METHOD AND APPARATUS FOR DEFENSE AGAINST NEW RADIO DENIAL-OF-SERVICE (DOS) ATTACKS

Description

1 / 34 METHOD AND APPARATUS FOR DEFENSE AGAINST NEW RADIO DENIAL-OF-SERVICE (DOS) ATTACKS CROSS-REFERENCE ON RELATED REQUEST

[0001] The present invention is based on Chinese Patent Application No. CN202310419217.5, filed on April 11, 2023, and entitled NEW RADIO DENIAL-OF-SERVICE (DOS) ATTACK DEFENSE METHOD AND APPARATUS, and claims priority to the invention, which is incorporated herein by reference in its entirety. FIELD OF TECHNIQUE

[0002] The embodiments of the present invention relate to the field of communications and, in particular, to a method and apparatus for defense against new radio denial-of-service (DOS) attacks. BACKGROUND

[0003] New radio access (NR) is an access process prior to authentication. A terminal has already obtained a radio access resource before successfully authenticating its identity at the base station; therefore, the base station is vulnerable to attacks from a malicious terminal, causing various security threats. As shown in Figure 1, when an authorized user equipment (UE) initiates signaling access, such as a Radio Resource Control Connection Request (MSG3), a base station can control a number of access UEs based on the maximum NR Radio Resource Control (RRC) configured by the base station. If a malicious UE continues to initiate an MSG3, the base station's NR RRC access resources will be exhausted. As a result, an NR denial-of-service (DoS) attack is caused on the base station, affecting normal UE access.Before a central network authenticates the UE, the base station and the central network cannot obtain UE authentication information. The legitimate UE can. Petition 870250091599, dated 07 / 10 / 2025, page 6 / 62 2 / 34 transport a random value or temporary mobile subscriber identity (TMSI) information in MSG3. However, since the authentication step has not yet been performed, this information is only used as a temporary identifier. An attacker can arbitrarily forge a malicious UE temporary identifier. Therefore, the base station cannot determine UE authentication.

[0004] It is very easy for an attacker to obtain an International Mobile Subscriber Identity (IMSI), a TMSI, and other authorized UE identity information through a pseudo-base station. If the attacker uses the identity information of an authorized user to carry out a NR attack, and if the main network isolates the user or does not respond to a user request based on the identity information, the authorized user may be affected. In a DOS attack on NR using MSG3, the identity of the malicious UE can be arbitrarily forged. Thus, currently, the industry uses a blacklist to restrict access for a malicious UE. Consequently, protection fails in many scenarios. However, by using this method, the attacker can carry out a DOS attack on a specific legitimate UE, making effective protection against the DOS attack impossible. SUMMARY

[0005] The embodiments of the present invention provide a new method and apparatus for defense against new radio denial-of-service (DOS) attacks to at least solve the problem that the use of a blacklist cannot effectively protect against a denial-of-service attack in the related technology.

[0006] According to one embodiment of the present invention, a novel method of defense against a new radio denial-of-service (DOS) attack is provided that is applied to a base station and includes: positioning the UE that initiates the new radio DOS attack to obtain Petition 870250091599, dated 07 / 10 / 2025, page 7 / 62 3 / 34 location information from the UE in response to a UE initiating a new radio DOS attack; and adjust a base station beam coverage region based on location information to exclude the UE initiating the new radio DOS attack from a beam coverage range.

[0007] According to another embodiment of the present invention, a novel defense apparatus against a new radio denial-of-service (DOS) attack is provided that is applied to a base station and includes: a positioning module configured to: position the UE initiating the new radio DOS attack to obtain location information of the UE in response to a UE initiating a new radio DOS attack; and an adjustment module configured to adjust a beam coverage region of the base station based on location information to exclude the UE initiating the new radio DOS attack from a beam coverage range.

[0008] According to another embodiment of the present invention, a computer-readable storage medium is also provided that stores a computer program, wherein the computer program is configured so that, when the computer program is executed by a processor, the processor will implement the steps in any of the embodiments of the method.

[0009] According to yet another embodiment of the present invention, an electronic apparatus is also provided which includes a memory, a processor and a computer program stored in the memory and executable by the processor, wherein the processor is configured to execute the computer program to implement the steps in any of the embodiments of the method. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 is a schematic diagram showing the relationship between elements when a malicious UE initiates a denial-of-service attack. Petition 870250091599, dated 07 / 10 / 2025, page 8 / 62 4 / 34 of service;

[0011] Figure 2 is a block diagram of a hardware structure of a computer terminal of a method of defense against a new radio denial-of-service (DOS) attack according to an embodiment of the present invention;

[0012] Figure 3 is a schematic diagram of a principle of a network architecture for defense against new radio denial-of-service (DOS) attacks according to an embodiment of the present invention;

[0013] Figure 4 is a flowchart of a defense method against a new radio denial-of-service (DOS) attack according to an embodiment of the present invention;

[0014] Figure 5 is a flowchart of a defense method against a new radio denial-of-service (DOS) attack according to an embodiment of the present invention;

[0015] Figure 6 is a structural block diagram of a new radio denial-of-service (DOS) attack defense device according to an embodiment of the present invention;

[0016] Figure 7 is a structural block diagram of an adjustment module of a new radio denial-of-service (DOS) attack defense device according to an embodiment of the present invention;

[0017] Figure 8 is a structural block diagram of a new radio denial-of-service (DOS) attack defense device according to an embodiment of the present invention;

[0018] Figure 9 is a structural block diagram of a detection module of a new radio denial-of-service (DOS) attack defense device according to an embodiment of the present invention; Petition 870250091599, dated 07 / 10 / 2025, page 9 / 62 5 / 34

[0019] Figure 10 is a schematic diagram of new radio denial-of-service (DOS) attack detection and physical isolation according to an embodiment of the present invention;

[0020] Figure 11 is a schematic diagram of a new radio denial-of-service (DOS) attack principle according to an embodiment of the present invention;

[0021] Figure 12 is a schematic flowchart of a denial-of-service attack detection method according to an embodiment of the present invention;

[0022] Figure 13 is a schematic diagram of a principle for obtaining the location of a signal source by means of a TDOA estimation positioning method according to an embodiment of the present invention;

[0023] Figure 14 is a schematic diagram of a protection principle against an attack on an RRC connection resource according to an embodiment of the present invention;

[0024] Figure 15 is a schematic diagram of a protection principle against an attack on an RRC connection resource according to an embodiment of the present invention; and

[0025] Figure 16 is a diagram of a defense information interaction principle against a new radio denial-of-service (DOS) attack according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0026] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0027] It should be noted that the terms first, second, etc. in the descriptive report and claims of embodiments of the present invention and in the accompanying drawings above are defined to distinguish similar objects and need not be used to describe a Petition 870250091599, dated 07 / 10 / 2025, page 10 / 62 6 / 34 specific order or sequence.

