可以是S210中第一请求消息的一例。该请求消息#4可以携带PDR#1，PDR#1的具体内容可以参考S603a中的描述。
S604b，UPF#1向该SMF#1发送UE#1的第一数据的传输情况。
具体地，UPF#1根据该请求消息向该SMF#1发送UE#1的第一数据的传输情况，该UE#1的第一数据的传输情况可以包括UE的标识、事件的标识。
示例性地，该UE#1的第一数据的传输情况如表3中所示。
表3

UPF#1可以按照预配置的上报规则向SMF#1发送UE#1的第一数据的传输情况，其中，该上报规则例如可以是UE触发事件即上报，或者定期上报。
S605b，SMF#1根据UE#1的第一数据的传输情况确定UE#1是否存在异常。
具体地，SMF#1根据级别#1的异常检测策略以及该UE#1的第一数据的传输情况确定该UE#1是否存在级别#1的异常。SMF#1确定该UE#1是否存在级别#1的异常的具体方式，可以参考S604a中UPF#1确定UE#1是否异常的描述。
可以理解，SMF#1对该UE列表#2中的其他UE的级别#1的异常检测和以上对UE#1的级别#1的异常检测类似。
在SMF#1确定该UE列表#2中存在级别#1的异常的UE(记为第一UE)后，SMF#1可确定是否继续对该第一UE中的UE进行其他级别的异常检测。SMF#1确定是否继续对该第一UE中的UE进行其他级别的异常检测包括三种情况。
情况一
S606a，SMF#1自行判断是否继续对该第一UE中的UE进行其他级别的异常检测。
例如，SMF#1可以默认对该第一UE进行其他级别的异常检测，该其他级别可以是SMF#1中配置的级别(例如，级别#2)。
又如，SMF#1可以根据第一UE的数量判断是否对第一UE开启级别#2的异常检测。示例性地，当该第一UE的数量大于阈值#3时，SMF#1开启对该第一UE的级别#2的异常检测。
情况二
SMF#1可通过NWDAF判断是否继续对该第一UE中的UE进行其他级别的异常检测。具体可以包括以下步骤。
S606b，SMF向NWDAF#2发送请求消息；相应地，NWDAF#2接收该请求消息。
该请求消息用于请求确定是否对该第一UE进行级别#2的异常检测。
该NWDAF#2与上述步骤中的NWDAF#1可以是同一个NWDAF，也可以不是同一个。例如，该NWDAF#2可以是管理NWDAF#1的NWDAF。
该请求消息可以携带指示该第一UE存在该级别#1的异常的信息。该请求消息可以包括该第一UE中每个UE的标识。可选地，该请求消息中还可以包括第一UE中每个UE触发策略的级别，每个UE触发策略的总权重。
示例性地，SMF#1可以按照预配置的上报规则，定时、或在第一UE的名单更新后、或在第一UE数量达到阈值后，向NWDAF#2发送该请求消息。
S607a，NWDAF#2确定是否对该第一UE开启级别#2的异常检测。
例如，NWDAF#2可以根据运营商策略直接向SMF#1下发级别#2异常检测的请求，请求SMF#2开启对该第一UE的级别#2的异常检测。
再如，NWDAF#2可以根据第一UE的数量、第一UE中每个UE触发策略的总权重等信息确定向SMF#1下发级别#2异常检测的请求，请求SMF#1开启对该第一UE的级别#2的异常检测。
可选地，S608a，在NWDAF#2向SMF#1下发级别#2异常检测的请求之前，NWDAF#2还可以向PCF发送请求消息，该请求消息用于请求PCF确定是否对第一UE进行级别#2的异常检测。相应地，PCF接收来自NWDAF#2的该请求消息。
NWDAF#2向PCF发送的请求消息可以携带第一UE的标识，可选地，该请求消息中还可以携带第一UE中每个UE触发策略的级别、每个UE触发策略的总权重。PCF可以根据该请求消息查询第一UE的策略信息。
S609，PCF根据第一UE的策略信息确定是否对第一UE进行级别#2的异常检测。
例如，PCF可以查询是该第一UE是否为“白名单”中的UE，“白名单”中的UE可以理解为无需确定是否异常的UE。若该第一UE中存在“白名单”中的UE(例如，UE#1)，则PCF从该第一UE中删 除该UE#1，即PCF修改该第一UE的名单。
可选地，PCF在接收到该请求消息后，还可以确定该第一UE中是否存在“黑名单”中的UE，“黑名单”中的UE可以理解为存在异常的可能性较大的UE。若该第一UE中存在“黑名单”中的UE(例如，UE#2)，则PCF从该第一UE中删除该UE#2。再如，若第一UE中某个UE触发策略的权重较大，PCF还可以将该UE加入“黑名单”，以进一步管理该UE。
进一步地，PCF还可以根据该请求消息指定该第一UE名单中部分或全部UE的异常检测策略，策略对应的权重以及该策略下分析条目对应的阈值。示例性地，该部分UE可以是PCF添加的UE、第一UE中触发策略权重较高的UE。例如，PCF针对该部分UE发送策略#3对应的阈值以及权重，该策略#3对应的阈值可以小于阈值T3，该权重可以大于W3，从而可以加大对该部分UE的异常检测的力度。
可选地，S610，PCF向NWDAF#2发送指示对第一UE进行级别#2的异常检测的信息#1。相应地，NWDAF#2接收来自PCF的该信息#1。
该信息#1可以携带需进行级别#2异常检测的UE的名单，即修改后的第一UE的名单。该信息#1还可以携带对该修改后的第一UE名单中UE进行异常检测的异常检测策略，策略对应的权重以及该策略下分析条目对应的阈值。
S611，NWDAF#2向SMF#1发送级别#2异常检测的请求消息，该请求消息用于请求SMF#1对该第一UE开启级别#2的异常检测，或请求SMF#1对该修改后的第一UE开启级别#2的异常检测。相应地，SMF#1接收来自NWDAF#2的该请求消息。
情况三
SMF#1可直接通过PCF判断是否继续对该第一UE中的UE进行其他级别的异常检测。
S606c，SMF#1向该PCF发送请求消息，该请求消息用于请求PCF确定是否对第一UE进行级别#2的异常检测；相应地，PCF接收来自PCF的该请求消息。
S607b，PCF确定是否对该第一UE进行级别#2的异常检测。
PCF确定是否对该第一UE进行级别#2的异常检测可以参考S609b中的描述。
S608b，PCF向SMF#1发送指示对第一UE进行级别#2的异常检测的信息#1。相应地，SMF#1接收来自PCF的该信息#1。
通过以上方式SMF#1可以确定对第一UE开启级别#2的异常检测。进而，SMF#1根据级别#2的异常检测策略确定该第一UE是否存在级别#2的异常。
以该第一UE包括该UE#1为例，SMF确定UE#1是否存在级别#2的异常可以参考S612至S615。
S612，SMF#1向服务该UE#1的至少一个UPF发送请求消息#5，该请求消息#5用于请求该至少一个UPF上报该UE#1的第二数据的传输情况。
