Hot application identification method, network system, network device and storage medium

Abstract

The present invention discloses a hot application identification method, a network system, a network device and a storage medium. The hot application identification method obtains merged flow data from an IPDR, filters out target flow data corresponding to the same application from the merged flow data, and determines the target application according to the target flow data; obtains the flow change trend of the target application, and identifies the target application as a hot application according to the flow change trend, obtains the merged flow data collected by the IPDR, and filters out the target flow data corresponding to the same application from the merged flow data to determine the target application, and then obtains the flow change trend of the target application, and identifies the target application as a hot application according to the flow change trend, so that the identification of hot applications does not need to rely on a feature library, avoids the lag problem caused by manual maintenance, thereby improving the timeliness of hot application identification and timely discovering new hot applications.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a hot application identification method, a network system, a network device and a storage medium. Background Art

[0002] With the development of mobile Internet, traffic management has gradually evolved into an important business direction. Traffic management is based on intelligent pipelines (physical networks) and aggregation platforms (commercial networks), with the business direction of expanding traffic scale, improving traffic levels, and enriching traffic connotations, and with the purpose of releasing traffic value. An important basic data for traffic management analysis is to obtain the popularity of applications, and use it to formulate corresponding marketing strategies for applications of different popularity, which helps to improve revenue and competitiveness.

[0003] At present, the identification of popular applications needs to be based on the statistics of application heat, and the statistics of application heat are mainly completed by DPI (Deep Packet Inspection). The use of DPI for application heat statistics requires the application type identification result based on DPI first, and the use of DPI to identify the application type needs to rely on the feature library. At present, the main way to update the feature library is for system maintenance personnel to manually discover and add new application data. Since the number of applications is growing rapidly every day, the update speed of the feature library cannot fully match the growth rate of the number of applications. Therefore, in the case of a rapid growth in the number of applications, only the maintenance personnel manually discovering and adding new application data cannot obtain the corresponding application type in time, and it is impossible to perform application heat statistics, which makes the application heat statistics lagging, which is not conducive to the timely discovery of new popular applications. Summary of the invention

[0004] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0005] The embodiments of the present invention provide a hot application identification method, a network system, a network device and a storage medium, which can improve the timeliness of hot application identification and discover new hot applications in a timely manner.

[0006] In a first aspect, an embodiment of the present invention provides a method for identifying hot applications, the method comprising:

[0007] Acquire merged stream data from an Internet Protocol information record (IPDR), wherein the merged stream data includes user subscription data and user session data;

[0008] Filtering target flow data corresponding to the same application from the merged flow data, and determining a target application according to the target flow data;

[0009] The traffic change trend of the target application is obtained, and according to the traffic change trend being an increasing trend, the target application is identified as a hot application.

[0010] In a second aspect, an embodiment of the present invention further provides a method for identifying hot applications, the method comprising:

[0011] Obtain user contract data and user session data;

[0012] Merging the user subscription data and the user session data to obtain merged stream data;

[0013] The merged flow data is sent to NWDAF so that the NWDAF can filter out the target flow data corresponding to the same application from the merged flow data and determine the target application based on the target flow data, as well as obtain the traffic change trend of the target application and identify the target application as a hot application based on the traffic change trend being an increasing trend.

[0014] In a third aspect, an embodiment of the present invention further provides a network system, including NWDAF and IPDR, wherein:

[0015] The IPDR is used to obtain user subscription data and user session data and merge the user subscription data and the user session data to obtain merged stream data;

[0016] The NWDAF is connected to the IPDR to obtain the merged flow data from the IPDR, and after filtering out the target flow data corresponding to the same application from the merged flow data, determines the target application according to the target flow data, and obtains the traffic change trend of the target application and identifies the target application as a hot application according to the traffic change trend being an increasing trend.

[0017] In a fourth aspect, an embodiment of the present invention further provides a network device, comprising the network system described in the third aspect; or, comprising at least one processor and a memory for communicating with the at least one processor; the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the hot application identification method described in the first aspect or the second aspect.

[0018] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the hot application identification method described in the first aspect or the second aspect.