[0028] The embodiments of the method according to the embodiments of the present invention can be performed on a mobile terminal, a computer terminal, or a similar computing device. Execution on the computer terminal is taken as an example. Figure 2 is a block diagram of a hardware structure of a computer terminal of a method of defense against novel radio denial-of-service (DOS) attacks according to an embodiment of the present invention. As shown in Figure 2, the computer terminal may include one or more (only one is shown in Figure 2) processors 202 (the processor 202 may include, among others, a microprocessor unit (MCU), a field-programmable gate array (FPGA), and other processing devices) and memories 204 configured to store data. The computer terminal may further include a transmission device 206 for a communication function and an input / output device 208.Those skilled in the art will understand that the structures shown in Figure 2 are merely illustrative and there will be no limitation as to the structures of the computer terminal. For example, the computer terminal may include even more or fewer components than those shown in Figure 2, or have a different configuration from that shown in Figure 2.

[0029] Memory 204 can be configured to store a computer program, such as software programs and application software modules, such as a computer program that corresponds to the new radio denial-of-service (DOS) attack defense method in this embodiment of the present invention. Processor 202 executes various functional applications and data processing while executing the computer program stored in memory 204, i.e., to implement the above method. Memory 204 Petition 870250091599, dated 07 / 10 / 2025, page 11 / 62 7 / 34 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memories. In some examples, memory 204 may also include memory located remotely from the processor 202. Such remote memories may be connected to the mobile terminal via a network. Examples of the above network include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0030] The 206 transmission device is configured to receive or transmit data over a network. Examples of the network above may include a wireless network provided by a computer terminal communication provider. In one example, the 206 transmission device includes a network interface controller (NIC) that can be connected to other network devices via a base station for internet communication. In another example, the 206 transmission device may be a radio frequency (RF) module for internet communication via radio.

[0031] Figure 3 is a schematic diagram of a network architecture principle for defense against new radio denial-of-service (DoS) attacks according to an embodiment of the present invention. This embodiment of the present invention can be implemented in the network architecture shown in Figure 3. As shown in Figure 3, the network architecture includes: a user terminal (UE), a wireless network communication device (base station), and a malicious UE (an attacker). In the process where the UE accesses a mobile cellular network, the UE, as a terminal, initiates an access request. The base station, as a node to connect the mobile network to the UE, performs access control on the UE. The malicious UE, as a malicious terminal, initiates a radio access request to the base station to maliciously occupy a Petition 870250091599, dated 07 / 10 / 2025, page 12 / 62 8 / 34 base station radio access feature. Ultimately, an authorized UE cannot gain access.

[0032] This embodiment provides a method of defense against new radio denial-of-service (DOS) attacks that is executed on the computer terminal or network architecture described above. Figure 4 is a flowchart of a method of defense against new radio denial-of-service (DOS) attacks according to an embodiment of the present invention. As shown in Figure 4, the flow includes the following steps:

[0033] In S402: In response to a UE initiating a new radio DOS attack, position the UE initiating the new radio DOS attack to obtain location information from the UE.

[0034] In S404: adjust a base station beam cover region based on location information to exclude the UE initiating the new radio DOS attack from the beam cover range.

[0035] Through the steps above, in response to the UE initiating the new radio DOS attack, the UE initiating the new radio DOS attack is positioned to obtain location information from the UE; and the base station's beam coverage region is adjusted according to the location information to exclude the UE initiating the new radio DOS attack from the beam coverage range. The problem is that using a blacklist in the related technology cannot effectively protect against a denial-of-service attack. The risk of a new radio denial-of-service attack that the base station faces is significantly reduced, and the effect of the availability and robustness of a wireless communication network when accessing new radio is enhanced.

[0036] An entity executing the above steps may be, but is not limited to, a base station, a terminal, and similar entities. Petition 870250091599, dated 07 / 10 / 2025, page 13 / 62 9 / 34

[0037] In one embodiment, the UE positioning that initiates the new radio DOS attack to obtain location information from the UE includes: requesting measured information from a plurality of transmit-receive points (TRPs), wherein the plurality of TRPs performs beam positioning on the UE initiating the new radio DOS attack using a time-of-arrival difference (TDOA), based on a preamble used by the UE initiating the new radio DOS attack for random access.

[0038] In one embodiment, adjusting a base station beam coverage region based on location information includes: transmitting location information and distribution data from an authorized UE to a data center, where the authorized UE includes a UE that does not initiate a new radio DOS attack; and receiving optimal beam coverage sent by the data center and adjusting the beam coverage region based on the optimal beam coverage.

[0039] In one embodiment, the base station's beam coverage region is adjusted based on location information to create a hole in the coverage, thereby preventing access by the UE (i.e., a malicious UE) that initiates the new radio DOS attack. The UE that initiates the new radio DOS attack is excluded from the beam coverage range.

[0040] In one embodiment, the transmission of location information and distribution data from an authorized UE to a data center and the reception of the ideal beam coverage sent by the data center can be performed by a central network. Or an interaction operation with the data center can be completed by means of another transmitting or receiving device (module, system). This embodiment of the present invention does not impose a specific limitation.

[0041] In one embodiment, the adjustment of the beam coverage region Petition 870250091599, dated 07 / 10 / 2025, page 14 / 62 10 / 34 based on ideal beam coverage includes one of the following: in response to a cell in which the base station is located being a low-frequency cell and the number of authorized UEs on a beam in which the UE initiating the new radio DOS attack is located being less than a first predefined limit, disable the beam in which the UE initiating the new radio DOS attack is located; and, in response to the cell in which the base station is located being a millimeter-wave cell, disable a beam in which the UE initiating the new radio DOS attack is located or adjust the beam in which the UE initiating the new radio DOS attack is located.

[0042] In one embodiment, beam coverage region adjustment based on ideal beam coverage further includes the following situations: in response to the cell in which the base station is located being the low-frequency cell and the number of authorized UEs in the beam in which the UE initiating the new radio DOS attack is located being equal to or greater than the first predefined limit, do not process the beam in which the UE initiating the new radio DOS attack is located; and, in response to the number of authorized UE accesses in the cell in which the base station is located being equal to a second predefined limit, do not process the beam in which the UE initiating the new radio DOS attack is located.

