Network security protection method based on XDR telephone bill data

Abstract

The invention relates to a network security protection method based on XDR telephone bill data. The method comprises that: abnormal behaviors of users are identified according to XDR telephone bill data, network security protection is performed then, and identification for the abnormal behaviors of the users Specifically comprises, according to the indexes of the XDR telephone bill data, identifying the abnormal behaviors of the users, wherein the indexes comprise signaling connection times, air interface time, flow, destination or source IP, destination or source port number, data packet number and / or application service type, and the user abnormal behaviors comprise threat behaviors of a network to a user, threat behaviors of the user to the Internet and abuse behaviors of the user to wireless resources. Compared with the prior art, the abnormal behaviors of the wireless user network are effectively monitored, then network security protection measures are taken, bad behaviors of thenetwork are purified, a green and safe network environment is achieved, and the method has the advantages of being wide in recognition range, effective and the like.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a network security protection method based on XDR bill data. Background technique [0002] As the application services on wireless mobile user terminals become more and more colorful, the way users use services has also undergone tremendous changes, from basic voice calls and text messages to integrated video, audio, pictures, text, Internet The leader of multi-functional media that integrates interoperability, along with this transformation process, the behavior that threatens users and network security has also changed, from viruses and Trojan horses that originally targeted end users to Internet devices, regional user awareness, For malicious attacks or threats to link elements such as network resources and service provisioning equipment, the corresponding preventive measures have also changed from patching vulnerabilities in the original terminal operating system to sens...

AI Technical Summary

Problems solved by technology

[0005] 1) Abnormal behaviors are increasingly common: battery attacks, port scans, signaling attacks, resource abuse

[0006] 2) Increased security threats: For example, network security behaviors have increased by 214% since the launch of LTE compared with 2G and 3G eras

[0007] 3) Bringing risks to the network: increased complaints, brand damage; network threats; user perception decline; network performance degradation; wireless resource shortage

[0008] 4) The frequency of occurrence is high: user behavior is complex and changeable, and wireless resources are frequently abused, which requires timely monitoring and discovery; user abnormal behavior events occur frequently, and potential hidden dangers need to be discovered in time by analyzing user online behavior

[0010] For the increasingly serious impact, the prevention measures adopted are relatively poor, such as: no means of discovery, lack of means of discovering network status events, lack of monitoring means for abnormal business behaviors, and lack of end-to-end demarcation and positioning of abnormal network behaviors Tool, uninformed customization can only rely on complaints to find, poor user perception, and can not eradicate the problem

It cannot be completely suppressed. The EPC control strategy can only deal with some network status behaviors, and there is no effective suppression method for battery attacks and signaling attacks.

The response speed is slow, and the period from the discovery of the cause of the problem to the implementation of the suppression measures through manual analysis is too long

Images