[0019] The embodiment of the present invention includes: obtaining merged flow data from an Internet protocol information record (IPDR), wherein the merged flow data includes user contract data and user session data; filtering out target flow data corresponding to the same application from the merged flow data, and determining a target application based on the target flow data; obtaining a traffic change trend of the target application, and identifying the target application as a hot application based on the traffic change trend being an increasing trend, by obtaining merged flow data collected by the IPDR, filtering out target flow data corresponding to the same application from the merged flow data to thereby determine the target application, and then obtaining a traffic change trend of the target application, and identifying the target application as a hot application based on the traffic change trend, so that the identification of hot applications does not need to rely on a feature library, and avoids the lag problem caused by manual maintenance, thereby improving the timeliness of hot application identification and timely discovering new hot applications.

[0020] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation on the technical solution of the present invention.

[0022] Figure 1 It is a schematic diagram of a 5G network architecture in the prior art provided by an embodiment of the present invention;

[0023] Figure 2 is a schematic diagram of a 5G network architecture provided by an embodiment of the present invention;

[0024] Figure 3 is a flow chart of a method for identifying hot applications on an IPDR side provided by an embodiment of the present invention;

[0025] Figure 4 It is a flowchart of specific steps for merging user contract data and user session data to obtain merged stream data provided by an embodiment of the present invention;

[0026] Figure 5 is a flow chart of a method for identifying hot applications on the NWDAF side provided by an embodiment of the present invention;

[0027] Figure 6 It is a flowchart of specific steps for filtering target stream data corresponding to the same application from merged stream data provided by an embodiment of the present invention;

[0028] Figure 7It is a flowchart of specific steps for filtering out the flow data generated by the same user group accessing the same application provided by an embodiment of the present invention;

[0029] Figure 8 A flowchart of specific steps for obtaining a traffic change trend of a target application and identifying the target application as a hot application according to an increasing traffic change trend provided by an embodiment of the present invention;

[0030] Fig. 9 is a flowchart of a specific example of a method for identifying hot applications provided by an embodiment of the present invention;

[0031] Fig.10 It is a structural diagram of a network device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0033] It should be understood that in the description of the embodiments of the present invention, the meaning of multiple (or multiple) is more than two, greater than, less than, and exceeding are understood to exclude the number itself, and above, below, and within are understood to include the number itself. If there is a description of "first", "second", etc., it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0034] In the eNA (Study of Enablers for Network Automation for 5G) project of 3GPP R16, the concept of NWDAF (Network Data Analytics Function) was proposed. Specifically, NWDAF can collect specific data from specific NF (Network Function), OAM (Operation Administration and Maintenance) or AF (Application Function), and obtain certain analysis results through certain big data analysis network elements, and send the results to specific NF, OAM or AF on demand. NWDAF is a very critical network function for realizing network intelligence. IPDR (Internet Protocol Detail Record) is an IP traceability system used for IP traceability.

[0035] Reference Figure 1 , which is a schematic diagram of the existing 5G network architecture, refer to Figure 2 , which is a schematic diagram of the architecture of the network system provided by the embodiment of the present invention applied in a 5G network, wherein the network system provided by the embodiment of the present invention includes NWDAF and IPDR. Based on the popular application identification method provided by the present invention, the embodiment of the present invention adds the ability to receive UDM user data contract information to IPDR on the basis of the original 5G network architecture, and adds the ability to receive external network element aggregated data to NWDAF, that is, receiving data streams from IPDR, wherein NWDAF and IPDR can be respectively set on different network devices, or NWDAF and IPDR can also be simultaneously set in the same network device.

[0036] based on Figure 2 The network architecture shown, the embodiment of the present invention provides a hot application identification method, a network system, a network device and a storage medium, which can improve the timeliness of hot application identification.

[0037] Reference Figure 3 The embodiment of the present invention provides a hot application identification method, which is applied to IPDR, including but not limited to the following steps 301 to 303:

[0038] Step 301: Obtain user contract data and user session data;

[0039] In one embodiment, based on Figure 2 In the network architecture shown, user subscription data can be obtained from UDM (Unified Data Manager), where UDM is a permanent storage location for user subscription data and is located in the home network to which the user has subscribed.

[0040] In one embodiment, the user subscription data may include but is not limited to IMSI, age, gender, region, occupation, etc.

[0041] In one embodiment, based on Figure 2 In the network architecture shown, user session data can be obtained from SMF (Session Management Function), where SMF is a functional unit of 5G service-based architecture. SMF is mainly responsible for interacting with the separated data plane, creating, updating and deleting PDU (Protocol Data Unit) sessions, and managing the session environment with UPF (User Plane Function), which is mainly responsible for coordinating PDU routing, forwarding, and policy execution for packet data.

