5G network element call sequence restoration method and device, and electronic equipment

Abstract

The present application discloses a 5G network element call sequence restoration method and device, and electronic device, the method comprising: filtering out data packets generated by services associated with target user equipment from historical data packets of core network traffic, and obtaining at least one communication information set based on the data packets, wherein the communication information included in the same communication information set is the communication information in the data packets generated by the same service, and the communication information included in the communication information set is sorted according to the time of calling the network element; traversing the communication information in any one of the communication information sets, and obtaining the network element call sequence according to the traversal result. This solves the problem that the call sequence of the network element cannot be restored in the 5G core network.

Description

Background Art

[0002] The 5G (5th Generation Mobile Communication Technology) core network adopts SBA (Service-based Architecture), which draws on the "microservice" concept in the computer field and splits the original multi-functional whole into multiple individuals with independent functions, making the core network more flexible and open. Similar to the microservice scenario, network elements communicate through API (Application Program Interface). During the communication between network elements, east-west traffic will be generated and there will be a call sequence. The call sequence is an important feature of the core network element service. Adding the network element call sequence as a dimension to the detection prototype can not only detect attack methods such as lateral movement, but also effectively locate the IP address that initiates the attack.

[0003] Under high-concurrency business processes, the number of network elements is fixed. The number of network elements and the order of network element calls completed by different target user devices to complete different business calls are different. If the network element call sequences of all target user devices to complete different services in the 5G core network are obtained in advance, the 5G core network can be security checked. When a network element call sequence that differs from historical services appears, it can be determined that an abnormality has occurred. However, at present, the call sequence between network elements cannot be restored in the 5G core network. Summary of the invention

[0004] The present application provides a 5G network element call sequence restoration method and device, and electronic device, which are used to determine the network element call sequence when each target user equipment in the 5G core network completes different services.

[0005] In a first aspect, an embodiment of the present application provides a 5G network element call sequence restoration method, the method comprising:

[0006] Filtering data packets generated by a service associated with a target user equipment from historical data packets of core network traffic, and obtaining at least one communication information set based on the data packets, wherein the communication information included in the same communication information set is the communication information in the data packets generated by the same service, and the communication information included in the communication information set is sorted according to the time of calling the network element;

[0007] Traversing the communication information in any one of the communication information sets, and obtaining a network element calling sequence according to the traversal result;

[0008] Each time a communication message is traversed, the following process is performed:

[0009] If the currently traversed first communication information is different from the last second communication information in any one of the communication information sets, determining the types of the first communication information and the second communication information;

[0010] A network element calling sequence to which the second communication information belongs is determined according to the type of the first communication information and the type of the second communication information.

[0011] The embodiment of the present application determines the communication information belonging to the same network element calling sequence according to the type of communication information in the 5G core network and the calling time sequence between the network elements in the communication information, so as to restore the sequence of network elements called by the service corresponding to the target user equipment in the 5G core network.

[0012] As an optional implementation manner, the target user equipment is determined by the following method, including:

[0013] Determine device identity from core network traffic;

[0014] The user equipment corresponding to the device identification conforming to the preset identification format rule is taken as the target user equipment.

[0015] The target user equipment that meets the identification format in the core network traffic is screened out in accordance with the preset identification format rules, thereby improving the efficiency of network element call sequence restoration and avoiding invalid restoration.

[0016] As an optional implementation manner, whether the currently traversed first communication information is the same as the previous second communication information in any one of the communication information sets is determined in the following manner:

[0017] If the information items of the first communication information and the second communication information are not completely identical except for the communication time, it is determined that the first communication information is different from the second communication information;

[0018] The information item is pre-recorded information used to represent different attributes of the communication information.

[0019] Before restoring the network element call sequence, duplicate information is pre-screened to avoid redundant errors in the restored network element call sequence.

