METHOD FOR ALLOCATING EQUIPMENT FROM USERS SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS

Description

/ 42 METHOD FOR ALLOCATING EQUIPMENT FROM USERS SUSPECTED OF MALICIOUS ACTIVITY INTO RESOURCE-CONTROLLED SLICES BASED ON THE CONCATENATION OF ANOMALY DETECTORS FIELD OF THE INVENTION [1] The invention balances security and latency using slices, or s / ices, with differentiated allocations of radio resources. An initial detector classifies User Equipment (UEs) as normal or anomalous. Anomalous UEs enter a chain of detectors that assess risk based on anomaly scores. Low-risk UEs receive more resources, while higher-risk UEs are allocated to more restrictive s / ices, monitored by more sophisticated detectors, with greater accuracy and recall, but also higher latency. This approach limits the use of radio resources by suspicious UEs, preventing attacks such as Distributed Denial of Service (DDoS) and reducing unnecessary connection rejections without compromising system security. The method also dynamically adjusts resource allocations according to changes in a UE's perceived risk over time.Furthermore, the detectors can utilize data collected by the sensors and share information with each other to increase detection efficiency. The invention is intended for use in the telecommunications field. FUNDAMENTALS OF THE INVENTION AND STATE OF THE ART [2] In anomaly detection applied to communication networks, many risks can be monitored and mitigated, including DDoS attacks on network functions such as the Core and RAN. Many of the techniques available in the literature use components of the invention described here, but in isolation, without integrating and combining them in the manner proposed here. [3] The study in [1] investigates the use of Machine Learning (ML) techniques for anomaly detection, evaluating the execution time of the algorithms to ensure they meet the response time requirements. In addition, an analysis is performed on the amount of network flows that can be Petition 870240111138, dated 12 / 30 / 2024, page 7 / 84 / 42 processed to identify threats in 5G networks, in order to respect the established time restrictions. [4] In [2], an extension of the work presented in [1] is analyzed, in which the architecture is enhanced with the ability to self-adapt to manage traffic fluctuations. When necessary, the system can allocate more computational resources, replace the Deep Learning (DL) framework, or even the detection model. This adaptation is made possible by an abstraction layer that uses virtualized frameworks, choosing the most appropriate one based on traffic behavior. Decision-making is based on experimental results that determine the system's throughput with different DL frameworks. Unlike the invention presented here, works [1] and [2] do not explore the use of s / ices, nor the use of countermeasures that benefit both system latency and the accuracy and recall of anomaly detections. [5] The study presented in [3] proposes a Zero Touch Network and Service Management (ZSM) solution, characterized by being automated and requiring minimal human intervention. This solution is aimed at detecting and mitigating DDoS attacks on network s / ices, with an emphasis on s / ices designed for massive machine-type communications (mMTC). The solution analyzes network traces in real time and classifies them as normal or anomalous, determining the occurrence of attacks. This approach presents significant differences in relation to the invention discussed here. Firstly, [3] focuses exclusively on the protection of a s / ice, while the invention uses s / ices as tools to manage resources and protect the system as a whole.In [3], as / ice mMTC is treated as a microcosm of the network, in which standard anomaly detection algorithms are adjusted to prioritize specific metrics of that scenario, such as system stability. This means that there is no evolution, adaptation or cooperation. [6] However, [3] presents a variant that makes it possible to create a control loop for detection. This loop includes a variable anomaly detection threshold. Petition 870240111138, dated 12 / 30 / 2024, page 8 / 84 / 42 The lower the threshold value, the higher the probability that devices will be included in the blocklist. In order to avoid high false positive rates, a solution based on three thresholds is used. UEs are allocated into three distinct categories: anomalous, suspicious UEs, and normal UEs. Based on the computed anomaly scores, it is then possible to categorize UEs. The authors calculate the percentage of UEs in each category after a complete event, i.e., after a sufficiently long time sequence. Depending on the relationship between the percentages, all UEs can be disconnected, all can be ignored (i.e., the system takes no action), or suspicious UEs can be monitored. In particular, if a UE is classified as suspicious multiple times, it is moved to the anomalous UE category, causing the proportion of anomalous UEs to increase and approach the condition of total blocking.This solution does not allow for individual rejection and isolation of UEs, as it sends connection rejection commands that affect all UEs in the slice indiscriminately. Although there is a gradation in the decision based on the list and count of suspicious detections, it is not designed to take targeted countermeasures individually for each UE. This also means that UEs classified as anomalous no longer have the chance to be re-evaluated and not lose their connection to the network. In contrast, the invention detailed in this document allocates suspicious UEs to slices with restricted resources and isolated from the normal slice, allowing UEs to safely attempt new connections without impacting the main slice. [7] In [4], network slicing is used because it is assumed that the level of isolation that can be maintained between slices can be a priori as good as the network manager desires. As the slicing strategy is also vulnerable to security threats, such as DDoS attacks, [4] presents a solution based on DL techniques to detect such attacks and subsequently create a sinkhole slice, allocating a small portion of physical resources to isolate and mitigate the action of malicious agents. The proposed approach is evaluated using a 5G network prototype developed based on OpenAirInterface. Several DL models are compared considering metrics such as detection accuracy, false positive rate, and execution time, among others. Petition 870240111138, dated 12 / 30 / 2024, page 9 / 84 / 42 other indicators related to the ML model. In addition, [4] analyzes the performance of the created slices in terms of throughput of benign and malicious users, as well as the processing time involved in slicing operations. The implementation in [4], however, differs substantially from the invention proposed here because it does not consider the system dynamics, i.e., the variability in the development or allocation of slices. It also does not consider the possibility of slices cooperating with each other to improve the detection process at each stage and in the system as a whole. Finally, the work in [4] does not present a decision chain and also does not study in detail the problem of system latency. [8] The implementation in [5] is similar in several ways to the contributions of [4], especially regarding the countermeasures applied by the system. The authors of [5] use an autoencoder based on Recurrent Neural Networks (RNNs) with multi-head attention, specialized in the analysis of anomalies in time series. Its architecture integrates an encoder, which maps the data into a latent space, and a reconstruction decoder. An important element of the model is the auto-attention mechanism in the encoding phase, which calculates and normalizes the preliminary anomaly scores to create attention weights. These weights generate a context vector, highlighting the most relevant data segments for effective anomaly detection. In addition, the model incorporates Long Short-Term Memory (LSTM) units to mitigate the fading gradient problem in RNNs, ensuring long-term data retention and processing.Once anomaly detection is performed, information from this detection is used to initiate secure slicing in the O-RAN. When malicious behavior is detected, the responsible UEs are isolated in a slice with severely limited resources. Although [5] uses resource contention slices, the work does not address the problem of the trade-off between latency and detection efficiency. Nor does it address maximizing system stability and handling UEs, even after there is evidence that they are malicious UEs. [9] The authors of [6] propose a system to support automated decision-making at the slice level. The developed paradigm integrates the use of Networks Petition 870240111138, dated 12 / 30 / 2024, page 10 / 84 / 42 Graph Convolutional Neural Networks (RNNs) are used to model correlations between multivariate Key Performance Indicators (KPIs) of data slices. They feed time series data from KPIs into convolutional graph modules, which attempt to find spatial and temporal relationships between the metrics. The result is then fed into an RNN, which aims to predict the future behavior of the data. Deviations from the predictions regarding the monitored metrics are detected based on probabilistic classification. This unsupervised methodology allows not only the identification of anomalies but also the explanation of the underlying characteristics of the monitored KPIs. In this way, it promotes a more detailed and efficient analysis of the phenomena governing the time series, while enabling the self-management of data slices.The entire concept of [6], despite its sophistication, forms only one link in the detection chain proposed in this document. Given the complexity of the proposal in [6], it could constitute one of the final detection stages of the invention described herein.

[10] The presence of anomalies in physical nodes (PNs) or physical links (PLs) in networks that support multiple virtual network elements can significantly impair the performance of network slices. To restore normality quickly, it is crucial to detect these anomalies accurately and quickly. Furthermore, since virtual nodes and links are distributed across different slices, it is necessary to adopt distributed detection methods for virtualized environments. In [7], a distributed algorithm for online detection of anomalies in PNs is presented, based on a One-Class Support Vector Machine (OCSVM) with distributed analysis. The problem is transformed into decentralized quadratic programming problems, with the solution obtained through alternating direction of the multipliers.An algorithm for anomaly detection in PLs is also proposed, using the correlation between measurements of neighboring virtual nodes, which requires the storage of covariance matrices and mean vectors. With this, it is possible to perform real-time analysis of anomalies in PLs. Although the work in [7] has a strong emphasis on cooperation between nodes and distributed learning, it focuses. Petition 870240111138, dated 12 / 30 / 2024, page 11 / 84 / 42 only in one stage of the solution proposed in this document, in which all detectors can cooperate, and, if spatially distributed, cooperation can be federated. Furthermore, [7] it does not address the balance between latency and accuracy / recall, nor does it propose a reassessment methodology for cases considered anomalous.