[0042] In one embodiment, user session data may include but is not limited to SEID (Session Endpoint Identifier), N4IP address, private network address, private network port, protocol type, destination IP address, destination port, number of packets, duration, known application types, URL, IMSI, etc.

[0043] Step 302: Merge the user subscription data and the user session data to obtain merged stream data;

[0044] In one embodiment, the user contract data and the user session data are merged to obtain merged stream data, which can facilitate NWDAF to acquire data. The user contract data and the user session data are merged into merged stream data, which can make the data stream acquired by NWDAF clearer and facilitate NWDAF to perform subsequent data analysis.

[0045] Step 303: Send the merged flow data to NWDAF so that NWDAF can filter out the target flow data corresponding to the same application from the merged flow data and determine the target application based on the target flow data, and obtain the traffic change trend of the target application and identify the target application as a hot application based on the traffic change trend being an increasing trend.

[0046] By sending the merged flow data to NWDAF, NWDAF can filter out the target flow data corresponding to the same application from the merged flow data and then determine the target application, and then obtain the traffic change trend of the target application. According to the traffic change trend, the target application is identified as a hot application, so that the identification of hot applications does not need to rely on the feature library, avoiding the lag problem caused by manual maintenance, thereby improving the timeliness of hot application identification and timely discovering new hot applications.

[0047] Reference Figure 4 In one embodiment, in the above step 302, the user subscription data and the user session data are merged to obtain the merged stream data, which may specifically include the following steps 401 to 402:

[0048] Step 401: merge the user session data obtained from the SMF and UPF through the session endpoint identifier SEID or N4IP address;

[0049] In one embodiment, since the user session data provided by the SMF and the UPF both include SEID and N4IP, the data streams can be merged through SEID and N4IP. Exemplarily, the data streams can be merged using a merge key.

[0050] Step 402: The merged user session data is merged with the user subscription data through the International Mobile Subscriber Identity IMSI to obtain a merged data stream.

[0051] In one embodiment, since the user session data merged by SMF and UPF and the user contract data of UDM both include IMSI, the merged user session data and user contract data can be further merged through IMSI to obtain merged flow data. The final merged flow data may include IMSI, age, gender, region, occupation, SEID, N4IP address, private network address, private network port, protocol type, destination IP address, destination port, number of packets, duration, known application types, URL, etc.

[0052] Reference Figure 5 The embodiment of the present invention further provides a method for identifying hot applications, which is applied to NWDAF, including but not limited to the following steps 501 to 503:

[0053] Step 501: Acquire merged stream data from IPDR, wherein the merged stream data includes user subscription data and user session data;

[0054] Among them, in step 501, the user contract data and the user session data have been explained accordingly in the previous embodiments and will not be repeated here. How the user contract data and the user session data are merged into the merged stream data has also been explained accordingly in the previous embodiments and will not be repeated here.

[0055] Step 502: Filter out target flow data corresponding to the same application from the merged flow data, and determine the target application according to the target flow data;

[0056] In one embodiment, target flow data corresponding to the same application is filtered out from the merged flow data, and the filtering can be performed according to the destination IP address. For example, data flows with the same destination IP address can be considered as target flow data corresponding to the same application, and the application corresponding to this destination IP address can be used as the target application.

[0057] The merged stream data may include stream data of multiple applications, and the stream data of each application includes corresponding user subscription data and user session data. The destination IP addresses corresponding to the stream data of different applications are generally different. For example, the specific structure of the merged stream data may be:

[0058] First stream data: first user subscription data and first user session data, wherein the destination IP address in the first user session data is IP1;

[0059] Second stream data: second user subscription data and second user session data, wherein the destination IP address in the second user session data is IP1;

[0060] Third stream data: third user subscription data and third user session data, wherein the destination IP address in the third user session data is IP2;

[0061] Fourth flow data: fourth user subscription data and fourth user session data, wherein the destination IP address in the fourth user session data is IP2;

[0062] Fifth stream data: fifth user subscription data and fifth user session data, wherein the destination IP address in the fifth user session data is IP3;

[0063] Based on this, the target flow data corresponding to the same application is filtered out from the merged flow data, and the filtering can be performed according to the destination IP address, that is, the above-mentioned first flow data and the second flow data are the target flow data corresponding to the first application, so the first application can be used as the target application; the above-mentioned third flow data and the fourth flow data are the target flow data corresponding to the second application, so the second application can be used as another target application.