[0043] In this embodiment of the present invention, the quantity of The number of authorized EUs being less than the first predefined limit indicates a small number of authorized EUs, and the number of authorized EUs being equal to or greater than the first predefined limit indicates a large number of authorized EUs. A numerical value for the first predefined limit can be determined based on a real-world situation. That is, the number of authorized EUs is determined based on a real-world situation. For the millimeter wave cell, there is no need to consider the number of authorized EUs. The beam Petition 870250091599, dated 07 / 10 / 2025, page 15 / 62 The 11 / 34 beam in which the UE initiating the new radio DOS attack is located can be disabled, or the beam in which the UE initiating the new radio DOS attack is located can be adjusted. The adjustment includes adjusting a phase of the beam in which the UE initiating the new radio DOS attack is located.

[0044] In one embodiment, Figure 5 is a flowchart of a method of defense against a novel radio denial-of-service (DOS) attack according to an embodiment of the present invention. As shown in Figure 5, the flow includes the following steps:

[0045] In S502: In response to the access resource consumption of a base station reaching a predefined resource consumption value, detect the access rate of UE(s) initiating the radio access request and / or the rate of generation of a timer timeout event corresponding to the radio access request and determine if a UE initiating the radio access request initiates a radio DOS attack.

[0046] In S504: In response to a UE initiating a new radio DOS attack, position the UE initiating the new radio DOS attack to obtain location information from the UE.

[0047] In S506: Adjust a base station beam cover region based on location information to exclude the UE initiating the new radio DOS attack from a beam cover range.

[0048] In one embodiment, for S502, in response to a Denial of Service (DoS) attack initiated by a malicious User Equipment (UE), the attacker typically floods radio frequency resources with a high or abnormally high access rate (attack frequency) to occupy them. Therefore, it is possible to determine if a UE initiates a DoS attack by detecting the access rate of the UE(s) initiating the radio access request. A malicious UE Petition 870250091599, dated 07 / 10 / 2025, page 16 / 62 12 / 34 initiates half-connections and executes waits, causing the half-connections to time out during the wait period. Therefore, it is also possible to detect the rate at which timer expiration events associated with the UE radio access request occur to determine if any UE is mounting a DOS attack. Real-world scenarios are not limited to these two situations; there may be cases where the connection speed is slow but the rate of timer expiration event generation is high, or there may be cases where both the connection speed and the rate of timer expiration event generation are high. The next determination step needs to be performed in either of the above situations to confirm whether a UE initiating the radio access request is launching a new radio DOS attack.

[0049] In one embodiment, detecting the access rate of UE(s) initiating the radio access request and / or the rate of timeout event generation corresponding to the radio access request and determining whether a UE initiating the radio access request initiates a new radio DOS attack includes: detecting whether the beam access distribution of the UE(s) initiating the radio access request is abnormal based on the access rate of the UE(s) initiating the radio access request and the timeout event generation rate; detecting whether the access behavior of a UE with an abnormal beam access distribution is abnormal; and detecting a UE with abnormal access behavior based on a machine learning algorithm to determine the UE initiating the new radio DOS attack.

[0050] In one embodiment, the detection of the distribution of access to the beam of the UE(s) initiating the radio access request is abnormal includes: in response to the access rate of the UE(s) initiating Petition 870250091599, dated 07 / 10 / 2025, page 17 / 62 13 / 34 If the radio access request reaches a first predefined value and / or the generation rate of the corresponding timer timeout event reaches a second predefined value, count the preamble of the UE(s) initiating the radio access request; and, in response to a number of UEs using a fixed preamble to initiate the radio access request on the same beam reaching a third predefined value, determine that the beam access distribution of the UE(s) initiating the radio access request is abnormal.

[0051] In one embodiment, detecting whether UE access behavior with abnormal beam access distribution is abnormal includes: setting a timeout value in the radio resource control configuration (RRC) rejection signaling; and, in response to the failure of the set timeout value to cause the access rate of the UE(s) initiating the radio access request to reach a predefined range, determining that the access behavior of the UE(s) initiating the radio access request is abnormal.

[0052] In the above modalities, the first predefined value, the second predefined value, the third predefined value, the first predefined limit and the second predefined limit are defined based on real situations, where first, second and third are only for the purpose of distinction, but are not distinguished in a sequential order.

[0053] According to the descriptions in the implementations above, those skilled in the art can clearly infer that the method according to the previous embodiments can be implemented based on software and an essential hardware platform or using hardware, however, the former is a better implementation in most cases. Based on this understanding, the technical solutions of the embodiments of the present invention, essentially, or the part that contributes to the related technology, can be presented in Petition 870250091599, dated 07 / 10 / 2025, page 18 / 62 14 / 34 form of a software product. The computer software product is stored on a storage medium (e.g., a read-only memory (ROM) / random access memory (RAM), a magnetic disk, or an optical disk) that includes a plurality of instructions to enable a terminal device (which may be a mobile phone, a computer, a server, a network device, or similar) to execute the method described in the embodiments of the present invention.

[0054] This embodiment also provides a new device for defense against new radio denial-of-service (DOS) attacks. The device is configured to implement the embodiments and preferred implementations described above. The content described will not be explored in detail. As used below, the term module can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the embodiments below is preferably implemented in software, implementation in hardware or a combination of software and hardware is also possible and foreseen.

[0055] Figure 6 is a structural block diagram of a defense apparatus against new radio denial-of-service (DOS) attacks according to an embodiment of the present invention. As shown in Figure 6, the defense apparatus 60 includes: a positioning module 610 configured to position the UE initiating the new radio DOS attack to obtain location information of the UE in response to a UE initiating a new radio DOS attack; and an adjustment module 620 configured to adjust a beam coverage region of the base station based on the location information to exclude the UE initiating the new radio DOS attack from the beam coverage range.

[0056] In one embodiment, the 610 positioning module is further configured to request measured information from a Petition 870250091599, dated 07 / 10 / 2025, page 19 / 62 15 / 34 Transmit-Receive Point (TRP) plurality, wherein the TRP plurality performs beam positioning on the UE that initiates the new radio DOS attack using a time-of-arrival difference (TDOA) based on a preamble used by the UE that initiates the new radio DOS attack for random access.