相应地，该至少一个UPF接收来自SMF#1的该请求消息#5。
其中，服务该UE#1的该至少一个UPF可以参考S240中的描述。该请求消息#5可以是S240中第二请求消息的一例。该请求消息#5可以携带PDR#2，该PDR#2用于匹配该第二数据。
该第二数据可以参考S240中第二数据的描述。
示例性地，该第二数据包括该至少一个UPF中该UE#1的至少一个会话的数据包。通过确定该至少一个UPF中该UE#1的至少一个会话的数据包的传输情况可以确级别#2中分析条目的统计值。例如，该至少一个会话包括会话#2，该会话#2为至少一个UE向该UE#1发起呼叫的会话，该会话#2的数据包可以包括数据包#2，数据包#2指示至少一个UE向该UE#1发起呼叫。
S613，UPF#2向SMF#1发送该UE#1的第二数据的传输情况。
相应地，该SMF#1接收来自该UPF#2的该UE#1的第二数据的传输情况。
该UPF#2为该至少一个UPF中的任一个UPF。
一种可能的情况中，该至少一个UPF包括该UPF#1。即该UPF#2和UPF#1可能是同一个UPF。
另一种可能的情况中，该至少一个UPF不包括该UPF#1。即该UPF#2为除UPF#1以外的服务该UE#1的至少一个UPF中的任一个。
具体地，UPF#2根据该请求消息#5统计与该PDR#2相匹配的第二数据，并确定该第二数据的传输情况。以SMF#1执行表1中的策略#3(“策略号”为“3”)为例，UPF#2在接收到该请求消息#4后，根据该PDR#2匹配UE#1被呼叫的数据包#2(第二数据的一例)。UPF#2收到一个数据包后，将数据包 与该PDR#2相匹配，如果该数据包的目标地址为UE#1的地址，且数据包内容类型为其他终端设备向UE#1发起的会话的信令，则UPF#2确定UE#1被呼叫。
该UE#1的第二数据的传输情况可以包括UE的标识、事件的标识。
例如，事件的标识包括事件#2的标识，该事件#2为UE#3向UE#1发起呼叫。UPF#2可以通过确定会话#2的第二数据确定UE#3向UE#1发起呼叫。例如，会话#2的第二数据包括数据包#2，数据包#2指示UE#3向UE#1发起呼叫，若UPF#2检测到该数据包#2，则UPF#2确定UE#1触发该事件#2，UPF#2向SMF#1发送该事件#2的标识。
S614，SMF#1根据该UE#1的第二数据的传输情况确定UE#1是否存在级别#2的异常。
具体地，SMF#1根据级别#2的异常检测策略以及该UE#1的第一数据的传输情况确定该UE#1是否存在级别#2的异常。SMF#1确定该UE#1是否存在级别#1的异常的具体方式，可以参考S432a中UPF#1确定UE#1是否异常的描述。
例如，该UE#1的第二数据的传输情况包括UE#1的标识、事件#2的标识，SMF在每次收到该UE#1的第二数据的传输情况后，可以在本地累加计数器#1，该计数器#1用于统计UE#1被呼叫的次数。在预设的时间段内，如果SMF#1收到的UE#1被呼叫的事件的次数大于阈值#2，则SMF#1确定UE#1可能存在级别#2的异常。
又如，该UE#1的第二数据的传输情况包括UE#1的标识、事件#3的标识，事件#3表示UE#1发起的呼叫被挂断。SMF#1还可以根据该UE#1的第二数据的传输情况统计UE#1发起的呼叫被挂断的次数。在预设的时间段内，如果SMF#1收到的UE#1发起的呼叫被挂断的事件的次数小于于阈值#2，则SMF#1确定UE#1可能存在级别#2的异常。
再如，该UE#1的第二数据的传输情况还可以包括事件#1的标识，事件#1表示UE#1发起的呼叫。SMF#1还可以根据该UE#1的第二数据的传输情况确定UE#1的呼叫被挂断的次数占UE#1发起呼叫次数的比例。如果UE#1的呼叫被挂断的次数占UE#1发起呼叫次数的比例小于阈值，则SMF确定UE#1存在级别#2的异常。同理，SMF还可以根据UE#1的呼叫被拒接的次数占UE#1发起呼叫次数的比例与阈值的大小关系，确定UE#1是否存在级别#2的异常。
可选地，SMF#1可以结合级别#2异常检测策略中的多项判断UE#1是否存在级别#2的异常。具体和S604a中UPF#1结合级别#1异常检测策略中的多项判断UE#1是否存在级别#1的异常类似。
需要说明的是，SMF#1接收来自该UPF#2的该UE#1的第二数据的传输情况仅为示例，SMF#1可以接收来自服务该UE#1的至少一个UPF的该UE#1的第二数据的传输情况。可选地，在该至少一个UPF包括UPF#1的情况下，UPF#1可以直接向该SMF#1发送该UE#1的第二数据的传输情况，而无需SMF#1请求。
通过SMF#1分析该第一UE是否存在级别#2的异常可以进一步缩小异常UE的名单，同时可以减小异常UE的误报率，或者说，可以提高异常终端设备检测的精准度。
S615，SMF#1向NWDAF#1发送响应消息#2，该响应消息#2包括第二UE的标识，该第二UE为该UE列表#2中存在异常的UE。
该响应消息#2可以是对S602中请求消息#2的响应。可选地，该响应消息#2还可以携带第一信息，该第一信息可以包括UE触发策略标识的集合以及UE触发策略的总权重，该第一信息用于NWDAF#1进一步确定第二UE是否存在其他级别(例如，级别#3)异常。该响应消息#2包括的信息可以如表4中第一行所示。
表4
可选地，该响应消息#2还可以包括UE触发策略(包括级别#1和级别#2中的策略)的信息。UE触发的策略的信息可以用于NWDAF#1确定第二UE是否存在异常。该响应消息#2包括的信息如表5中第一行所示。
表5
示例性地，SMF#1可以按照预配置的发送条件，在每次该第二UE的名单更新时、或者定时、定期，或者在该第二UE的数量超过阈值时，向该NWADF#1发送该响应消息#2。
可选地，S616，NWDAF#1确定该第二UE是否存在其他级别的异常。
应理解，NWDAF#1确定的异常的级别可以与SMF#1确定的异常的级别不同。
一种可能的实现方式中，NWDAF#1可以根据现有技术的方式确定第二UE是否存在异常，NWDAF#1的检测流程可以参考3GPP TS 23.288中的描述。示例性地，NWDAF#1可以向AMF请求第二UE的第三数据，该第三数据例如可以接入数据、位置数据，NWDAF#1根据该第三数据确定第二UE是否异常。NWDAF#1确定异常的具体方式可以参考现有的相关描述，在此不再赘述。
另一种可能的实现方式中，NWDAF#1根据NWDAF#1支持分析的异常检测策略，确定第二UE是否存在配置级别的异常。例如，SMF#1确定第二UE存在级别#2的异常，NWDAF#1可以进一步确定该第二UE是否存在级别#3的异常。