[0064] Of course, using the destination IP address for filtering is only one of the methods. In fact, you can also use other dimensions for filtering, as long as the dimension can uniquely identify a certain application.

[0065] It is understandable that the above is only a schematic illustration for explaining how to filter out target stream data corresponding to the same application from the merged stream data. The total amount of actual merged stream data may be large, and the number of target stream data corresponding to the same application may also be large.

[0066] Step 503: Obtain the traffic change trend of the target application, and identify the target application as a hot application based on the traffic change trend being an increasing trend.

[0067] In one embodiment, hot application identification is performed on the target application based on the traffic change trend, so that the identification of hot applications does not need to rely on the feature library, avoiding the lag problem caused by manual maintenance, thereby improving the timeliness of hot application identification and discovering new hot applications in a timely manner.

[0068] In one embodiment, when the traffic change trend of the target application is an increasing trend, that is, the number of visits to the target application becomes more and more, it means that the target application is a new popular application.

[0069] In one embodiment, the traffic change trend of the target application can be obtained based on the total traffic, the total number of links accessing the target application, or the total number of users of the target application.

[0070] In one embodiment, the flow change trend can be obtained by using a trend prediction algorithm. The embodiment of the present invention does not limit the specific algorithm implementation, such as using an autoregressive differential moving average model ARIMA.

[0071] Reference Figure 6 In one embodiment, in the above step 502, the target stream data corresponding to the same application is filtered out from the merged stream data, which may specifically include the following steps 601 to 602:

[0072] Step 601: Divide the merged stream data into user groups;

[0073] In one embodiment, the merged stream data contains a variety of stream data, covering multiple user groups. By way of example, the merged stream data can be divided into user groups based on a single dimension. For example, based on age, the user groups can be divided into young people, middle-aged people, and elderly people, etc.; for another example, based on occupation, the user groups can be divided into doctors, students, white-collar workers, etc. Of course, the above only exemplifies the user group division method of the embodiment of the present invention. In fact, the user groups can also be divided according to other dimensions.

[0074] In addition, in addition to the above-mentioned user group division method, in one embodiment, the merged stream data can be divided into user groups by using a clustering algorithm to directly calculate the characteristic behavior distance of the user group, wherein the characteristics of the user group can be divided into ordered indicators and disordered indicators.

[0075] For example, for ordered indicators, such as data that can be sorted, such as age, the Minkowski distance can be used to calculate the characteristic behavior distance, specifically:

[0076] Given a sample x i =(x i1 ;x i2 ;...;x in ) and x j =(x j1 ;x j2 ;...;x jn ), then the characteristic behavior distance is:

[0077]

[0078] Among them, p represents the power, which can be 1, 2, 3, etc., representing the first-order distance, second-order distance, third-order distance, etc.

[0079] For unordered indicators, such as occupations and other data that cannot be sorted, a mixed distance calculation formula can be used, such as VDM (Value Difference Metric). Combining Minkowski distance and VDM can handle mixed attributes. Assuming there are n c ordered attributes, nn cWithout loss of generality, let the ordered attributes come before the unordered attributes.

[0080]

[0081] Let m u,a represents the number of samples with the value a on attribute u, m u,a,i represents the number of samples with value a on attribute u in the i-th sample cluster, k is the number of sample clusters, and p is the power number. Then the VDM distance between two discrete values ​​a and b on attribute u (i.e., the characteristic behavior distance to be calculated) is:

[0082]

[0083] Among them, the data with the closest characteristic behavior distance belongs to the same user group. By continuously performing iterative calculations in the above manner, the user group division of the merged stream data can be finally completed.

[0084] Step 602: Filter out the flow data generated by the same user group accessing the same application to obtain target flow data.

[0085] For example, after dividing the user groups, the specific structure of the merged stream data can be:

[0086] First stream data: first user subscription data and first user session data, wherein the destination IP address in the first user session data is IP1, corresponding to the first user group;

[0087] Second stream data: second user subscription data and second user session data, wherein the destination IP address in the second user session data is IP1, corresponding to the first user group;

[0088] Third stream data: third user subscription data and third user session data, wherein the destination IP address in the third user session data is IP2, corresponding to the first user group;

[0089] Fourth stream data: fourth user subscription data and fourth user session data, wherein the destination IP address in the fourth user session data is IP2, corresponding to the second user group;

[0090] Fifth stream data: fifth user subscription data and fifth user session data, wherein the destination IP address in the fifth user session data is IP3, corresponding to the second user group;

[0091] Based on this, the first stream data and the second stream data are stream data generated by the same user group accessing the same application.

