A data processing method, device, equipment and storage medium

Abstract

The embodiments of the present invention provide a data processing method, device, equipment and storage medium, which relate to the fields of network technology and security technology. The specific implementation scheme is: in response to receiving a first data acquisition request sent by a service consumer, determining the target network function NF unit indicated by the first data acquisition request and the specified time window; determining a trusted time window under the specified time window; wherein the trusted time window is a time window within the specified time window, excluding the time within the abnormal time period; obtaining the data generated by the target NF unit within the trusted time window as the first data; using the first data, generating a request result corresponding to the first data acquisition request, and feeding back the request result to the service consumer. It can be seen that through this scheme, the valid data of the abnormal NF unit can be fully utilized.

Description

Technical Field

[0001] The present invention relates to the field of network technology and security technology, and in particular to a data processing method, device, equipment and storage medium. Background Art

[0002] The NWDAF (Network Data Analytics Function) unit defined by 3GPP (3rd Generation Partnership Project) can collect raw data from NF (Network Function) units and output intelligent analysis results for service consumers to make subsequent operational decisions. However, the data provided by NF units due to configuration errors or network attacks will lack credibility. For example, NF units that are maliciously controlled by network attacks may send false data or even adversarial samples that are difficult to detect, which in turn affects the accuracy of the statistical analysis of the NWDAF unit, making the credibility of the intelligent analysis results low.

[0003] In the related art, in order to ensure the accuracy of the statistical analysis of the NWDAF unit, when collecting raw data from the NF unit, the abnormal NF unit is added to the blacklist by detecting the security status information released by the NF unit, and the data of the abnormal NF unit in the blacklist will not participate in the statistical analysis of the NWDAF unit. However, the control granularity of the processing mechanism for adding the abnormal NF unit to the blacklist is too coarse, resulting in the inability to use the valid data generated by the abnormal NF unit.

[0004] Therefore, a data processing method is urgently needed to fully utilize the valid data of abnormal NF units. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide a data processing method, apparatus, device and storage medium to fully utilize the valid data of abnormal NF units. The specific technical solution is as follows:

[0006] In a first aspect, an embodiment of the present invention provides a data processing method, which is applied to a network data analysis function NWDAF unit, and the method includes:

[0007] In response to receiving a first data acquisition request sent by a service consumer, determining a target network function NF unit and a specified time window indicated by the first data acquisition request;

[0008] Determine a trusted time window under the specified time window; wherein the trusted time window is a time window within the specified time window except for the time within the abnormal time period, and the abnormal time period is a time period when the security state of the target NF unit is abnormal;

[0009] Acquire data generated by the target NF unit within the trusted time window as first data;

[0010] A request result corresponding to the first data acquisition request is generated by using the first data, and the request result is fed back to the service consumer.

[0011] Optionally, the using the first data to generate a request result corresponding to the first data acquisition request includes:

[0012] Using the first data, a processing result corresponding to the first data is generated as a request result corresponding to the first data acquisition request.

[0013] Optionally, before using the first data to generate a request result corresponding to the first data acquisition request, the method further includes:

[0014] Acquire data generated by the target NF unit within the specified time window as second data;

[0015] The using the first data to generate a request result corresponding to the first data acquisition request includes:

[0016] Using the first data, generating a first processing result corresponding to the first data;

[0017] generating a second processing result corresponding to the second data by using the second data;

[0018] A result content including the first processing result and the second processing result is constructed as a request result corresponding to the first data acquisition request.

[0019] Optionally, the result content also includes:

[0020] A first credibility label associated with the first processing result, and a second credibility label associated with the second processing result; wherein the credibility represented by the first credibility label is higher than the credibility represented by the second credibility label.

[0021] Optionally, determining a trusted time window under the specified time window includes:

[0022] Determine the abnormal time period corresponding to the target NF unit obtained from the network traffic analysis system;

[0023] From the time period represented by the designated time window, the time period intersecting with the abnormal time period is eliminated to obtain a credible time window under the designated time window.

[0024] Optionally, the method of obtaining the abnormal time period of the target NF unit from the network traffic analysis system includes:

[0025] Initiating a second data acquisition request for querying the security status of the target NF unit to the network traffic analysis system, so that the network traffic analysis system determines the time period in which the security status of the target NF unit is abnormal from the query time period indicated by the second data acquisition request, obtains the abnormal time period, and feeds back the abnormal time period; wherein the query time period includes the time period represented by the specified time window;

[0026] Receive the abnormal time period fed back by the network traffic analysis system.

[0027] Optionally, the network traffic analysis system determines that the security status of the target NF unit is in an abnormal time period, including:

[0028] Analyze the network traffic data of the target NF unit within the query time period to obtain the start and end time of the abnormal event occurring in the target NF unit;

[0029] A time period within the start and end time of the abnormal event occurring in the target NF unit is determined as a time period in which the safety state of the target NF unit is abnormal.

[0030] Optionally, the acquiring the data generated by the target NF unit within the trusted time window includes:

[0031] Determine whether the data generated by the target NF unit within the trusted time window is historical data;

[0032] If so, the data generated by the target NF unit within the trusted time window is obtained from the data storage repository; otherwise, the data generated by the target NF unit within the trusted time window is obtained from the target NF unit.

[0033] Optionally, the method further comprises:

[0034] According to the abnormal time period corresponding to the target NF unit, the data stored in the data storage repository and belonging to the abnormal time period is cleared.

[0035] In a second aspect, an embodiment of the present invention provides a data processing device, which is applied to a network data analysis function NWDAF unit, and the device includes:

[0036] A first determination module is configured to determine, in response to receiving a first data acquisition request sent by a service consumer, a target network function NF unit and a specified time window indicated by the first data acquisition request;

[0037] A second determining module is used to determine a trusted time window under the specified time window; wherein the trusted time window is a time window within the specified time window except for the time within the abnormal time period, and the abnormal time period is a time period when the security state of the target NF unit is abnormal;

[0038] an acquisition module, configured to acquire data generated by the target NF unit within the trusted time window as first data;

[0039] A generating module is used to generate a request result corresponding to the first data acquisition request by using the first data, and feed back the request result to the service consumer.

[0040] Optionally, the using the first data to generate a request result corresponding to the first data acquisition request includes:

[0041] Using the first data, a processing result corresponding to the first data is generated as a request result corresponding to the first data acquisition request.

[0042] Optionally, before using the first data to generate a request result corresponding to the first data acquisition request, the method further includes:

[0043] Acquire data of a specified type generated by the target NF unit within the specified time window as second data;

[0044] The using the first data to generate a request result corresponding to the first data acquisition request includes:

[0045] Using the first data, generating a first processing result corresponding to the first data;

[0046] generating a second processing result corresponding to the second data by using the second data;

[0047] A result content including the first processing result and the second processing result is constructed as a request result corresponding to the first data acquisition request.