[11] In [8] a distributed framework for anomaly detection in virtual machines (VMs) using Federated Learning (FL) is discussed. This framework allows network slice managers to collaborate in training a global anomaly detection model, keeping network metrics locally, without the need for sharing. To handle data complexity in high-dimensional scenarios, [8] uses the Bidirectional Wasserstein Generative Adversarial Network with Gradient Penalizing and Multi-Discriminators (BiWGAN-GP) model. This model utilizes the ability of Generative Adversarial Networks (GANs) to capture complex distributions, learning the normal data distribution from sets of resource metrics spread across multiple VM monitors.BiWGAN-GP, with its multi-discriminator architecture, can be trained directly on distributed data sources, eliminating the high communication and processing costs associated with collecting and centralizing local data. Furthermore, an anomaly score is used as a criterion to quantify the deviation of the new metrics from the learned normal distribution, enabling the detection of anomalous behavior in the VMs. Similar to the work in [7], the development in [8] uses a complex anomaly detection algorithm employing a federated approach. However, unlike [7], it uses a semi-supervised detection algorithm. This makes [8] conceptually very convergent with the proposal presented here of using normal data from slice 0 to train semi-supervised models.However, [8] differs in that it consists of only one coordination node and, consequently, one central decision unit. In this invention, there are potentially several federation points simultaneously, forming a multipolar system. Furthermore, just as. Petition 870240111138, dated 12 / 30 / 2024, page 12 / 84 / 42 in virtually all cases evaluated, [8] does not deal with the possibility of reassessing anomalous UEs with greater precision and recall from progressively more complex stages of detection.

[12] Still on the subject of federated detection, [9] proposes DeepFedKDAD, a framework based on deep federated knowledge distillation for anomaly detection in Beyond 5G (B5G) network slices. Specifically, a hybrid model is proposed that combines Convolutional Neural Networks (CNNs) and BiLSTM to classify the spatiotemporal network traffic characteristics of UEs as normal or anomalous. The differentiating factor, however, is the introduction of a privacy-preserving technique based on Federated Knowledge Distillation (FKD). Instead of sending model parameters, FKD only exchanges the logits of the local model with the global server, reducing communication overhead. FKD consists of a complex teacher model and a lightweight student model, where each UE trains its own teacher model and transfers knowledge to the student model.Since the characteristics of [9] have many similarities with the developments presented in [7] and [8], the differences with respect to the proposal in this document are also similar. The system in [9] can be understood as only one of the stages of the system described here. This system has a set of decentralized nodes of equal importance for which, despite being heterogeneous in terms of computational complexity, a linear growth in complexity is assumed as a function of the depth of the detection chain. Furthermore, [9] does not concern itself with the latency-precision relationship, nor with the ability to increase network stability, i.e., to keep UEs connected for as long as possible, avoiding excess and spurious signals, but still ensuring secure communication.

[13] Another work related to FL is

[10] , in which a knowledge-based hierarchical framework for anomaly detection in network slicing systems is presented. This framework adopts a management plan that enables hierarchical and intelligent management of slices across domains. To address the challenges posed by multivariate and unbalanced datasets in Petition 870240111138, dated 12 / 30 / 2024, page 13 / 84 / 42 virtualized network environments,

[10] creates a specific model for anomaly detection in sub-slices. In this model, components such as the encoder, generator, and distributed discriminators perform adversarial learning simultaneously. In addition, a cross-domain knowledge extraction module, based on graphical attention networks, is implemented to increase efficiency and accuracy in anomaly identification. Training anomaly detection models in sub-slices promotes collaborative detection both between and within slices, while protecting data privacy. The achievements of

[10] have a high degree of similarity to what is proposed in this document, as it promotes collaboration between slices and within the slice itself, which is also a striking characteristic of the method proposed here.However,

[10] it does not include defense considerations through the association of slices with resource constraints or the evolution of mitigation degrees to attacks that adhere to a varying trade-off between latency and precision / recall.

[14] Another approach that combines anomaly detection with slicing involves the use of intelligent management mechanisms aggregated to the detection algorithms. The authors of

[11] present a closed-loop system composed of: (1) an Intent-Based Networking (IBN) mechanism for efficient end-to-end network slicing control, orchestration, and management; and (2) a data analysis mechanism that uses hybrid ensemble learning (EL) algorithms for predicting network resource utilization, as well as anomaly detection and mitigation. The ML models assist the IBN platform in updating and proactively managing network resources, and can dynamically trigger changes to slice configurations. The IBN-based manager performs an activity similar to the slice selector agent of this invention (which will be presented in Figure 4 in step 401).However, the purpose of the manager in

[11] is to adapt the network to the conditions it observes in real time. In this way, it does not constitute a slice creator that allocates resources to UEs according to different degrees of suspicion about malicious activities, thus differing from the realizations proposed in this document. Petition 870240111138, dated 12 / 30 / 2024, page 14 / 84 / 42

[15] In

[12] , an approach is proposed that locates possible anomalies in the slices and optimizes resource allocation strategies in an integrated way, using the history of user behavior in order to reduce the average system latency. To solve the problem, a framework is used that simultaneously locates possible anomalies in the slices and defines resource allocation strategies by predicting future user requests and positions. Although aiming for a global reduction in latency,

[12] works with independent nodes and slices, which do not simultaneously handle the evaluation process of the same UE. There are no data connection links from the output of one detector to the input of a new one. Therefore, what

[12] does is only minimize the total latency.Conversely, the invention presented in this document implicitly contains a multi-objective optimization problem, in which the goal is to find a Pareto-optimal operating point that is advantageous for the network manager's needs in terms of latency, accuracy, and recall.

[16] With regard to patents, a relationship is identified with some:

[13] ,

[14] ,

[15] and

[16] . Among the main claims of

[13] , the following stand out: real-time network data processing for anomaly detection, the use of historical data and the updating of the detection analysis based on the input of new historical data or based on changes in the time window used, the use of ML to compute deviations in metric behavior, and the use of user feedback to change anomaly detection models in real time. The claims of

[13] do not address a variable trade-off between latency and detection efficiency. Nor do they address the ability of a method to reassess UEs considered anomalous, in order to preserve network stability as much as possible. They also do not mention the use of slices as a system protection tool.

[17] Claims in

[14] include anomaly detection through analysis of network service descriptors, time series related to service-level metrics, resources, and slices. Patent

[14] focuses on the description of detection methods, primarily those related to time series reconstruction. Broadly speaking,

[14] is an extension of

[13] that also incorporates network slices into the analysis. However,

[14] does not address the latency versus efficiency problem, nor does it create a chain. Petition 870240111138, dated 12 / 30 / 2024, page 15 / 84 / 42 of detectors and does not cover cooperation between detector nodes, i.e., it does not include considerations about detector federations.

[18] Claims in

[15] deal with an anomaly detection process based on the creation of clusters through the reduction of the time series into multiple detection paths defined by reduced-dimensional representations of the series. Evaluations in these branches are used for the system's decision-making process. The logic of the system dividing input data among multiple paths and the cooperation between these paths is one of the premises of the technique described in this document. However,

[15] does not explicitly mention the use of ML techniques. It also does not treat the nodes of the cooperation system as independent entities within the decision set. Finally, it is not a process whose focus is to simultaneously guarantee security, low latency, and system stability.

[19] The claims of

[16] include methods for identifying the causes of anomalies. The main claims deal with multivariate time series based on network metrics, which have their dimensions correlated pairwise. The correlations are then used for predictions of the behavior of the original metrics. Deviations identify time instants characterized by anomalous behavior. The main similarity of the method in

[16] with the method in this document is the use of analysis paths parallel to the timeline of the original metrics, which resembles the transition of UEs considered anomalous from one detection stage to the next, while, at the same time, data from that UE are collected in the slice allocated to it. So there are possibly two analysis paths, that of the slice dedicated to the UE and possibly that of data analyzed by the previous detector now analyzed in a supposedly more complex detector, with lower latency and higher detection efficiency.However,

[16] it does not have many of the considerations made for the invention in this document. Namely, it does not have the ability to allocate slices dedicated to containing anomalous events. It also does not have adaptive slice configuration mechanisms or the ability to reanalyze certain users. OBJECTIVES AND ADVANTAGES OF THE INVENTION Petition 870240111138, dated 12 / 30 / 2024, page 16 / 84 / 42

[20] The invention shown in this patent application seeks to achieve the following objectives: • To achieve a compromise between low latency and high efficiency in terms of accuracy and recall of the anomaly detection process; • To ensure that the ability of faulty or malicious UEs to exhaust the RAN's radio resources and create countermeasures for this type of attack is reduced. To this end, RAN slices are created or used in such a way that UEs with samples of normal temporal behavior (usually time-discrete and amplitude-discretized temporal sequences) are allocated to slices with a generous amount of resources, close to what is expected for the optimized operation of a UE. Conversely, UEs with anomalous behavior are allocated to slices with reduced resources. However, the concatenation of detectors and the continuous reclassification of anomalous cases allow for a review of a suspected UE to the normal class; • Create a chain of detectors with progressive levels of anomaly detection and analysis. The proposal is to create a gradual, comprehensive, and detailed analysis method, in which each step of the process progressively balances latency and accuracy / recall. In the initial stages, the focus is on latency, ensuring greater real-time capability, with samples easily detected for anomalies being quickly discarded. On the other hand, samples initially classified as anomalous go through subsequent stages with greater processing delays but superior detection efficiency. Thus, the method allows the UEs (Unified Electronic Units) to remain integrated into the network in a controlled manner, limiting the radio resources allocated to UEs classified as anomalous, with resource constraints intensifying as the number of anomalous classifications grows and the complexity of the analyses increases.However, the reassessment capability allows UEs, initially considered anomalous, to be reviewed and eventually reintegrated into the system. Petition 870240111138, dated 12 / 30 / 2024, page 17 / 84 / 42 system, which may be extremely relevant if these UEs prove to be important for the operation of the network; • Create decision flexibility at each step of the method. Each detector can not only forward its samples to more sophisticated detectors, but also perform an internal reassessment during the current step. This functionality allows detectors to use a classification voting mechanism, implementing a procedure similar to ensemble decision-making. That is, a detector can classify the behavior of a UE multiple times (using different samples of the measured metrics) and choose the most frequent classification among those performed. Although this technique introduces greater latency, and is therefore optional, it can still be advantageous in scenarios where detection accuracy is the system's priority; • To improve detector behavior throughout the method, enabling them to become more robust and efficient as the system evolves. Detectors are interconnected, sharing training data, especially in the case of semi-supervised and supervised detectors. Decision rules or model weights (assuming the chosen base model is a neural network) can be transmitted between detectors, allowing them to learn from each other. This increases the accumulated experience of the detectors, in a process similar to transfer learning. Furthermore, this approach indirectly allows learning through samples of operation that have not been previously observed, facilitating cooperative learning. This is especially useful if the detectors are distributed not only in a temporal chain and at different stages, but also spatially.Although this process generates an increase in data transmission over communication links and, consequently, higher latency, it offers significant advantages in terms of accuracy and recall. However, it is crucial to evaluate each case individually to determine the optimal compromise between latency and detection efficiency. Petition 870240111138, dated 12 / 30 / 2024, page 18 / 84 / 42 • Expand the set of normal samples observed by the detectors, primarily improving the performance of semi-supervised algorithms in metrics designed for the analysis of highly unbalanced data, such as the data evaluated during anomaly detection. The created slices provide data to all detectors, allowing them to visualize a larger number of samples than if they were operating independently. This process is particularly advantageous for novelty detection methods, where a large volume of normal samples is essential for training the models, making them more robust. In particular, slice 0, which contains the normal samples, is of great importance for the analysis, as it provides a solid basis for detection and detector enhancement.The method also aims to increase the efficiency of data utilization within the system, which is achieved by leveraging samples collected in different slices.