[0092] Likewise, the above is only an illustrative description, and the total data volume of the actual merged stream data may be large, and the number of target stream data corresponding to the same application may also be large.

[0093] By dividing the merged stream data into user groups, the accuracy of screening out target stream data corresponding to the same application can be improved, thereby improving the accuracy and reliability of subsequent hot application identification.

[0094] Reference Figure 7 In one embodiment, after the merged flow data is divided into user groups, further supplementary screening can be performed to further improve accuracy. Based on this, in the above step 602, the flow data generated by the same user group accessing the same application is screened out, which can specifically include the following steps 701 to 702:

[0095] Step 701: Identify the application type of the application based on the access behavior data of the same user group to the same application;

[0096] In one embodiment, if the access behavior data of the same user group for the same application is similar, the application type of the application can be estimated. The access behavior data may include but is not limited to access time, access duration, access traffic distribution, access traffic size, source port, etc. For example, when the access time is all at night, it means that the user group may be students, and it may be a game application or a video application; when the access duration is very long, it means that the application may be a game application; when the access traffic distribution is very uniform, but the access traffic is very large, it may be a video application; when the access traffic distribution is very uniform, but the access traffic is very small, it may be a chat application or a game application; in addition, if the source port of the access is fixed, the application type can also be estimated by the source port. In summary, if there is a potential inherent regularity in the access behavior data of the same user group for the same application, the application can be considered as a target application for hot application identification.

[0097] In one embodiment, the access behavior data includes data of multiple dimensions. When analyzing from a single dimension, a simple variance or statistical distribution of a single dimension can be used to determine whether the data features of a single dimension are distributed in a fixed manner. For the relationship between multiple dimensions, the covariance matrix, divergence matrix, or PCA and other feature identification methods can be used to determine whether the multiple dimensions are correlated. If multiple feature dimensions are correlated, the application type of the application can be identified through multiple feature dimensions. For example, the access time of game applications is longer, the access traffic is smaller, and the number of access links is larger; the access time distribution of short videos is intermittent, the access traffic size also presents intermittent peaks, and the number of access links is small.

[0098] Step 702: Filter out the flow data corresponding to the application according to the application type.

[0099] The flow data corresponding to the application is screened out according to the application type as the target flow data, and whether the corresponding application is necessary as the target application can be determined according to the application type, thereby further improving the accuracy and reliability of subsequent hot application identification.

[0100] In one embodiment, before filtering out the target flow data corresponding to the same application from the merged flow data, the merged flow data can be quantified first. For example, the occupation field can be filled with a digital number, and the region field can be filled with longitude and latitude to facilitate subsequent analysis of the merged flow data. It should be noted that the above quantification method is only exemplary, and a suitable quantification method can be selected according to the actual situation in actual applications.

[0101] In one embodiment, before filtering out the target stream data corresponding to the same application from the merged stream data, the merged stream data may be feature analyzed to obtain the weights of each dimension in the merged stream data, and the data corresponding to the dimension whose weight is less than the first preset threshold value may be eliminated. Exemplarily, algorithms such as PCA (Principal Component Analysis) may be used to identify the main dimensions to reduce the dimension of the merged stream data, and eliminate the data corresponding to the unimportant dimensions. For example, in the merged stream data, the weights of age and occupation are the largest, and the weight of region is relatively small, so the data of the region dimension may be ignored. Exemplarily, the above-mentioned first preset threshold may be 2%, 5%, 10%, etc., and may be freely set according to actual conditions. For example, when the first preset threshold is 5%, the weight of the region in the merged stream data is only 3%, and the data of the region dimension is eliminated. By reducing the dimension of the merged stream data, the influence of some unimportant dimensions on the accuracy of the analysis of the merged stream data may be reduced, and the efficiency of the analysis of the merged stream data may be improved, and the accuracy of the analysis may be improved.

[0102] It can be understood that the steps of quantizing the merged stream data and reducing the dimension of the merged stream data can be performed either one or all of them, which is not limited in the embodiment of the present invention.

[0103] In one embodiment, before filtering out the flow data generated by the same user group accessing the same application, known data may be first obtained from a preset feature library, wherein the known data is obtained based on at least one of a uniform resource locator URL, a destination port, a protocol type, and an application type. After obtaining the known data, the flow data corresponding to the known data is removed from the merged flow data. Several common known data determination methods are listed below:

[0104] The URL field is a record of specific well-known URLs. These records are WEB services. You can use the URL to determine whether the corresponding flow data is generated by accessing a known application.