[0048] Optionally, the result content also includes:

[0049] A first credibility label associated with the first processing result, and a second credibility label associated with the second processing result; wherein the credibility represented by the first credibility label is higher than the credibility represented by the second credibility label.

[0050] Optionally, the second determining module is specifically configured to:

[0051] Determine the abnormal time period corresponding to the target NF unit obtained from the network traffic analysis system;

[0052] From the time period represented by the designated time window, the time period intersecting with the abnormal time period is eliminated to obtain a credible time window under the designated time window.

[0053] Optionally, the method of obtaining the abnormal time period of the target NF unit from the network traffic analysis system includes:

[0054] Initiating a second data acquisition request for querying the security status of the target NF unit to the network traffic analysis system, so that the network traffic analysis system determines the time period in which the security status of the target NF unit is abnormal from the query time period indicated by the second data acquisition request, obtains the abnormal time period, and feeds back the abnormal time period; wherein the query time period includes the time period represented by the specified time window;

[0055] Receive the abnormal time period fed back by the network traffic analysis system.

[0056] Optionally, the network traffic analysis system determines that the security status of the target NF unit is in an abnormal time period, including:

[0057] Analyze the network traffic data of the target NF unit within the query time period to obtain the start and end time of the abnormal event occurring in the target NF unit;

[0058] A time period within the start and end time of the abnormal event occurring in the target NF unit is determined as a time period in which the safety state of the target NF unit is abnormal.

[0059] Optionally, the obtaining of the specified type of data generated by the target NF unit within the trusted time window includes:

[0060] Determine whether the specified type of data generated by the target NF unit within the trusted time window is historical data;

[0061] If so, obtain the specified type of data generated by the target NF unit within the trusted time window from the data storage repository; otherwise, obtain the specified type of data generated by the target NF unit within the trusted time window from the target NF unit.

[0062] Optionally, the device further comprises:

[0063] The cleaning module is used to clean up the data stored in the data storage repository and belonging to the abnormal time period according to the abnormal time period corresponding to the target NF unit.

[0064] In a third aspect, an embodiment of the present invention provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0065] Memory, used to store computer programs;

[0066] The processor is used to implement the steps of any of the above-mentioned data processing methods when executing the program stored in the memory.

[0067] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned data processing methods are implemented.

[0068] Beneficial effects of the embodiments of the present invention:

[0069] The data processing method provided by the embodiment of the present invention, when receiving the first data acquisition request sent by the service consumer, obtains the data generated by the target NF unit within the trusted time window as the first data by determining the trusted time window under the specified time window indicated by the first data acquisition request, and uses the first data to generate a request result corresponding to the first data acquisition request, and feeds the request result back to the service consumer. Since the first data obtained is the data generated by the target NF unit within the trusted time window, compared with the data generated by the target NF unit within the specified time window, which may contain false data, the first data obtained by this scheme is more accurate. Therefore, the request result corresponding to the first data acquisition request generated by using the first data contains a more accurate analysis result for the first data. It can be seen that through this scheme, the valid data of the abnormal NF unit can be fully utilized.

[0070] Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0072] Figure 1 A flowchart of a data processing method provided by an embodiment of the present invention;

[0073] Figure 2 Another flow chart of the data processing method provided by the embodiment of the present invention;

[0074] Figure 3 Another flow chart of the data processing method provided by the embodiment of the present invention;

[0075] Figure 4 A schematic diagram of a data collection and processing system for an abnormal NF unit provided by an embodiment of the present invention;

[0076] Figure 5 A flowchart of a specific example for implementing an embodiment of the present invention;

[0077] Figure 6 A timing diagram for data collection and processing for abnormal NF units in order to implement an embodiment of the present invention;

[0078] Figure 7 A schematic diagram of the structure of a data processing device provided by an embodiment of the present invention;

[0079] Figure 8 The present invention is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0080] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field based on this application belong to the scope of protection of the present invention.

[0081] The following first introduces the professional terms involved in the embodiments of the present invention:

[0082] NF unit: Network function unit. Each functional module in 5G (fifth generation mobile communication technology) can be called a NF unit. For example, the NF unit can be an AMF (Access and mobility management functions) unit, an SMF (Session Management Function) unit, and so on.

[0083] NWDAF unit: used to collect and analyze network data, generate and output analysis results, and assist service consumers who put forward analysis requirements to select relevant strategies; service consumers are NF units that put forward analysis requirements to the NWDAF unit;

[0084] NTA (Network Traffic Analysis) system: A key application function that interacts with the 5G core network. It has the ability to perform retrospective analysis and retain historical traffic, and supports providing the start and end time of abnormal events to the NWDAF unit in the form of event subscription.

[0085] The NWDAF unit defined by 3GPP can collect raw data from NF units and output intelligent analysis results for service consumers to make subsequent operational decisions. However, due to misconfiguration or network attacks, the data provided by NF units will lack credibility. For example, an abnormal NF unit that is maliciously controlled by a network attack may send false data or even adversarial samples that are difficult to detect, which in turn affects the accuracy of the statistical analysis of the NWDAF unit and makes the credibility of the intelligent analysis results low.

[0086] In the related art, in order to ensure the accuracy of the statistical analysis of the NWDAF unit, when collecting raw data from the NF unit, the abnormal NF unit is added to the blacklist by detecting the security status information released by the NF unit, and the data of the abnormal NF unit identified in the blacklist will not participate in the statistical analysis of the NWDAF unit. However, the control granularity of the processing mechanism for adding the abnormal NF unit to the blacklist is too coarse, resulting in the inability to use the valid data generated by the abnormal NF unit.

[0087] Based on the above content, in order to fully utilize the valid data of the abnormal NF unit, the embodiments of the present invention provide a data processing method, apparatus, device and storage medium.

[0088] Below, a data processing method provided by an embodiment of the present invention is first introduced.

[0089] A data processing method provided by an embodiment of the present invention is applied to a network data analysis function NWDAF unit, which can be deployed in a server, a virtual machine or a container. The NWDAF unit is used to receive a data analysis request from a service consumer for a NF unit, and feed back the data analysis result for the NF unit to the service consumer.

[0090] The data processing method provided by the embodiment of the present invention may include the following steps:

[0091] In response to receiving a first data acquisition request sent by a service consumer, determining a target network function NF unit and a specified time window indicated by the first data acquisition request;

[0092] Determine a trusted time window under the specified time window; wherein the trusted time window is a time window within the specified time window except for the time within the abnormal time period, and the abnormal time period is a time period when the security state of the target NF unit is abnormal;

[0093] Acquire data generated by the target NF unit within the trusted time window as first data;

[0094] A request result corresponding to the first data acquisition request is generated by using the first data, and the request result is fed back to the service consumer.

