Abnormal identification method and system, storage medium and electronic device

Abstract

The embodiment of the present invention provides an abnormality identification method and device, system, storage medium and electronic device, the method comprising: obtaining first data of a target terminal from a target network element through a log system, the first data comprising first terminal description information of the target terminal and first data flow description information of a target data flow of the target terminal; inputting the first data into a target identification model through the log system, and obtaining a first identification result output by the target identification model, the target identification model being used to identify whether there is an abnormality in the target terminal according to the first data; when the first identification result indicates that there is an abnormality in the target terminal, sending a notification message to a security management background through the log system, the notification message being used to indicate that there is an abnormality in the target terminal. Through the present invention, the technical problem that the log system cannot identify terminal abnormalities in the related art is solved, and the log system is able to identify abnormalities in the terminal.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and in particular, to an abnormality identification method and system, a storage medium, and an electronic device. Background Art

[0002] With the large-scale commercial use of 5G and the advent of the era of the Internet of Everything, more traffic consumption is generated in the network, and the network topology is more complex and the scale of terminals has increased dramatically. Therefore, it is more important to achieve network security. Once a network security problem occurs, it may cause very serious consequences.

[0003] At present, operators and equipment manufacturers are facing a severe network security situation. In the related technology, firewall devices are usually deployed in the network to intercept data from the terminal, and a log system (such as a log system based on the network detailed record protocol (IP Detailed Record, referred to as IPDR)) is deployed to realize the association of terminal information with the Internet log, and the terminal's Internet log is stored to facilitate the terminal's source tracing query. However, this method has the following defects: First, the log system lacks the ability to proactively discover and notify the abnormalities existing in the terminal and the data stream generated by the terminal in advance. The log system belongs to the source tracing system. Although the terminal's Internet log can be consulted and analyzed in the log system after the network security problem caused by the abnormal terminal occurs, the log system cannot realize the abnormal prejudgment before the network problem occurs, and the security department cannot be notified in advance, so that the method cannot control the terminal's Internet behavior before the network security problem occurs, and at this time the abnormal terminal has begun to carry out dangerous activities, which seriously affects the network security. Second, the log system lacks the ability to proactively discover and report problems afterwards: When network security problems occur, the log device can only passively receive and store the Internet logs of all terminals, and these Internet logs are only raw records without any markings or prompts. Therefore, the security department cannot know whether these logs are abnormal logs based on the massive logs stored in the log system. The security department can only trace the source from the log system based on the Internet Protocol (IP) address after discovering the complete problem in the network. Third, because the log system stores all the received logs, the log system needs to store a large amount of log data, which takes up a lot of storage space and consumes a lot of storage resources.

[0004] With regard to the technical problem in the related technology that the log system cannot identify terminal abnormalities, no effective technical solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide an abnormality identification method and device, a storage medium and an electronic device, so as to at least solve the technical problem in the related art that the log system cannot identify the abnormality of the terminal.

[0006] According to one embodiment of the present invention, there is provided an abnormality identification, including: obtaining first data of a target terminal from a target network element through a log system, wherein the first data includes first terminal description information of the target terminal and first data flow description information of a target data flow of the target terminal; inputting the first data into a target recognition model through the log system, and obtaining a first recognition result output by the target recognition model, wherein the target recognition model is used to identify whether there is an abnormality in the target terminal based on the first data; and when the first recognition result indicates that there is an abnormality in the target terminal, sending a notification message to a security management background through the log system, wherein the notification message is used to indicate that there is an abnormality in the target terminal.

[0007] In an exemplary embodiment, after the first data is input into the target recognition model through the log system, the method further includes: obtaining a second recognition result output by the target recognition model, wherein the target recognition model is also used to identify whether there is an abnormality in the target data flow based on the first data; and when the second recognition result indicates that there is an abnormality in the target data flow, sending the notification message to the security management background through the log system, wherein the notification message is also used to indicate that there is an abnormality in the target data flow.

[0008] In an exemplary embodiment, obtaining the first data of the target terminal from the target network element through the log system includes: obtaining the first terminal description information from the first network element, and obtaining the first data flow description information from a user plane function entity UPF.

[0009] In an exemplary embodiment, the obtaining of the first terminal description information from the first network element includes at least one of the following: obtaining access data of the target terminal from an access management function entity AMF; obtaining session description information of the target terminal from a session management function entity SMF; obtaining policy information corresponding to the target terminal from a policy control function entity PCF; obtaining subscription information of the target terminal from a unified data management function entity UDM; wherein, the obtaining of the first data flow description information from a user plane function entity UPF includes at least one of the following: obtaining the duration of the target data flow, the five-tuple information of the target data flow, the protocol type of the target data flow, the uniform resource locator URL carried in the target data flow, the application corresponding to the target data flow, the number of data packets in the data flow, and the total length of data packets in the data flow from the UPF.

[0010] In an exemplary embodiment, when the first identification result indicates that there is an abnormality in the target terminal and / or the second identification result indicates that there is an abnormality in the target data stream, the method further includes: adding a label to the first log corresponding to the target terminal through the log system, wherein the label is used to indicate that there is an abnormality in the first log; saving the first log through the log system, and sending the first log to the security management background.

[0011] In an exemplary embodiment, after sending a notification message to the security management background through the log system, the method further includes: obtaining a detection result of the target data stream sent by a firewall device, wherein the detection result is used to indicate that the target data stream is abnormal; wherein the method further includes: adding a tag to a second log corresponding to the target terminal through the log system, wherein the tag is used to indicate that the second log is abnormal, and the generation time of the second log is later than the generation time of the first log; saving the second log through the log system, and sending the second log to the security management background; or obtaining the second log from the target network element through the log system. The second data of the target terminal, wherein the second data includes the second terminal description information of the target terminal and the second data flow description information of the target data flow; the second data is input into the target recognition model through the log system, and a third recognition result output by the target recognition model is obtained; when the third recognition result indicates that the target data flow is abnormal, a label is added to the third log corresponding to the target terminal through the log system, wherein the label is used to indicate that the third log is abnormal and the generation time of the third log is later than the generation time of the first log; the third log is saved through the log system, and the third log is sent to the security management background.

[0012] In an exemplary embodiment, when the first recognition result indicates that there is no abnormality in the target terminal and the second recognition result indicates that there is no abnormality in the target data flow, the method further includes: when the confidence corresponding to the first recognition result output by the target recognition model is greater than a first preset confidence threshold, and the confidence corresponding to the second recognition result is greater than a second preset confidence threshold, filtering the log corresponding to the target terminal through the log system, and not saving the log corresponding to the target terminal through the log system.