[0057] Figure 7 is a structural block diagram of a tuning module of a new radio denial-of-service (DOS) attack defense apparatus according to an embodiment of the present invention. As shown in Figure 7, the tuning module 620 includes: a transmitter unit 710 configured to transmit location information and distribution data from an authorized UE to a data center, where the authorized UE includes a UE that does not initiate a new radio DOS attack; and a receiver unit 720 configured to receive the optimal beam coverage sent by the data center and adjust the beam coverage region based on the optimal beam coverage.

[0058] Figure 8 is a structural block diagram of a tuning module of a defense device against new radio denial-of-service (DOS) attacks according to an embodiment of the present invention. As shown in Figure 8, the defense device 80 further includes: a detection module 810 configured to determine whether a UE initiating a radio access request initiates a new radio DOS attack by detecting the access rate of the UE initiating a radio access request and / or a timer timeout event generation rate corresponding to the radio access request in response to a base station access resource consumption reaching a predefined resource consumption value.

[0059] Figure 9 is a structural block diagram of a detection module of a device for defense against denial-of-service attacks. Petition 870250091599, dated 07 / 10 / 2025, page 20 / 62 16 / 34 new radio (DOS) service according to an embodiment of the present invention. As shown in Figure 9, the detection module 810 includes: a distribution detection unit 910 configured to detect whether the beam access distribution(s) of the UE(s) initiating(s) the radio access request is / are abnormal based on the access rate of the UE(s) initiating(s) the radio access request and the timer timeout event generation rate; a behavior detection unit 920 configured to detect whether UE access behavior with abnormal beam access distribution is abnormal; and an algorithm determination unit 930 configured to detect a UE with abnormal access behavior based on a machine learning algorithm to determine the UE initiating the new radio DOS attack.

[0060] It should be noted that the above modules or units can be implemented via software or hardware. The latter can be implemented in the following ways, but without limitation: the above modules or units are located on the same processor; or the above modules or units can be located on different processors, respectively, in any combination.

[0061] One embodiment of the present invention further provides a computer-readable storage medium that stores a computer program, wherein the computer program is configured so that, when the computer program is executed by a processor, the processor will implement the steps in any of the embodiments of the method when executed.

[0062] In one embodiment, the computer-readable storage medium may include, but is not limited to: various media that can store computer programs, such as a flash disk. Petition 870250091599, dated 07 / 10 / 2025, page 21 / 62 17 / 34 USB, a read-only memory (ROM), a random access memory (RAM), a portable hard disk drive, a magnetic disk, or an optical disk.

[0063] One embodiment of the present invention further provides an electronic apparatus comprising a memory, a processor and a computer program stored in memory and executable by the processor, wherein the processor is configured to execute the computer program to implement the steps in any of the embodiments of the method.

[0064] In one embodiment, the electronic device may also include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0065] Obviously, those skilled in the art will understand that the various modules or steps of the embodiments of the present invention can be implemented using a general-purpose computing apparatus, which may be concentrated in a single computing apparatus or distributed in a network consisting of a plurality of computing apparatuses. The modules or steps may be implemented using program codes that can be executed by a computing apparatus so that the modules or steps can be stored in a storage apparatus for execution by the computing apparatus. Furthermore, in some cases, the steps shown or described may be executed in a different order from those in the present document, or the steps may be transformed separately into several integrated circuit modules, or a plurality of modules or steps among the modules or steps may be transformed into a single integrated circuit module for implementation.Thus, the embodiments of the present invention are not limited to any specific combinations of hardware and software. Petition 870250091599, dated 07 / 10 / 2025, page 22 / 62 18 / 34

[0066] To enable those skilled in the art to understand the technical solutions of the embodiments of the present invention more clearly, specific scenario embodiments will be elaborated below. Scenario I Mode

[0067] A next-generation NR (gNB) B node is an access device that connects a terminal to a mobile communication network. One of its most important functions is to perform radio access control on the terminal to ensure normal access for an authorized terminal and deny access to an unauthorized terminal.

[0068] A user device (UD) is a terminal device used by an end user for communication. In a normal case, the access behavior of an authorized terminal conforms to the 3GPP protocol, and the authentication of the authorized terminal initiates a request to a base station and is controlled by the base station. A malicious UD does not fully follow the protocol provisions and is not controlled by the base station. The malicious UD is a malicious terminal device that is specially processed. An attacker creates the malicious UD using mature software-defined radio (SDR) hardware and software tools, controls the malicious UD via a computer to continuously initiate new radio access requests to the base station, and sets up a large number of new radio half-connections in a short period of time.This depletes the base station's new radio resources and causes an attack, such as a denial-of-service (DOS) attack, on the base station.

[0069] Non-cooperative positioning primarily means using communication between the terminal device and the base station for positioning, with no other device participating in the positioning process. A target for non-cooperative positioning could be a single-mode terminal, an older terminal that does not support 5G. Petition 870250091599, dated 07 / 10 / 2025, page 23 / 62 19 / 34 or similar, or it could be a non-cooperative user unwilling to provide location information. This type of positioning can be classified into methods based on time of arrival (TOA) or time difference of arrival (TDOA), angle of arrival (AOA), frequency difference of arrival (FDOA), received signal strength (RSS), fingerprints, and similar methods based on different usage parameters. When a malicious UE is positioned, since the malicious UE will not provide its location information on its own, the malicious UE can generally only be positioned in a non-cooperative manner.

[0070] Beamforming (BF), also known as beamforming or spatial filtering, is a multi-antenna transmission technology applied to a closely spaced array of antennas. Its main principle is to use the strong correlation of the array signals and the wave interference principle to generate a radiation pattern with strong directionality, so that a main lobe of the radiation pattern adaptively points towards the arrival direction of a user terminal, thereby increasing the signal-to-noise ratio, system capacity, and coverage range. In this embodiment of the present invention, a base station antenna prevents beamforming in the area where the malicious UE is located by controlling beam coverage.Since the malicious UE cannot receive the access response from the base station, the access procedure of the malicious UE is interrupted, thus achieving defense against the air interface DOS attack caused by the malicious UE.

[0071] A directional (DA) antenna, also known as a beam antenna, is an antenna that radiates or receives greater power in a specific direction, which can improve performance and reduce interference from harmful sources. Petition 870250091599, dated 07 / 10 / 2025, page 24 / 62 20 / 34

[0072] This mode provides a solution to primarily address the security threat that, in a synchronous multi-block signal (SSB) NR communication system, a malicious terminal initiates a radio access request to consume limited new radio access resources from the base station.