[0095] The solution provided by the embodiment of the present invention, when receiving the first data acquisition request sent by the service consumer, obtains the data generated by the target NF unit within the trusted time window as the first data by determining the trusted time window under the specified time window indicated by the first data acquisition request, and uses the first data to generate a request result corresponding to the first data acquisition request, and feeds the request result back to the service consumer. Since the first data obtained is the data generated by the target NF unit within the trusted time window, compared with the data generated by the target NF unit within the specified time window, which may contain false data, the first data obtained by this solution is more accurate. Therefore, the request result corresponding to the first data acquisition request generated by using the first data contains a more accurate analysis result for the first data. It can be seen that through this solution, the valid data of the abnormal NF unit can be fully utilized.

[0096] The data processing method provided by the embodiment of the present invention is introduced below in conjunction with the accompanying drawings.

[0097] like Figure 1 As shown, the data processing method provided by the embodiment of the present invention may include steps S101-S104:

[0098] S101, in response to receiving a first data acquisition request sent by a service consumer, determining a target network function NF unit and a specified time window indicated by the first data acquisition request;

[0099] In this embodiment, the service consumer may initiate a first data acquisition request to the NWDAF unit in a query manner or an event subscription manner, and the first data acquisition request may be a request for the analysis result of the specified data. Exemplarily, the specified data may be performance data such as CPU utilization and memory utilization of the server where the target NF unit is located. After receiving the first data acquisition request sent by the service consumer, the NWDAF unit may determine the target NF unit and the specified time window indicated by the first data acquisition request according to the parameters carried in the first data acquisition request. Exemplarily, the first data acquisition request may carry the identifier of the target NF unit and the specified time window, and the NWDAF unit may determine the target NF unit according to the identifier, and may collect and analyze the data within the specified time window of the target NF unit according to the specified time window. Exemplarily, the identifier of the target NF unit may be the name of the target NF unit, ID (identity document, identity identification number), etc., which can uniquely determine the identifier of the target NF unit. The designated time window may be any time period selected by the service consumer, for example, the designated time window may be 202003051200-202003081600 (12:00 on March 5, 2020 to 16:00 on March 8, 2020).

[0100] It should be noted that the service consumer and the target NF unit are essentially NF units. In actual application scenarios, any NF unit can be used as both the target NF unit of the collected data and the service consumer. When a certain NF unit initiates a first data acquisition request to the NWDAF unit as a service consumer, the target NF unit indicated by the first data acquisition request can be any NF unit other than the service consumer. For example, the slice management unit is an NF unit. When it acts as a service consumer and needs to subscribe to some data of the user plane functional unit, the user plane functional unit can be used as the target NF unit.

[0101] S102, determining a trusted time window under the specified time window; wherein the trusted time window is a time window within the specified time window except for the time within the abnormal time period, and the abnormal time period is a time period when the security status of the target NF unit is abnormal;

[0102] It is understandable that the service consumer initiates a first data acquisition request to the NWDAF unit, and the data to be subscribed is the data analysis result within the specified time window. Since the specified time window may include a time period when the security status of the target NF unit is abnormal, when the security status of the target NF unit is abnormal, false data may be sent to the NWDAF unit, causing the NWDAF unit to analyze the data within the specified time window, which will generate inaccurate data analysis results. Therefore, in order to obtain more accurate data analysis results, the trusted time window under the specified time window can be first determined, so that the data within the trusted time window can be collected and analyzed later to obtain more accurate data analysis results.

[0103] In this embodiment, the trusted time window is a time window within the specified time window, excluding the time within the abnormal time period. In practical applications, by analyzing the information representing the security status of the target NF unit, the time period representing the configuration error of the target NF unit or the time period under network attack can be determined as the time period when the security status of the target NF unit is abnormal. Exemplarily, in a specific implementation, the target NF unit has information representing the security status, and the information representing the security status includes a first identifier representing a normal security status and a second identifier representing an abnormal security status. The NWDAF unit sends a request to the target NF unit to obtain information about the security status. After receiving the request, the target NF unit feeds back its own security status information to the NWDAF unit. After receiving the information about the security status of the target NF unit, the NWDAF unit determines the time period corresponding to the second identifier as the time period when the security status of the target NF unit is abnormal.

[0104] S103, acquiring data generated by the target NF unit within the trusted time window as first data;

[0105] After determining the trusted time window under the specified time window through step S102, in order to feed back a more accurate analysis result to the service consumer, the data generated by the target NF unit within the trusted time window can be collected to obtain the first data. It can be understood that since the first data is the data generated within the trusted time window, compared with the data generated by the target NF unit within the specified time window, which may contain false data, the first data obtained by this solution is more accurate, so that the subsequent analysis of the collected first data can obtain a more accurate analysis result. Exemplarily, the data generated by the target NF unit within the trusted time window can be the CPU utilization, memory utilization, load, number of concurrency, etc. of the server where the target NF unit is located within the trusted time window.

[0106] S104: Generate a request result corresponding to the first data acquisition request using the first data, and feed back the request result to the service consumer.

[0107] In this embodiment, after the first data is acquired through step S103, the NWDAF unit can use the first data to generate a request result corresponding to the first data acquisition request. The request result of the first data acquisition request includes a more accurate analysis result obtained by analyzing the first data. It can be understood that the request result of the first data acquisition request is fed back to the service consumer, so that the service consumer can obtain a request result including a more accurate analysis result.

[0108] Optionally, in an implementation manner, using the first data to generate a request result corresponding to the first data acquisition request may include:

[0109] Using the first data, a processing result corresponding to the first data is generated as a request result corresponding to the first data acquisition request.

[0110] In this implementation, after acquiring the first data, the NWDAF unit analyzes the first data and generates a processing result corresponding to the first data as a request result corresponding to the first data acquisition request. Exemplarily, if the first data acquisition request is a data acquisition request for average CPU utilization, the NWDAF unit acquires the CPU utilization of the server where the target NF unit is located within the trusted time window as the first data, and processes the first data, that is, takes the average value of the CPU utilization within the trusted time window, and obtains the processing result corresponding to the first data as the request result corresponding to the first data acquisition request. It can be understood that the processing result of the first data is fed back to the service consumer as a request result corresponding to the first data acquisition request, so that the service consumer can obtain a more accurate analysis result for the data.