一个示例中，NWDAF#1根据SMF#1上报的响应消息#2确定该第二UE是否存在级别#3的异常，该响应消息#2包括的信息可以如表4中所示。例如，SMF#1上报第二UE中UE#1向UE#2发起呼叫的时间为t2，UE#1的呼叫被UE#2挂断的时间为t2，则NWDAF#1可以根据该响应消息#2确定UE#1和UE#2通话的时长；NWDAF#1还可以根据该响应消息#2确定UE#1和其他UE通话的时长，从而NWDAF#1可以确定UE#1通话时长的离散度，进而确定UE#1是否存在级别#3的异常。同理，NWDAF#1还可以根据该响应消息#2确定UE#1是否触发级别#3中的其他策略，并根据UE#1触发的策略确定UE#1确定UE是否存在级别#3的异常。可选地，NWDAF#1可以结合UE#1触发的多个策略确定UE#1是否存在级别#3的异常。
另一个示例中，NWDAF#1针对缩减后UE(第二UE)名单，向SMF#1发送事件曝光订阅请求(Event Exposure Subscribe Request)，该订阅请求用于请求SMF#1上报第二UE的第二数据的传输情况。
SMF#1上报的上报第二UE的第二数据的传输情况可以通过服务该第二UE的至少一个UPF获取，具体可以参考S612至S614中的描述。SMF#1可以通过N4接口直接将第二UE的第二数据的传输情况上报至NWDAF#1。NWDAF#1确定第二UE是否存在级别#3的异常可以参考该可能的实现方式中的第一个示例。
基于上述方案，当NWDAF#1需要对网络中的UE做到“应检尽检”时，即需要分析网络中尽可能多的UE的行为时，NWDAF#1可以通过SMF和UPF中的至少一个网元缩减需检测的UE的名单，减小NWDAF#1的负担；同时，SMF和UPF根据配置的异常检测策略对UE名单的进行缩减，可以提高异常UE检测的精准度。
图7是本申请实施例提供的另一种异常检测的方法700的示意图。在图6所示方法中，由NWDAF发起缩小需分析的终端设备的范围请求，并由其他网元(例如，SMF、UPF)将缩小后的终端设备的范 围发送至NWDAF；在图7所示的方法中，可以由其他网元(例如，SMF、UPF)将缩小后的终端设备的范围发送至NWDAF。方法700可以包括如下步骤。
S701，预先在相关NF(例如：SMF、AMF和NWDAF)中配置各级别的异常检测策略，各级别的异常检测策略如表1中所示。
示例性地，UPF中可以配置级别#1的异常检测策略，SMF中配置级别#2的异常检测策略，NWDAF可以配置级别#3的异常检测策略。以上各网元的配置仅为示例，本申请对各网元配置的具体级别不做限制。例如，SMF中还可以配置级别#3的异常检测策略。
S702，SMF接收来自UE#1的会话建立请求消息。
示例性地，SMF可以通过AMF接收来自UE#1的该会话建立请求消息，该会话建立请求消息用于请求SMF建立UE#1的会话。SMF可以根据该会话建立请求消息选择服务UE#1的UPF。该服务UE#1的UPF包括至少一个UPF。SMF如何选择服务UE#1的UPF可以参考协议3GPP TS 23.501中的相关描述。
S703，SMF向该UPF#1发送请求消息，该请求消息用于请求该UPF#1确定UE#1的第一数据的传输情况；相应地，该UPF#1接收来自该SMF的该请求消息#3。
该UPF#1为服务UE#1的至少一个UPF中的一个UPF，该UPF#1可以是S210中第一用户面网元的一例。该请求消息以及该第一数据的相关内容可以参考S603a中的描述，在此不再赘述。
S704，UPF#1根据该请求消息确定UE#1是否存在级别#1的异常。
UPF#1根据该请求消息确定UE#1是否存在级别#1的异常的具体过程可以参考S604a中的描述。
S705，UPF#1向SMF发送指示信息#1；相应地，SMF接收来自UPF#1的该指示信息#1。
该指示信息#1用于指示UE#1存在级别#1的异常。该指示信息#1包括的内容可以参考S605a中的描述。
可以理解，SMF可能在预设时间内接收到多个UE的会话请求消息，SMF分析该多个UE是否存在级别#1的异常和该SMF分析UE#1是否存在级别#1的异常类似。也就是说，SMF在预设的时间内可以通过至少一个UPF确定至少一个UE(记为第一UE)存在级别#1的异常。
在SMF确定该第一UE存在级别#1的异常后，SMF#1可确定是否继续对该第一UE中的UE进行其他级别的异常检测。SMF#1确定是否继续对该第一UE中的UE进行其他级别的异常检测包括三种情况。
情况一：SMF#1可自行判断是否继续对该第一UE中的UE进行其他级别的异常检测。
情况二：SMF#1可通过NWDAF判断是否继续对该第一UE中的UE进行其他级别的异常检测。具体参考S606b，S607a至S608a，S609至S611的描述。
情况三：SMF#1可通过PCF判断是否继续对该第一UE中的UE进行其他级别的异常检测。具体参考S606c，S607b以及S608b的描述。
SMF#1确定对第一UE开启级别#2的异常检测后，SMF#1根据级别#2的异常检测策略确定该第一UE是否存在级别#2的异常。
以SMF判断该第一UE中的该UE#1是否存在其他级别(例如，级别#2)的异常为例，该过程可以包括S706至S709。
S706，SMF向服务该UE#1的至少一个UPF发送请求消息，该请求消息用于请求该至少一个UPF上报该UE#1的第二数据的传输情况。
相应地，该至少一个UPF接收来自SMF的该请求消息。
该步骤可以参考S612的相关描述。
S707，UPF#2向SMF#1发送该UE#1的第二数据的传输情况。
相应地，该SMF#1接收来自该UPF#2的该UE#1的第二数据的传输情况。
该UPF#2为该至少一个UPF中的任一个UPF。
一种可能的情况中，该至少一个UPF包括该UPF#1。即该UPF#2和UPF#1可能是同一个UPF。
另一种可能的情况中，该至少一个UPF不包括该UPF#1。即该UPF#2为除UPF#1以外的服务该UE#1的至少一个UPF中的任一个。
该UE#1的第二数据的传输情况可以包括UE的标识、事件的标识。具体参考S453的相关描述。
S708，SMF根据该UE#1的第二数据的传输情况确定UE#1是否存在其他级别的异常。
具体实现方式可以参考S615中的描述。
S709，SMF向NWDAF#1发送通知消息#1，该通知消息#1包括第二UE的标识，该第二UE为第一UE中存在异常的UE。
该通知消息#3可以参考S616中的响应消息#2。
在一种可能的实现方式中，SMF以第一周期向NWDAF#1发送该通知消息#3。该第一周期可以根据实际情况设定。也就是说，SMF在预设的时长内确定第一UE存在异常，SMF向NWDAF#1发送第一UE存在异常的信息。
S710，NWDAF#1确定该第二UE是否存在其他级别的异常。