[0073] This embodiment of the present invention demonstrates and analyzes the risk of a denial-of-service attack that uses the Radio Resource Control Connection Request (MSG3) as an attack payload on the base station at the new radio access stage. In response to the problem that the use of a blacklist technology cannot eliminate residual risk and will exacerbate the risk of a denial-of-service attack, a method and apparatus are provided which determine a beamspace in which the UE is located, based on a preamble in a UE access request, identify location information of a malicious terminal through radio measurement, identify a new radio denial-of-service attack based on a new radio access rate, a new radio half-connection ratio, new radio access behavior, and the like.They alter the coverage area of ​​a portion of the base station's beam by adjusting physical parameters such as phase, delay, and beam signal intensity to exclude the malicious UE from the base station's coverage range. This ultimately isolates the malicious UE in a physical space, interrupts access attempts by the malicious UE, and protects against access requests initiated by the malicious terminal based on a predefined protection strategy. In this way, the risk of denial-of-service attacks facing the base station is significantly reduced, and the availability and robustness of a wireless communication network in new radio access areas are improved.

[0074] In this mode, the defense against the DOS attack again Petition 870250091599, dated 07 / 10 / 2025, page 25 / 62 The 21 / 34 radio includes two parts: new radio DOS attack detection and physical isolation. Both functions are implemented in a base station entity and are accomplished through the cooperation of hardware and software. Figure 10 is a schematic diagram of new radio denial-of-service (DOS) attack detection and physical isolation according to one embodiment of the present invention. As shown in Figure 10, physical isolation implements protection by cutting off traffic from a physical PHY layer. In new radio DOS attack detection, a determination is made primarily based on data such as location data of an access terminal obtained by the PHY layer, UE access behavior obtained by an RRC layer, and an access preamble.

[0075] One method for detecting a new radio DOS attack is as follows:

[0076] (1) An abnormal pattern of spatial distribution and radio direction characteristic of a malicious UE. Figure 11 is a schematic diagram of a new radio denial-of-service (DOS) attack principle according to an embodiment of the present invention. As shown in Figure 11, when an attack occurs, an attacker selects a leftmost beam to initiate access (determined by the attacker's spatial location). From the perspective of a base station (BT), compared to other beams, a large number of UEs use fixed preambles to initiate the access request from a set of beams. In terms of the spatial distribution of the UEs, this is an abnormal scenario. The base station can identify data, such as the distribution of UEs in each beam, by counting a distribution characteristic of the preambles.A basic principle is that the base station can define one or more preambles for each beam, and the base station's cell coverage is formed by combining a plurality of beams. The UEs can select. Petition 870250091599, dated 07 / 10 / 2025, page 26 / 62 22 / 34 beams and corresponding preambles based on beam signal strength to initiate access. Therefore, the base station can set predefined values ​​based on the preambles to determine if the UE access rates / UE distributions / half-connection quantities in the beam coverage regions are abnormal.

[0077] (2) The peculiarity of access connections: To implement resource imbalance between requests and responses, the attacker can set up a large number of half-connections to new radio and the base station side can generate a large number of timer timeout events. To avoid such a phenomenon that a normal UE anticipates a new radio access resource, once the base station releases resources by virtue of the timer timeout. A malicious UE access rate will be high compared to a new radio access rate in a normal environment. In a real attack, the normal UE cannot anticipate the new radio access resource only if the malicious UE access rate reaches a certain value. Therefore, the base station can identify an attack by setting a new radio access rate value and a generation rate (quantity) of timer timeout events.

[0078] (3) Protocol non-compliance, after the authorized UE fails to access due to insufficient base station resources, the authorized UE may receive a configuration rejection signal (RRC Connection Reject). The configuration rejection signal contains a wait_time field that will require the UE to wait for wait_time seconds before accessing a cell or attempting to access other cells. However, the malicious UE will not execute this signal and may continuously initiate an access request on a cell, and the access request will always maintain a high rate. The reason the malicious UE generates this behavior is that if the UE ma Petition 870250091599, dated 07 / 10 / 2025, page 27 / 62 23 / 34 licious wait, the previously established half-connection will expire during the wait, so the base station releases a large number of access resources after the wait ends, making it impossible for the malicious UE to exhaust the base station's access resources at once, giving the authorized UE an opportunity to anticipate the access resources and complete the access, thus making the new radio DOS attack unauthorized. Through this feature, by adjusting the wait_time value in RRC Connection Reject, the base station measures whether a new radio access rate will change as wait_time changes. If the amplitude of the variation is small, this indicates that the new radio DOS attack may be caused by the malicious UE. Furthermore, according to the protocol, if the authorized UE fails to access more than five times, cell re-selection will be performed, which means that, in a normal scenario, the access rate to the same cell will not always remain high.

[0079] Figure 12 is a schematic flowchart of a method for detecting denial-of-service attacks according to an embodiment of the present invention. As shown in Figure 12, when the access resources of a base station are consumed to a predefined value, the base station initiates a detection flow:

[0080] 1. Account for whether the access rate and the timer timeout event generation rate reach the predefined values. Since only the access request rate / timer timeout event generation rate are accounted for, a smaller amount of base station resources is consumed. Therefore, this determination is preferentially performed.

[0081] 2. If the access request rate exceeds the predefined value, a distribution of one access request in each beam will be identified based on an access preamble characteristic.

[0082] 3. If the above data exceeds the predefined values, the Petition 870250091599, dated 07 / 10 / 2025, p. 28 / 62 24 / 34 abnormal access behavior is observed when adjusting the configuration rejection signal (RRC Connection Reject). If the access behavior is abnormal, the data is transmitted to a machine learning algorithm for decision-making. The above data includes the statistical access rate, the timer timeout event generation rate, the distribution in each beam, and similar data. During implementation, the above data is fed into the machine learning algorithm. The algorithm performs detection and determination based on internal operations and the algorithm's detection logic. This will not be detailed in this document. In one embodiment, the machine learning algorithm is selected by an operator based on a real-world scenario. The detection results of the machine learning algorithm include an abnormal detection result and a normal detection result.A normal detection result indicates that the current UE is not initiating an attack and the communication scenario is normal. If the machine learning algorithm's detection result is abnormal, this indicates that the current UE is initiating an attack, i.e., the base station is under attack. After obtaining the abnormal and normal detection results and determining the presence or absence of an attack on the base station, the flow of the denial-of-service attack detection method shown in Figure 12 is terminated. If the detection result is abnormal, i.e., after the base station is under attack, the flow of the new radio denial-of-service (DOS) attack defense method provided by this embodiment of the present invention needs to be continued in order to continue implementing the base station beam coverage adjustment step in the new radio denial-of-service (DOS) attack defense method.