[0111] The solution provided by the embodiment of the present invention, when receiving the first data acquisition request sent by the service consumer, obtains the data generated by the target NF unit within the trusted time window as the first data by determining the trusted time window under the specified time window indicated by the first data acquisition request, and uses the first data to generate a request result corresponding to the first data acquisition request, and feeds the request result back to the service consumer. Since the first data obtained is the data generated by the target NF unit within the trusted time window, compared with the data generated by the target NF unit within the specified time window, which may contain false data, the first data obtained by this solution is more accurate. Therefore, the request result corresponding to the first data acquisition request generated by using the first data contains a more accurate analysis result for the first data. It can be seen that through this solution, the accuracy of the statistical analysis results and the full use of the valid data of the abnormal NF unit can be taken into account.

[0112] Optionally, in another embodiment of the present invention, before using the first data in the above step S104 to generate a request result corresponding to the first data acquisition request, the method further includes:

[0113] Acquire data generated by the target NF unit within the specified time window as second data;

[0114] It can be understood that since the time window indicated by the first data acquisition request sent by the service consumer is a specified time window, the data generated by the target NF unit within the specified time window can be obtained as the second data, so that the analysis results corresponding to the second data can be fed back to the service consumer subsequently, allowing the service consumer to choose to use the analysis results corresponding to the first data or the analysis results corresponding to the second data.

[0115] Accordingly, in this embodiment, using the first data to generate a request result corresponding to the first data acquisition request may include steps A1-A3:

[0116] A1, using the first data, generating a first processing result corresponding to the first data;

[0117] A2, using the second data, generating a second processing result corresponding to the second data;

[0118] In this embodiment, the NWDAF unit performs statistical analysis on the first data generated within the trusted time window and the second data generated within the specified time window, respectively, to generate a first processing result corresponding to the first data and a second processing result corresponding to the second data.

[0119] A3, constructing result content including the first processing result and the second processing result as a request result corresponding to the first data acquisition request.

[0120] In this embodiment, by constructing result content including the first processing result and the second processing result, and feeding back the result content to the service consumer as the request result corresponding to the first data acquisition request, the service consumer can obtain the first processing result of the data within the specified time window corresponding to its request, and the second processing result of the data within the trusted time window under the specified time window corresponding to its request, so that the service consumer can use the first processing result or the second processing result by itself to perform subsequent decision analysis.

[0121] Optionally, in one implementation, the result content may also include:

[0122] A first credibility label associated with the first processing result, and a second credibility label associated with the second processing result; wherein the credibility represented by the first credibility label is higher than the credibility represented by the second credibility label.

[0123] In this implementation, the first processing result and the second processing result are respectively corresponding to a credibility label, which is used to characterize the credibility of the processing result. It can be understood that since the first processing result is an analysis result corresponding to the first data, and the first data is data within a credible time window, the first processing result corresponding to the first data can have a higher credibility.

[0124] Exemplarily, the method for determining the credibility label may be to pre-set multiple labels representing different credibility levels, corresponding to different trusted time percentages. For example: 5 levels of credibility labels may be set, corresponding to 100%, 80%, 60%, 40%, and 20% trusted time percentages, respectively. Since the trusted time percentage of the trusted time window is 100%, the first credibility label associated with the first processing result is a credibility label corresponding to 100%; if the duration of the trusted time window under the specified time window accounts for 20% of the total duration of the specified time window, the second credibility label associated with the second processing result is a credibility label corresponding to 20%. It should be noted that the method for determining the credibility label is only used as an example, and the embodiment of the present invention does not limit the method for determining the credibility label. For example, the method for determining the credibility label may also be to directly set the second credibility label to any value representing a credibility lower than the first credibility label.

[0125] It can be understood that by using the first credibility tag associated with the first processing result and the second credibility tag associated with the second processing result as the result content of the request result corresponding to the first data acquisition request, the service consumer can use the credibility tags corresponding to the first processing result and the second processing result as auxiliary information for subsequent decisions, thereby helping to improve the accuracy of subsequent decisions.

[0126] It can be seen that through this solution, the data generated by the target NF unit within the specified time window is obtained as the second data, and the second processing result corresponding to the second data is fed back to the service consumer, so that the service consumer can choose the first processing result corresponding to the first data or the second processing result corresponding to the second data for use, thereby increasing the choice space for the service consumer.

[0127] Alternatively, in another embodiment of the present invention, Figure 2 As shown, determining the trusted time window under the specified time window in the above step S102 may include steps S1021-S1022:

[0128] S1021, determining the abnormal time period corresponding to the target NF unit obtained from the network traffic analysis system;

[0129] In this embodiment, the network traffic analysis system is a network traffic analysis system deployed in the 5G core network, which supports providing the start and end time of abnormal events to the NWDAF unit in the form of event subscription.

[0130] Optionally, in one implementation, the method of obtaining the abnormal time period of the target NF unit from the network traffic analysis system may include steps B1-B2:

[0131] B1, initiating a second data acquisition request for querying the security status of the target NF unit to the network traffic analysis system, so that the network traffic analysis system determines the time period when the security status of the target NF unit is abnormal from the query time period indicated by the second data acquisition request, obtains the abnormal time period, and feeds back the abnormal time period; wherein the query time period includes the time period represented by the specified time window;

[0132] In this implementation, the NWDAF unit initiates a second data acquisition request for querying the security status of the target NF unit to the network traffic analysis system, so that the network traffic analysis system feeds back the abnormal time period of the target NF unit within the query time period. The query time period may be any time period that includes the specified time window. Exemplarily, the second data acquisition request may be a second data acquisition request for querying the security status of the target NF unit within the time period represented by the specified time window sent by the NWDAF unit after receiving the first data acquisition request sent by the service consumer, according to the specified time window indicated by the first data acquisition request. Exemplarily, the second data acquisition request may also be a second data acquisition request for querying the security status of the target NF unit within the query time period sent in advance by the NWDAF unit before receiving the first data acquisition request sent by the service consumer. It can be understood that since the query time period includes the time period represented by the specified time window, the NWDAF unit may determine the trusted time window within the specified time window, excluding the time within the abnormal time period, by using the abnormal time period within the query time period obtained in advance from the network traffic analysis system after receiving the first data acquisition request.

[0133] Exemplarily, in a specific implementation, the network traffic analysis system determines that the security status of the target NF unit is in an abnormal time period, which may include steps B11-B12:

[0134] B11, analyzing the network traffic data of the target NF unit within the query time period to obtain the start and end time of the abnormal event occurring in the target NF unit;

[0135] In this implementation, by analyzing whether an abnormal event occurs in the target NF unit, it is determined whether the security state of the target NF unit is in an abnormal time period. The network traffic analysis system can perform a retrospective query and analysis on the network traffic data of the target NF unit in the query time period. If the analysis finds that an abnormal event occurs in the target NF unit, the start and end time of the abnormal event can be located, thereby obtaining the start and end time corresponding to the abnormal event occurring in the target NF unit. Exemplarily, the abnormal event can be an abnormal event of parameter configuration error of the target NF unit, or a security event such as a botnet event or a vulnerability attack event.