该步骤可以参考S617中的描述。
基于上述方案，SMF可以在UE建立会话时，分析该UE是否存在异常，并向NWDAF上报网络中存在异常的UE。由NWDAF进一步确定该网络中存在异常的UE是否存在其他异常，可以减轻NWDAF的负担，同时提高异常UE检测的精准度。
图8是本申请实施例提供的另一种异常检测的方法800的示意图。在图8所示方法中，可以由AF指定对终端设备进行异常分析的异常级别。方法800可以包括如下步骤。
S801，预先在相关NF(例如：SMF、AMF和NWDAF)中配置各级别的异常检测策略，各级别的异常检测策略如表1中所示。
示例性地，UPF中可以配置级别#1的异常检测策略，SMF中配置级别#2的异常检测策略，NWDAF可以配置级别#3的异常检测策略。以上各网元的配置仅为示例，本申请对各网元配置的具体级别不做限制。例如，SMF中还可以配置级别#3的异常检测策略。
S802，AF向NWDAF发送请求消息#1，该请求消息#1用于请求NWDAF分析UE列表#1中的UE是否异常。
需要说明的是，该AF可以归属于运营商网络或者第三方。当该AF属于第三方时，AF可以通过NEF向NWDAF发送该请求消息#1。
该请求消息#1可以包括UE列表#1中的UE的标识，即由AF指定NWDAF分析的终端设备的标识。该请求消息还包括指示信息#4，该指示信息#4指示异常级别。示例性地，AF中可以预先配置终端设备的异常级别，以及各异常级别对应的异常检测策略。该异常级别以及异常检测策略可以参考S602中的描述。
可选地，该请求消息#1还包括各异常检测策略对应的阈值和异常检测策略对应的权重中的至少一种。
也就是说，在该实施例中，可以由AF指定NWDAF分析的终端设备，分析的异常级别。可选地，AF还可以指定异常级别对应的异常检测策略的阈值和权重。
S803，NWDAF确定该UE列表#1中的UE是否存在异常。
根据AF指定的异常级别，NWDAF分析该UE列表#1中的UE是否存在异常可以分为两种情况。
情况一，NWDAF根据指定的级别向SMF发送请求消息，该请求消息用于请求SMF确定该UE列表#1中的UE是否存在指定级别的异常。
可以理解，在该种情况下，AF指定的异常级别可以是SMF或者UPF支持分析的异常级别(例如，级别#1或级别#2)。
示例性地，AF可以指定NWDAF分析该UE列表#1中的UE是否存在级别#1和/或级别#2的异常。NWDAF确定该UE#1列表#1中的UE是否存在级别#1和/或级别#2的异常可以参考图6中S602至S616中的描述，不再赘述。
可选地，若由AF指定各异常级别中的异常检测策略，异常检测策略对应的阈值以及异常检测策略对应的权重，则NWDAF按照AF指定的异常检测策略、异常检测策略对应的阈值以及异常检测策略对应的权重进行异常检测。
情况二，NWDAF根据指定的异常级别分析该UE列表#1中的UE是否存在异常。
可以理解，在该种情况下，该AF指示的异常级别为该NWDAF支持分析的级别。示例性地，AF可以指示NWDAF分析该UE列表#1中的UE是否存在级别#3的异常。
一个示例中，若NWDAF接收的指示为分析该UE列表#1中的UE是否存在级别#3的异常，则NWDAF可以默认对该UE列表#1中的UE开启级别#1和级别#2的异常检测；NWDAF检测第一UE是否存在级别#3的异常，该第一UE为UE列表#1中存在级别#1和/或级别#2异常的UE。NWDAF确定该UE#1列表#1中的UE是否存在级别#1和/或级别#2的异常可以参考图6中S602至S616；NWDAF可以进一步分析该第一UE是否存在级别#3的异常，该步骤可以参考S617中的描述。
另一个示例中，NWDAF接收的指示为分析该UE列表#1中的UE是否存在级别#3的异常，则NWDAF对该UE列表#1中的UE开启级别#3的异常检测；具体可以参考图6中S617中的描述。
S804，NWDAF向AF发送通知消息，该通知消息包括第二UE的标识，该第二UE为该UE列表#1中存在异常的UE。相应地，AF接收来自NWDAF的该通知消息。
可选地，该通知消息还可以包括，第二UE触发的异常的异常级别、异常级别对应的异常检测策略的标识、异常检测策略对应的阈值以及第二UE中每个UE触发策略的总权重。
S805，AF确定是否对该第二UE进行异常检测。
示例性地，AF可以根据该通知消息确定是否对该第二UE进行异常检测。
例如，若该第二UE的数量超过预设的阈值，则AF确定对该第二UE进行异常检测。
可选地，AF还可以根据应用层的需求确定是否对该第二UE进行异常检测。
例如，在上述步骤中，由AF指示对该UE列表#1中的UE进行级别#1的分析，相应地，该第二UE为该UE列表#1中存在级别#1异常的UE；AF根据应用层的需求还可以请求NWDAF检测该第二UE是否存在其他级别(例如，级别#2或级别#3)的异常。
可选地，AF还可以根据该通知消息确定该第二UE中各UE触发策略的权重，AF指示NWDAF对该第二UE中触发策略权重较高的UE进行异常检测，即AF可以对该第二UE中的部分UE进行异常检测。或者，AF还可以根据应用层的指示增加需进行异常检测的UE的名单。即AF可以修改第二UE的名单(增加或删除部分UE)。
可选地，若AF确定对该第二UE进行异常检测，AF还可以进一步指定各异常级别中的异常检测策略，异常检测对应的阈值以及异常检测策略对应的权重。后续，由NWDAF按照AF指定的异常检测策略、异常检测策略对应的阈值以及异常检测策略对应的权重进行检测。
其中，AF请求确定第二UE是否存在异常，和AF请求分析该UE列表#1中的UE是否异常类似，不再赘述。
重复以上步骤，直至NWDAF发送的异常UE的信息满足AF的需求。例如，异常UE的信息可以包括异常UE的数量、异常UE触发的异常级别、异常UE触发的策略的权重等。
基于上述方案，当NWDAF需要对AF指定的UE进行异常检测时，NWDAF可以通过SMF和UPF中的至少一个网元缩减需检测的UE的名单，减小NWDAF的负担；同时，SMF和UPF根据配置的异常检测策略对UE名单的进行缩减，可以提高异常UE检测的精准度。
应理解，本申请实施例中的具体的例子只是为了帮助本领域技术人员更好地理解本申请实施例，而非限制本申请实施例的范围。
还应理解，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
还应理解，在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
可以理解的是，本申请上述实施例中，由通信设备实现的方法，也可以由可配置于通信设备内部的部件(例如芯片或者电路)实现。