[0083] In this mode, a space in which a UE is located is identified using an estimation positioning method. Petition 870250091599, dated 07 / 10 / 2025, page 29 / 62 25 / 34 TDOA (which can be replaced according to different scenarios) and a preamble for the use of random access by the UE. Figure 13 is a schematic diagram of a principle for obtaining the location of a signal source by means of a TDOA estimation positioning method according to an embodiment of the present invention. As shown in Figure 13, a plurality of transmit and receive points (TRPs) calculates, based on preambles (identified access request), the time at which the same access request arrives at the TRPs. Using time and radio propagation speed, the distances between the signal source and the TRPs can be calculated. Using the TRPs as circle centers and the distances as radii, an interaction of circles is the location of the signal source. The base station adjusts the beam coverage based on the signal measurement data for complete protection against an attack.In one embodiment, it is determined whether it is the same access request signal based on a preamble, and to avoid determination errors, this determination is made after repeated counting of the preamble. For the same access request signal, the reception times of different TRPs are different. When several TRPs receive the same access request signal, a difference in arrival time may occur. Therefore, the location of the signal source can be obtained using the TDOA estimation positioning method.

[0084] A base station antenna forms a plurality of beams to cover a cell based on a beamforming principle (which has a directionality characteristic in which the energy of the beams is concentrated in a specific direction, while energy in other directions is canceled out) and the cell coverage can be adjusted based on the beamforming weight of each beam in the cell, so that the base station can flexibly configure the signal coverage. If the base station has more coverage beams, it will be Petition 870250091599, dated 07 / 10 / 2025, page 30 / 62 26 / 34 is more flexible for the base station to adjust signal coverage, and protection will have less impact on an authorized UE, thus implementing physical isolation on a new radio DOS intruder and minimizing the impact on an authorized user.

[0085] Depending on the base station configuration, the distribution of malicious and authorized UEs can be divided into the following scenarios:

[0086] 1. There are a small number of authorized users in a low-frequency cell (including a maximum of eight beams) and in a beam in which a malicious UE is located: since the low-frequency cell has a wider beam and coarser control granularity, a general strategy is to directly disable the beam in which the malicious UE is located.

[0087] 2. There is a large number of authorized users in a low-frequency cell and in a beam where a malicious UE is located: a general strategy is to take no action.

[0088] 3. There are a small number of authorized users in a millimeter wave cell (including a maximum of 64 beams) and in a beam in which a malicious UE is located: since the millimeter wave cell has a narrower beam and finer control granularity, and the number of users in a single beam is limited, a general strategy is to adjust or disable the beam in which the malicious UE is located.

[0089] 4. There are a large number of authorized users in a millimeter wave cell and in a beam in which a malicious UE is located: a general strategy is to control or disable the beam in which the malicious UE is located.

[0090] 5. When the number of authorized users accessing a cell reaches a certain value (the new radio DOS attack has little impact on the users who accessed the cell), a Petition 870250091599, dated 07 / 10 / 2025, page 31 / 62 27 / 34 The overall strategy is to take no action.

[0091] In a real-world environment for real-world implementation, due to the beam location where the malicious UE is located, mobility, the environment around the base station, and other factors, the beam coverage strategy configuration needs to be combined with the machine learning algorithm to implement a more flexible protection strategy. Scenario II Mode

[0092] In this embodiment, the defense method against a denial-of-service attack provided in this embodiment of the present invention will be introduced with reference to an attack flow.

[0093] Before new radio access authentication, a malicious UE transmits a large number of MSG3s or RRC connection configuration completions (MSG5s), protecting against new radio DOS attacks for the RRC connection quantity limit feature on the base station. Attack Case I

[0094] Figure 14 is a schematic diagram of a protection principle against an attack on an RRC connection resource according to an embodiment of the present invention. As shown in Figure 14, an attacker uses a terminal with modified source code to frequently perform random access, RRC connection request and RRC connection configuration, and transmit an initial network-attached storage (NAS) message. The message carries an authorized International Mobile Subscriber Identity (IMSI).

[0095] After receiving the initial NAS message, a central network initiates authentication, responds to the attacker with an authentication request, and activates a T3560 timer (whose default value is 5 s).

[0096] The attacker receives the authentication request and does not respond to the main network with an authentication response. Instead Petition 870250091599, dated 07 / 10 / 2025, page 32 / 62 28 / 34 of this, it initiates a new request and replaces the authorized IMSI in the NAS message. The above process is repeated continuously.

[0097] The response is not given here because the main network starts the T3410 timer, usually 5 seconds after an authentication request is sent. If a response is received, the main network will stop the T3410 timer, preventing subsequent attacks from being executed.

[0098] In real-world tests, for Case I, if a base station RRC connection quantity resource is 100, an attack rate needs to reach 25 RRC connections / s or more for the malicious UE to have sufficient capability to anticipate RRC resources and ensure that a normal UE is subjected to a new radio DOS attack. Attack Case II

[0099] Figure 15 is a schematic diagram of a protection principle against an attack on an RRC connection resource according to an embodiment of the present invention. As shown in Figure 15, an attacker uses a malicious UE to perform random access, uses an RRC connection request with different TMSIs or random values, and waits for a response from one side of the network with the RRC connection configuration. However, the attacking terminal does not respond with the message "RRC connection configuration completed". The above process is repeated continuously. The reason for the lack of response here is that, after the base station transmits the RRC connection configuration, the base station may activate a 2s timer. If there is a response, the result will be similar to the content above.

[0100] In real-world tests, for Case II, if a base station RRC connection quantity resource is 50, an attack rate needs to reach 30 RRC connections / s or more for the malicious UE to have sufficient capability to preempt RRC resources and ensure that a normal UE is subjected to a new radio DOS attack. Petition 870250091599, dated 07 / 10 / 2025, page 33 / 62 29 / 34

[0101] In both attack cases above, by attacking the RRC connection limit resource, the base station's RRC connection limit resource is exhausted, so that an authorized UE has no RRC connection resources and cannot access, but is subjected to a DOS attack. The means of attack in Case I are similar to those in Case II, except that Case I requires a large number of authorized IMSIs to ensure identity authentication (if the identity is not authorized, the central network side will transmit an authentication failure message instead of activating the T3410 timer), while Case II does not require an authorized identity (a random value or any TMSI can be used), however, in general, the timer time is 2 s. Therefore, if the base station has more RRC connection resources, the access rate required to cause a new radio DOS attack needs to be higher.From a defensive perspective, the attacker's attack costs can be increased by optimizing the timer timing. For Case I, an authorized identity (IMSI) can be obtained using a pseudo base station. For Case II, the attacker may not provide identity information. Since the attacker's authorized identity cannot be distinguished in the attack process, conventional blacklist protection not only fails but also affects an authorized UE. Therefore, in this embodiment of the present invention, a signal is positioned based on a preamble transmitted by a UE in a random access process. For the above cases, the base station can adjust a portion of the beam coverage to create a hole in the coverage, thereby interrupting the malicious UE's access flow and completing the protection.