[0105] The destination port is a record of well-known HTTP WEB service ports such as 80 and 443. The destination port can be used to determine whether the corresponding flow data is generated by accessing a known application.

[0106] The specific protocol is the record of well-known protocols such as DNS, SSH, and FTP. The specific protocol can be used to determine whether the corresponding flow data is generated by accessing known applications;

[0107] Records whose application types have been identified. In the UPF session data, the known application types will have corresponding identification fields. Based on the identification fields, it can be determined whether the corresponding flow data is generated by accessing the known application.

[0108] Since there is no need to identify popular applications for known application types, by eliminating the flow data corresponding to the known data from the merged flow data, the number of samples for subsequent screening of flow data generated by the same user group accessing the same application can be reduced, thereby improving the efficiency and accuracy of the analysis.

[0109] Reference Figure 8 In one embodiment, in the above step 503, the traffic change trend of the target application is obtained, and according to the traffic change trend being an increasing trend, the target application is identified as a hot application, which specifically includes the following steps 801 to 802:

[0110] Step 801: Obtain the traffic of a target application during a first preset time period, and predict the traffic change trend of the target application according to the traffic of the target application during the first preset time period;

[0111] In one embodiment, the traffic of the target application in the first preset time period is obtained, and the traffic of the target application can be monitored according to a certain frequency. For example, the first preset time period can be 3 days, and the daily traffic of the target application can be obtained. Then, the traffic change trend of the target application in the second preset time period is obtained through the trend prediction algorithm. For example, the second preset time period can be 7 days. The specific prediction algorithm can adopt the autoregressive difference moving average model ARIMA, etc. By predicting the traffic change trend of the target application, the time required for identifying hot applications can be shortened, and the efficiency of identifying hot applications can be improved. It can be understood that the first preset time period and the second preset time period can be freely set according to actual conditions. For example, the first preset time period can also be in hours. The first preset time period can be 3 hours, and the second preset time period can be 24 hours.

[0112] Step 802: When the traffic change trend is an increasing trend within a second preset time period and the growth rate exceeds a second preset threshold, the target application is identified as a hot application.

[0113] In one embodiment, the accuracy can be improved by setting a second preset threshold to judge the traffic change trend of the target application. Exemplarily, the second preset threshold can be 30%, 40%, 50%, etc. It is understandable that the second preset threshold can also be freely set according to actual conditions.

[0114] In one embodiment, when the target application is identified as a hot application, the target flow data is sent to the user plane function UPF. After UPF receives the target flow data of the NWDAF hot application, it can automatically capture the flow data according to the destination IP address, destination port, protocol, etc., and automatically export it to push to OAM (Operation Administration and Maintenance). OAM can perform detailed application analysis based on the flow data sent by UPF, import the application feature library, and send it to UPF. When IPRD receives the flow data of the application again, it is a known application and there is no need to identify the hot application, thus forming a closed loop.

[0115] The following is an example to illustrate the present invention. Fig. 9 , specifically including the following steps 901 to 914:

[0116] Step 901: NWDAF subscribes to the stream data of unknown applications from IPDR;

[0117] Step 902: UPF subscribes to the stream data of popular unknown applications from NWDAF;

[0118] Step 903: IPDR subscribes to user subscription data from UDM;

[0119] Step 904: The user equipment UE comes online, and the SMF creates a PDU session;

[0120] Step 905: IPDR collects control plane creation data from SMF;

[0121] Step 906: The UE uses the network service, and after the service session ends, the flow data is released;

[0122] Step 907: IPDR collects user session data of this segment of flow data from UPF;

[0123] Step 908: IPDR merges the data of SMF, UPF, and UDM according to fields such as SEID, N4IP, and IMSI to obtain corresponding merged flow data;

[0124] Step 909: IPDR pushes the flow data of the unknown application in the merged flow data to NWDAF;

[0125] Step 910: NWDAF continuously receives IPDR data, analyzes merged flow data corresponding to the same unknown application, and obtains a traffic change trend of the unknown application. When the traffic change trend exceeds a second preset threshold, the unknown application is identified as a hot unknown application.