以上，结合图2至图8详细说明了本申请实施例提供的异常检测的方法。上述异常检测的方法主要从网元之间交互的角度进行了介绍。可以理解的是，各个网元，为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超 出本申请的范围。
以下，结合图9至图11对本申请实施例提供的通信装置及系统进行详细说明。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，部分内容不再赘述。
图9是本申请实施例提供的通信装置900的示意性框图。如图所示，该通信装置900可以包括：收发单元910和处理单元920。
在一种可能的设计中，该通信装置900可以是上文方法实施例中的第一用户面网元，也可以是用于实现上文方法实施例中第一用户面网元的功能的芯片。
应理解，该通信装置900可对应于根据本申请实施例的方法200至方法500中的第一用户面网元，或者对应于方法600、方法700以及方法800中的UPF。该通信装置900可以包括用于执行图2至图5中方法中的第一用户面网元执行的方法单元。并且，该通信装置900中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200至图8中的方法800的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该通信装置900可以是上文方法实施例中的第一会话管理网元，也可以是用于实现上文方法实施例中第一会话管理网元的功能的芯片。
应理解，该通信装置900可对应于根据本申请实施例的方法200至方法500中的第一会话管理网元，或者对应于方法600、方法700以及方法800中的SMF。该通信装置900可以包括用于执行图2中的方法200至图5中方法500中的第一会话管理网元执行的方法单元。并且，该通信装置900中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200至图8中的方法800的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该通信装置900可以是上文方法实施例中的网络数据分析功能网元，也可以是用于实现上文方法实施例中网络数据分析功能网元的功能的芯片。
应理解，该通信装置900可对应于根据本申请实施例的方法200至方法500中的第一网络数据分析功能网元、第二网络数据分析功能网元或第三网络数据分析功能网元，或者对应于方法600至方法800中的NWDAF。该通信装置900可以包括用于执行图2中的方法200至图8中的方法800中的NWDAF执行的方法单元。并且，该通信装置900中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200至图8中的方法800的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
还应理解，该通信装置900中的收发单元910可对应于图10中示出的通信设备1000中的收发器1020。该通信装置900中的处理单元920可对应于图10中示出的通信设备1000中的处理器1010。
还应理解，当该通信装置900为芯片时，该芯片包括收发单元。示例性地，该芯片还可以包括处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
收发单元910用于实现通信装置900的信号的收发操作，处理单元920用于实现通信装置900的信号的处理操作。
示例性地，该通信装置900还包括存储单元930，该存储单元930用于存储指令。
图10是本申请实施例提供的通信设备1000的示意性框图。如图10所示，该通信设备1000包括：至少一个处理器1010和通信接口1020。该处理器1010与存储器耦合，用于执行存储器中存储的指令，以控制通信接口1020发送和/或接收信号。示例性地，该通信设备1000还包括存储器1030，用于存储指令。
应理解，上述处理器1010和存储器1030可以合成一个处理装置，处理器1010用于执行存储器1030中存储的程序代码来实现上述功能。具体实现时，该存储器1030也可以集成在处理器1010中，或者独立于处理器1010。
还应理解，在一种可能的设计中，该通信接口1020可以包括接收器(或者称，接收机)和发射器(或者称，发射机)。该通信接口1020还可以进一步包括天线，天线的数量可以为一个或多个。通信接口1020还可以是接口电路。
当该通信设备1000为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
图11是本申请实施例的一种芯片系统的示意图。这里的芯片系统也可为电路组成的系统。图11所示的芯片系统1100包括：逻辑电路1110以及输入/输出接口(input/output interface)1120，所述逻辑电路用于与输入接口耦合，通过所述输入/输出接口传输数据(例如第一指示信息)，以执行图2至图8所述的方法。
本申请实施例还提供了一种处理装置，包括处理器和接口。所述处理器可用于执行上述方法实施例中的方法。
应理解，上述处理装置可以是一个芯片。例如，该处理装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所提供的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行图2至图6所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行图2至图6所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种通信系统，其包括前述的第一分析网元和第一用户面网元，示例性地，该第一分析网元可以是会话管理网元，例如，前述的第一会话管理网元；该第一分析网元可以是网络数据分析功能网元，例如，前述的第二网络数据分析功能网元；该通信系统还可以包括第二分析网元，示例性地，该第二分析网元可以是网络数据分析功能网元，例如，前述的第一网络数据分析功能网元；该通信系统还可以包括第三分析网元、应用功能网元和策略管理功能网元，该第三分析网元也可以是网络数据分析功能网元，例如，前述的第三网络数据分析功能网元。该通信系统还可以包括服务第一终端设备的至少一个用户面网元，该第一终端设备为需要进行异常检测的终端设备中的任一终端设备。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方 法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (34)