[21] The realizations and possibilities cited for the invention have the following advantages with respect to the state of the art: • The state of the art has a large body of work focused on optimizing the latency of anomaly detection algorithms. However, the use of slices with the intention of managing latency as a function of the accuracy / recall of anomaly detection has not been explored in the literature. Furthermore, the anomaly detection methods in the literature for low latency avoid the use of sophisticated Artificial Intelligence (AI) models and often do not even use AI; • On the one hand, in the state of the art there are considerations of control loops and threshold adaptability of anomaly detection algorithms. On the other hand, there are several works that focus on the use of anomaly detectors in slices, since slices have the ability to protect a given application from the rest of the network, isolating it from malicious external activities. Unlike the proposal of this patent, slices are not used to partition normal UEs from suspicious UEs, giving both classes paths of Petition 870240111138, dated 12 / 30 / 2024, p. 19 / 84 / 42 distinct and isolated processing, but fully integrated into a control loop that encompasses the entire system. There are still works in the literature that use the concept of slices with reduced resources to protect the network, but doing so as the final containment measure of the method, and not as a form of adaptable and dynamic treatment that allows the re-evaluation of UEs as the system evolves; • The relevant literature lacks methods that allow for the re-evaluation of UEs (Unit Emissions) in the communication network through a continuous and progressive detection process, which attempts to guarantee a compromise between latency and precision / recall by advancing detections along the detector chain. Nor are there any studies in the literature that attempt to explore the dynamics of this compromise. • The state of the art lacks approaches with detection stages equipped with a voting system for multiple detections performed at different points in time, i.e., on different samples of the same UE and evaluated by the same detector. Except for algorithms based on decision forests, such as those inspired by Isolation Forest, no methods have been found that combine a multiplicity of results with voting for classification performed by a detector. Additionally, the use of the mode in the analysis requires the application of a voting mechanism in serial format, while algorithms such as Isolation Forest use a parallel approach. Although serialization may be unfavorable from the point of view of latency, it offers advantages in terms of decision efficiency and capturing the dynamics of the system. This is especially relevant considering that the characteristics of a UE can change over time, affecting the detector's input metrics.This allows for a more accurate classification by relying on more data. • Although the literature explores the use of FL in training ML models for anomaly detection, this approach focuses on training global models from data processed by local models, each of which is associated with its local metrics. The main motivation for FL in this Petition 870240111138, dated 12 / 30 / 2024, page 20 / 84 / 42. The context is to ensure data security and reduce the transmission of large volumes of information between processing units. However, the method presented in this document differs conceptually from this approach, although it can take advantage of the benefits of standard FL methods. Here, the exchange of information between detectors (potentially, but not necessarily, mediated by FL) aims to improve the individual performance of each detector over time. Training is not centralized, but multipolar: each detector uses data from past detectors (and, in offline scenarios, possibly also future data) to improve its detection capability. Therefore, the method described can be understood as a generalization of FL, where each detection stage can be considered as a global model trained via FL; • The current state of the art does not present studies that explore the allocation of evasive evolution units (EEs) with normal behavior in one or more dedicated slices, aiming, among other objectives, at a more detailed analysis of these EEs and the collection of their key performance indicators (KPIs) to expand the number of data from events considered normal. This approach allows for the improvement of the training of semi-supervised anomaly detectors. This paradigm remains unexplored in the literature of the field. GENERAL DESCRIPTION OF THE INVENTION

[22] The invention proposes a chain method for detecting anomalies in mobile networks, encompassing architectures such as 5G, 5G Open RAN, and 6G. This method not only identifies anomalous UEs, or user equipment, but also allows for the re-evaluation of those previously classified as suspicious, based on more complex detectors and also on additional data collected in properly activated slices. The difference in the approach lies in the introduction of detector layers with different levels of precision, recall, and latency, combined with the ability to re-evaluate suspicious UEs and use data from normal cases for the retraining of detectors based on semi-supervised algorithms. Petition 870240111138, dated 12 / 30 / 2024, page 21 / 84 / 42

[23] Decisions with better detection metrics tend to be slower, which can conflict with latency constraints imposed by systems that do not allow the use of algorithms dependent on large analysis windows or long processing times to identify anomalies. To minimize latency and meet Service Level Agreements (SLAs), a staged adaptive approach is adopted. In the early stages, the priority is speed, with less precise but faster detectors performing an initial screening. These detectors quickly classify easily identifiable events as anomalous or normal. Events with anomaly scores closer to the decision threshold proceed to later stages, where they are analyzed by progressively more sophisticated detectors that use larger windows and more complex algorithms, resulting in longer processing times but with greater accuracy and recall.

[24] In the remainder of this document, all subsequent analyses assume preprocessing so that the data are properly separated and segmented by UE. This data is then parallelized or allocated in a buffer. Parallelization benefits the proposed minimization of latency, but with a considerable increase in memory usage, whereas the use of a buffer generates data serialization and therefore less memory occupancy, but with the loss of synchronization with the original process and the impossibility of real-time processing. It is worth noting that the preprocessing of the input for its partitioning according to the system's UE IDs is not the focus of this invention.

[25] Each detector has its own re-evaluation mechanism, based on data observed on the network. The network administrator can configure the system for specific prioritizations at each detection stage, including the first detector, adjusting the trade-off between accuracy, recall, and latency according to their needs. It is important to note that these internal re-evaluations are not mandatory; a detector can be configured to perform only a single detection per stage. If multiple detections are chosen in a stage and the maximum number of evaluations is odd, a voting mechanism is applied. In this case, the final decision of the stage is based on the detection class with the highest number of votes. Petition 870240111138, dated 12 / 30 / 2024, page 22 / 84 / 42 defined, respectively, by the argmax of the counters of the classes detected in a detection stage.

[26] When a stage classifies an event as non-anomalous, the detector output is represented by the value 0. Anomalous classifications are categorized into different groups, according to the stage in which they were performed. These outputs range from 1 to N, where 1 indicates the anomalous classification of the first detector, 2 of the second detector, and so on up to N, of the last detector in the system.

[27] The detectors' decisions and the outputs of each stage provide the information necessary for the selection or creation of slices. For outputs classified as non-anomalous, regardless of depth (defined by the index of the activated detector), the output result is 0. In this case, the system performs either: - the selection of slices, in static systems where the characteristics of the slices have already been defined by an external resource management algorithm; or - the creation of slices, in dynamic systems that require real-time adjustments, adapting radio configurations and resources as needed.

[28] For outputs classified as anomalous, the method outputs as a response the index of the detector that identified the anomaly. In this configuration, the allocation or construction of slices depends directly on the depth of the detector: slices assigned to shallower stages tend to be less restrictive with regard to resources. This is because a UE identified as anomalous by E+1 stages is more likely to be effectively anomalous than a UE detected as anomalous by only E stages.

[29] As the method progresses through the detector chain, the slices become progressively more restrictive, reflecting the increasing probability of detecting anomalous behavior. After the final stage N, the method can completely block the UE connection, failing to allocate any slice whatsoever.

[30] This approach allows suspected UEs to remain connected to the RAN, but with increasingly stringent restrictions, ensuring that they are unable to exhaust Petition 870240111138, dated 12 / 30 / 2024, page 23 / 84 / 42 essential resources for the network. The greater the number of stages that classify the UE as suspect, the more rigorous the prevention of resource depletion will be.

[31] The method also enables the sharing of training data between detectors in the case of using semi or fully supervised algorithms for anomaly detection. This exchange of information allows detectors to learn from each other, mutually enriching their detection capabilities, that is, making them more efficient for the same processing latency value.

[32] More importantly, detectors can take advantage of observed data in the slices allocated and configured according to the UE under analysis, increasing the availability of examples for training. In the semi-supervised context, for example, which is described here as an illustrative but not limiting example, slice 0 (which contains normal operating examples) provides data for detectors at deeper stages, allowing these detectors to accumulate more experience and obtain additional examples of normal behavior. These examples are especially relevant because semi-supervised algorithms depend on normal data for proper training. The more normal data there is, the more the detector learns normality patterns, and the more adept it becomes at detecting patterns that deviate from that normality.