[0102] Figure 16 is a diagram of an information interaction principle for a defense against denial-of-service attacks. Petition 870250091599, dated 07 / 10 / 2025, page 34 / 62 30 / 34 (DOS) of new radio according to an embodiment of the present invention. As shown in Figure 16, the following is included:

[0103] Intruder: maliciously requests access resources from a base station and initiates a DOS attack on an authorized terminal.

[0104] NG-RAN Node: manages radio access resources and provides a communication service to a terminal.

[0105] AMF: It is an Access and Mobility Management (AMF) function that provides position service messages between a UE and an LMF, as well as between a RAN and the LMF, and provides a position service management function for transmission and supervision services in this flow.

[0106] LMF: It is an allocation management function (LMF) that stores and manages information about a terminal's location.

[0107] TRP: This is a transmit-receive point (TRP), responsible for measuring and positioning a terminal.

[0108] Data center: The data center receives a distribution of authorized UEs and a distribution of initial access requests that are acquired by a base station and calculates the ideal beam coverage based on a machine learning algorithm to ensure that a malicious UE cannot access and minimize the impact on authorized UEs.

[0109] As shown in Figure 16, the principle of information interaction for defense against a new radio denial-of-service (DOS) attack in this embodiment of the present invention is as follows:

[0110] An attacker initiates a new radio DOS attack on a node Base station NG-RAN. When access resources exceed a predefined value, an attack detection flow is initiated. First, the base station NG-RAN node calculates an access request rate and a preamble for access request usage. If the Petition 870250091599, dated 07 / 10 / 2025, page 35 / 62 If the access request rate and preamble exceed predefined values, the system monitors the sent RRC connection rejection signal and observes the access behavior of a UE, transmitting the acquired access information to a machine learning algorithm for decision-making. If the algorithm's decision result is abnormal, the base station's NG-RAN node enables a location measurement function for the access request signal source and transmits a measurement request information to a plurality of TRPs. The plurality of TRPs uses TDOA positioning technology (or other radio positioning technologies) to measure the access request with the same preamble and the acquired measured information. The plurality of TRPs reports the measured data, i.e., the measured information, to the base station's NG-RAN node.The NG-RAN node of the base station will determine the location of the access request signal source and the distribution of authorized UEs based on the measured data, and will report the positioning information to an AMF of a central network. The AMF reports the measured data, i.e., the positioning information, to a LMF to manage the location information of the access signal source. Then, the above measurement process is repeated continuously to allow the LMF to acquire sufficient location information and report and upload the location information, i.e., the positioning information, to a data center.

[0111] The data center receives the distribution of authorized UEs and the distribution of the initial access request that are acquired by the LMF, calculates the location of the malicious UE and the ideal beam coverage based on the machine learning algorithm to ensure that the malicious UE cannot access and minimize the impact on authorized UEs, and transmits the strategy, i.e., a control strategy. Petition 870250091599, dated 07 / 10 / 2025, page 36 / 62 32 / 34 beam, to the LMF of the central network. After the LMF transmits the beam control strategy to the AMF, the AMF then transmits it to the NGRAN node of the base station, and the NGRAN node of the base station notifies the base station network management to execute the beam control strategy and complete the protection.

[0112] In conclusion, embodiments of the present invention provide a method and apparatus for defense against new radio denial-of-service (DOS) attacks that are primarily used to address a security threat problem where, in a synchronous signal multi-block (SSB) NR communication system, a malicious terminal initiates an access request to consume limited new radio resources from the base station.

[0113] The embodiments of the present invention demonstrate and analyze the risk of a denial-of-service attack that uses the Radio Resource Control Connection Request (MSG3) as an attack payload on the base station at the new radio access stage. In response to the problem that the use of a blacklist technology cannot eliminate residual risk and will exacerbate the risk of a denial-of-service attack, a method is provided that identifies a new radio denial-of-service attack based on the combination of several factors, such as the spatial distribution of UEs, the new radio access rate, the half-connection ratio to new radio, and the new radio access behavior with reference to the machine learning algorithm. In an NR system, a UE access process is completed using a new radio beam mechanism. The UE can select an ideal beam to complete the new radio access.The embodiments of the present invention detect information about the location of the malicious UE to allow the base station to adjust the delay, phase, and intensity of a beam signal, alter part of the base station's beam coverage, artificially generate a hole in the coverage, and exclude the UE. Petition 870250091599, dated 07 / 10 / 2025, page 37 / 62 33 / 34 malicious terminals are removed from the base station's cellular coverage range, isolating the malicious UE in physical space and disrupting the malicious UE's radio access process. Simultaneously, without modifying the original architecture and communication flow, protection against a radio access request initiated by a malicious terminal is ultimately implemented based on a predefined protection strategy. Thus, the risk of denial-of-service attacks facing the base station is significantly reduced, and the availability and robustness of a wireless communication network in new radio accesses are improved.

[0114] The technical solutions provided in the embodiments of the present invention are applicable to the technical field of new radio security for base stations and any scenario in which a terminal accesses the base station via a new radio to access base station services based on an NR protocol, including, but not limited to: a mobile communication service scenario in which a user accesses a base station network via a new radio and an Internet of Things (IoT) scenario that uses the NR protocol, in which a terminal accesses a management and control system via a new radio. The embodiments of the present invention significantly improve the availability of a base station product using the NR protocol and can effectively eliminate the DOS and DOS attack risk introduced by a new radio access mechanism.The residual risk of denial-of-service and distributed denial-of-service attacks caused by a 3GPP protocol in an existing 5G new radio access stream can be essentially eliminated, and the availability of a base station access service can be effectively improved. A malicious UE using a new radio access stream to carry out a denial-of-service attack can be effectively identified, and the attack traffic can be precisely intercepted. This solves the problem of a conventional blacklist. Petition 870250091599, dated 07 / 10 / 2025, page 38 / 62 The current 34 / 34 system is unable to stop a novo-radio DOS attack and has side effects. Using the radio directionality feature to physically isolate an attacker is applicable to protection against most novo-radio attacks.