  1. 一种异常检测的方法，其特征在于，所述方法包括：
    向第一用户面网元发送第一请求消息，所述第一请求消息用于请求上报第一终端设备的第一数据的传输情况；
    接收来自所述第一用户面网元的所述第一数据的传输情况；
    在根据第一级别的异常检测策略以及所述第一数据的传输情况确定所述第一终端设备存在所述第一级别的异常的情况下，向服务所述第一终端设备的至少一个用户面网元发送第二请求消息，所述第二请求消息用于请求上报所述第一终端设备的第二数据的传输情况；
    根据第二级别的异常检测策略以及所述第二数据的传输情况，确定所述第一终端设备是否存在所述第二级别的异常。
  2. 根据权利要求1所述的方法，其特征在于，所述第一级别的异常检测策略包括所述第一数据的传输情况与用于确定是否存在所述第一级别的异常的第一阈值的对应关系，所述第二级别的异常检测策略包括所述第二数据的传输情况与用于确定是否存在所述第二级别的异常的第二阈值的对应关系。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一数据的传输情况包括以下中的至少一个：
    所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的数量，所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的传输速度，所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的传输离散度，所述第一用户面网元中所述第一终端设备的不同类型的数据包的数量的比例。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述第二数据的传输情况包括以下中的一个或多个：
    所述至少一个用户面网元中的任一用户面网元中的所述第一终端设备的至少一个会话的数据包的数量，所述至少一个用户面网元中的任一用户面网元中的所述第一终端设备的至少一个会话的数据包的传输速度，所述至少一个用户面网元中的任一用户面网元中的所述第一终端设备的至少一个会话的数据包的传输离散度，或所述第一终端设备的不同类型的数据包的数量的比例。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，
    所述向第一用户面网元发送所述第一请求消息包括：第一分析网元向所述第一用户面网元发送所述第一请求消息；
    所述接收来自所述第一用户面网元的所述第一数据的传输情况包括：所述第一分析网元接收来自所述第一用户面网元的所述第一数据的传输情况；
    确定所述第一终端设备存在所述第一级别的异常包括：所述第一分析网元确定所述第一终端设备存在所述第一级别的异常；
    向所述至少一个用户面网元发送所述第二请求消息包括：第二分析网元向所述至少一个用户面网元发送所述第二请求消息；
    确定所述第一终端设备是否存在所述第二级别的异常包括：第二分析网元确定所述第一终端设备是否存在所述第二级别的异常；
    其中，所述第一分析网元的服务范围小于所述第二分析网元的服务范围。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    所述第一分析网元向所述第二分析网元发送指示所述第一终端设备存在所述第一级别的异常的信息。
  7. 根据权利要求5或6所述的方法，其特征在于，所述方法还包括：
    若所述第二分析网元确定所述第一终端设备存在所述第二级别的异常，所述第二分析网元向策略控制网元或者应用功能网元反馈所述第一终端设备存在所述第二级别的异常的信息；或者
    若所述第二分析网元确定所述第一终端设备不存在所述第二级别的异常，所述第二分析网元向策略控制网元或者应用功能网元反馈所述第一终端设备存在所述第一级别的异常的信息。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，在所述向第一用户面网元发送第一请求消息之前，所述方法还包括：
    接收用于请求分析至少一个终端设备是否异常的信息，所述至少一个终端设备包括所述第一终端设备；
    向第一用户面网元发送所述第一请求消息包括：
    根据所述用于请求分析至少一个终端设备是否异常的信息，向所述第一用户面网元发送所述第一请求消息。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，在所述向所述至少一个用户面网元发送所述第二请求消息之前，所述方法还包括：
    发送用于确认是否需要对所述第一终端设备进行所述第二级别的异常检测的信息；
    接收用于指示需要对所述第一终端设备进行所述第二级别的异常检测的信息。
  10. 根据权利要求1至9中任一项所述的方法，其特征在于，所述方法还包括：
    根据第一级别的异常检测策略确定第一级别的数据包检测规则PDR，所述第一级别的PDR用于检测所述第一数据，所述第一请求消息包括用于指示第一级别的PDR的信息；
    根据第二级别的异常检测策略确定第二级别的PDR，所述第二级别的PDR用于检测所述第二数据，所述第二请求消息包括用于指示第二级别的PDR的信息。
  11. 一种异常检测的方法，其特征在于，所述方法包括：
    第一用户面网元接收用于请求确定第一终端设备的第一数据的传输情况的请求消息；
    所述第一用户面网元根据所述第一级别的异常检测策略和所述第一数据的传输情况，确定所述第一终端设备存在所述第一级别的异常；
    所述第一用户面网元向分析网元发送指示所述第一终端设备存在所述第一级别的异常的信息；
    所述第一用户面网元接收来自所述分析网元的第二请求消息，所述第二请求消息用于请求上报所述第一终端设备的第二数据的传输情况；
    所述第一用户面网元向所述分析网元上报所述第一终端设备的所述第二数据的传输情况，所述第二数据的传输情况用于确定所述第一终端设备是否存在所述第二级别的异常。
  12. 根据权利要求11所述的方法，其特征在于，所述第一级别的异常检测策略包括所述第一数据的传输情况与用于确定是否存在所述第一级别的异常的第一阈值的对应关系。
  13. 根据权利要求11或12所述的方法，其特征在于，所述第一数据的传输情况包括以下中的至少一个：
    所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的数量，所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的传输速度，所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的传输离散度，所述第一用户面网元中所述第一终端设备的不同类型的数据包的数量的比例。
  14. 根据权利要求11至13中任一项所述的方法，其特征在于，所述用于请求确定第一终端设备的第一数据的传输情况的请求消息包括用于指示第一级别的数据包检测规则PDR的信息，所述第一级别的PDR用于检测所述第一数据，所述第二请求消息包括用于指示第二级别的PDR的信息，所述第二级别的PDR用于检测所述第二数据。
  15. 一种通信装置，其特征在于，所述装置包括收发单元和处理单元，
    所述收发单元，用于向第一用户面网元发送第一请求消息，所述第一请求消息用于请求上报第一终端设备的第一数据的传输情况；
    所述收发单元，还用于接收来自所述第一用户面网元的所述第一数据的传输情况；
    在根据第一级别的异常检测策略以及所述第一数据的传输情况确定所述第一终端设备存在所述第一级别的异常的情况下，所述收发单元，还用于向服务所述第一终端设备的至少一个用户面网元发送第二请求消息，所述第二请求消息用于请求上报所述第一终端设备的第二数据的传输情况；
    所述处理单元，用于根据第二级别的异常检测策略以及所述第二数据的传输情况，确定所述第一终端设备是否存在所述第二级别的异常。
  16. 根据权利要求15所述的装置，其特征在于，所述第一级别的异常检测策略包括所述第一数据 的传输情况与用于确定是否存在所述第一级别的异常的第一阈值的对应关系，所述第二级别的异常检测策略包括所述第二数据的传输情况与用于确定是否存在所述第二级别的异常的第二阈值的对应关系。