[33] In the cases discussed so far, the interrelation between detectors and training examples is limited to causal systems. This means that detectors can only use data processed by previous detectors. This also means that slice data can only be used for training by detectors related to time instants with timestamps later than those of the data. However, if training is performed offline and latency ceases to be a constraint on the method's operation, this limitation to causality can be removed. In this scenario, detectors at more superficial stages in the chain could also take advantage of training examples and data from slices and detectors linked to future detection stages, further increasing the efficiency and learning of the method. Petition 870240111138, dated 12 / 30 / 2024, p. 24 / 84 / 42

[34] An illustrative, but not limiting, example of the system's application is the prevention of DDoS attacks on RAN networks. In this context, metrics such as RAN Resource Control (RRC) Connection Request counters can be used as inputs for the detectors. These metrics can be represented as time series, although this is not mandatory. The system is also capable of acting on point anomalies, not being restricted to scenarios with contextual or collective anomalies. In addition, other input metrics can be considered, such as Timing Advance (TA), also represented by a discrete time sequence.

[35] Another illustrative, but not limiting, example is the application of the described chain system for the detection of operational errors. When monitored signals, such as the Received Signal Strength Indication (RSSI) or the Reference Signal Received Power (RSRP), show values ​​significantly different from those considered normal, this may indicate an anomalous situation, such as a problem in the positioning of the transmission tower or an inadequate system configuration.

[36] Anomaly analysis in this context is valuable for optimizing system performance and can enable the use of the described method as part of an automated control loop. This loop would adjust system parameters based on anomaly detection at different stages of analysis, and could even act as a segmented debugging method.

[37] In addition, the system can be configured to monitor variables according to their relevance. For example, less critical variables or those with less impact on the RAN can be analyzed in a few stages, while more sensitive variables or those fundamental to the network's operation would go through a greater number of analysis steps, ensuring more robust and accurate detection.

[38] Yet another illustrative, but not limiting, example of the system's operation as described here is its use in creating more or less robust network performance metrics. Several variables can be monitored by the proposed system, such as, but not limited to, the RSSI and RSRP mentioned above. However, instead of a network monitoring system, a network evaluation system would be created, using Petition 870240111138, dated 12 / 30 / 2024, page 25 / 84 / 42, proposes using the scores of different detectors within the anomaly detector chain as input variables for an estimate of the signal quality of the entire RAN. The idea is that a network prone to exhibiting more anomalous signals than a more stable and better-configured one would generate lower values ​​for the anomaly scores. These values ​​could serve as input for a new method of calculating Quality of Service (QoS).

[39] Other illustrative, but not exhaustive, examples include the following cases: • the creation of a control loop for the enhancement of anomaly detectors; • detection of connection failures and defective UEs; • the creation of a maintenance system in which defective UEs are placed in slices with lower resources while they are monitored, adapted, upgraded or repaired; • The use of metrics related to the detection process to alter the resources allocated to the different slices; • the creation of an algorithm similar to an ensemble of anomaly detectors, whose final detector can be adjusted according to the user's preferences; and • the recursive use of the method on slices of the normal type.

[40] Case (1) is a case that deals with a system aimed at training detectors well adapted to monitored UEs. One possibility is that the system is created to train powerful detectors with a lot of normal data for learning semi-supervised algorithms (novelty detection techniques). The idea is that the system is used to train detectors with different levels of precision / recall and latency for a type of UE and for different use cases, including those seen previously, such as DDoS attacks. Thus, it is possible to use the trained detectors in other operational contexts, where only one of the detectors in the detection chain would be used for a specific scenario requiring a certain precision / recall and latency.

[41] Case (2) is an adaptation of the invention for detecting problems in monitored variables and configuration problems. The idea is to detect whether a UE has Petition 870240111138, dated 12 / 30 / 2024, page 26 / 84 / 42, regarding any manufacturing, connection, or protocol defect and monitoring its operation. Depending on the UE rating (for example, according to the QoS method described earlier), it is possible to assign it a quality of operation value.

[42] Case (3) is an extension of all scenarios described so far. It is a specific application of the scheme, where UE partitioning into slices with heterogeneous resources is used to allow UEs to undergo real-time maintenance without disrupting network operation and without creating interruptions or substantial changes, thus preserving network stability. In other words, case (3) is a case of maximizing stability. So, unlike the previous cases, although its implementation is virtually identical, the objective is different. Instead of encouraging a network optimized for efficiency or latency, the idea becomes a network optimized for stability.

[43] In case (4), the metrics generated by the chain detection method itself are used to adjust aspects of the slices defined for the system. For example, probability distributions of the depths reached in the chain can be analyzed to assess the complexity of the cases observed by the network and to determine the level of suspicion assigned to the monitored UEs. Statistics such as the average depth required for UEs to be moved to slice 0 can be used to calculate a degree of confidence in the method regarding the network's behavior. Based on this data, even slice 0, responsible for normal samples, could adopt a more conservative approach in resource allocation, especially in scenarios where the observed average depth is high. This would ensure greater caution in the treatment of UEs in the system.Furthermore, the other slices would be adjusted proportionally to reflect the new usage and resource allocation conditions of slice 0, maintaining the overall balance of the system and improving its performance.

[44] In case (5), all detectors in the chain can be used for the same detection. The depth of this detection can be adjusted by an external algorithm that uses RAN metrics. Although similar to case (1), this scenario stands out for offering Petition 870240111138, dated 12 / 30 / 2024, page 27 / 84 / 42 gives the user the possibility to define system priorities in terms of latency and accuracy manually, adaptively, or automatically. This flexibility allows adjusting the system's operation to specific operational needs and desired network performance. Furthermore, the user can take advantage of ensembles and federated algorithms, which typically offer superior performance compared to isolated algorithms. Case (5) allows, for example, selecting only one element of the chain and disabling the others, turning the chain into a single detector. The chain configuration can be highly adaptable, allowing skipping stages or dynamically adjusting the detectors used. Such decisions can be made by external control systems, ensuring greater alignment with the dynamic demands of the network.Another example for Case (5) is that all detectors in the chain used in the detection process are fed simultaneously with the same samples from the same UE. A final example is that all detectors are fed with distinct (but properly correlated) samples from the same UE. These examples exploit the variability created by different detection models and by different samples in order to improve detection performance metrics.

[45] In case (6), it is ensured that the method is replicable at different scales of use. The same detection chain approach can be applied within a slice associated with the UE. In the case of slice 0 associated with normal events, it is important to consider that the UE can be compromised over time by malicious agents (e.g., through the use of malware). Therefore, it is proposed to apply the detection chain also at the slice 0 level.

[46] In summary, the invention uses a carefully orchestrated chain of detectors to ensure the system operates with low latency while maintaining high reliability and robustness in anomaly detection. In the initial layers, detection efficiency is intentionally sacrificed to allow clearly normal UEs to be processed simply and quickly, ensuring that their applications and routines are handled rapidly. In the deeper layers, the priority gradually changes, with latency being sacrificed in favor of greater accuracy and Petition 870240111138, dated 12 / 30 / 2024, page 28 / 84 / 42 revocation. In other words, for a UE to be integrated into slice 0, reserved for normal operation, it must undergo increasingly rigorous levels of analysis, demonstrating with a higher level of reliability that its behavior does not pose risks to the RAN. However, since the chaining of anomaly detectors is conceptually independent of the network, the compromise addressed depends on the problem solved. As per the illustrative, but not limiting, examples mentioned above, it is possible that the objectives of the method may be changed to other operational goals, such as stability optimization. Even more simply, the user may only want an anomaly detector with time-variable performance, which could be achieved by changing the depth of the detector chain over time. DESCRIPTION OF THE FIGURES

[47] The invention will be described in detail below, and for better understanding, reference will be made to the accompanying drawings, in which are represented: Figure 1: Flowchart of the initial detector in the anomaly detector chain with all its optional steps; Figure 2: Flowchart of the intermediate detectors in the anomaly detector chain with all their optional steps; Figure 3: Flowchart of the final detector in the anomaly detector chain with all its optional steps; Figure 4: Agent responsible for selecting / creating suitable slices for detector decisions; Figure 5: Processing and sharing of detector and slice information. DETAILED DESCRIPTION OF THE INVENTION

[48] ​​The METHOD OF ALLOCATION OF USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS shows a series of anomaly detectors in user equipment, or User Equipment - UEs, using the information detected by the detectors for the creation and selection of slices of Petition 870240111138, dated 12 / 30 / 2024, page 29 / 84 / 42 network, or network slices, with slices with more network resources being allocated to user equipment where fewer anomalies were detected, and slices with fewer network resources being allocated to user equipment where more anomalies were detected. The detectors are also organized in such a way that the initial detectors have lower latency and lower detection accuracy, and subsequent detectors gradually have higher latency and higher detection accuracy, thus the most effective, but slower, detectors are only used on highly suspicious user equipment. The detectors can also be used multiple times to analyze the same user equipment, thus obtaining several distinct detections that are processed and analyzed for a single detection of anomaly or not in the equipment.

[49] In step 101 (101) anomaly detection is performed by an initial detector. An illustrative, but not limiting, example of this step is based on detector 1 as a detector that prioritizes low latency over other metrics, being a potentially less complex detector than the others. In this case, its intention would be to triage network events. Detector 1 can handle point, contextual, and collective anomaly cases. In the contextual and collective cases, the process is based on the analysis of input data in the form of discrete sequences or continuous time series

[17] . In the point case, it can handle specific time instants or also a time window containing the instant for which the anomaly analysis is desired. An illustrative, but not limiting, example of the input type for detector 1 is a multivariate time series of RAN metrics, such as RSSI, RSRP, TA, and the RRC Connection Requests counter.

[50] Step 102 (102) deals with the result of a Boolean condition on the output of detector 1, namely whether the result of the set {non-anomalous, anomalous}, isomorphic to the set {0,1}, is the non-anomalous item, or signal 0. For the non-anomalous output, the result is forwarded to the next stage of the invention, which is the anomalous classification counter. An illustrative, but not limiting, example of step 102 (102) is that detector 1 is of low complexity and, consequently, has low latency to identify as non-anomalous punctual, contextual or collective events with patterns Petition 870240111138, dated 12 / 30 / 2024, p. 30 / 84 / 42 many simple to detect, that is, whose anomaly scores are close to the lower end of the range of possible score values. For example, but not limited to, practically zero values ​​with almost no changes in the RRC Connection Requests counter over long time intervals are examples of easily detectable normal network conditions.