[0126] Step 911: NWDAF sends the corresponding merged stream data to UPF;

[0127] Step 912: The UPF receives the merged flow data corresponding to the hot unknown application, and starts to automatically capture the flow data subsequently generated by the hot unknown application;

[0128] Step 913: UPF pushes the flow data subsequently generated by the hot unknown application to OAM;

[0129] Step 914: OAM analyzes the unknown application through the flow data of the popular unknown application, imports the application feature library, and sends it to UPF.

[0130] Among them, in step 901, NWDAF can also subscribe to the stream data of all applications from IPDR, and then process the data by the known data elimination method in the previous embodiment to obtain the stream data of unknown applications.

[0131] IPDR sends the merged flow data of unknown applications to NWDAF, which then selects the target flow data corresponding to the same unknown application from the merged flow data, obtains the traffic change trend of the unknown application, and identifies the unknown application as a hot application based on the traffic change trend. This makes it unnecessary to rely on the feature library for identifying hot applications, thus avoiding the lag caused by manual maintenance, thereby improving the timeliness of hot application identification and timely discovering hot unknown applications. The merged flow data corresponding to the hot unknown application is then sent to UPF, which automatically captures the flow data of the hot unknown application and pushes it to OAM. OAM analyzes the hot unknown application, imports the application feature library, and sends it to UPF, making the hot unknown application a known application, forming a closed loop.

[0132] It should also be understood that the various implementations provided in the embodiments of the present invention can be combined arbitrarily to achieve different technical effects.

[0133] In addition, an embodiment of the present invention further provides a network system, including NWDAF and IPDR, wherein IPDR is used to obtain user contract data and user session data and merge the user contract data and user session data to obtain merged flow data; NWDAF is connected to IPDR to obtain merged flow data from IPDR, and after filtering out target flow data corresponding to the same application from the merged flow data, the target application is determined according to the target flow data, and the traffic change trend of the target application is obtained and the target application is identified as a hot application according to the traffic change trend. The above network system and the above hot application identification method are based on the same inventive concept, so new hot applications can be discovered in a timely manner.

[0134] In addition, an embodiment of the present invention further provides a network device, including the above network system, wherein the above network device and the above hot application identification method are based on the same inventive concept, so new hot applications can be discovered in a timely manner. The network device can set only one of NWDAF and IPDR, or set both NWDAF and IPDR.

[0135] Fig.10 The embodiment of the present invention provides a network device 1000 provided by the embodiment of the present invention. The network device 1000 includes: a memory 1001, a processor 1002, and a computer program stored in the memory 1001 and executable on the processor 1002. When the computer program is executed, it is used to execute the above-mentioned hot application identification method.

[0136] The processor 1002 and the memory 1001 may be connected via a bus or other means.

[0137] The memory 1001 is a non-transient computer-readable storage medium that can be used to store non-transient software programs and non-transient computer executable programs, such as the hot application identification method described in the embodiment of the present invention. The processor 1002 implements the above hot application identification method by running the non-transient software programs and instructions stored in the memory 1001.

[0138] The memory 1001 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store and execute the above-mentioned hot application identification method. In addition, the memory 1001 may include a high-speed random access memory 1001, and may also include a non-volatile memory 1001, such as at least one disk memory 1001, a flash memory device or other non-volatile solid-state memory 1001. In some embodiments, the memory 1001 may optionally include a memory 1001 remotely arranged relative to the processor 1002, and these remote memories 1001 may be connected to the network device 1000 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0139] The non-transient software programs and instructions required to implement the above-mentioned hot application identification method are stored in the memory 1001. When executed by one or more processors 1002, the above-mentioned hot application identification method is executed, for example, Figure 3 Steps 301 to 303 of the method, Figure 4 In steps 401 to 402 of the method, Figure 5 Steps 501 to 503 of the method, Figure 6 In steps 601 to 602 of the method, Figure 7 In steps 701 to 702 of the method, Figure 8 In steps 801 to 802 of the method, Fig. 9 Method steps 901 to 914.

[0140] The embodiment of the present invention further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the above-mentioned hot application identification method.

[0141] In one embodiment, the computer-readable storage medium stores computer-executable instructions, which are executed by one or more control processors 1002, for example, by a processor 1002 in the network device 1000, so that the one or more processors 1002 can execute the above-mentioned hot application identification method, for example, execute Figure 3 Steps 301 to 303 of the method, Figure 4 In steps 401 to 402 of the method, Figure 5 Steps 501 to 503 of the method, Figure 6 In steps 601 to 602 of the method, Figure 7 In steps 701 to 702 of the method, Figure 8 In steps 801 to 802 of the method, Fig. 9 Method steps 901 to 914.