[0013] In an exemplary embodiment, before the first data is input into the target recognition model through the log system and the first recognition result output by the target recognition model is obtained, the method further includes: obtaining a plurality of sample data through a network data analysis function NWDAF entity, wherein each of the plurality of sample data includes terminal description information of a terminal, data flow description information of a data flow of the terminal, and a detection result corresponding to the data flow of the terminal, the detection result is a detection result obtained by a firewall device on the data flow of the terminal, and the detection result is used to indicate whether there is an abnormality in the data flow of the terminal; training a pre-trained recognition model using the plurality of sample data through the NWDAF entity to obtain a trained recognition model, and determining the trained recognition model as the target recognition model.

[0014] In an exemplary embodiment, the log system includes a network detailed recording protocol IPDR log system, and the target recognition model is located in a NWDAF entity, wherein the first data is input into the target recognition model through the log system, and a first recognition result output by the target recognition model is obtained, including: sending the first data to the NWDAF entity through the IPDR log system, wherein the NWDAF entity is used to input the received first data into the target recognition model; and obtaining the first recognition result output by the target recognition model from the NWDAF entity through the IPDR log system.

[0015] According to another embodiment of the present invention, there is provided an abnormality identification device, comprising: a first acquisition module, used to obtain first data of a target terminal from a target network element through a log system, wherein the first data includes first terminal description information of the target terminal and first data flow description information of a target data flow of the target terminal; a second acquisition module, used to input the first data into a target recognition model, and obtain a first recognition result output by the target recognition model, wherein the target recognition model is used to identify whether there is an abnormality in the target terminal based on the first data; a notification module, used to send a notification message to a security management background through the log system when the first recognition result indicates that there is an abnormality in the target terminal, wherein the notification message is used to indicate that there is an abnormality in the target terminal.

[0016] According to another embodiment of the present invention, there is provided an abnormality identification system, comprising: a log system and a target network element, wherein the log system is used to obtain first data of a target terminal from the target network element, wherein the first data includes first terminal description information of the target terminal and first data flow description information of a target data flow of the target terminal; the log system is further used to input the first data into a target identification model and obtain a first identification result output by the target identification model, wherein the target identification model is used to identify whether there is an abnormality in the target terminal based on the first data; the log system is further used to send a notification message to a security management background through the log system when the first identification result indicates that there is an abnormality in the target terminal, wherein the notification message is used to indicate that there is an abnormality in the target terminal.

[0017] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when run.

[0018] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0019] Through the present invention, the first data of the target terminal is obtained from the target network element through the log system, wherein the first data includes the first terminal description information of the target terminal and the first data flow description information of the target data flow of the target terminal; the first data is input into the target recognition model through the log system, and the first recognition result output by the target recognition model is obtained, wherein the target recognition model is used to recognize whether the target terminal has an abnormality according to the first data; when the first recognition result indicates that the target terminal has an abnormality, a notification message is sent to the security management background through the log system, wherein the notification message is used to indicate that the target terminal has an abnormality. Therefore, the technical problem that the log system cannot recognize the terminal abnormality can be solved, and the log system can recognize the abnormality of the terminal, so that the log system can recognize the abnormality before the security problem occurs in the network and notify the security management background, thereby improving the security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a hardware structure block diagram of an electronic device according to an abnormality identification method according to an embodiment of the present invention;

[0021] Figure 2is a network architecture diagram of an abnormality identification method according to an embodiment of the present invention;

[0022] Figure 3 is a flow chart of an abnormality identification method according to an embodiment of the present invention;

[0023] Figure 4 is a schematic diagram of model training performed by an NWDAF entity in an embodiment of the present invention;

[0024] Figure 5 is a flow chart of an abnormality identification method according to another embodiment of the present invention;

[0025] Figure 6 is a schematic diagram of a service data flow within an IPDR log system according to an embodiment of the present invention;

[0026] Figure 7 4 is a structural block diagram of an abnormality identification device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0029] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal, a server, a network element in a communication network, or a similar computing device. Taking running on an electronic device as an example, Figure 1 is a hardware structure block diagram of an electronic device according to an abnormality identification method according to an embodiment of the present invention. Figure 1 As shown, the electronic device may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above electronic device may also include a transmission device 106 for communication functions and an input and output device 108. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0030] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the abnormal identification method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0031] The transmission device 106 is used to receive or send data via a network. The specific examples of the above-mentioned network may include a wireless network or a wired network. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0032] The present application embodiment can be run on Figure 2 In the network architecture shown in Figure 2 As shown, the network architecture of the core network includes the following network elements: Network Data Analytics Function (NWDAF) entity, IRDP log system, Access Management Function (AMF) entity, Session Management Function (SMF) entity, Policy Control Function (PCF) entity, Unified Data Management (UDM) entity, User Plane Function (UPF) entity; wherein, the NWDAF entity can communicate directly with the AMF entity, SMF entity, PCF entity, UDM entity, and UPF entity through the interface defined by the 3GPP standard to subscribe to the relevant data of the terminal. Among them, each entity can also be called a network element.

[0033] In this embodiment, a method for identifying anomalies running on the above network architecture is provided. Figure 3 is a flow chart of an abnormality identification method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0034] Step S302, obtaining first data of a target terminal from a target network element through a log system, wherein the first data includes first terminal description information of the target terminal and first data flow description information of a target data flow of the target terminal;

[0035] Step S304: inputting the first data into a target recognition model through the log system, and obtaining a first recognition result output by the target recognition model, wherein the target recognition model is used to recognize whether the target terminal is abnormal according to the first data;

[0036] Step S306: When the first identification result indicates that the target terminal is abnormal, a notification message is sent to the security management background through the log system, wherein the notification message is used to indicate that the target terminal is abnormal.

[0037] Through the present invention, the first data of the target terminal is obtained from the target network element through the log system, wherein the first data includes the first terminal description information of the target terminal and the first data flow description information of the target data flow of the target terminal; the first data is input into the target recognition model through the log system, and the first recognition result output by the target recognition model is obtained, wherein the target recognition model is used to recognize whether the target terminal has an abnormality according to the first data; when the first recognition result indicates that the target terminal has an abnormality, a notification message is sent to the security management background through the log system, wherein the notification message is used to indicate that the target terminal has an abnormality. Therefore, the technical problem that the log system cannot recognize the terminal abnormality can be solved, and the log system can recognize the abnormality of the terminal, so that the log system can recognize the abnormality before the security problem occurs in the network and notify the security management background, thereby improving the security of the network.

[0038] In an exemplary embodiment, after the first data is input into the target recognition model through the log system, the method further includes: obtaining a second recognition result output by the target recognition model, wherein the target recognition model is also used to identify whether there is an abnormality in the target data flow based on the first data; and when the second recognition result indicates that there is an abnormality in the target data flow, sending the notification message to the security management background through the log system, wherein the notification message is also used to indicate that there is an abnormality in the target data flow.

[0039] Among them, the target recognition model obtains two recognition results according to the input first data: a first recognition result and a second recognition result, the first recognition result is used to indicate whether there is an abnormality in the target terminal, and the second recognition result is used to indicate whether there is an abnormality in the target data flow.