[51] In step 103 (103), the anomaly conditional of detector 1 registers the indication of an anomalous event, i.e., boolean signal 1. This indicates that there are suspicions that the signal is anomalous and that verification of more anomaly detections is necessary. An illustrative, but not limiting, example of step 103 (103) refers to a detection case that presents a greater number of fluctuations in the value of the Connection Requests RRC counter. Because this is a case at a higher level of anomaly scores, it is desirable to analyze the signal with a different anomaly detector. An illustrative, but not limiting, example of possible new detectors would be more complex detectors, with more sophisticated decision rules or with a greater number of weights or layers in the case of methods using neural networks, such as LSTM and convolutional networks. These detectors would have higher latency.Another illustrative, but not limiting, example for step 103 (1030) is any detection variable that fluctuates considerably in behavior, having high variance and frequently excursion between its upper and lower extremes of values. Complex patterns with some randomness or noisy labels for supervised detection methods can also be responsible for triggering step 103 (103).

[52] In step 104 (104), it is tested whether the maximum number of detection steps by detector 1 has been reached, this being an optional step. If set to only 1 evaluation step, the process goes directly to step 106 (106) of emitting the activation signal of the detection voting system, where one of the two decision classes necessarily counts 0 detections and loses in the voting scheme. Step 104 (104) has the function of enabling the analysis of several samples or several data sequences, provided that the stochastic process remains approximately stationary, which is not always true. However, Petition 870240111138, dated 12 / 30 / 2024, page 31 / 84 / 42 if the number of analyses M of step 104 (104) is relatively small, this not only contributes to not excessively increasing latency, but also allows the correlation between the analyzed signals to be relatively high. An illustrative, but not limiting, use case is the analysis of anomalies in the process of connecting user equipment to the RAN before the contention resolution timer, a Contention Resolution Timer or CRT. If the number M of analyses performed produces analyses much faster than the period defined by this timer, whose minimum analysis time is 8ms, it may be that the use of an M > 1 is useful for greater accuracy at each detection stage.

[53] In step 105 (105), each time step 104 (104) does not reach its maximum value of M analyses, detector 1 in step 101 (101) re-analyzes data sequences at its input, thus attempting to extract more information from the analyzed user equipment. This step, like step 104 (104), is optional. Step 105 (105) is important because it allows the RAN to extract more data from the user equipment, thus increasing the accuracy and recall of the detection. The use of step 105 (105) produces greater latency, but this is again a compromise between latency and detection efficiency. An illustrative, but not limiting, case of this step includes new samples of variables such as Timing Advance, or TA, allowing for a greater number of estimates of the variable. This analysis can be useful by enabling a greater number of TA measurements and thus anomaly decisions for various TA values ​​over the desired analysis time.Consequently, the anomaly classification becomes more consistent with estimates of the location of the inspected user equipment, since inspecting the geographic position of a user's equipment is extremely useful for determining the possibility of attacks.

[54] Step 106 (106) relates to the emission of the decision voting activation signal. This means that, after the number M of analyses determined in step 104 (104), detection stage 1 sends a signal that allows comparison between the number of anomalous and non-anomalous detection counts in the M analyses performed. Therefore, it is interesting that M is an odd number, this value being 1 in the case of only one analysis by the detector, as in the case where steps 104 (104) and 105 Petition 870240111138, of 12 / 30 / 2024, page 32 / 84 / 42 (105) are not carried out. An illustrative, but not limiting, example of step 106 (106) is the reduction of decision noise. The detector can, if desired, read decisions from very close time instants. As the system has inherent noise, the use of measurements close in time can maintain a high correlation between them and improve the accuracy of the decision. Step 106 (106) is then responsible for sending the signal that ends this period of multiple detections in the same analysis stage.

[55] Step 107 (107) counts non-anomalous detections. This is a system that maintains, for when step 104 (104) shows M > 1, a counter of the times anomalous detections were recorded. An illustrative, but not limiting, example of step 107 (107) is to become the input of a maximum count voting algorithm. However, any logic could take the output of step 107 (107) as a feature for a final classifier of detection stage 1.

[56] Step 108 (108) is extremely similar to step 107 (107), but for counting anomalous decisions. In a similar vein to step 107 (107), an illustrative, but not limiting, example for this step includes its use as the input to some decision logic, serving as a secondary feature of the system.

[57] Step 109 (109) relates to the implementation of some logic on the anomalous and non-anomalous event counters detected in the M realizations of the system for making a final decision. Step 109 (109) has three inputs, requiring step 106 (106), step 107 (107) and step 108 (108) to be able to perform the final anomaly detection of stage 1, thus this step 109 (109) is also optional if such counting does not take place and a single detection occurs, only taking the non-anomalous or anomalous value itself as a result. An illustrative, but not limiting, example of the logic of step 109 (109) is the creation of a decision-maker based on the argmax between the two classes of counters: anomalous and normal events. However, a slightly more advanced logic is possible for step 109 (109): an illustrative, but not limiting, example is the use of a system that also takes into account the order of counter increments. Petition 870240111138, dated 12 / 30 / 2024, pp. 33 / 84 / 42

[58] Step 110 (110) is simply the decision based on the result obtained from step 109 (109). Basically, step 110 (110) emits a binary signal identifying whether the final decision of detection stage 1 is for an anomalous or non-anomalous user device. The characteristics of the illustrative and non-limiting examples of step 110 (110) closely follow what was detailed for step 109 (109).

[59] In step 111 (111), the detection stage outputs the value 0. The 0 slice is reserved for user devices deemed normal, i.e., non-anomalous by the initial detector. However, even more importantly, step 111 (111) can emit the Radio Resource Control, or RRC, Connection Setup signal that accepts the connection of the user device in question.As an illustrative, but not limiting, example, since stage 1 can be considered the least complex and, especially, the least latency, it is justified that it should be responsible for accepting user equipment with patterns that are highly suited to behavior profiles considered normal, if a semi-supervised detector is used, or with very few fluctuations in the input (if the focus is more on unsupervised detection). In this case, step 111 (111) would be responsible for accepting evidently normal user equipment and allocating it to slice 0.

[60] Step 112 (112) outputs the integer 1, corresponding to slice 1. This slice is responsible for allocating resources to a user device provisionally classified as suspect of level 1. In addition, step 112 (112) transfers the input data from the first detector to the second detector. The aim is a quick transfer for detection in another analysis layer. It can be assumed, illustratively but not limitingly, that the detector used in stage 1 is of the decision tree type with simple conditional rules for determining an attack. Although relatively inefficient, the method has low latency and allows for near real-time operations. And step 112 (112) is responsible for forwarding the user device under test to a new, slightly more robust detector and reserving slice 1 for this user device, with much more modest radio resources than slice 0.In terms of the nature of the data passed to detector 2, here's an example. Petition 870240111138, dated 12 / 30 / 2024, page 34 / 84 / 42, illustrative but not limiting, is the transfer of data already seen by detector 1 to detector 2, thus incurring the risk of losing the property of near real-time processing. Another case is that only the user equipment is connected to the second detector, without reusing previous data and only injecting new data from the user equipment into the new detector for analysis.

[61] Step 201 (201) refers to forwarding the analyzed data from the (i-1)th detector to the i-th detector, i=2, 3, .„, N. When the (i-1)th detector classifies a dataset related to a user device as anomalous after M re-evaluations, the dataset is sent to a new detector. An illustrative, but not limiting, example is that the dataset consists of only one sample, in this case, a sample of a time series with T time instants where the focus of analysis is on the most recent time instant t. This case illustrates an inference situation. However, for supervised algorithms, another illustrative, but not limiting, example deals with the training analysis performed on a dataset from a user device consisting of several time series of size T.

[62] Step 202 (202) is very similar to step 101 (101), except that it is intended for a generic detector i different from the first and last detectors. An illustrative, but not limiting, example again deals with detectors i that increase in complexity and latency in ascending order with the index i.

[63] Step 203 (203) resembles step 102 (102), but for a generic detector i instead of the first detector in the system. Again, an illustrative but not limiting example of this step is the classification of non-anomalous events in a step i of the system, where detector i is more efficient but also slower in terms of processing than detector i-1.

[64] Step 204 (204) resembles step 103 (103). However, it takes into account the action of detector i instead of detector 1. An illustrative, but not limiting, example of step 204 (204) is the classification of an anomalous event with detector i in a chain of detectors that become increasingly complex and with greater delay as processing occurs from the initial detectors to the detectors Petition 870240111138, dated 12 / 30 / 2024, p. 35 / 84 / 42 subsequent. Another illustrative, but not limiting, example is that the same detector is repeated throughout the chain, in order to create a reliability method, through which the same user equipment is analyzed several times by the same detector but at different time points. This generates detection with temporal variability and can be useful for the final efficiency of the detection.

[65] Step 205 (205) deals with a verification loop, this step being optional. Detector i attempts detection M times on its input data, with M having a value of 1 if this step is not performed. On the (M+1)-th time, the data is shifted to the next detector. An illustrative, but not limiting, example of step 205 (205) is that detector i classifies the detection of M consecutive analyses of M distinct data coming from a single user device according to some global detection logic. The data may, for example, be single samples of time series or, as another example, sequences of samples of time series. On the (M+1)-th detection, the detector decides to send its input data to a new detector. An illustrative, but not limiting, example is that detector i+1 is more sophisticated than ie, which may re-evaluate the data more accurately and change the anomalous classification made in i+1 to a normal classification.