  17. 根据权利要求15或16所述的装置，其特征在于，所述第一数据的传输情况包括以下中的至少一个：
    所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的数量、所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的传输速度、所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的传输离散度、所述第一用户面网元中所述第一终端设备的不同类型的数据包的数量的比例。
  18. 根据权利要求15至17任一项所述的装置，其特征在于，所述第二数据的传输情况包括以下中的一个或多个：
    所述至少一个用户面网元中的任一用户面网元中的所述第一终端设备的至少一个会话的数据包的数量、所述至少一个用户面网元中的任一用户面网元中的所述第一终端设备的至少一个会话的数据包的传输速度、所述至少一个用户面网元中的任一用户面网元中的所述第一终端设备的至少一个会话的数据包的传输离散度、或所述第一终端设备的不同类型的数据包的数量的比例。
  19. 根据权利要求15至18任一项所述的装置，其特征在于，所述处理单元还用于确定所述第一终端设备存在所述第一级别的异常。
  20. 根据权利要求18或19所述的装置，其特征在于，所述收发单元还用于：
    向策略控制网元或所述第二分析网元反馈所述第一终端设备存在所述第二级别的异常的信息；或者
    向策略控制网元或所述第二分析网元反馈所述第一终端设备存在所述第一级别的异常的信息。
  21. 根据权利要求15至20中任一项所述的装置，其特征在于，所述收发单元还用于：
    接收用于请求分析至少一个终端是否异常的信息，所述至少一个终端包括所述第一终端设备；
    所述收发单元具体用于：
    根据所述用于请求分析至少一个终端是否异常的信息，向所述第一用户面网元发送所述第一请求消息。
  22. 根据权利要求15至21中任一项所述的装置，其特征在于，所述收发单元还用于：
    发送用于确认是否需要对所述第一终端设备进行所述第二级别的异常检测的信息；
    接收用于指示需要对所述第一终端设备进行所述第二级别的异常检测的信息。
  23. 根据权利要求15至22中任一项所述的装置，其特征在于，所述处理单元还用于：
    根据第一级别的异常检测策略确定第一级别的数据包检测规则PDR，所述第一级别的PDR用于检测所述第一数据，所述第一请求消息包括用于指示第一级别的PDR的信息；
    根据第二级别的异常检测策略确定第二级别的PDR，所述第二级别的PDR用于检测所述第二数据，所述第二请求消息包括用于指示第二级别的PDR的信息。
  24. 一种通信系统，其特征在于，所述系统包括第一分析网元和第二分析网元，
    所述第一分析网元，用于向第一用户面网元发送第一请求消息，所述第一请求消息用于请求上报第一终端设备的第一数据的传输情况；
    所述第一分析网元，还用于接收来自所述第一用户面网元的所述第一数据的传输情况；
    在根据第一级别的异常检测策略以及所述第一数据的传输情况确定所述第一终端设备存在所述第一级别的异常的情况下，所述第二分析网元，用于向服务所述第一终端设备的至少一个用户面网元发送第二请求消息，所述第二请求消息用于请求上报所述第一终端设备的第二数据的传输情况；
    所述第二分析网元，还用于根据第二级别的异常检测策略以及所述第二数据的传输情况，确定所述第一终端设备是否存在所述第二级别的异常，其中，所述第一分析网元的服务范围小于所述第二分析网元的服务范围。
  25. 根据权利要求24所述的系统，其特征在于，所述第一级别的异常检测策略包括所述第一数据的传输情况与用于确定是否存在所述第一级别的异常的第一阈值的对应关系，所述第二级别的异常检测策略包括所述第二数据的传输情况与用于确定是否存在所述第二级别的异常的第二阈值的对应关系。
  26. 根据权利要求24或25所述的系统，其特征在于，所述第一数据的传输情况包括以下中的至 少一个：
    所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的数量、所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的传输速度、所述第一用户面网元中所述第一终端设备的至少一个会话的数据包的传输离散度、所述第一用户面网元中所述第一终端设备的不同类型的数据包的数量的比例。
  27. 根据权利要求24至26任一项所述的系统，其特征在于，所述第二数据的传输情况包括以下中的一个或多个：
    所述至少一个用户面网元中的任一用户面网元中的所述第一终端设备的至少一个会话的数据包的数量、所述至少一个用户面网元中的任一用户面网元中的所述第一终端设备的至少一个会话的数据包的传输速度、所述至少一个用户面网元中的任一用户面网元中的所述第一终端设备的至少一个会话的数据包的传输离散度、或所述第一终端设备的不同类型的数据包的数量的比例。
  28. 根据权利要求24至27任一项所述的系统，其特征在于，
    所述第一分析网元，还用于确定所述第一终端设备存在所述第一级别的异常；
    所述第一分析网元，还用于向所述第二分析网元发送指示所述第一终端设备存在所述第一级别的异常的信息。
  29. 根据权利要求28所述的系统，其特征在于，
    若所述第二分析网元确定所述第一终端设备存在所述第二级别的异常，所述第二分析网元还用于向策略控制网元或者应用功能网元反馈所述第一终端设备存在所述第二级别的异常的信息；或者，
    若所述第二分析网元确定所述第一终端设备不存在所述第二级别的异常，所述第二分析网元还用于向策略控制网元或者应用功能网元反馈所述第一终端设备存在所述第一级别的异常的信息。
  30. 根据权利要求24至29中任一项所述的系统，其特征在于，
    所述第一分析网元还用于接收用于请求分析至少一个终端设备是否异常的信息，所述至少一个终端设备包括所述第一终端设备；
    所述第一分析网元具体用于：
    根据所述用于请求分析至少一个终端是否异常的信息，向所述第一用户面网元发送所述第一请求消息。
  31. 根据权利要求24至30中任一项所述的系统，其特征在于，
    所述第一分析网元还用于根据第一级别的异常检测策略确定第一级别的数据包检测规则PDR，所述第一级别的PDR用于检测所述第一数据，所述第一请求消息包括用于指示第一级别的PDR的信息；
    所述第二分析网元还用于根据第二级别的异常检测策略确定第二级别的PDR，所述第二级别的PDR用于检测所述第二数据，所述第二请求消息包括用于指示第二级别的PDR的信息。
  32. 一种通信装置，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于执行所述存储器中存储的计算机程序，以使得所述通信装置执行权利要求1至10中任一项所述的方法，或者，执行权利要求11至14中任一项所述的方法。
  33. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，当所述计算机程序被通信装置运行时，使得所述装置执行如权利要求1至10中任意一项所述的方法，或者，执行如权利要求11至14中任意一项所述的方法。
  34. 一种芯片系统，其特征在于，包括：
    处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片系统的通信装置执行如权利要求1至10中任意一项所述的方法，或者，执行如权利要求11至14中任意一项所述的方法。
PCT/CN2023/105067 2022-07-30 2023-06-30 异常检测的方法和通信装置 WO2024027427A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210912458.9 2022-07-30
CN202210912458.9A CN117528527A (zh) 2022-07-30 2022-07-30 异常检测的方法和通信装置