[0136] B12: Determine the time period within the start and end time of the abnormal event occurring in the target NF unit as the time period in which the safety status of the target NF unit is abnormal.

[0137] It can be understood that, since the data generated by the target NF unit in the time period within the start and end time of the abnormal event is unreliable data, the time period can be determined as the time period when the security state of the target NF unit is abnormal.

[0138] B2, receiving the abnormal time period fed back by the network traffic analysis system.

[0139] After the network traffic analysis system feeds back the determined abnormal time period of the target NF unit, the NWDAF unit receives the abnormal time period fed back by the network traffic analysis system.

[0140] S1022: Eliminate the time period that intersects with the abnormal time period from the time period represented by the designated time window to obtain a credible time window under the designated time window.

[0141] It can be understood that since the data generated by the target NF unit during the abnormal time period is unreliable data, in order to obtain a trusted time window under the specified time window, the time in the specified time window that intersects with the abnormal time period can be eliminated, and the remaining time period is the time period corresponding to the trusted time window.

[0142] It can be seen that through this solution, the network traffic analysis system is used to determine the abnormal time period corresponding to the target NF unit, so that the NWDAF unit can obtain the start and end time of the abnormal event of the target NF unit through event subscription, and thus the start and end time of the abnormal event can be used to quickly and accurately determine the trusted time window of the target NF unit.

[0143] Alternatively, in another embodiment of the present invention, Figure 3 As shown, the acquisition of data generated by the target NF unit within the trusted time window in the above step S103 may include steps S1031-S1032:

[0144] S1031, determining whether the data generated by the target NF unit within the trusted time window is historical data;

[0145] In this embodiment, when obtaining the data generated by the target NF unit within the trusted time window, it is possible to first determine whether the data generated by the target NF unit within the trusted time window is historical data. Exemplarily, the method for determining whether the data generated within the trusted time window is historical data may be to determine whether the trusted time window is a time window earlier than the current time, and if so, the data generated within the trusted time window is determined as historical data. For example, if the current time is 12:00 on March 8, 2020, and if the time period represented by the trusted time window is from 9:00 to 16:00 on March 5, 2020, the data generated within the trusted time window may be determined as historical data; if the time period represented by the trusted time window is from 9:00 to 16:00 on March 10, 2020, the data generated within the trusted time window is not historical data.

[0146] Exemplarily, the method for determining whether the data generated in the trusted time window is historical data may also be to determine whether the trusted time window is earlier than the start time of the cache period according to the cache period of the data in the target NF unit, and if so, determine the data generated in the trusted time window as historical data. For example, if the cache period of the memory occupancy rate in the target NF unit is 7 days, if the time period represented by the trusted time window is a time period from 12 days before the current time to 8 days before the current time, the memory occupancy rate generated in the trusted time window is historical data.

[0147] S1032: If yes, obtain the data generated by the target NF unit within the trusted time window from the data storage library; otherwise, obtain the data generated by the target NF unit within the trusted time window from the target NF unit.

[0148] In this embodiment, the data repository can store data in the target NF unit that exceeds the cache period. In addition, the data repository supports the data retrieval and cleanup request of the NWDAF unit for the trusted time window. It can be understood that if the data generated by the target NF unit in the trusted time window is historical data, the data generated in the trusted time window can be obtained from the data repository according to the index of the data, otherwise the data generated in the trusted time window can be directly obtained from the target NF unit.

[0149] Optionally, in one implementation, the method further includes: according to the abnormal time period corresponding to the target NF unit, clearing the data stored in the data storage repository and belonging to the abnormal time period.

[0150] In this implementation, after determining the abnormal time period corresponding to the target NF unit, the NWDAF unit can perform targeted cleaning of the historical data stored in the data repository according to the abnormal time period, that is, clean up the data stored in the data repository that belongs to the abnormal time period to ensure that when the NWDAF unit obtains historical data from the data repository, it obtains reliable historical data, thereby ensuring the accuracy of subsequent analysis results.

[0151] It can be seen that through this solution, by judging whether the data generated in the trusted time window is historical data, the data can be obtained from the address where the data generated in the trusted time window is stored. In addition, by using the abnormal time period corresponding to the target NF unit, the untrusted data in the data storage library can be cleaned up to ensure that the NWDAF unit can obtain credible historical data from the data storage library.

[0152] In order to better understand the content of the embodiments of the present invention, Figure 4-Figure 6 Specific examples of embodiments of the present invention are introduced.

[0153] Figure 4 A schematic diagram of a data collection and processing system for an abnormal NF unit provided by an embodiment of the present invention is shown. Figure 4 As shown, the system is mainly composed of NWDAF unit 430, ADRF unit 420, NF unit 410, NEF (Network Exposure Function) unit 440 deployed in the 5G core network, and NTA (Network Traffic Analysis) system 450 covering the core network, that is, AF (Application Function) unit 450. The system also includes AMF unit 460, SMF unit 470, UE (User Equipment) unit 401, RAN (Radio Access Network) unit 402, UPF (User Plane Function) unit 403 and DN (Data Network) unit 404. The units communicate with each other using the standard interface defined by 3GPP. In this system:

[0154] The NWDAF unit 430 initiates a subscription / query for the abnormal time period of the target NF unit 410 to the AF unit 450 (corresponding to the second data acquisition request in the above text); the NWDAF unit 430 accepts the first data acquisition request of the service consumer, determines the data collection type (corresponding to the specified data in the above text) and the target NF unit 410, revises the time window for data collection according to the trusted time window, and feeds back the analysis and processing results of the data corresponding to the specified time window and the trusted time window with different credibility.

[0155] The AF unit 450 includes a data collection and analysis module, a historical traffic retention module, a data backtracking analysis module, a time positioning module, an event subscription / publishing module, and a request response module, wherein:

[0156] a) Data collection and analysis module: It has the ability to collect original traffic and analyze protocols on the signaling plane, user plane, and management plane within the 5G core network.

[0157] b) Historical traffic retention module: It has the ability to store and retrieve all the collected original traffic and the metadata generated after analysis.

[0158] c) Data backtracking analysis module: It can perform backtracking query and analysis on the stored original traffic and metadata data, and can identify security events and abnormal behaviors involving NF units.

[0159] d) Time positioning module: Based on the data backtracking analysis and historical traffic retention module, locate the start and end time of security events / abnormal events and provide feedback to the request response module.