[0040] In an exemplary embodiment, obtaining the first data of the target terminal from the target network element through the log system includes: obtaining the first terminal description information from the first network element, and obtaining the first data flow description information from a user plane function entity UPF.

[0041] In the above embodiment, the first terminal description information is information related to the target terminal, and the first data flow description information is information related to the target data flow.

[0042] In an exemplary embodiment, the obtaining of the first terminal description information from the first network element includes at least one of the following: obtaining access data of the target terminal from an access management function entity AMF; obtaining session description information of the target terminal from a session management function entity SMF; obtaining policy information corresponding to the target terminal from a policy control function entity PCF; obtaining subscription information of the target terminal from a unified data management function entity UDM; wherein, the obtaining of the data flow description information from a user plane function UPF entity includes at least one of the following: obtaining the duration of the target data flow, the five-tuple information of the target data flow, the protocol type of the target data flow, the uniform resource locator URL carried in the target data flow, the application corresponding to the target data flow, the number of data packets in the data flow, and the total length of data packets in the data flow from the UPF.

[0043] Among them, the relevant data of the terminal can be obtained from multiple network elements through the log system, for example, the relevant data of the terminal can be obtained from at least one of the above-mentioned AMF entity, SMF entity, PCF, UDM entity and UPF entity, and the first terminal description information can be data obtained from at least one of the above-mentioned AMF entity, SMF entity, PCF, UDM entity and UPF entity. Among them, the access data of the target terminal includes but is not limited to: the location of the target terminal and / or the mobility of the target terminal; the session description information of the target terminal includes but is not limited to the relevant information of the protocol data unit (PDU) session of the target terminal, such as the radio access technology (RAT) used by the target terminal, the bearer type (Bear Type), and at least one of the activation time of the PDU session; the policy information corresponding to the target terminal includes but is not limited to the policy information used to control and charge the services of the target terminal; the five-tuple information of the target data flow includes the source IP address, source port, destination IP address, destination port and transport layer protocol of the data packet in the target data flow; the application corresponding to the target data flow includes but is not limited to: the application to which the target data flow belongs.

[0044] It should be noted that the acquisition of the first data flow description information from the user plane function UPF entity may also include acquiring the Deep Packet Inspection (DPI) features of the target data flow from the UPF entity. Optionally, the DPI features may be related features obtained by using DPI technology in related technologies, including but not limited to: the source IP address, source port, destination IP address, destination port and transport layer protocol in the target data flow, the outflow direction of the target data flow, the website accessed by the target terminal, resource content, resource type,

[0045] In an exemplary embodiment, when the first identification result indicates that there is an abnormality in the target terminal and / or the second identification result indicates that there is an abnormality in the target data stream, the method further includes: adding a label to the first log corresponding to the target terminal through the log system, wherein the label is used to indicate that there is an abnormality in the first log; saving the first log through the log system, and sending the first log to the security management background.

[0046] In the above embodiment, when the log system obtains the target recognition model output indicating that there is an abnormality in the target data flow, it adds a label to the first log corresponding to the received target terminal, stores the first log with the label, and sends the first log to the security management background, so that the security management platform can take security control measures in time according to the first log.

[0047] In an exemplary embodiment, after sending a notification message to the security management background through the log system, the method further includes: obtaining a detection result of the target data stream sent by a firewall device, wherein the detection result is used to indicate that the target data stream is abnormal; wherein the method further includes: adding a tag to a second log corresponding to the target terminal through the log system, wherein the tag is used to indicate that the second log is abnormal, and the generation time of the second log is later than the generation time of the first log; saving the second log through the log system, and sending the second log to the security management background; or obtaining the second log from the target network element through the log system. The second data of the target terminal, wherein the second data includes the second terminal description information of the target terminal and the second data flow description information of the target data flow; the second data is input into the target recognition model through the log system, and a third recognition result output by the target recognition model is obtained; when the third recognition result indicates that the target data flow is abnormal, a label is added to the third log corresponding to the target terminal through the log system, wherein the label is used to indicate that the third log is abnormal and the generation time of the third log is later than the generation time of the first log; the third log is saved through the log system, and the third log is sent to the security management background.

[0048] It should be noted that, in the above embodiment, after obtaining the detection result sent by the firewall device indicating that the target data flow is abnormal, all subsequent logs corresponding to the received target terminal, including the above second log, are tagged by the log system, and the subsequent logs are stored after being tagged, and each subsequent log is sent to the security management background, so that the security management background can timely perform security analysis on the log of the target terminal. Alternatively, in the above embodiment, after obtaining the detection result sent by the firewall device indicating that the target data flow is abnormal, the log system is used to again perform security analysis on the log of the target terminal, such as the above second data, and obtain the third recognition result corresponding to the second data output by the target recognition model, that is, the target recognition model recognizes and judges the relevant data of the target terminal again, and when the third recognition result indicates that the target data flow is abnormal, all subsequent logs corresponding to the received target terminal, including the above third log, are tagged by the log system, and the subsequent logs are stored after being tagged, and each subsequent log is sent to the security management background, so that the security management background can timely perform security analysis on the log of the target terminal.

[0049] In an exemplary embodiment, when the first recognition result indicates that there is no abnormality in the target terminal and the second recognition result indicates that there is no abnormality in the target data flow, the method further includes: when the confidence corresponding to the first recognition result output by the target recognition model is greater than a first preset confidence threshold, and the confidence corresponding to the second recognition result is greater than a second preset confidence threshold, filtering the log corresponding to the target terminal through the log system, and not saving the log corresponding to the target terminal through the log system.

[0050] The first preset confidence threshold may be the same as or different from the second preset confidence threshold.

[0051] Among them, the log system only stores the log of the corresponding terminal when an abnormality is identified, and filters out the log of the terminal without abnormality, thereby greatly saving the storage space required for log storage. It should be noted that in the above embodiment, if there is an abnormality in the target data stream, it can be determined that there is an abnormality in the target terminal corresponding to the target data stream.

[0052] In an exemplary embodiment, before the first data is input into the target recognition model through the log system and the first recognition result output by the target recognition model is obtained, the method further includes: obtaining a plurality of sample data through a network data analysis function NWDAF entity, wherein each of the plurality of sample data includes terminal description information of a terminal, data flow description information of a data flow of the terminal, and a detection result corresponding to the data flow of the terminal, the detection result is a detection result obtained by a firewall device on the data flow of the terminal, and the detection result is used to indicate whether there is an abnormality in the data flow of the terminal; training a pre-trained recognition model using the plurality of sample data through the NWDAF entity to obtain a trained recognition model, and determining the trained recognition model as the target recognition model.