[0020] As an optional implementation manner, determining the type of the first communication information and the second communication information includes:

[0021] When a request mode exists in the information item of the first communication information, determining that the type of the first communication information is a request;

[0022] When a request mode exists in the information item of the second communication information, determining that the type of the second communication information is a request;

[0023] When a response code exists in the information item of the first communication information, determining that the type of the first communication information is a response;

[0024] When a response code exists in the information item of the second communication information, it is determined that the type of the second communication information is a response.

[0025] As an optional implementation manner, determining, according to the type of the first communication information and the type of the second communication information, a network element calling sequence to which the second communication information belongs includes:

[0026] If the type of the first communication information is a request, and the type of the second communication information is a request, storing the first communication information in a stack;

[0027] If the type of the first communication information is a response, and the type of the second communication information is a request, popping the communication information at the top of the stack and adding it to the preset storage character;

[0028] If the type of the first communication information is a request, and the type of the second communication information is a response, the first communication information is stored in a stack, and all the communication information in the storage character is obtained, and the obtained communication information is combined into a call sequence in reverse order according to the time sequence of adding to the storage character;

[0029] If the type of the first communication information is a response, and the type of the second communication information is a response, the communication information at the top of the stack is popped out and added to the preset storage character.

[0030] As an optional implementation, the method further includes:

[0031] For any communication information set, after traversing the communication information set, if the storage character is not empty, the communication information in the preset storage character is combined into a calling sequence in reverse order according to the time sequence of adding the storage character.

[0032] As an optional implementation, the method further includes:

[0033] If the first communication information currently traversed is the first communication information in the communication information set, the first communication information is defined as the first communication information, and when the first communication information is different from the next communication information in any one of the communication information sets, the first communication information is stored in the stack.

[0034] As an optional implementation, the method further includes:

[0035] If the first communication information is the same as the second communication information, the second communication information is deleted.

[0036] In a second aspect, an embodiment of the present application provides a 5G network element call sequence restoration device, the device comprising:

[0037] A screening module, used to screen out data packets generated by a service associated with a target user equipment from historical data packets of core network traffic, and obtain at least one communication information set based on the data packets, wherein the communication information included in the same communication information set is the communication information in the data packets generated by the same service, and the communication information included in the communication information set is sorted according to the time of calling the network element;

[0038] A traversal restoration module, used to traverse the communication information in any one of the communication information sets, and obtain a network element calling sequence according to the traversal result;

[0039] The traversal restoration module is specifically used for:

[0040] If the currently traversed first communication information is different from the last second communication information in any one of the communication information sets, determining the types of the first communication information and the second communication information;

[0041] A network element calling sequence to which the second communication information belongs is determined according to the type of the first communication information and the type of the second communication information.

[0042] In a third aspect, an embodiment of the present application provides an electronic device, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for 5G network element call sequence restoration provided in the first aspect above.

[0043] In a fourth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the method for restoring a 5G network element call sequence provided in the first aspect.

[0044] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 A schematic diagram of a process of restoring a 5G network element calling sequence according to an embodiment of the present application;

[0047] Figure 2 A first process diagram for restoring a 5G network element calling sequence according to an embodiment of the present application;

[0048] Figure 3 A second process diagram for restoring a 5G network element calling sequence according to an embodiment of the present application;

[0049] Figure 4 A third process diagram for restoring a 5G network element calling sequence according to an embodiment of the present application;

[0050] Figure 5 This is a schematic diagram of the overall process of a 5G network element call sequence restoration method according to an embodiment of the present application;

[0051] Figure 6 A schematic diagram of the structure of a 5G network element call sequence restoration device according to an embodiment of the present application;

[0052] Figure 7 The figure is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0054] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application. The method can be executed in the order of the method shown in the embodiment or drawings or in parallel during the actual processing process or when the control device is executed.