[0160] e) Event subscription / publishing module: It provides the abnormal event subscription service of NF unit to the outside world. The network function (such as NWDAF) unit can subscribe to the abnormal events of the specified NF unit through this module, and the AF unit can publish the event related information through this module. Among them, the event related information may include the event type, the ID of the NF unit and the time when the event occurred. The event related information can be stored in the event subscription / publishing module in the form of a list. For example, the list of event related information stores the following data: the NF unit with ID SMF_01 has a configuration abnormality event, and the time of occurrence is T0; the NF unit with ID UPF_02 has a NF unit intrusion event, and the time of occurrence is T1-T2 time period; the NF unit with ID AMF_01 has a call intrusion event, and the time of occurrence is T3.

[0161] f) Request response module: Receives event parameters passed by the event subscription / publishing module, obtains event-related information through data backtracking analysis and time positioning module, and provides feedback.

[0162] The AF unit 450 receives the query request of the NWDAF unit 430 (corresponding to the second data acquisition request above), and uses its full data message storage and historical data backtracking analysis capabilities. If the target NF unit 410 has abnormal behavior, it can accurately locate the "loss" time of the target NF unit 410 through historical traffic correlation.

[0163] In addition, the ADRF (Analytics Data Repository Function) unit 420 (corresponding to the data repository mentioned above) can receive the data retrieval and cleanup request for the trusted time window from the NWDAF unit 430.

[0164] Figure 5 A flowchart of a specific example of implementing an embodiment of the present invention is shown, including steps S501-S505:

[0165] S501, NWDAF unit passed Figure 4 The NEF (Network Exposure Function) unit 440 shown in the figure initiates an abnormal event subscription for the target NF unit to the AF unit (corresponding to the second data acquisition request mentioned above). The AF unit uses the historical communication traffic through the retrospective analysis capability to obtain the abnormal / failure time of the detected target NF unit, obtains the abnormal time period and feeds back.

[0166] S502, the NWDAF unit receives a first subscription request (corresponding to the first data acquisition request mentioned above) from a service consumer, determines a target NF unit according to an ID indicated by the first subscription request, and determines a specified time window indicated by the first subscription request;

[0167] S503, the NWDAF unit determines a trusted time window according to the abnormal time period of the target NF unit fed back by the AF unit and the designated time window indicated by the first subscription request, and collects data of the designated time window and the trusted time window for the target NF unit;

[0168] S504, if the first subscription request sent by the service consumer involves historical data, the NWDAF unit obtains historical data of a specified time window and a trusted time window from the ADRF unit;

[0169] S505, the NWDAF unit performs data analysis, and may analyze the data collected in the specified time window and the trusted time window, and return analysis results of different credibility to the service consumer according to the subscription request.

[0170] Figure 6A timing diagram of data collection and processing for abnormal NF units according to an embodiment of the present invention is shown, including the following steps:

[0171] 1. The ADRF unit has stored historical data for a certain period of time.

[0172] According to the description in the 3GPP TS 23.288 protocol, ADRF exposes the Nadrf service, allowing other 5G core network NF units to use the service for data storage and retrieval. The metadata of the data stored by the ADRF unit includes at least the instance ID of the NF unit and the timestamp of data collection. For example, AMF_01 is an ID that can uniquely identify a specific access and mobility management network function unit, and a series of data involving the AMF unit (such as resource utilization and load of the AMF unit) is collected and stored, and its timestamp is 202001011530 (15:30 on January 1, 2020), 202001101100, 202001200800, etc.

[0173] 2. The NWDAF unit initiates an abnormal event subscription to the AF unit, and the AF unit feeds back relevant information to the NWDAF unit based on the relevant input parameters of the subscription.

[0174] In this example, a service named AbnormalEvent is defined, and the NWDAF unit initiates an abnormal event subscription to the AF unit through the field with the service name AbnormalEvent_Subscribe (corresponding to the second data acquisition request above). Among them, the parameters contained in AbnormalEvent_Subscribe should at least include the subscription ID, and the NF unit ID and the specific time can be used as optional parameters. For example, the subscription ID is Abnormal Event, the network function ID is NF1_ID, the time is 202003101200, and the other network function ID is NF2_ID, and the time is 202001151200.

[0175] The AF unit receives the data acquisition request and performs retrospective query and analysis on the traffic containing NF1_ID and NF2_ID through the data backtracking analysis module and the historical traffic retention module. If the detection and analysis finds that a security incident has occurred in NF1 and NF2, the start and end time of the security incident / abnormal event is located through the time positioning module, and the event type and abnormal time period obtained from the analysis are fed back to the event subscription / publishing module through the request response module.

[0176] The event subscription / publishing module returns the data acquisition request information to the NWDAF unit through the field with the service name AbnormalEvent_Notify, which may include the event type, network function ID, and the start and end time of the abnormal event. The NWDAF unit receives and saves the data acquisition request information returned by the AF unit.

[0177] 3. The NWDAF unit receives the first subscription request from the service consumer.

[0178] In this embodiment, the service name provided by the service consumer through the NWDAF unit is

[0179] The Nnwdaf_AnalyticsSubscription_Subscribe field is used to subscribe to data analysis. According to the description in the 3GPP TS 23.288 protocol, at least the subscription parameters provided include Analytics ID, which may include the ID of the NF unit to be analyzed, and the specified time window to be analyzed. For example, the IDs of the NF units to be analyzed are NF1_ID and NF2_ID, the specified time window to be analyzed for NF1 is 202003051200-202003101200, and the specified time window to be analyzed for NF2 is 202001011200-202001101200.

[0180] 4. The NWDAF unit determines the target NF unit according to the subscription parameters contained in the first subscription request of the service consumer, modifies the relevant parameters, and collects data from the target NF unit.

[0181] In this example, if the current time is 9:00 on March 5, 2020, the data collection for NF1 is performed by the NWDAF unit to the target NF unit, i.e., NF1, through standard open services. The data collected for NF2 is determined to be historical data by the NWDAF unit, and the NWDAF unit initiates a request to the ADRF unit to collect data from NF2 through standard open services.

[0182] The NWDAF unit determines the trusted time window of NF1 based on the saved start and end time of the abnormal event of NF1. Assuming that the trusted time window of NF1 is 202003081600 (that is, the trusted time of NF1 is on or before 16:00 on March 8, 2020), the trusted time window under the specified time window of NF1 is determined to be 202003051200-202003081600.

[0183] Furthermore, the NWDAF unit can also collect data of NF1 in two time windows at the same time, namely, the specified time window 202003051200-202003101200 requested by the service consumer, and the modified trusted time window 202003051200-202003081600, to collect data of NF1. NF1 receives the data collection request sent by the NWDAF unit and sends the relevant data within the specified time range to the NWDAF unit. According to the above description, data within the range of 202003051200-202003101200 and data within the range of 202003051200-202003081600 will be returned.