[66] Step 206 (206) is a reassessment step, where detector i is activated again as in step 202 (202) if step 205 (205) is performed. An illustrative, but not limiting, example is that the detector analyzes a new dataset from the same user equipment that had been previously assessed and attempts to detect again whether the user equipment is actually an attacker or not. Another illustrative, but not limiting, example is that this assessment always deals with the same input dataset, i.e., that the detection is no longer in real time, but rather occurs at intervals equal to M times the period of a detection.

[67] Step 207 (207) is identical to step 106 (106) of stage 1. Basically, it is again a signal to activate voting between decisions registered as anomalous and non-anomalous. It starts from the maximum number of evaluations M desired by the detector stage i, M being 1 if steps 205 (205) and 206 (206) do not occur. An illustrative, but not limiting, example of a possible Petition 870240111138, of 12 / 30 / 2024, p. 36 / 84 / 42 variation of step 207 (207) would be its use as a selector of decision-making logics. Assuming that the system can choose a decision algorithm based on the anomaly and non-anomaly counts of steps 208 (208) and 209 (209), step 206 (206) could select which of these algorithms is the most convenient. A simpler illustrative, but not limiting, example is that step 206 (206) focuses on activating the mode among the counters, generating a kind of argmax between the classes.

[68] Step 208 (208) deals with the counter of detections considered non-anomalous. Each time one of the M realizations of detection stage i results in the non-detection of an anomaly, this counter is incremented. An illustrative, but not limiting, example of step 208 (208) is its use as the input to a decision logic about the final classification decided by stage i.For example, this detection could refer to the detection of attacks on the RAN network by means of attacking user equipment that seeks to corrupt the Random Access system.

[69] Step 209 (209) is very similar to step 108 (108) of detection stage 1. In general, it only increments the count of analyses considered anomalous. An illustrative, but not limiting, example of step 209 (209) is its use as a secondary feature already properly processed through detector i for a more complete detection, which is based on M analyses from the user equipment, thus increasing the level of precision and recall of the detection.

[70] Step 210 (210) operates just like step 109 (109) of detector 1. The idea is the same: step 210 (210) receives as input the counts of non-anomalous and anomalous events coming from steps 208 (208) and 209 (209), respectively, as well as the output of step 207 (207), which is related to the enabling decision signal from step 210 (210). Thus, we see that step 207 (207) is just a boolean switch for step 210 (210). Step 210 (210) applies a decision logic to the counters from steps 208 (208) and 209 (209) in order to make a final classification decision. Therefore, step 210 (210) is also optional if such counting does not occur and only one detection is made, taking only the non-anomalous or anomalous value itself as the result. An illustrative, but not limiting, example is that step 210 (210) calculates the maximum among the event counters. Petition 870240111138, dated 12 / 30 / 2024, page 37 / 84 / 42 anomalous and non-anomalous. An illustrative, but not limiting, use case of step 210 (210) is its use for detecting anomalous user equipment at the network core level, where the analyzed data are data packets of a UDP-type communication protocol. Based on the count of anomalous and non-anomalous packets in M ​​realizations, the user equipment responsible for the packets is classified as anomalous or normal.

[71] Step 211 (211) is set up as exactly the same step as step 110 (110) of detection stage 1. In this stage of the process, the decision is made based on the result of step 210 (210). The course of action is directly linked to step 210 (210). In short, step 211 (211) returns the index of the most probable class. For example, but not limited to, step 211 (211) may choose the class of the counter with the highest count. However, the decision logic can become more complex, using in this step 211 (211) a more complex decision system that makes use of some additional attributes, such as the sequence of decisions in the M analyses to decide the final boolean value of the system.

[72] Step 212 (212) is exactly the same as step 111 (111) of detection stage 1. This is the output of a non-anomalous user equipment detection, emitting a high-level Boolean signal to the user equipment in question and creating signal 0, relative to the slice index to which the user equipment will be allocated, in this case slice 0, which is conventionally considered the slice intended for normal user equipment, with an adequate number of radio resources for efficient communication between user equipment and base station (BS). An illustrative, but not limiting, example of this step is its use after i analysis steps, where the median value of the total number of existing stages is assigned to aio. That is, i is possibly the detection stage that most closely approximates the average compromise between latency and accuracy / recall of the complete system.Imagine a scalarized optimization problem with latency and detection efficiency objectives, and with a convex weight alpha assigned to one of them and, consequently, 1 - alpha to the remaining objective. One can think of the median i as assigning the value 0.5 to alpha. Under these conditions, the assignment of normality to... Petition 870240111138, dated 12 / 30 / 2024, page 38 / 84 / 42 user equipment indicates a much higher level of certainty about its nature than at the beginning of the process: in fact, with the same weight given to latency. It also implies that the user equipment will be removed from slice i-1, in which it had previously been placed (a slice with lower radio resources i-2, i-3 and so on until slice 0), to be placed in slice 0. Another illustrative, but not limiting, example is that the positive Boolean signal of step 212 (212) is an acceptance signal for the user equipment's connection to the RAN, that is, an RRC Connection Setup. If the type of anomaly is different, for example at the network core level, it is possible that the action of step 212 (212), instead of an acceptance of the connection, is a realization of eliminating the bus of a user equipment at the core level and releasing it in the system.

[73] Step 213 (213) is identical to step 112 (112) of detection stage 1. In general terms, step 213 (213) creates output i for the system, which corresponds to a slice with more limited resources than the slice associated with detector i - 1. The idea is to increasingly reduce the danger of a user device that is increasingly evidenced to be an anomalous user device, such as an attacking, defective, corrupted EU, etc. In the diagram in Figure 2, step 213 (213) shows the forwarding to the next detection stage i + 1. An illustrative, but not limiting, example of step 213 (213) is a forwarding to a detection unit with more complex decision rules than those of stage i. Another illustrative, but not limiting, example is that the definition of the later stage model depends on variance and bias metrics collected from the training of the preceding stages.Therefore, the model would not necessarily always become more complex and have more weights as it evolved along the detection chain.

[74] Step 301 (301) is very similar to step 201 (201). The last detector receives user equipment or data from that user equipment coming from the (N-1)-th detector. The last detector uses this information as input data. An illustrative and non-limiting example of this step is the input of new user equipment data at each new iteration of detector N, without reuse of Petition 870240111138, dated 12 / 30 / 2024, p. 39 / 84 / 42 data coming from the (Nl)th detector. However, another illustrative and non-limiting example is precisely the reuse of past data, increasing latency but increasing data availability for the last detector in the system.

[75] Step 302 (302) is related to steps 101 (101) and 202 (202). Step 302 (302) depends on the decision rules of the Nth detector for classifying the input signals as anomalous or non-anomalous. An illustrative, but not limiting, example of step 302 (302) is the use of an extremely sophisticated detector in this last layer of the system. Since the system has previously gone through N-1 detection steps, a very sophisticated anomaly detection algorithm for time series could be used, such as an algorithm based on transformers or CNNs, i.e., forecasting-type anomaly detection algorithms based on advanced neural networks.

[76] Step 303 (303) is like steps 102 (102) and 203 (203). The last detector detects a non-anomalous state as one of M detection possibilities. An illustrative, but not limiting, example is the normality decree in the first normal detection, prioritizing non-anomalous cases. This would guarantee greater permissiveness of the algorithm and greater preference for preserving user equipment connections to the network, which can be favorable from a connectivity point of view.

[77] Step 304 (304) is the same as steps 103 (103) and 204 (204). Realization #15 determines the evaluation of an event as anomalous. An illustrative, but not limiting, example is that any anomalous detection is decisive for the final decision to be decreed as anomalous. That is, if there are M-1 normal detections and only one anomalous one, the detection stage will still consider the user equipment as anomalous. This means that the detector prioritizes the detection of attacks and ensures that the system has a high degree of protection.

[78] Step 305 (305) is the same as step 205 (205), and is also optional. This step ensures that user equipment events are analyzed at least M times by the last detector, M being 1 if this step is not performed. This ensures that the detector will need to evaluate a total of M detections before confirming the class corresponding to the user equipment. An illustrative, but not limiting, example, Petition 870240111138, dated 12 / 30 / 2024, page 40 / 84 / 42, states that the quantity M of times detections are performed in this last detector stage varies over time, according to the network dynamics.

[79] Step 306 (306) is the same as step 206 (206), and is also optional. Step 306 (306) passes the user equipment through the last detector again, as in step 302 (302). An illustrative, but not limiting, example of this step is the use of new user equipment data for each new run. Another illustrative, but not limiting, example is that the same series of user equipment data is analyzed repeatedly M times (considering that the detection algorithm has some stochasticity) in order to determine a possible disconnection of the user equipment.

[80] Step 307 (307) is equal to step 207 (207) of the i-th detector, consisting of the emission, after a number of evaluations of the N-th detector greater than the maximum value M, of a decision voting activation signal, M being 1 if steps 305 (305) and 306 (306) do not occur. This is a necessary step to activate the comparison process between the count values ​​of anomalous and non-anomalous detections registered by the last detector of the method. An illustrative, but not limiting, example of this step includes the case when M is equal to 1. That is, it is the case of lowest latency, and for which, after only one detection, the comparison between counts is activated. As one of the classes of this binary system has not even been registered, the other will be declared the final decision. However, another interesting illustrative, but not limiting, case is that the voting enablement signal is also activated based on the calculated anomaly scores.For very extreme scores (both from a non-anomalous and anomalous point of view), it may be worthwhile to interrupt the detection process and assign a class to the user's equipment without spending more inference steps, for example, using an advanced neural network with a high inference time.