[0053] In the above embodiment, the NWDAF entity can obtain relevant data of at least one terminal from the above multiple network elements, for example, obtain terminal description information and data flow description information of at least one terminal from at least one of the above AMF entity, SMF entity, PCF, UDM entity and UPF entity, wherein the NWDAF entity is used for at least one of the following: obtaining access data of the at least one terminal from the access management function entity AMF; obtaining session description information of the at least one terminal from the session management function entity SMF; obtaining policy information corresponding to the at least one terminal from the policy control function entity PCF; obtaining subscription information of the at least one terminal from the unified data management function entity UDM. The NWDAF entity can also be used for at least one of the following: obtaining the duration of the data flow of the at least one terminal, the five-tuple information of the data flow of the at least one terminal, the protocol type of the data flow of the at least one terminal, the uniform resource locator URL carried in the data flow of the at least one terminal, the application corresponding to the data flow of the at least one terminal, the number of data packets in the data flow of the at least one terminal, and the total length of data packets in the data flow of the at least one terminal from the UPF. The NWDAF entity trains the pre-trained recognition model according to the sample data, and obtains the target recognition model after the training is completed.

[0054] The number of data packets in the above embodiment includes but is not limited to the total number of data packets in the duration of the data stream. For example, the number of data packets included in the first data stream description information may be the total number of data packets corresponding to the target data stream in the duration of the target data stream.

[0055] In an exemplary embodiment, the log system includes a network detailed recording protocol IPDR log system, and the target recognition model is located in a NWDAF entity, wherein the first data is input into the target recognition model through the log system, and a first recognition result output by the target recognition model is obtained, including: sending the first data to the NWDAF entity through the IPDR log system, wherein the NWDAF entity is used to input the received first data into the target recognition model; and obtaining the first recognition result output by the target recognition model from the NWDAF entity through the IPDR log system.

[0056] In the above embodiment, the target recognition model is located in the NWDAF entity. The IPDR log system obtains the recognition result output by the target recognition model in the NWDAF entity through interaction with the NWDAF entity, thereby enabling the IPDR log system to know whether there are abnormalities in the target terminal and the target data flow.

[0057] The abnormality identification method in the above embodiment is explained below with reference to an example, but is not intended to limit the technical solution of the embodiment of the present invention.

[0058] The embodiments of the present invention can be applied in a 5G communication network, where, for example Figure 2 As shown, a NWDAF entity is deployed in the core network. NWDAF communicates directly with multiple main network elements through the interface defined by the 3GPP standard to subscribe to relevant data of the terminal. The main network elements include but are not limited to the following network elements: AMF entity, SMF entity, PCF, UDM entity and UPF entity.

[0059] The NWDAF entity is used for at least one of the following:

[0060] Obtain terminal access data from the AMF entity, such as terminal location, mobility and other data;

[0061] Obtain relevant data of the terminal PDU session from the SMF entity, such as RAT, bearer type, activation time of the PDU session, etc.;

[0062] Obtain relevant policy information of the terminal from the PCF entity;

[0063] Obtain relevant contract information of the terminal (including but not limited to package information) from the UDM entity;

[0064] Obtain flow records from the UPF entity and extract flow-related information from the flow records, such as duration, five-tuple, protocol type, URL, number of packets, packet length, application, DPI characteristics, etc.;

[0065] Get NAT logs from Carrier Grade Network Address Translation (CGNAT).

[0066] The NWDAF entity determines metadata based on the data obtained from each main network element, including but not limited to: the NWDAF entity deduplicates the data obtained from each main network element, and determines the deduplicated data as a metadata. The NWDAF entity can normalize the deduplicated data to obtain processed data, and determine the processed data as feature data corresponding to the target terminal.

[0067] At the same time, the NWDAF entity obtains the detection results of the firewall device (Firewall) in real time. Among them, the Firewall has a security management function, which is used to determine whether the data flow generated by the terminal is normal. When the Firewall detects that the data flow is abnormal, it notifies the NWDAF entity of the data flow anomaly, and the NWDAF entity uses the detection result as the label result of the corresponding metadata. Each metadata and the corresponding label result constitute a sample data, and multiple sample data constitute a sample set. The NWDAF entity trains the recognition model by using the sample set, and finally obtains the target recognition model, which is used to determine whether there is an abnormality in the data flow of the terminal.

[0068] The IPDR log system (or IPDR network element) interacts with the NWDAF entity in real time. The IPDR network element can send the terminal description information of the target terminal and the data flow description information of the target data flow to the NWDAF entity when the target data flow is just generated, and obtain the first recognition result and the second recognition result output by the target recognition model from the NWDAF entity, so as to prejudge whether the target terminal and the target data flow are abnormal. If there is an abnormality, the IPDR network element can actively label all subsequent logs of the target terminal with an abnormal label, and actively report it to the security department (such as the security management background in the above embodiment), so that the IPDR network element has the ability to proactively notify in advance.

[0069] Among them, the IPDR network element continues to interact with the NWDAF entity in real time, and receives real-time information sent by the Firewall. The real-time information includes but is not limited to the Firewall's detection of the target data flow, and the detection result returned when the target data flow is detected to indicate that the target data flow is abnormal. The IPDR network element can obtain the recognition result obtained by the target recognition model in the NWDAF entity to re-recognize the target data flow, thereby realizing the combined detection result of the Firewall and the recognition result of the target recognition model to determine whether the target data flow is abnormal. If there is an abnormality, all subsequent logs of the target terminal can be actively marked with an abnormal label, and all subsequent logs of the target terminal can be actively reported to the security department, so that the IPDR network element has the ability to conduct active analysis afterwards.

[0070] by Figure 2 For example, in the embodiment of the present invention, the traffic of the terminal (User Equipment, referred to as UE) (such as the target data flow in the above embodiment) is transmitted in the data plane, wherein the traffic passes through the Radio Access Network (Radio Access Network, referred to as RAN) node, UPF entity, Firewall and finally reaches the Domain Name (Domain Name, referred to as DN) network. Among them, all the traffic of the terminal passes through the Firewall

[0071] Among them, the NWDAF entity collects the control event records of the Firewall through the Network Exposure Function entity (wherein, the control event records include the detection results in the above embodiment); and interacts with the main network elements of the control plane (such as AMF entity, SMF entity, PCF and UDM entity and other network elements) through the serial bus interface (SerialBus Interface, referred to as SBI); NWDAF also collects the detailed flow log records generated by the UPF entity, and the detailed flow log records store relevant information of the data flow, including but not limited to the duration, five-tuple information, protocol type, uniform resource locator URL, application, number of data packets, and total length of data packets in the above embodiment. Optionally, the UPF entity can obtain the various data required in the flow log record of the data flow by adopting a private soft acquisition interface, or directly using a hardware probe to analyze the traffic of the Gi port for identification.