[0184] 5. The NWDAF unit sends a data retrieval request to the ADRF unit.

[0185] In this example, the service operation name defined by the NWDAF unit through the standard is

[0186] The field of Nadrf_DataManagement_RetrievalRequest (data management retrieval) requests the data of the specified NF unit from the ADRF unit. The NWDAF unit determines the trusted time window of NF2 based on the start and end time of the abnormal event of NF2 that is saved. Assuming that the trusted time window of NF2 is from 202001051000 to 202001081800 (that is, the trusted time of NF2 is from 10:00 on January 5, 2020 to 18:00 on January 8, 2020), the trusted time window under the specified time window of NF2 is determined to be 202001051000-202001081800, and the NWDAF unit can collect the data of NF2 in this trusted time window from the ADRF unit.

[0187] Furthermore, the NWDAF unit can also collect NF2 data from the ADRF unit in two time windows at the same time, namely, the time window 202001011200-202001101200 specified by the service consumer and the modified trusted time window 202001051000-202001081800, to collect NF2 data from the ADRF unit.

[0188] The ADRF unit receives the data retrieval request sent by the NWDAF unit and sends the relevant data within the specified time range to the NWDAF unit. According to the above description, the data within the range of 202001011200-202001101200 and the data within the range of 202001051000-202001081800 will be returned through the field of the standard defined service operation named Nadrf_DataManagement_RetrievalNotify (data management notification).

[0189] 6. The NWDAF unit uses the collected data to perform data analysis and returns analysis results with different levels of credibility to the service consumer based on the subscription requirements for the specified time window and the trusted time window.

[0190] In this example, the NWDAF unit will use the standard defined service operation name

[0191] The field of Nnwdaf_AnalyticsSubscription_Notify returns the analysis result corresponding to the Analytics ID to the service consumer.

[0192] Furthermore, the NWDAF unit can analyze the data of the specified time window requested by the service consumer and the trusted time window respectively, and give different credibility (corresponding to the credibility label above). For example, the credibility of the analysis result of the specified time window 202003051200-202003101200 for NF1 is Confidence1 (first credibility), the credibility of the analysis result of the trusted time window 202003051200-202003081600 is Confidence2 (second credibility), the credibility of the analysis result of the specified time window 202001011200-202001101200 for NF2 is Confidence3 (third credibility), and the credibility of the analysis result of the trusted time window 202001051000-202001081800 is Confidence4 (fourth credibility).

[0193] 7. The NWDAF unit can perform targeted cleaning of historical data stored in the ADRF unit to ensure the accuracy of the NWDAF unit's use of historical data and the accuracy of historical data analysis results.

[0194] In this example, the service operation name defined by the NWDAF unit through the standard is

[0195] The Nadrf_DataManagement_Delete (data management deletion) field initiates a data deletion request to the ADRF unit, specifying that the deleted data is untrusted data of NF2, that is, data outside the range of 202001051000 to 202001081800.

[0196] The ADRF unit receives the data deletion request sent by the NWDAF unit, retrieves the saved data about NF2, and deletes the data before 202001051000 (i.e. 10:00 on January 5, 2020) and the data after 202001081800 (i.e. 18:00 on January 8, 2020). At the same time, the ADRF unit can also delete the historical data analysis results of NF2 that contain untrusted time ranges. After the data deletion is completed, the ADRF unit responds to the deletion operation through the standard defined service operation name Nadrf_DataManagement_Delete.

[0197] It can be seen that through this solution, combined with the network traffic analysis system deployed in the core network, using its retrospective analysis capabilities, the time of occurrence of abnormal behaviors and security incidents can be more accurately located. For zero-day vulnerabilities, some important attack behavior information that was previously missed by the system can be detected through historical traffic, ensuring the accuracy of data collected by the NWDAF unit. Compared with the coarse-grained blacklist identification processing method in the relevant technology, this solution fully utilizes the valid data of abnormal NF units through a trusted time window mechanism, and realizes the cleaning of dirty data in historical collection / storage data. In addition, this solution improves the technical solution for data collection of NWDAF units facing abnormal NF units in the standard, further ensuring the accuracy of the analysis, and at the same time, compared with the introduction of additional data purification modules, it reduces the impact on system performance caused by the introduction of additional security mechanisms.

[0198] Corresponding to the above method embodiment, the present invention also provides a data processing device, such as Figure 7 As shown, the device comprises:

[0199] A first determination module 710 is configured to determine a target network function NF unit and a specified time window indicated by a first data acquisition request sent by a service consumer in response to receiving the first data acquisition request;

[0200] A second determining module 720 is configured to determine a trusted time window under the specified time window; wherein the trusted time window is a time window within the specified time window except for the time within an abnormal time period, and the abnormal time period is a time period when the security status of the target NF unit is abnormal;

[0201] An acquisition module 730 is used to acquire data of a specified type generated by the target NF unit within the trusted time window as first data;

[0202] The generating module 740 is used to generate a request result corresponding to the first data acquisition request by using the first data, and feed back the request result to the service consumer.

[0203] Optionally, the using the first data to generate a request result corresponding to the first data acquisition request includes:

[0204] Using the first data, a processing result corresponding to the first data is generated as a request result corresponding to the first data acquisition request.

[0205] Optionally, before using the first data to generate a request result corresponding to the first data acquisition request, the method further includes:

[0206] Acquire data of a specified type generated by the target NF unit within the specified time window as second data;

[0207] The using the first data to generate a request result corresponding to the first data acquisition request includes:

[0208] Using the first data, generating a first processing result corresponding to the first data;

[0209] generating a second processing result corresponding to the second data by using the second data;

[0210] A result content including the first processing result and the second processing result is constructed as a request result corresponding to the first data acquisition request.

[0211] Optionally, the result content also includes:

[0212] A first credibility label associated with the first processing result, and a second credibility label associated with the second processing result; wherein the credibility represented by the first credibility label is higher than the credibility represented by the second credibility label.

[0213] Optionally, the second determining module is specifically configured to:

[0214] Determine the abnormal time period corresponding to the target NF unit obtained from the network traffic analysis system;

[0215] From the time period represented by the designated time window, the time period intersecting with the abnormal time period is eliminated to obtain a credible time window under the designated time window.

[0216] Optionally, the method of obtaining the abnormal time period of the target NF unit from the network traffic analysis system includes:

[0217] Initiating a second data acquisition request for querying the security status of the target NF unit to the network traffic analysis system, so that the network traffic analysis system determines the time period in which the security status of the target NF unit is abnormal from the query time period indicated by the second data acquisition request, obtains the abnormal time period, and feeds back the abnormal time period; wherein the query time period includes the time period represented by the specified time window;

[0218] Receive the abnormal time period fed back by the network traffic analysis system.