[81] Step 308 (308) has the same function as step 208 (208) of the i-th detection stage. The purpose of this step is to maintain a dynamic count of non-anomalous detections recorded by the N-th detector, through which it is possible to calculate the fraction of M analyses that are normal. An illustrative example, but not Petition 870240111138, dated 12 / 30 / 2024, page 41 / 84 / 42, the limitation of step 308 (308) involves the use of an adaptive correction factor with a positive value less than 1, in order to reduce the importance of non-anomalous counts compared to the count of anomalous events. This could make the decision-making process more conservative and bias it towards a preference for anomaly detection. It is even possible that this factor originates from Bayesian analyses of the signals and derives from some a priori information obtained throughout the system.

[82] Step 309 (309) is identical to step 209 (209) of the i-th detector and has the same purpose. Its function is to count the number of anomalous events detected by the N-th. The count of anomalous events serves as a counterpoint to the count of normal events in step 308 (308). An illustrative, but not limiting, example can also go through a procedure analogous to that described in step 308 (308). The idea is to modify the counting structure so that the count of anomalous cases receives a higher weight, transforming the system into a more conservative system that prefers to opt more frequently for the rejection of suspicious events.

[83] Step 310 (310) is identical to step 210 (210) of the i-th detection stage. It is a maximization functional between the counters of steps 308 (308) and 309 (309), the event counters classified as normal and anomalous, respectively, and can only function with the validation signal issued by step 307 (307), and thus this step 310 (310) is also optional if such counting does not occur and a single detection occurs, only taking the non-anomalous or anomalous value itself as a result. The idea is to create relevant information for the final decision stage of the last detector. An illustrative, but not limiting, example of this step is its adaptation to accommodate other analyses of the counter values, such as the timestamps associated with each detection and the intervals between these temporal labels, which could provide somewhat more sophisticated information for the decision.

[84] Step 311 (311) mirrors the operation of step 211 (211) used in the i-th detector. This step handles the detection stage decision process, creating a function on the counts of normal and anomalous detection counters. An illustrative, but not limiting, example is the use of this step as Petition 870240111138, dated 12 / 30 / 2024, p. 42 / 84 / 42, a function of argmax over the decision classes, based on the count values ​​of both. An illustrative, but not limiting, example of this step is the use of a decision algorithm with probabilistic output, which can be combined with an externally controlled variable decision threshold.

[85] Step 312 (312) is directly linked to step 212 (212). The idea is the same as that step, that is, to assign a high boolean signal to a user device declared as normal and to place it in slice 0 of normal resources. An illustrative, but not limiting, example of step 312 (312) is to grant the user device a connection acceptance. However, it is not necessary for step 312 (312) to be limited to the acceptance of the user device in question. This step may consist, for example, of assigning a score to the user device based on the number of detection steps it has passed through and the calculated anomaly scores. As the Nth detection stage is the last, the score of a user device that has reached this stage of analysis should undergo a large deduction beforehand.

[86] Step 313 (313) is related to step 213 (213), and its function is to activate a low, final Boolean signal for the user equipment. An illustrative, but not limiting, example of this signal is that it is an RRC Connection Reject type rejection signal. It should therefore remove the user equipment from slice N-1 where it is located and prevent it from attempting further network connection attempts for a predetermined time. As the user equipment goes through many detection stages before reaching this stage of the chain, it is also of interest that the rejection be accompanied by some form of additional timing to the standard timing adopted by the RRC Connection Reject.

[87] Step 401 (401) consists of the slice creator or selector agent, which acts based on the detections made by the detection stages along the detector chain. When an integer from 0 to N reaches the agent, it creates an appropriate slice, selecting the amount of resources needed to run a user device characterized by that integer. Alternatively, a series of predefined slices forms a list ordered in descending order with respect to the amount of resources, a list to which the selector agent has access. Petition 870240111138, dated 12 / 30 / 2024, pages 43 / 84 / 42 The larger the integer number in the agent's input, the greater the reduction in resources required to create or select a suitable slice. An illustrative, but not limiting, example of the 401 step is its use in an adaptive system that requires a study or inspection of the network's user equipment to determine how many resources are needed. In this case, slices are created dynamically. Another illustrative, but not limiting, example is when slices are fixed and kept constant according to specifications created by the RAN managers. Another adaptive, but not limiting, example is that the selection of slices for user equipment occurs sequentially, through a buffer, not allowing the allocation or creation of more than one slice at a time. A final illustrative, but not limiting, example is the possibility of creating slices in parallel, allowing more than one detector to transmit its decisions simultaneously to the agent.This allows for the simultaneous management of resources across multiple user devices at the same time. When necessary, the analyzed user devices are queued for allocation to their corresponding slices.

[88] Step 501 (501) involves processing training data from different detectors and using the data collected from different slices, this being done to improve the detection of anomalous equipment. An illustrative, but not limiting, example of step 501 (501) is its use as a way to collect training data from machine learning methods such as, for example, weights of neural networks trained on different semi-supervised or supervised detectors and their transmission to the multiple detectors in the chain, either through a central agent or even in a federated way. This is important, for example, so that simple detectors are able to learn from more advanced detectors in the chain, from which they learn advanced decision rules, which the simple detectors can emulate without having to be exhaustively trained.Another illustrative, but not limiting, example is the use of data, such as metrics or KPIs, obtained and processed in the different slices of the system, in such a way that they can be passed on to all detectors. In this type of analysis, extremely important data includes, for example, data from... Petition 870240111138, dated 12 / 30 / 2024, p. 44 / 84 / 42 slice 0, as this slice is dedicated to the normal use of RAN. Therefore, slice 0 is a very rich source of normal information for detectors. Since semi-supervised detectors typically train only with normal data, in order to be able to detect behavioral deviations only from this type of training, and since these are novelty detectors, the use of normal data is very important for the system as a whole.

[89] Step 502 (502) is specifically characterized by the processing and sharing of data collected in the system slices. Step 502 (502) aims to make available to step 501 (501) the slice data necessary to improve detection performance in all system slices. An illustrative, but not limiting, example of step 502 (502) is its ability to observe normal events for all user devices accessing the network. This means that the normal data produced by various user devices can be randomly mixed (given the conservation of temporality between the data, since they may be temporal sequences), which increases the variability of the data and enriches the probability distribution of what the detectors in the chain consider normal. In general terms, this is equivalent to making the process histogram increasingly closer to its real distribution.Another illustrative, but not limiting, example is the ability of processing system slices to obtain information about slices at lower levels of the system. These slices contain metrics considered to indicate suspicious behavior. In theory, for fully supervised methods, it is possible that this data could be used for anomaly classification. However, this type of analysis is considered less robust than novelty detection, as the system usually has dynamic behavior, including deviations from previously unseen behaviors. This can impair the ability to detect anomalies at different detection stages, as certain behavioral deviations will have a nature never before observed by the supervised system.