[0072] The IPDR network element obtains the control plane data from the SMF entity and obtains the detailed flow log record from the UPF entity, and uses the private IP address of the terminal or the control plane session ID (Control Plane session ID, referred to as CP-SEID) as the key to associate the control plane data and the detailed flow log record, and collects the NAT log of the carrier-level network address translation (Carrier Grade Network Address Translation, referred to as CGNAT) entity, and uses the private IP and private PORT of the terminal to associate with the UPF flow record (i.e., the detailed flow log record in the above embodiment). At the same time, the IPDR network element collects the rest of the terminal data from the UDM entity, PCF entity, AMF entity and other network elements.

[0073] Figure 4 is a schematic diagram of model training for the NWDAF entity in an embodiment of the present invention. In an embodiment of the present invention, before training, the firewall detects whether the data flow is abnormal according to a detection strategy, wherein the detection strategy includes but is not limited to at least one of the following:

[0074] Attack detection security policy, used to detect single-packet attacks, scanning attacks, and flooding attack anomalies;

[0075] DPI application layer identification strategy, used to detect anomalies such as signature matching, protocol analysis, and business identification;

[0076] Intrusion Prevention System (IPS) functional strategy, used to detect anomalies such as worms, Trojans, botnets, spyware, adware, CGI attacks, cross-site scripting attacks, injection attacks, directory traversal, information leakage, remote file inclusion attacks, overflow attacks, code execution, denial of service, scanning tools, backdoors, etc.

[0077] URL matching strategy is used for data filtering, file filtering, virus monitoring, etc.

[0078] like Figure 4As shown, in step 1 to step 5, each main network element of the core network reports relevant information to NWDAF. The NWDAF entity obtains information from each main network element of the core network, and receives the security event record (i.e., the control event record in the above embodiment) sent by the Firewall in real time in step 6. After receiving the control event record, the NWDAF entity saves the controlled record and associates it with the information obtained from each main network element of the core network. Optionally, the private network address of the terminal is used, that is, according to the private network address of the terminal carried in the controlled record, the control event record is associated with the information obtained from each main network element of the core network. Among them, the management and control event records are associated with the flow records obtained from the UPF entity (such as duration, quintuple, protocol, URL, number of packets, packet length, application, DPI characteristics) through the private network address, and the PDU session related information obtained from the SMF entity (such as RAT, Bear Type, private network address, activation time) and other information; and based on the terminal number obtained, and then combined with the location, mobility and other data obtained from the AMF entity, the relevant policy information obtained from the PCF entity, and the contract information obtained from the UDM entity, the sample data is obtained by association, thereby improving the feature space of the sample data.

[0079] The NWDAF entity performs supervised training on the recognition model based on the sample data (as shown in step 7), thereby obtaining the final target recognition model. The recognition model before training can be constructed using a variety of algorithms, including but not limited to: neural networks, support vector machines (SVM), decision trees and other classification algorithms. The NWDAF entity substitutes the sample data and the initial parameters of the recognition model into the loss function of the recognition model, and finally obtains the optimal parameters of the recognition model by using optimization algorithms (including but not limited to gradient optimization, kernel methods, principal component analysis) and other dimensionality reduction methods.

[0080] Among them, the recognition model has the following functions through the training process:

[0081] First, identify whether the terminal is abnormal based on the terminal description information and data flow description information. Among them, the recognition model discovers the inherent rules of the terminal's contract information (such as contract time, location, package type, age, gender, occupation of the user used by the terminal, activation time, activation location and other characteristics) in the sample data with abnormal label results according to the sample data and the label results in the sample data, so as to learn the ability to predict whether the terminal description information is abnormal. For example, the Internet of Things card has a fixed rule. If there is an abnormal location area and abnormal time period in the data corresponding to a certain Internet of Things card, it can be identified that the device where the Internet of Things card is located is abnormal (for example, the device is hijacked, resulting in the abnormality). For another example, the terminal of a student user in a certain location area has the following characteristics: the terminal is located near the campus during class time. During this time, the terminal's traffic and behavior generally do not have significant differences. If a certain terminal continues to perform a large number of abnormal services, it can be inferred that the terminal may be an abnormal terminal by combining the terminal identity information and flow information.

[0082] The second is to identify whether there are abnormalities in the data flow based on the terminal description information and the data flow description information. Among them, according to the sample data and the label results in the sample data, the internal rules are discovered from the various feature information in the sample data (such as quintuple, number of packets, number of connections, DPI features, time, and location). For example, if a terminal suddenly frequently accesses the Domain Name System (DNS), the target recognition model can identify that the terminal may be conducting DNS attacks, denial of service attacks (DOS), etc. Alternatively, if a UE port frequently accesses the same port of different destination IPs, the target recognition model can identify that the behavior is a virus or hacker scanning behavior. For another example, directly through the DPI feature, the target recognition model can identify some illegal applications (APPs) and illegal destination IPs in the quintuple, etc.

[0083] The target recognition model is run and updated in real time by the NWDAF entity, and other network elements can subscribe to and query the recognition results.

[0084] Figure 5 is a flow chart of an abnormality identification method according to another embodiment of the present invention. Figure 5 As shown, the method includes two stages:

[0085] In phase 1, that is, the abnormal session flow establishment process, the following processing steps are included:

[0086] In step 1 to step 6, each main network element of the core network reports relevant information to the IPDR log. In the initial stage of establishing a stream session, the IPDR log system receives relevant information from the SMF entity and the UPF entity, and associates it through the private network IP or CP-SEID field of the terminal to complete the data merging of the terminal plane and the control plane. The IPDR also receives the location information, package information, policy information and a few flow information at the beginning of the service from the main network element of the terminal, and reports the obtained information as feature data to the NWDAF entity. The target recognition model in the NWDAF entity predicts whether the terminal is abnormal and whether the flow is abnormal. The IPDR log system obtains the recognition result output by the target recognition model from the NWDAF entity (as shown in step 7); once the NWDAF entity determines that the terminal or flow is abnormal, the IPDR log system can report the terminal and the log to the security management background (as shown in step 8), that is, report as soon as possible before the security incident breaks out, thereby reducing the risk.

[0087] In phase 2, the abnormal session flow process (i.e., the subsequent flow is ongoing), the following processing steps are included:

[0088] In step 9, the IPDR log system receives the security events reported by the firewall device;

[0089] The IPDR log system can subscribe to the security events reported by the firewall received by the NWDAF entity and directly mark the flow, or it can sample the flow, extract the characteristic data of the flow, and report it to the NWDAF entity to intelligently identify the flow through the target recognition model, so as to determine whether the flow is an abnormal flow (as shown in step 10).

[0090] In step 11, if the data flow is found to be abnormal, the IPDR log system will save all the relevant logs of the flow, and can actively send these records to the security management background later, so as to complete the subsequent active reporting.

[0091] Among them, for the flow records of normal terminals, the target recognition model in the NWDA entity simultaneously outputs the corresponding confidence. When the confidence exceeds the threshold, the IPDR can directly filter the relevant flow logs, that is, not save the relevant flow logs, thereby saving storage space.