[0055] In view of the problem that the calling sequence of network elements cannot be restored in the related technologies. This application proposes a 5G network element calling sequence restoration method, device, and electronic device, which can restore the calling sequence of network elements according to the characteristics of the network element calling sequence in the core network traffic in the 5G core network, and discloses a network element calling sequence restoration method, which uses the core network traffic data to restore the calling sequence of the network element without the need for distributed tracking tools and will not occupy core network resources.

[0056] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings.

[0057] The 5G network element call sequence restoration method in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0058] Figure 1 A schematic diagram of a 5G network element call sequence restoration method provided by an embodiment of the present application is shown, including:

[0059] Step 101: Filter out data packets generated by a service associated with a target user device from historical data packets of core network traffic, and obtain at least one communication information set based on the data packets, wherein the communication information included in the same communication information set is the communication information in data packets generated by the same service, and the communication information included in the communication information set is sorted according to the time of calling the network element.

[0060] In the 5G core network, multiple service processes are carried out concurrently, and each service corresponds to a call sequence of multiple network elements. First, it is necessary to determine the data packets generated by each service associated with each target user device from the historical data packets of the core network traffic, and complete the separation of high-concurrency services by parsing the data packets to achieve the restoration of the network element call sequence. For example, when a PDU (Professional Development Units) session establishment service occurs, it will generate information including the timestamp, IP address, port information, request method, request path, request parameters, etc. when the AMF (Access and Mobility Management Function) network element initiates a request to the SMF (Session Management Function), as well as the timestamp, response code, IP address, port information, response parameters, etc. when the SMF initiates a response to the AMF.

[0061] Since the number of network elements in the core network is specific, there are several user devices in the core network, each user device is connected to a different network element in the core network, and each user device completes different service calls in a different order of calling the network elements connected to itself. In this application, the request or response process from one network element to another network element is defined as a communication information in a communication information set.

[0062] The target user equipment refers to that since there are multiple user equipments in the core network traffic, some user equipments do not meet the preset rules corresponding to the target user equipments. Therefore, it is necessary to first screen out the target user equipments in the core network traffic and subsequently parse the data packets corresponding to the target user equipments.

[0063] The communication information included in the data packet generated by the same target user equipment when completing a service constitutes a communication information set, which includes multiple pieces of communication information, and each piece of communication information is sorted in the communication information set according to the time of occurrence. For example, the network element call sequence for the target user equipment A to complete service A is network element 1-network element 2-network element 3, and the time order of the call sequence is: network element 1 sends a request to network element 2, which is defined as communication information one, network element 2 sends a request to network element 3, which is defined as communication information two, network element 3 sends a response to network element 2, which is defined as communication information three, and network element 2 sends a response to network element 1, which is defined as communication information four. In the data packet generated by the target user equipment A when completing service A, the communication information in the communication information set is sorted as: communication information one, communication information two, communication information three, and communication information four.

[0064] The following describes an implementation method of determining the target user equipment disclosed in this application:

[0065] Determine the device identification from the core network traffic; and use the user equipment corresponding to the device identification that complies with the preset identification format rule as the target user equipment.

[0066] In order to solve the problem of data packet ownership under high-concurrency business processes, it is necessary to extract user information about the target user device from the core network traffic. The user information here mainly refers to the device identification of the target user device in the core network. According to the field characteristics of the 5G user device identification, the device identification can be extracted using the positive matching method.

[0067] The 3GPP standard has established format specifications for 5G user identity, including:

[0068] <supi> ＝ <mcc> + <mnc> + <msin>

[0069] <suci>=<SUCI Type>+<Home Network ID>+<Routing Indicator>+ <protectionscheme>+<Home Network Public Key ID> +<Protection Scheme Output>

[0070] <5G-GUTI>=<PLMN ID> +<AMF ID> +<5G TMSI>

[0071] According to the preset identification format rules of the 5G device identifier and some known fields therein, the user device corresponding to the device identifier that meets the preset identification format rules in the core network traffic is selected as the target user device.