[0142] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0143] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory 1001 technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically include computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0144] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above-mentioned implementation mode. Technical personnel familiar with the field can also make various equivalent deformations or substitutions under the shared conditions without violating the spirit of the present invention. These equivalent deformations or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A method for identifying popular applications, applied to a network data analysis function NWDAF, comprising: Acquire merged stream data from an Internet Protocol information record (IPDR), wherein the merged stream data includes user subscription data and user session data; Filtering target flow data corresponding to the same application from the merged flow data, and determining a target application according to the target flow data; The traffic change trend of the target application is obtained, and according to the traffic change trend being an increasing trend, the target application is identified as a hot application.

2. The method for identifying popular applications according to claim 1, characterized in that: The step of filtering out target stream data corresponding to the same application from the merged stream data includes: dividing the merged stream data into user groups; Filter out the flow data generated by the same user group accessing the same application to obtain the target flow data.

3. The method for identifying popular applications according to claim 1, characterized in that: Before the target stream data corresponding to the same application is filtered out from the merged stream data, at least one of the following is further included: quantizing the merged stream data; Perform feature analysis on the merged stream data to obtain weights of various dimensions in the merged stream data, and remove data corresponding to dimensions whose weights are less than a first preset threshold.

4. The method for identifying popular applications according to claim 2, characterized in that: Before filtering out the flow data generated by the same user group accessing the same application, the method further includes: Acquire known data from a preset feature library, wherein the known data is obtained according to at least one of a uniform resource locator URL, a destination port, a protocol type, and an application type; The stream data corresponding to the known data is removed from the merged stream data.

5. The method for identifying popular applications according to claim 2, characterized in that: The filtering out of the flow data generated by the same user group accessing the same application includes: Identify the application type of the application based on the access behavior data of the same user group to the same application; Filter out the flow data corresponding to the application according to the application type.

6. The method for identifying popular applications according to claim 1, characterized in that: The obtaining of the traffic change trend of the target application and identifying the target application as a hot application according to the traffic change trend being an increasing trend comprises: Acquire the flow of the target application in a first preset time period, and predict the flow change trend of the target application according to the flow of the target application in the first preset time period; When the traffic change trend is an increasing trend within a second preset time period and the growth rate exceeds a second preset threshold, the target application is identified as a hot application.

7. The method for identifying popular applications according to claim 1, characterized in that: The method further comprises: When the target application is identified as a hot application, the target flow data is sent to the user plane function UPF.

8. A method for identifying hot applications, applied to Internet Protocol information record (IPDR), comprising: Obtain user contract data and user session data; Merging the user subscription data and the user session data to obtain merged stream data; The merged flow data is sent to the network data analysis function NWDAF, so that the NWDAF can filter out the target flow data corresponding to the same application from the merged flow data, determine the target application based on the target flow data, and obtain the traffic change trend of the target application and identify the target application as a hot application based on the traffic change trend being an increasing trend.

9. The method for identifying popular applications according to claim 8, characterized in that: The obtaining of user contract data and user session data includes: Obtain user contract data from the unified data management (UDM); Obtain user session data from the session management function SMF and the user plane function UPF.

10. The method for identifying popular applications according to claim 9, characterized in that: The step of merging the user subscription data and the user session data to obtain merged stream data includes: Merging the user session data obtained from the SMF and the UPF through a session endpoint identifier SEID or an N4 Internet Protocol N4IP address; The merged user session data is merged with the user subscription data through the International Mobile Subscriber Identity IMSI to obtain a merged data stream.

11. A network system, characterized in that: It includes network data analysis function NWDAF and Internet protocol information record IPDR, including: The IPDR is used to obtain user subscription data and user session data and merge the user subscription data and the user session data to obtain merged stream data; The NWDAF is connected to the IPDR to obtain the merged flow data from the IPDR, and after filtering out the target flow data corresponding to the same application from the merged flow data, determines the target application according to the target flow data, and obtains the traffic change trend of the target application and identifies the target application as a hot application according to the traffic change trend being an increasing trend.

12. A network device, characterized in that: comprising the network system as claimed in claim 11; or, comprising at least one processor and a memory for communicatively connecting to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the hot application identification method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the hot application identification method according to any one of claims 1 to 10.

Images