[0092] Figure 6 This is a schematic diagram of the service data flow inside the IPDR log system according to an embodiment of the present invention, including:

[0093] Step 1: The IPDR log system continuously obtains relevant data from the service main network element and then associates the data;

[0094] Step 2: For the initial session terminal and data, the IPDR log system interacts with the NWDAF entity to determine whether the terminal and flow data are abnormal;

[0095] Step 3: Filter the logs without abnormalities and do not save them;

[0096] Step 4: Report abnormal terminals and data to the security management backend department in advance;

[0097] The execution order of step 3 and step 4 can be interchanged, that is, step 4 is executed first, and then step 3;

[0098] Step 5: Save the logs with abnormalities;

[0099] Step 6: Report the abnormal log afterwards;

[0100] Step 7: The NWDA entity can proactively query the IPDR system for relevant logs.

[0101] Through the above embodiments, a security log system based on artificial intelligence (AI) is provided. By giving the IPDR log system intelligent capabilities, the problem log can be notified to the security management background in advance when it is predicted that there may be risk data before the risk occurs, so as to have the active ability of pre-risk discovery notification. In addition, after the risk occurs, the log can be actively analyzed to mark the logs with abnormalities, and the logs with abnormalities can be actively discovered and reported to the security management background, so that the security problems can be exposed in advance. After the log system has intelligent capabilities, it can selectively save suspicious data (i.e., logs with abnormalities) and filter out a large number of logs without abnormalities, thereby greatly reducing storage costs. In the above embodiment, the IPDR log system is linked with the NWDAF entity, and the IPDR log system can proactively predict whether the terminal is abnormal through intelligent prediction capabilities, thereby having the ability of prior notification; and the IPDR log system is linked with the NWDAF entity and the firewall, and can rely on the target recognition model of the NWDAF to determine whether the data flow is abnormal, thereby having the ability of post-analysis; the IPDR log system filters the logs that are reliable and have no security issues by judging the logs, thereby greatly reducing the storage requirements and being very effective in cost control; the method of obtaining security events from the firewall adopted in the above embodiment effectively obtains a large amount of cheap label data, greatly improves the recognition accuracy of the recognition model, gets rid of the process of human participation, and reduces the training cost; each main network element provides a multi-dimensional feature space (space, time, business, etc.) for the recognition model, enriches the dimensions of the recognition model, covers a variety of possibilities, greatly improves the generalization performance of the recognition model, and avoids the problem of overfitting; and even if the firewall is not deployed at some points, the IPDR log system can still use the target recognition model that has been integrated and released in the NWDAF entity for intelligent analysis.

[0102] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0103] In the present embodiment, a device for determining abnormal movement is also provided, and the device is used to implement the above-mentioned embodiments and preferred embodiments, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceived.

[0104] Figure 7 is a structural block diagram of an abnormality identification device according to an embodiment of the present invention. Figure 7 As shown, the device comprises:

[0105] A first acquisition module 72, configured to acquire first data of a target terminal from a target network element through a log system, wherein the first data includes first terminal description information of the target terminal and first data flow description information of a target data flow of the target terminal;

[0106] A second acquisition module 74 is used to input the first data into a target recognition model and obtain a first recognition result output by the target recognition model, wherein the target recognition model is used to identify whether the target terminal is abnormal according to the first data;

[0107] The notification module 76 is used to send a notification message to the security management background through the log system when the first identification result indicates that the target terminal is abnormal, wherein the notification message is used to indicate that the target terminal is abnormal.

[0108] Through the present invention, the first data of the target terminal is obtained from the target network element through the log system, wherein the first data includes the first terminal description information of the target terminal and the first data flow description information of the target data flow of the target terminal; the first data is input into the target recognition model through the log system, and the first recognition result output by the target recognition model is obtained, wherein the target recognition model is used to recognize whether the target terminal has an abnormality according to the first data; when the first recognition result indicates that the target terminal has an abnormality, a notification message is sent to the security management background through the log system, wherein the notification message is used to indicate that the target terminal has an abnormality. Therefore, the technical problem that the log system cannot recognize the terminal abnormality can be solved, and the log system can recognize the abnormality of the terminal, so that the log system can recognize the abnormality before the security problem occurs in the network and notify the security management background, thereby improving the security of the network.

[0109] In an exemplary embodiment, the second acquisition module is also used to: obtain a second recognition result output by the target recognition model, wherein the target recognition model is also used to identify whether there is an abnormality in the target data flow based on the first data; the notification module is also used to send the notification message to the security management background when the second recognition result indicates that there is an abnormality in the target data flow, wherein the notification message is also used to indicate that there is an abnormality in the target data flow.

[0110] In an exemplary embodiment, the first acquisition module is further used to: acquire the first terminal description information from a first network element, and acquire the first data flow description information from a user plane function entity UPF.

[0111] In an exemplary embodiment, the first acquisition module is also used for at least one of the following: obtaining access data of the target terminal from an access management function entity AMF; obtaining session description information of the target terminal from a session management function entity SMF; obtaining policy information corresponding to the target terminal from a policy control function entity PCF; obtaining contract information of the target terminal from a unified data management function entity UDM.

[0112] In an exemplary embodiment, the first acquisition module is also used for at least one of the following: obtaining from the UPF the duration of the target data stream, the five-tuple information of the target data stream, the protocol type of the target data stream, the uniform resource locator URL carried in the target data stream, the application corresponding to the target data stream, the number of data packets in the data stream, and the total length of the data packets in the data stream.

[0113] In an exemplary embodiment, the device also includes a processing module for adding a label to a first log corresponding to the target terminal when the first identification result indicates that there is an abnormality in the target terminal and / or the second identification result indicates that there is an abnormality in the target data stream, wherein the label is used to indicate that there is an abnormality in the first log; saving the first log, and sending the first log to the security management background.

[0114] In an exemplary embodiment, after sending a notification message to the security management background through the log system, the second acquisition module is also used to: obtain the detection result of the target data flow sent by the firewall device, wherein the detection result is used to indicate that the target data flow is abnormal; the processing module is also used to: add a label to the second log corresponding to the target terminal, wherein the label is used to indicate that the second log is abnormal, and the generation time of the second log is later than the generation time of the first log; save the second log through the log system, and send the second log to the security management background; or, the first acquisition module is also used to obtain from the target network element The second data of the target terminal, wherein the second data includes the second terminal description information of the target terminal and the second data flow description information of the target data flow; the second acquisition module is also used to: input the second data into the target recognition model, and obtain the third recognition result output by the target recognition model; the processing module is also used to: when the third recognition result indicates that the target data flow is abnormal, add a label to the third log corresponding to the target terminal, wherein the label is used to indicate that the third log is abnormal and the generation time of the third log is later than the generation time of the first log; save the third log, and send the third log to the security management background.