[0072] For example, the preset target user equipment identification format rule is that the first three digits are numbers, the fourth digit is a character, and the last four digits are text. Assuming that there is user equipment A in the core network traffic, with an IP identification of 0.0.0.0; user equipment B, with an IP identification of 0.0.0.1; then user equipment B is screened out in the core network traffic as the target user equipment.

[0073] Step 102: Traverse the communication information in any one of the communication information sets.

[0074] For a communication information set corresponding to any service corresponding to any target user equipment, each piece of communication information in the communication information set is traversed, and during the traversal process, the network element calling sequence is restored.

[0075] As an optional implementation manner, when a request mode exists in the information item of the first communication information, determining that the type of the first communication information is a request;

[0076] When a request mode exists in the information item of the second communication information, determining that the type of the second communication information is a request;

[0077] When a response code exists in the information item of the first communication information, determining that the type of the first communication information is a response;

[0078] When a response code exists in the information item of the second communication information, it is determined that the type of the second communication information is a response.

[0079] Specifically, before restoring the call sequence, the communication type is pre-marked for each communication information in the communication set. The marking standard is that the data with a request method but no response code is marked as a request, and the data with a response code but no request method is marked as a response. For example: the communication type marked on the first communication information is: request method GET; the communication type marked on the second communication information is: response code 201; that is, the communication type of the first communication information is a request, and the communication type of the second communication information is a response.

[0080] Each time a communication message is traversed, the following process is performed:

[0081] Each time a communication information is traversed, the following is performed: if the currently traversed first communication information is different from the last second communication information in any one of the communication information sets, then the types of the first communication information and the second communication information are determined.

[0082] Specifically, during the traversal process, it is first necessary to determine whether the currently traversed first communication information is the same as the previous second communication information in any one of the communication information sets:

[0083] 1) Not the same

[0084] If information items other than the communication time in the first communication information and the second communication information are not completely the same, it is determined that the first communication information is different from the second communication information, wherein the information items are pre-recorded information used to represent different attributes of the communication information.

[0085] In the process of data packets forming a communication information set, information about calls between network elements is extracted in advance from the data packets as information items of each communication information in the communication information set, such as request mode, response code, etc.

[0086] The request method is, for example, the five request methods defined in HTTP2.0: GET, POST, PUT, DELETE, and PATCH. The response code is an HTTP status code, which reflects the status of the network element processing the HTTP request and indicates whether the corresponding request is successful.

[0087] For example, the communication time in the first communication information is 9:00, and the request method is GET; the communication time in the second communication information is 9:01, and the request method is POST. Since the first communication information and the second communication information have different request methods except for the communication time, it can be determined that the first communication information and the second communication information are different.

[0088] 2) Same

[0089] If the first communication information is the same as the second communication information, the second communication information is deleted.

[0090] Specifically, if the first communication information and the second communication information are identical except for the communication time, it proves that the second communication information and the first communication information constitute repeated communication. In order to avoid errors in the restored call sequence, the second communication information that occurred earlier will be deleted.

[0091] For example, network element 1 requests network element 2 to form the second communication information. In the communication information set, it is found that the next first communication information of the second communication information is also a request from network element 1 to network element 2, and the communication time of the first communication information is the same as that of the second communication information. In this case, the request of network element 1 may fail in the second communication information, and network element 2 does not receive the request message. Therefore, in the first communication information, network element 1 re-issues a request to network element 2.

[0092] A network element calling sequence to which the second communication information belongs is determined according to the type of the first communication information and the type of the second communication information.

[0093] An important criterion for determining whether two communication messages belong to the same network element calling sequence is whether there is a "response wait" between the communications corresponding to the two communication messages.

[0094] During the process of calling network elements, the first network element requests the following network elements in the calling order until the last network element in the calling sequence is requested, and then the last network element responds to the first network element in turn. When the first network element waits until the last network element responds in turn, the whole calling process of the calling sequence is completed. That is, if there is a "response waiting" between the two communication messages, they belong to the same network element calling sequence.