[0115] The above descriptions are merely preferred examples of embodiments of the present invention and are not intended to limit embodiments of the present invention. Those skilled in the art may make various alterations and transformations to embodiments of the present invention. Any modification, equivalent substitution, and improvement made within the principles of embodiments of the present invention will fall within the scope of protection of the present invention. Petition 870250091599, dated 07 / 10 / 2025, page 39 / 62

Claims

1 / 6 CLAIMS 1. A method of defense against a new radio denial-of-service (DOS) attack, carried out by a base station, characterized in that it comprises: positioning a user equipment (UE) that initiates the new radio DOS attack to obtain location information from the UE, in response to the UE initiating a new radio DOS attack; and adjusting a beam coverage region of the base station based on the location information to exclude the UE initiating the new radio DOS attack from a beam coverage range.

2. A method according to claim 1, characterized in that the positioning of a user equipment (UE) initiating a new radio DOS attack to obtain location information from the UE comprises: requesting measured information from a plurality of transmit-receive points (TRPs), wherein the plurality of TRPs performs beam positioning on the UE initiating the new radio DOS attack using a time-of-arrival difference (TDOA) based on a preamble used by the UE initiating the new radio DOS attack for random access.

3. Method according to claim 1, characterized in that adjusting a base station beam coverage region based on location information comprises: transmitting location information and distribution data from an authorized UE to a data center, wherein the authorized UE comprises a UE that does not initiate a new radio DOS attack; and receiving the optimal beam coverage sent by the data center and adjusting the beam coverage region based on the optimal beam coverage. Petition 870250091599, 07 / 10 / 2025, p. 40 / 62 2 / 6 4. A method according to claim 3, characterized in that adjusting the beam coverage region based on ideal beam coverage comprises one of the following: disabling the beam in which the UE initiating the new radio DOS attack is located in response to a cell in which the base station is located being a low-frequency cell and the number of authorized UEs from a beam in which the UE initiating the new radio DOS attack is located being less than a first predefined limit; and disabling a beam in which the UE initiating the new radio DOS attack is located or adjusting the beam in which the UE initiating the new radio DOS attack is located in response to the cell in which the base station is located being a millimeter-wave cell.

5. Method, according to claim 1, characterized in that the method further comprises: determining whether a UE initiating a radio access request initiates a new radio DOS attack upon detecting the access rate of the UE initiating a radio access request and / or the generation rate of a timer timeout event corresponding to the radio access request in response to a base station access resource consumption reaching a predefined resource consumption value.

6. Method, according to claim 5, characterized in that determining whether a UE initiating a radio access request initiates a new radio DOS attack by detecting the access rate of the UE initiating the radio access request and / or the generation rate of a timeout event of the timer corresponding to the radio access request comprises: detecting whether the beam access distribution of the initiating UE Petition 870250091599, dated 07 / 10 / 2025, p.41 / 62 3 / 6 the radio access request is abnormal based on the access rate of the UE initiating the radio access request and the timer timeout event generation rate; detect if a UE access behavior with an abnormal beam access distribution is abnormal in response to the beam access distribution of a UE initiating the radio access request being abnormal; and detect a UE with an abnormal access behavior based on a machine learning algorithm to determine the UE initiating the radio DOS attack.

7. A method according to claim 6, characterized in that the detection of the abnormal beam access distribution of the UE initiating the radio access request comprises: counting the preamble of the UE initiating the radio access request in response to the access rate of the UE initiating the radio access request reaching a first predefined value and / or the generation rate of the corresponding timer timeout event reaching a second predefined value; and determining the abnormal beam access distributions of the UEs initiating the radio access request in response to a number of UEs using a fixed preamble to initiate the radio access request on the same beam reaching a third predefined value.

8. Method according to claim 6, characterized in that detecting whether UE access behavior with abnormal beam access distribution is abnormal comprises: adjusting a timeout value in the radio resource control (RRC) configuration when rejecting the signaling; and determining whether UE access behavior initiating the radio access request is abnormal in response to the adjusted timeout value that fails to cause the UE access rate initiating the radio access request to reach a predefined range.

9. A device for defense against a new radio denial-of-service (DOS) attack applied to a base station and characterized in that it comprises: a positioning module configured to position a user equipment (UE) that initiates the new radio DOS attack to obtain location information from the UE in response to the UE initiating a new radio DOS attack; and an adjustment module configured to adjust a beam coverage region of the base station based on the location information to exclude the UE that initiates the new radio DOS attack from a beam coverage range.

10. Apparatus, according to claim 9, characterized in that the positioning module is further configured to request measured information from a plurality of transmit-receive points (TRPs), wherein the plurality of TRPs performs beam positioning on the UE that initiates the new radio DOS attack using a time-of-arrival difference (TDOA) based on a preamble used by the UE that initiates the new radio DOS attack for random access.

11. Apparatus, according to claim 9, characterized in that the adjustment module comprises: a transmitter unit configured to transmit location information and distribution data from an authorized UE to a data center, wherein the authorized UE comprises a UE that does not initiate a new radio DOS attack; and a receiver unit configured to receive the ideal beam coverage sent by the data center and adjust the beam coverage region based on the ideal beam coverage.

12. Device according to claim 9, characterized in that it further comprises: a detection module configured to determine whether a UE initiating a radio access request initiates a new radio DOS attack upon detecting the access rate of a UE initiating a radio access request and / or the rate of generation of a timer timeout event corresponding to the radio access request in response to a base station access resource consumption reaching a predefined resource consumption value.

13. Apparatus, according to claim 12, characterized in that the detection module comprises: a distribution detection unit configured to detect whether the beam access distribution of the UE initiating the radio access request is abnormal based on the access rate of the UE initiating the radio access request and the timeout event generation rate of the timer; a behavior detection unit configured to detect whether a UE access behavior with the abnormal beam access distribution is abnormal; and an algorithm determination unit configured to detect a UE with an abnormal access behavior based on a machine learning algorithm to determine the UE initiating the radio DOS attack.

14. Computer-readable storage medium characterized in that it stores a computer program, wherein the computer program is configured so that, when the computer program is executed by a processor, it causes the processor to implement the steps of the method as defined in any one of claims 1 to 8.

15. Electronic device characterized in that it comprises a memory, a processor, and a computer program stored in memory and executable by the processor, wherein the processor is configured to execute the computer program to implement the steps of the method as defined in any one of claims 1 to 8. Petition 870250091599, dated 07 / 10 / 2025, pp. 45 / 62

Images