[0115] In an exemplary embodiment, when the first recognition result indicates that there is no abnormality in the target terminal and the second recognition result indicates that there is no abnormality in the target data flow, the processing module is also used to: when the confidence corresponding to the first recognition result output by the target recognition model is greater than a first preset confidence threshold, and the confidence corresponding to the second recognition result is greater than a second preset confidence threshold, filter the log corresponding to the target terminal and do not save the log corresponding to the target terminal.

[0116] In an exemplary embodiment, the log system includes a network detailed recording protocol IPDR log system, and the target recognition model is located in the NWDAF entity, wherein the second acquisition module is also used to: send the first data to the NWDAF entity, wherein the NWDAF entity is used to input the received first data into the target recognition model; and obtain the first recognition result output by the target recognition model from the NWDAF entity.

[0117] In another embodiment of the present invention, an abnormality identification system is provided, which is used to implement the above embodiments and preferred implementation modes, and the descriptions that have been made are omitted. The system includes: a log system and a target network element, wherein:

[0118] The log system is used to obtain first data of the target terminal from the target network element, wherein the first data includes first terminal description information of the target terminal and first data flow description information of the target data flow of the target terminal;

[0119] The log system is further used to input the first data into a target recognition model and obtain a first recognition result output by the target recognition model, wherein the target recognition model is used to identify whether the target terminal is abnormal based on the first data;

[0120] The log system is also used to send a notification message to the security management background through the log system when the first identification result indicates that the target terminal is abnormal, wherein the notification message is used to indicate that the target terminal is abnormal.

[0121] Through the present invention, the first data of the target terminal is obtained from the target network element through the log system, wherein the first data includes the first terminal description information of the target terminal and the first data flow description information of the target data flow of the target terminal; the first data is input into the target recognition model through the log system, and the first recognition result output by the target recognition model is obtained, wherein the target recognition model is used to recognize whether the target terminal has an abnormality according to the first data; when the first recognition result indicates that the target terminal has an abnormality, a notification message is sent to the security management background through the log system, wherein the notification message is used to indicate that the target terminal has an abnormality. Therefore, the technical problem that the log system cannot recognize the terminal abnormality can be solved, and the log system can recognize the abnormality of the terminal, so that the log system can recognize the abnormality before the security problem occurs in the network and notify the security management background, thereby improving the security of the network.

[0122] In an exemplary embodiment, after the first data is input into the target recognition model through the log system, the log system is also used to: obtain a second recognition result output by the target recognition model, wherein the target recognition model is also used to identify whether there is an abnormality in the target data flow based on the first data; and when the second recognition result indicates that there is an abnormality in the target data flow, send the notification message to the security management background, wherein the notification message is also used to indicate that there is an abnormality in the target data flow.

[0123] In an exemplary embodiment, the log system is further used to: obtain the first terminal description information from a first network element, and obtain the first data flow description information from a user plane function entity UPF.

[0124] In an exemplary embodiment, the log system is also used for at least one of the following: obtaining access data of the target terminal from an access management function entity AMF; obtaining session description information of the target terminal from a session management function entity SMF; obtaining policy information corresponding to the target terminal from a policy control function entity PCF; and obtaining contract information of the target terminal from a unified data management function entity UDM.

[0125] In an exemplary embodiment, the log system is also used for at least one of the following: obtaining from the UPF the duration of the target data stream, the five-tuple information of the target data stream, the protocol type of the target data stream, the uniform resource locator URL carried in the target data stream, the application corresponding to the target data stream, the number of data packets in the data stream, and the total length of data packets in the data stream.

[0126] In an exemplary embodiment, when the first identification result indicates that there is an abnormality in the target terminal and / or the second identification result indicates that there is an abnormality in the target data stream, the log system is also used to: add a label to the first log corresponding to the target terminal, wherein the label is used to indicate that there is an abnormality in the first log; save the first log, and send the first log to the security management background.

[0127] In an exemplary embodiment, after sending the notification message to the security management background through the log system, the log system is further used to: obtain the detection result of the target data flow sent by the firewall device, wherein the detection result is used to indicate that the target data flow is abnormal; add a label to the second log corresponding to the target terminal, wherein the label is used to indicate that the second log is abnormal, and the generation time of the second log is later than the generation time of the first log; save the second log through the log system, and send the second log to the security management background; or obtain the second data of the target terminal from the target network element, wherein the second data includes the second terminal description information of the target terminal and the second data flow description information of the target data flow; input the second data into the target recognition model and obtain the third recognition result output by the target recognition model; if the third recognition result indicates that the target data flow is abnormal, add a label to the third log corresponding to the target terminal, wherein the label is used to indicate that the third log is abnormal, and the generation time of the third log is later than the generation time of the first log; save the third log, and send the third log to the security management background.

[0128] In an exemplary embodiment, when the first recognition result indicates that there is no abnormality in the target terminal and the second recognition result indicates that there is no abnormality in the target data flow, the log system is also used to: when the confidence corresponding to the first recognition result output by the target recognition model is greater than a first preset confidence threshold, and the confidence corresponding to the second recognition result is greater than a second preset confidence threshold, filter the log corresponding to the target terminal and do not save the log corresponding to the target terminal.

[0129] In an exemplary embodiment, the system also includes a network data analysis function NWDAF entity, wherein, before the first data is input into the target recognition model through the log system and the first recognition result output by the target recognition model is obtained, the NWDAF entity is used to: obtain multiple sample data, wherein each sample data in the multiple sample data includes terminal description information of a terminal, data flow description information of the data flow of the terminal, and a detection result corresponding to the data flow of the terminal, wherein the detection result is a detection result obtained by a firewall device on the data flow of the terminal, and the detection result is used to indicate whether there is an abnormality in the data flow of the terminal; use the multiple sample data to train the pre-trained recognition model to obtain a recognition model after the training is completed, and determine the recognition model after the training is completed as the target recognition model.

[0130] In an exemplary embodiment, the log system includes a network detailed recording protocol IPDR log system, and the target recognition model is located in a NWDAF entity, wherein the IPDR log system is also used to: send the first data to the NWDAF entity, wherein the NWDAF entity is used to input the received first data into the target recognition model; and obtain the first recognition result output by the target recognition model from the NWDAF entity.