[0095] Taking the core network's authentication process for the target user device as an example, the network element call sequence of this process is AMF-AUSF (Authentication Server Function)-UDM (Unified Data Management)-UDR (Unified Data Repository), which is mapped to the communication information set as AMF initiating a request to AUSF, AUSF initiating a request to UDM, UDM initiating a request to UDR, UDR returning a response to UDM, UDM returning a response to AUSF, and AUSF returning a response to AMF. From this point of view, a key feature of the sequence is that after the network element at the front of the sequence sends a communication type request, it will not receive a response reply immediately, and it needs to wait for the network element at the back of the sequence to return a response in reverse order. Therefore, if you want to restore a series of network element call sequences, you need to wait until the network element at the back of the sequence fully responds to the network element at the front of the sequence, and this series of network element call sequences will be completely restored.

[0096] As an optional implementation manner, the process of restoring the network element call sequence can be summarized into the following steps according to the type of the first communication information and the type of the second communication information:

[0097] If the type of the first communication information is a response, and the type of the second communication information is a request, popping the communication information at the top of the stack and adding it to the preset storage character;

[0098] Specifically, if the type of the first communication information is a response and the type of the previous communication information is a request, it proves that in the string of calling sequences, the first network element has requested the last network element, and the last network element has begun to respond in the direction of the first network element. The communication information stored at the top of the stack at this time is the call between the last two network elements in the string of network element calling sequences, so the communication information is popped out of the stack and added to the preset storage characters as the restoration of the calling order between the last two network elements in the string of network element calling sequences.

[0099] If the type of the first communication information is a request, and the type of the second communication information is a response, the first communication information is stored in a stack, and all the communication information in the storage character is obtained, and the obtained communication information is combined into a call sequence in reverse order according to the time sequence of adding to the storage character;

[0100] Specifically, if the type of the first communication information is a request and the type of the previous communication information is a response, it proves that the call sequence temporarily stored in the current storage character has been responded to by the last network element to the first network element, and the call sequence has been restored, so the communication information is organized into a call sequence in reverse order according to the time order of adding the storage characters.

[0101] If the type of the first communication information is a response, and the type of the second communication information is a response, popping the communication information at the top of the stack and adding it to the preset storage character;

[0102] Specifically, if the type of the first communication information is a response, and the type of the second communication information is a response, it proves that the string of call sequences is in the process of responding from the last network element to the first network element. Each time a response is made, a communication information can be popped from the top of the stack as a part of the network element call sequence in the string of call sequences.

[0103] If the first communication information currently traversed is the first communication information in the communication information set, the first communication information is defined as the first communication information, and when the first communication information is different from the next communication information in any one of the communication information sets, the first communication information is stored in the stack.

[0104] Step 103: Obtain a network element calling sequence according to the traversal result.

[0105] After the communication set is traversed, the obtained multiple strings of network element call sequences are all network element call sequences included in the target user equipment to complete a service. The output multiple strings of network element call sequences contain all network element link information covered by the communication information set.

[0106] Specifically, see Figure 2 , assuming that the communication information in the communication information set is as shown in the figure, and the information items of the first communication information in this example are not completely the same as the information items of the second communication information except the communication time, the numbers 1, 2, 3, 4, and 5 represent network element 1, network element 2, network element 3, network element 4, and network element 5. For the sake of simplicity, this application uses simplified numbers; in addition, the closed end of the stack is defined as the bottom of the stack, and the open end of the stack is defined as the top of the stack.

[0107] An empty stack is pre-established to store the communication information transferred from the communication information set; a preset storage character is pre-established to store the communication information popped from the stack, and the sequence composed of the preset storage characters in chronological order can constitute the restored network element call sequence after processing. It should be noted that the structure of the stack determines that the storage of communication information is first in, last out, in other words, the communication information first stored in the stack is the last to be popped out when it is popped out of the stack.