[0219] Optionally, the network traffic analysis system determines that the security status of the target NF unit is in an abnormal time period, including:

[0220] Analyze the network traffic data of the target NF unit within the query time period to obtain the start and end time of the abnormal event occurring in the target NF unit;

[0221] A time period within the start and end time of the abnormal event occurring in the target NF unit is determined as a time period in which the safety state of the target NF unit is abnormal.

[0222] Optionally, the obtaining of the specified type of data generated by the target NF unit within the trusted time window includes:

[0223] Determine whether the specified type of data generated by the target NF unit within the trusted time window is historical data;

[0224] If so, obtain the specified type of data generated by the target NF unit within the trusted time window from the data storage repository; otherwise, obtain the specified type of data generated by the target NF unit within the trusted time window from the target NF unit.

[0225] Optionally, the device further comprises:

[0226] The cleaning module is used to clean up the data stored in the data storage repository and belonging to the abnormal time period according to the abnormal time period corresponding to the target NF unit.

[0227] The embodiment of the present invention further provides an electronic device, such as Figure 8 As shown, it includes a processor 801, a communication interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communication interface 802, and the memory 803 communicate with each other through the communication bus 804.

[0228] Memory 803, used for storing computer programs;

[0229] The processor 801 is used to implement the steps of the data processing method described in any of the above embodiments when executing the program stored in the memory 803.

[0230] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0231] The communication interface is used for communication between the above electronic device and other devices.

[0232] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0233] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0234] In another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of the data processing method described in any of the above embodiments are implemented.

[0235] In another embodiment of the present invention, a computer program product including instructions is provided, which, when executed on a computer, enables the computer to execute the steps of the data processing method described in any one of the above embodiments.

[0236] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0237] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0238] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0239] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A data processing method, characterized in that: Applied to a network data analysis function NWDAF unit, the method comprises: In response to receiving a first data acquisition request sent by a service consumer, determining a target network function NF unit and a specified time window indicated by the first data acquisition request; Determine a trusted time window under the specified time window; wherein the trusted time window is a time window within the specified time window except for the time within the abnormal time period, and the abnormal time period is a time period when the security state of the target NF unit is abnormal; Acquire data generated by the target NF unit within the trusted time window as first data; Using the first data, generating a request result corresponding to the first data acquisition request, and feeding back the request result to the service consumer; The target NF unit has information indicating a security state, the information indicating a security state includes a first identifier indicating that the security state is normal, and determining the trusted time window under the specified time window includes: sending a request for obtaining the information indicating the security state to the target NF unit, and after receiving the information indicating the security state of the target NF unit, determining the time window within the time period corresponding to the first identifier as the trusted time window under the specified time window; Before using the first data to generate a request result corresponding to the first data acquisition request, it also includes: acquiring the data generated by the target NF unit within the specified time window as the second data; using the first data to generate a request result corresponding to the first data acquisition request, including: using the first data to generate a first processing result corresponding to the first data; using the second data to generate a second processing result corresponding to the second data; constructing a result content including the first processing result and the second processing result as the request result corresponding to the first data acquisition request.

2. The method according to claim 1, characterized in that The using the first data to generate a request result corresponding to the first data acquisition request includes: Using the first data, a processing result corresponding to the first data is generated as a request result corresponding to the first data acquisition request.

3. The method according to claim 1, characterized in that The results also include: A first credibility label associated with the first processing result, and a second credibility label associated with the second processing result; wherein the credibility represented by the first credibility label is higher than the credibility represented by the second credibility label.

4. The method according to any one of claims 1 to 3, characterized in that: The determining of a credible time window under the specified time window includes: Determine the abnormal time period corresponding to the target NF unit obtained from the network traffic analysis system; From the time period represented by the designated time window, the time period intersecting with the abnormal time period is eliminated to obtain a credible time window under the designated time window.

5. The method according to claim 4, characterized in that The method of obtaining the abnormal time period of the target NF unit from the network traffic analysis system includes: Initiating a second data acquisition request for querying the security status of the target NF unit to the network traffic analysis system, so that the network traffic analysis system determines the time period in which the security status of the target NF unit is abnormal from the query time period indicated by the second data acquisition request, obtains the abnormal time period, and feeds back the abnormal time period; wherein the query time period includes the time period represented by the specified time window; Receive the abnormal time period fed back by the network traffic analysis system.

6. The method according to claim 5, characterized in that The network traffic analysis system determines that the security status of the target NF unit is in an abnormal time period, including: Analyze the network traffic data of the target NF unit within the query time period to obtain the start and end time of the abnormal event occurring in the target NF unit; A time period within the start and end time of the abnormal event occurring in the target NF unit is determined as a time period in which the safety state of the target NF unit is abnormal.

7. The method according to claim 4, characterized in that The acquiring the data generated by the target NF unit within the trusted time window includes: Determine whether the data generated by the target NF unit within the trusted time window is historical data; If so, the data generated by the target NF unit within the trusted time window is obtained from the data storage repository; otherwise, the data generated by the target NF unit within the trusted time window is obtained from the target NF unit.

8. The method according to claim 7, characterized in that The method further comprises: According to the abnormal time period corresponding to the target NF unit, the data stored in the data storage repository and belonging to the abnormal time period is cleared.

9. A data processing device, characterized in that: Applied to a network data analysis function NWDAF unit, the device comprises: A first determination module is configured to determine, in response to receiving a first data acquisition request sent by a service consumer, a target network function NF unit and a specified time window indicated by the first data acquisition request; A second determining module is used to determine a trusted time window under the specified time window; wherein the trusted time window is a time window within the specified time window except for the time within the abnormal time period, and the abnormal time period is a time period when the security state of the target NF unit is abnormal; an acquisition module, configured to acquire data generated by the target NF unit within the trusted time window as first data; A generating module, configured to generate a request result corresponding to the first data acquisition request by using the first data, and feed the request result back to the service consumer; The target NF unit has information indicating a security state, and the information indicating a security state includes a first identifier indicating that the security state is normal. The second determining module is further configured to send a request for obtaining the information indicating a security state to the target NF unit, and after receiving the information indicating a security state of the target NF unit, determine a time window within a time period corresponding to the first identifier as a trusted time window under the designated time window; The acquisition module is also used to acquire the specified type of data generated by the target NF unit within the specified time window as the second data; the generation module is also used to use the first data to generate a first processing result corresponding to the first data; use the second data to generate a second processing result corresponding to the second data; and construct a result content including the first processing result and the second processing result as a request result corresponding to the first data acquisition request.

10. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the steps of the method according to any one of claims 1 to 8 when executing a program stored in a memory.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images