[0131] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0132] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0133] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0134] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0135] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0136] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0137] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for identifying anomalies, characterized in that: include: Acquire first data of a target terminal from a target network element through a log system, wherein the first data includes first terminal description information of the target terminal and first data flow description information of a target data flow of the target terminal; Inputting the first data into a target recognition model through the log system, and obtaining a first recognition result output by the target recognition model, wherein the target recognition model is used to identify whether the target terminal is abnormal according to the first data; When the first identification result indicates that the target terminal is abnormal, sending a notification message to the security management backend through the log system, wherein the notification message is used to indicate that the target terminal is abnormal; The acquiring the first data of the target terminal from the target network element through the log system includes: acquiring the first terminal description information from the first network element, and acquiring the first data flow description information from the user plane function entity UPF; The acquiring the first terminal description information from the first network element includes at least one of the following: Obtaining access data of the target terminal from an access management function entity AMF; Acquire the session description information of the target terminal from the session management function entity SMF; Acquire policy information corresponding to the target terminal from a policy control function entity PCF; Acquire the contract information of the target terminal from the unified data management function entity UDM; The obtaining of the first data flow description information from a user plane function entity UPF includes at least one of the following: Obtain from the UPF the duration of the target data stream, the five-tuple information of the target data stream, the protocol type of the target data stream, the uniform resource locator URL carried in the target data stream, the application corresponding to the target data stream, the number of data packets in the data stream, and the total length of the data packets in the data stream.

2. The method according to claim 1, characterized in that After inputting the first data into the target recognition model through the log system, the method further includes: Obtaining a second recognition result output by the target recognition model, wherein the target recognition model is further used to identify whether the target data flow is abnormal based on the first data; When the second identification result indicates that an abnormality exists in the target data flow, the notification message is sent to the security management background through the log system, wherein the notification message is also used to indicate that an abnormality exists in the target data flow.

3. The method according to claim 2, characterized in that When the first recognition result indicates that the target terminal is abnormal and / or the second recognition result indicates that the target data flow is abnormal, the method further includes: Adding a tag to the first log corresponding to the target terminal by the log system, wherein the tag is used to indicate that the first log has an abnormality; The first log is saved through the log system, and the first log is sent to the security management background.

4. The method according to claim 3, characterized in that After sending the notification message to the security management background through the log system, the method further includes: Acquire a detection result sent by a firewall device and obtained by detecting the target data flow, wherein the detection result is used to indicate that an abnormality exists in the target data flow; Wherein, the method further comprises: adding a tag to the second log corresponding to the target terminal through the log system, wherein the tag is used to indicate that the second log is abnormal and the generation time of the second log is later than the generation time of the first log; saving the second log through the log system, and sending the second log to the security management backend; or, Acquire second data of the target terminal from the target network element through the log system, wherein the second data includes second terminal description information of the target terminal and second data flow description information of the target data flow; Inputting the second data into the target recognition model through the log system, and obtaining a third recognition result output by the target recognition model; When the third identification result indicates that the target data flow is abnormal, adding a label to the third log corresponding to the target terminal through the log system, wherein the label is used to indicate that the third log is abnormal and the generation time of the third log is later than the generation time of the first log; The third log is saved through the log system, and the third log is sent to the security management background.

5. The method according to claim 2, characterized in that: When the first recognition result indicates that the target terminal does not have an abnormality, and the second recognition result indicates that the target data flow does not have an abnormality, the method further includes: When the confidence corresponding to the first recognition result output by the target recognition model is greater than a first preset confidence threshold, and the confidence corresponding to the second recognition result is greater than a second preset confidence threshold, the log corresponding to the target terminal is filtered through the log system, and the log corresponding to the target terminal is not saved through the log system.

6. The method according to claim 1, characterized in that Before inputting the first data into the target recognition model through the log system and obtaining the first recognition result output by the target recognition model, the method further includes: Acquire multiple sample data through a network data analysis function NWDAF entity, wherein each sample data of the multiple sample data includes terminal description information of a terminal, data flow description information of a data flow of the terminal, and a detection result corresponding to the data flow of the terminal, the detection result is a detection result obtained by a firewall device on the data flow of the terminal, and the detection result is used to indicate whether the data flow of the terminal is abnormal; The NWDAF entity uses the multiple sample data to train the pre-trained recognition model to obtain a trained recognition model, and determines the trained recognition model as the target recognition model.

7. The method according to any one of claims 1 to 6, characterized in that The log system includes a network detailed record protocol IPDR log system, and the target recognition model is located in the NWDAF entity, wherein the first data is input into the target recognition model through the log system, and the first recognition result output by the target recognition model is obtained, including: Sending the first data to the NWDAF entity through the IPDR log system, wherein the NWDAF entity is used to input the received first data into the target recognition model; The first recognition result output by the target recognition model is obtained from the NWDAF entity through the IPDR log system.

8. An abnormality identification device, characterized in that: include: A first acquisition module, configured to acquire first data of a target terminal from a target network element through a log system, wherein the first data includes first terminal description information of the target terminal and first data flow description information of a target data flow of the target terminal; a second acquisition module, configured to input the first data into a target recognition model and acquire a first recognition result output by the target recognition model, wherein the target recognition model is configured to recognize whether the target terminal is abnormal based on the first data; a notification module, configured to send a notification message to a security management backend through the log system when the first identification result indicates that the target terminal is abnormal, wherein the notification message is used to indicate that the target terminal is abnormal; The first acquisition module is further used to: acquire the first terminal description information from the first network element, and acquire the first data flow description information from the user plane function entity UPF; The first acquisition module is further used for at least one of the following: acquiring access data of the target terminal from an access management function entity AMF; acquiring session description information of the target terminal from a session management function entity SMF; acquiring policy information corresponding to the target terminal from a policy control function entity PCF; acquiring contract information of the target terminal from a unified data management function entity UDM; The first acquisition module is also used for at least one of the following: obtaining from the UPF the duration of the target data stream, the five-tuple information of the target data stream, the protocol type of the target data stream, the uniform resource locator URL carried in the target data stream, the application corresponding to the target data stream, the number of data packets in the data stream, and the total length of the data packets in the data stream.

9. An abnormality identification system, characterized in that: include: Log system and target network element, where: The log system is used to obtain first data of the target terminal from the target network element, wherein the first data includes first terminal description information of the target terminal and first data flow description information of the target data flow of the target terminal; The log system is further used to input the first data into a target recognition model and obtain a first recognition result output by the target recognition model, wherein the target recognition model is used to identify whether the target terminal is abnormal based on the first data; The log system is further configured to send a notification message to a security management background when the first identification result indicates that the target terminal is abnormal, wherein the notification message is used to indicate that the target terminal is abnormal; The log system is further used to: obtain the first terminal description information from the first network element, and obtain the first data flow description information from the user plane function entity UPF; The log system is also used for at least one of the following: obtaining the access data of the target terminal from the access management function entity AMF; obtaining the session description information of the target terminal from the session management function entity SMF; obtaining the policy information corresponding to the target terminal from the policy control function entity PCF; obtaining the contract information of the target terminal from the unified data management function entity UDM; the log system is also used for at least one of the following: obtaining the duration of the target data stream, the five-tuple information of the target data stream, the protocol type of the target data stream, the uniform resource locator URL carried in the target data stream, the application corresponding to the target data stream, the number of data packets in the data stream, and the total length of data packets in the data stream from the UPF.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 7 when executed.

11. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.

Images