Publications (1)

Publication Number Publication Date
WO2024027427A1 true WO2024027427A1 (zh) 2024-02-08

Family

ID=89742571

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/105067 WO2024027427A1 (zh) 2022-07-30 2023-06-30 异常检测的方法和通信装置

Country Status (2)

Country Link
CN (1) CN117528527A (zh)
WO (1) WO2024027427A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110830422A (zh) * 2018-08-10 2020-02-21 中国移动通信有限公司研究院 一种终端行为数据处理方法及设备
CN111770490A (zh) * 2019-04-02 2020-10-13 电信科学技术研究院有限公司 一种确定终端行为分析的方法和设备
US20220039046A1 (en) * 2018-09-26 2022-02-03 Nec Corporation Network data analytics function, access and mobility function, and control method for ue analytics assistance for network automation and optimisation

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110830422A (zh) * 2018-08-10 2020-02-21 中国移动通信有限公司研究院 一种终端行为数据处理方法及设备
US20220039046A1 (en) * 2018-09-26 2022-02-03 Nec Corporation Network data analytics function, access and mobility function, and control method for ue analytics assistance for network automation and optimisation
CN111770490A (zh) * 2019-04-02 2020-10-13 电信科学技术研究院有限公司 一种确定终端行为分析的方法和设备

Also Published As

Publication number Publication date
CN117528527A (zh) 2024-02-06

Similar Documents

Publication Publication Date Title
CN106664219B (zh) 基于过去历史数据的网络节点可用性预测
US11012323B2 (en) Feature parameter obtaining method and apparatus
US11290915B2 (en) Systems and methods for granular beamforming across multiple portions of a radio access network based on user equipment information
US20220408293A1 (en) Method and device for providing network analysis information for rfsp index selection in mobile communication network
US20230388817A1 (en) Activating intelligent wireless communciation device reporting in a wireless network
WO2022226713A1 (zh) 策略确定的方法和装置
US20230142002A1 (en) Communication Method and Apparatus
US20240057139A1 (en) Optimization of deterministic and non-deterministic traffic in radio-access network (ran)
WO2022141295A1 (zh) 一种通信方法和装置
WO2024027427A1 (zh) 异常检测的方法和通信装置
WO2023071770A1 (zh) 获取数据分析结果的方法及通信装置
WO2022234807A1 (en) Communication system
US20240163741A1 (en) Ran node, ue, and method
WO2024027381A1 (zh) 异常检测的方法和通信装置
WO2023185452A1 (zh) 一种通信方法和通信装置
WO2022170588A1 (zh) 一种通信的方法和通信装置
CN116325890A (zh) 网络切片动态拥塞控制
WO2023071771A1 (zh) 一种通信方法和通信装置
US20230403684A1 (en) Communication method, device, and storage medium
WO2024032197A1 (zh) 通信方法、装置、设备及存储介质
WO2024007156A1 (zh) 一种通信方法和装置
WO2023213134A1 (zh) 一种数据报告的方法、装置及系统
WO2022174780A1 (zh) DDoS攻击检测的方法和装置
WO2022165846A1 (zh) 用于获取数据的方法和装置
WO2023035872A1 (zh) 确定用户面路径的方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23849137

Country of ref document: EP

Kind code of ref document: A1