[0108] When starting the traversal:

[0109] The type of the first line of communication information is request, and the 1-2 communication information is stored in the stack. At this time, one 1-2 communication information is stored in the stack;

[0110] The type of the second line of communication information is request, and the type of the first line of communication information is also request. The communication information 2-3 of the second line is stored in the stack. At this time, two pieces of communication information are stored in the stack. The bottom of the stack is the communication information 1-2, and the second line of the stack is 2-3. See Figure 3 ;

[0111] The type of the communication information in the third row is a response, and the type of the communication information in the second row is a request, the communication information 2-3 at the top of the stack is popped out and added to the preset storage character, at this time, a piece of communication information 1-2 is stored in the stack, and a piece of communication information 2-3 is stored in the preset storage character;

[0112] The type of the fourth line of communication information is a request, and the type of the third line of communication information is a response. The fourth line of communication information 2-4 is stored in the stack, and the communication information 2-3 stored in the preset storage character is derived from the preset storage character to form a call sequence. See Figure 4 At this time, the information stored in the stack from the bottom to the top is: 1-2 request, 2-4 request, the preset storage character is empty, and the restoration of the first string of call sequence 2-3 request is completed.

[0113] It should be noted that since in the stack, the order of popping and pushing is opposite, for example, the second line of communication information 2-3 is pushed in the order 2-3, and the order of entering the preset storage characters when popped is 3-2. The sequence stored in the preset storage characters is actually opposite to the network element call sequence to be restored. Therefore, when exporting the call sequence from the preset storage characters, it is necessary to compose the call sequence in reverse order. In the case illustrated in the above figure, as long as the call sequence is exported from the preset storage characters, in order to simplify the description, it is defaulted to the sequence that has completed the reverse operation.

[0114] The type of the fifth line of communication information is request, and the type of the fourth line of communication information is request, similar to the processing of the second line of communication information, the fifth line of communication information 4-5 is stored in the stack;

[0115] The type of the communication information in the sixth row is a response, and the type of the communication information in the fifth row is a request. Referring to the processing of the communication information in the third row, the communication information 4-5 at the top of the stack is popped out and added to the preset storage character. At this time, two pieces of communication information are stored in the stack, which are 1-2 and 2-4 from the bottom to the top of the stack, and one piece of 4-5 communication information is stored in the preset storage character;

[0116] The types of the communication information in the seventh and eighth rows are both responses, and the type of the communication information in the fifth row is a response. Starting from the top of the stack, the two communication information 2-4 and 1-2 are popped out of the stack and added to the preset storage characters;

[0117] The type of the communication information in the ninth line is a request, and the type of the communication information in the eighth line is a response, that is, the communication information records in the preset storage characters are exported to form a call sequence, and the restoration of the second string of call sequences is completed, that is, the restored call sequence is: 1-2-4-5.

[0118] It should be noted that, as can be seen from the above example, if the communication information type of the current row is a request, the communication information of the current row needs to be pushed into the stack; to complete the restoration of a string of call sequences, the communication information type of the current row needs to be a response, and when the type of the communication information of the next row is a request, the communication information in the preset storage characters can derive the call sequence of the preset storage characters that constitute the string of network elements. Therefore, after traversing the communication information set, if the preset storage characters are not empty, that is, the preset storage characters store the call sequence of the network element that has not been derived:

[0119] As an optional implementation, for any communication information set, the communication information in the preset storage characters is combined into a calling sequence in reverse order according to the time sequence of adding the storage characters.

[0120] When the storage character is not empty, it proves that there is communication information in the preset storage characters that constitutes a string of network element call sequences. A new row of communication information of the request type is needed to trigger the call sequence in the preset storage characters to export the preset storage characters. However, at this time all the communication information in the communication information set has been traversed, so an extra step is required to export the communication information in the preset storage characters from the preset storage characters to form a call sequence.