[090] BIBLIOGRAPHIC REFERENCES • LF Maimó, FJG Clemente, MG Pérez, and GM Pérez, “On the performance of a deep learning-based anomaly detection system for 5G networks”, in 2017 Petição 870240111138, de 30 / 12 / 2024, pág. 45 / 84 / 42 IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computed, Scalable Computing & Communications, Cloud & Big Data Computing, Internet of People and Smart City Innovation (SmartWorld / SCALCOM / UIC / ATC / CBDCom / IOP / SCI), ago. 2017, p. 1-8. doi: 10.1109 / UIC-ATC.2017.8397440. • L. Fernández Maimó, Á. L. Perales Gómez, F. J. García Clemente, M. Gil Pérez, e G. Martínez Pérez, “A Self-Adaptive Deep Learning-Based System for Anomaly Detection in 5G Networks”, IEEE Access, vol. 6, p. 7700-7712, 2018, doi: 10.1109 / ACCESS.2018.2803446. • S. B. Saad, “Security architectures for network slice management for 5G and beyond”, phdthesis, Sorbonne Université, 2023. Acesso em: 22 de novembro de 2024. [Online]. Disponível em: https: / / theses.hal.science / tel-04464041 • B. Bousalem, V. F. Silva, R. Langar, e S. Cherrier, “DDoS Attacks Detection and Mitigation in 5G and Beyond Networks: A Deep Learning-based Approach”, em GLOBECOM 2022 - 2022 IEEE Global Communications Conference, dez. 2022, p. 1259-1264. doi: 10.1109 / GLOBECOM48099.2022.10001562. • M. Kouchaki, J. Moore, M. Zhang, e V. Marojevic, “Advancing O-RAN Security: Integrated Intrusion Detection and Secure Slicing xApps”, em IEEE INFOCOM 2024 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), maio 2024, p. 1-2. doi: 10.1109 / INFOCOMWKSHPS61880.2024.10620781. • A. Chawla, A.-M. Bosneag, e A. Dalgkitsis, “Graph-based Interpretable Anomaly Detection Framework for Network Slice Management in Beyond 5G Networks”, em NOMS 2023-2023 IEEE / IFIP Network Operations and Management Symposium, maio 2023, p. 1-6. doi: 10.1109 / NOMS56928.2023.10154357. • W. Wang, Q. Chen, X. He, e L. Tang, “Cooperative Anomaly Detection With Transfer Learning-Based Hidden Markov Model in Virtualized Network Slicing”, IEEE Commun. Lett., vol. 23, no9, p. 1534-1537, set. 2019, doi: 10.1109 / LCOMM.2019.2923913. Petição 870240111138, de 30 / 12 / 2024, pág. 46 / 84 / 42 • W. Wang, C. Liang, L. Tang, H. Yanikomeroglu, e Q. Chen, “Federated Multi- Discriminator BiWGAN-GP based Collaborative Anomaly Detection for Virtualized Network Slicing”, IEEE Trans. Mob. Comput., vol. 22, no11, p. 6445- 6459, nov. 2023, doi: 10.1109 / TMC.2022.3200059. • N. A. Elorm Kuadey, G. T. Maale, G. Sun, e G. Liu, “DeepFedKDAD: Deep Federated Knowledge Distillation Based Anomaly Detection in B5G Network Slicing”, em 2023 International Conference on Networks, Communications and Intelligent Computing (NCIC), nov. 2023, p. 146-151. doi: 10.1109 / NCIC61838.2023.00030. • Y. Wu, L. Liang, Y. Jia, e W. Wen, “HFL-TranWGAN: Knowledge-Driven Cross- Domain Collaborative Anomaly Detection for End-to-End Network Slicing”, IEEE Trans. Netw. Serv. Manag., p. 1-1, 2024, doi: 10.1109 / TNSM.2024.3471808. • K. Abbas, T. A. Khan, M. Afaq, e W.-C. Song, “Ensemble Learning-based Network Data Analytics for Network Slice Orchestration and Management: An Intent- Based Networking Mechanism”, em NOMS 2022-2022 IEEE / IFIP Network Operations and Management Symposium, abr. 2022, p. 1-5. doi: 10.1109 / NOMS54207.2022.9789706. • Z. Ming, H. Yu, and T. Taleb, “User Request Provisioning Oriented Slice Anomaly Prediction and Resource Allocation in 6G Networks,” in ICC 2024 - IEEE International Conference on Communications, Jun. 2024, p. 3640-3645. doi: 10.1109 / ICC51166.2024.10622281. • S. Muddu, C. Tryfonas, and RP Bulusu, “Sharing model state between real-time and batch paths in network security anomaly detection”, US10158652B2, December 18, 2018. Accessed December 2, 2024. [Online]. Available at: https: / / patents.google.com / patent / US10158652B2 / en?q=(slice+anomaly)&oq=slice+anomaly • JXS Lozano, A. Garcia-Saavedra, X. Li, and X. Costa-Pérez, “Anomaly detection and troubleshooting system for a network using machine learning and / or artificial intelligence”, EP3720051B1, May 4, 2022. Accessed December 2, 2024. [Online]. Available at: Petition 870240111138, dated 12 / 30 / 2024, pp. 47 / 84 / 42 https: / / patents.google.com / patent / EP3720051B1 / en?q=(slice+anomaly)&oq=slice+anomaly • S. Gupta, E. Giral, DS Charles, and V. Muntés-Mulero, “Multivariate path-based anomaly prediction”, US10628289B2, April 21, 2020. Accessed December 2, 2024. [Online]. Available at: https: / / patents.google.com / patent / US10628289B2 / en?q=(slice+anomaly)&oq=slice+anomaly • F. Bandukwala, GM Goerg, SP Ruth, and JJ Halcrow, “Systems and Methods of Anomaly Detection”, US20230138371A1, May 4, 2023. Accessed December 2, 2024. [Online]. Available at: https: / / patents.google.com / patent / US20230138371A1 / en?q=(slice+anomaly)&oq=slice +anomaly • CC Aggarwal, Outlier Analysis, 2nd ed. Springer Publishing Company, Incorporated, 2016. • V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: a survey”, ACM Comput Surv, vol. 41, no. 3, pp. 15:1–15:58, Jul. 2009, doi: 10.1145 / 1541880.1541882. Petition 870240111138, dated 12 / 30 / 2024, p. 48 / 84

Claims

1 / 5 CLAIMS 1) METHOD OF ALLOCATION OF USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, being a method of anomaly detection in the RAN network, characterized by using a series of anomaly detectors in a chain, user equipment connecting to and using the network, with the traffic data from this equipment then passing through said chain of detectors; the initial detectors have lower latency and lower detection accuracy, and subsequent detectors gradually having higher latency and higher detection accuracy, with subsequent detectors receiving detection data from previous detectors; the detectors generate an anomaly value for the user equipment showing which detectors performed detection of suspected anomaly in this equipment;and then selecting a network slice according to the suspected anomaly of the equipment, with a normal network slice being allocated to equipment not detected as anomalous, and a slice with fewer network resources being allocated to equipment detected as anomalous according to the equipment's risk level based on how many detectors identified the equipment as anomalous. 2) A METHOD FOR ALLOCATING USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to claim 1, characterized in that the desired network slices for each risk profile of the user equipment according to anomaly detection are created and defined dynamically, choosing the necessary radio resources in real time through the data obtained from this equipment and the detectors. 3) METHOD FOR ALLOCATING USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to Petition 870240111138, dated 12 / 30 / 2024, page 49 / 84 2 / 5 claim 2, characterized by, in the creation of dynamic definition of slice resources, the following are created: • a list of slices suitable for different risk profiles, which are defined by the detectors through which a user equipment has passed; • a slice table based on the complexity and latency characteristics demonstrated by the detectors of different detection stages; and • an external dynamic control for the dynamic adaptation of the radio resources of the slices, which depends on variables internal to the detector chain and variables external to the system. 4) METHOD FOR ALLOCATING USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to claims 1 and 2, characterized by performing a reassessment of a user equipment, allowing it to be reassessed as non-anomalous after having been classified as anomalous in previous detection steps, thus allocating a normal slice to this user equipment. 5) METHOD FOR ALLOCATING USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to claim 1, characterized in that, in the method: • The use of a decision method applied to the list of anomalous and normal decisions obtained from previous detectors, and the use of additional classification steps based on secondary features; • Performing anomaly detection of user equipment M times before the anomaly detection itself, where M is an odd number, and counting how many times the detector decided the equipment as anomalous or not, with the detector deciding between anomalous or not equipment through the category of anomalous or not with the highest count. 6) METHOD FOR ALLOCATING USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to claim 1, characterized by, in the selection of slices for all detectors in the detection chain, performing data analysis sequentially or simultaneously, using a data buffer for the integer values ​​of slice selection for the different user equipment analyzed by the detectors in the detection chain, and the analyzed user equipment being organized in a queue for allocation to their corresponding slices. 7) METHOD FOR ALLOCATING USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to claim 1, characterized by: • The data obtained from the equipment using the different slices of the network are used for training supervised or semi-supervised detectors; • The order of information distribution follows the order of a causal system, with detectors further along in the detector chain using information from detectors earlier in the chain; and • The use of information from detectors further along in the detector chain is sent to detectors earlier in the chain for enhancement. 8) METHOD FOR ALLOCATION OF EQUIPMENT FROM USERS SUSPECTED OF MALICIOUS ACTIVITY IN SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to claim 1, characterized in that all detectors, whether initial, intermediate, or final, have a similar sequence of operating steps, these steps being: • The intermediate and final detectors having steps 201 (201) and 301 (301), in which the data analyzed by the previous detector is sent to the current detector; Petition 870240111138, dated 12 / 30 / 2024, p.51 / 84 4 / 5 • In steps 101 (101), 202 (202) and 303 (303) anomaly detection is performed by a corresponding detector in its position in the detector chain; • In steps 102 (102), 203 (203) and 303 (303) non-anomalous equipment is detected; and in steps 103 (103), 204 (204) and 304 (304) anomalous equipment is detected; • In steps 110 (110), 211 (211) and 311 (311) the equipment result is taken as non-anomalous or anomalous; • In steps 111 (111), 212 (212) and 312 (312) output 0 of non-anomalous signal is sent, ending the detection; and in steps 112 (112), 213 (213) and 313 (313) an anomalous signal output i is sent, where i is the position of the detector in the detector chain, and in steps 112 (112), 213 (213) after this the equipment is forwarded for analysis by the subsequent detector in the chain. 9) METHOD FOR ALLOCATING EQUIPMENT FROM USERS SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to claims 5 and 8, characterized by performing steps on the detectors in which: • After steps 102 (102), 203 (203) and 303 (303) steps 107 (107), 208 (208) and 308 (308) are performed respectively, counting the non-anomalous detections; and after steps 103 (103), 204 (204) and 304 (304) steps 108 (108), 209 (209) and 309 (309) are performed respectively, counting the anomalous detections; • In steps 104 (104), 205 (205) and 305 (305), it is verified whether the analyzed user equipment has already been verified M times, this value M chosen by the user; if the user equipment has not been analyzed M times, then steps 105 (105), 206 (206) and 306 (306) are performed back to steps 101 (101), 202 (202) and 303 (303) for new anomaly detection;and if the value M has been reached, proceed to steps 106 (106), 207 (207) and 307 (307); • In steps 106 (106), 207 (207) and 307 (307), a decision counter checks whether more non-anomalous or anomalous decisions have been made, then counting the equipment as anomalous or not according to the greater number of detections by the detector; • In steps 109 (109), 210 (210) and 310 (310), logic is implemented on the anomalous and non-anomalous event counters to make a final decision, and the decision is then sent to steps 110 (110), 211 (211) and 311 (311). 10) METHOD FOR ALLOCATING USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to claims 6, 8 and 9, characterized in that a step 401 (401) is performed, in which an integer value between 0 and N is received, with N being the total number of detectors in the detector chain, and this value is used for slice selection; with a value of 0 indicating a slice for normal user equipment; and other values ​​such that the larger the integer value received, the greater the reduction in resources for the creation or selection of a slice. 11) METHOD FOR ALLOCATING USER EQUIPMENT SUSPECTED OF MALICIOUS ACTIVITY INTO SLICES WITH CONTROLLED RESOURCES BASED ON THE CONCATENATION OF ANOMALY DETECTORS, according to claims 7, 8 and 9, characterized by performing step 501 (501) of processing training data from the different detectors and using the data collected from the different slices, these used for training all anomaly detectors of the semi-supervised or supervised types; and a step 502 (502) in which the processing and sharing of data collected in the system slices is carried out, making available to step 501 (501) the slice data necessary to improve the detection performance of all detectors. Petition 870240111138, dated 12 / 30 / 2024, p. 53 / 84

Images