[0121] The present application discloses a method for restoring a network element call sequence based on the characteristics of the network element call sequence in the core network traffic in the 5G core network, and uses the core network traffic data to restore the call sequence of the network element without the need for distributed tracing tools and without occupying core network resources.

[0122] See also Figure 5 The overall flow chart of this application:

[0123] Step 501: Determine the device identification from the core network traffic;

[0124] Step 502: taking the user equipment corresponding to the device identifier that complies with the preset identifier format rule as the target user equipment;

[0125] Step 503: Filtering data packets generated by services associated with the target user equipment from historical data packets of core network traffic, and obtaining at least one communication information set based on the data packets;

[0126] Step 504: traverse the communication information set;

[0127] Step 505: Determine whether the last communication information in the communication information set has been traversed, if yes, execute step 506, if not, execute step 507;

[0128] Step 506: Determine whether the preset storage character is empty, if yes, execute step 515, if no, execute step 514;

[0129] Step 507: Determine whether the information items of the first communication information and the information items of the second communication information are completely identical except for the communication time, if yes, proceed to step 508, if no, proceed to step 509;

[0130] Step 508: deleting the second communication information;

[0131] Step 509: Determine whether the type of the first communication information is a request, if so, execute step 510, if not, execute step 513;

[0132] Step 510: Determine whether the type of the second communication information is a request, if so, execute step 511, if not, execute step 512;

[0133] Step 511: store the first communication information into the stack, and return to step 505;

[0134] Step 512: store the first communication information in the stack, and continue to execute step 514;

[0135] Step 513: pop the communication information at the top of the stack and add it to the preset storage character, and return to step 505;

[0136] Step 514: assemble the communication information in the preset storage characters into a call sequence in reverse order according to the time sequence of adding the storage characters, and return to step 505;

[0137] Step 515: Obtain the network element calling sequence according to the traversal result.

[0138] It should be noted that the above overall flowchart is only an embodiment of the present invention, and the step sequence in the implementation process is not limited to the step sequence of the above steps 509 to 513. The sequence of steps 509 to 513 can be appropriately adjusted according to actual needs, such as 510, 509, 511, 512, 513.

[0139] Example 2

[0140] Based on the same inventive concept, the present application also provides a 5G network element call sequence restoration device, such as Figure 6 As shown, the device comprises:

[0141] A screening module 601 is used to screen out data packets generated by a service associated with a target user equipment from historical data packets of core network traffic, and obtain at least one communication information set based on the data packets, wherein the communication information included in the same communication information set is the communication information in the data packets generated by the same service, and the communication information included in the communication information set is sorted according to the time of calling the network element;

[0142] A traversal restoration module 602, configured to traverse the communication information in any one of the communication information sets, and obtain a network element calling sequence according to the traversal result;

[0143] The traversal restoration module is specifically used for:

[0144] If the currently traversed first communication information is different from the last second communication information in any one of the communication information sets, determining the types of the first communication information and the second communication information;

[0145] A network element calling sequence to which the second communication information belongs is determined according to the type of the first communication information and the type of the second communication information.

[0146] Optionally, the screening module 601 is specifically used for:

[0147] Determine device identity from core network traffic;

[0148] The user equipment corresponding to the device identification conforming to the preset identification format rule is taken as the target user equipment.

[0149] Optionally, the traversal restoration module 602 is further configured to determine whether the currently traversed first communication information is the same as the previous second communication information in any one of the communication information sets by:

[0150] If the information items of the first communication information and the second communication information are not completely identical except for the communication time, it is determined that the first communication information is different from the second communication information;

[0151] The information item is pre-recorded information used to represent different attributes of the communication information.

[0152] Optionally, the traversal restoration module 602 is further configured to: when a request mode exists in the information item of the first communication information, determine that the type of the first communication information is a request;

[0153] When a request mode exists in the information item of the second communication information, determining that the type of the second communication information is a request;

[0154] When a response code exists in the information item of the first communication information, determining that the type of the first communication information is a response;

[0155] When a response code exists in the information item of the second communication information, it is determined that the type of the second communication information is a response.

[0156] Optionally, the traversal restoration module 602 is further specifically configured to: if the type of the first communication information is a request, and the type of the second communication information is a request, store the first communication information in a stack;

[0157] If the type of the first communication information is a response, and the type of the second communication information is a request, popping the communication information at the top of the stack and adding it to the preset storage character;

[0158] If the type of the first communication information is a request, and the type of the second communication information is a response, the first communication information is stored in a stack, and all the communication information in the storage character is obtained, and the obtained communication information is combined into a call sequence in reverse order according to the time sequence of adding to the storage character;

[0159] If the type of the first communication information is a response, and the type of the second communication information is a response, the communication information at the top of the stack is popped out and added to the preset storage character.

[0160] Optionally, the traversal restoration module 602 is further used for: for any communication information set, after traversing the communication information set, if the storage character is not empty, composing the communication information in the preset storage character into a call sequence in reverse order according to the time sequence of adding the storage character.

[0161] Optionally, the traversal restoration module 602 is further used for:

[0162] If the first communication information currently traversed is the first communication information in the communication information set, the first communication information is defined as the first communication information, and when the first communication information is different from the next communication information in any one of the communication information sets, the first communication information is stored in the stack.

[0163] Optionally, the traversal restoration module 602 is further configured to: if the first communication information is the same as the second communication information, delete the second communication information.

[0164] After introducing the 5G network element call sequence restoration method and device of the exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0165] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system".

[0166] In some possible implementations, the electronic device according to the present application may include at least one processor and at least one memory. The memory stores a program code, and when the program code is executed by the processor, the processor executes the steps in the 5G network element call sequence restoration method according to various exemplary implementations of the present application described above in this specification.

[0167] Refer to the following Figure 7 To describe the electronic device 130 according to this implementation mode of the present application, that is, the above-mentioned network element calling sequence restoration device. Figure 7 The electronic device 130 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0168] like Figure 7 As shown, the electronic device 130 is in the form of a general electronic device. The components of the electronic device 130 may include but are not limited to: the at least one processor 131, the at least one memory 132, and a bus 133 connecting different system components (including the memory 132 and the processor 131).

[0169] Bus 133 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0170] The memory 132 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322 , and may further include a read-only memory (ROM) 1323 .

[0171] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0172] The electronic device 130 may also communicate with one or more external devices 134 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 130, and / or communicate with any device that enables the electronic device 130 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 135. Furthermore, the electronic device 130 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 136. As shown, the network adapter 136 communicates with other modules for the electronic device 130 via a bus 133. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0173] In some possible implementations, various aspects of a 5G network element call sequence restoration method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product runs on a computer device, the program code is used to enable the computer device to execute the steps of a 5G network element call sequence restoration method according to various exemplary implementations of the present application described above in this specification.

[0174] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0175] The program product for monitoring of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on an electronic device. However, the program product of the present application is not limited to this. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, an apparatus or a device or used in combination with it.

[0176] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0177] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0178] The program code for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or completely on the remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0179] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0180] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0181] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0182] The present application is described with reference to the flowcharts and block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and block diagram, as well as the combination of the processes and boxes in the flowchart and block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and block diagram. Figure 1 Process or multiple processes and boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0183] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 Process or multiple processes and boxes Figure 1 A function specified in one or more boxes.

[0184] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 Process or multiple processes and boxes Figure 1 The steps for the functions specified in one or more boxes.

[0185] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0186] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.< / protectionscheme> < / suci> < / msin> < / mnc> < / mcc> < / supi>

Claims

1. A 5G network element call sequence restoration method, characterized in that: The method comprises: Filtering data packets generated by a service associated with a target user equipment from historical data packets of core network traffic, and obtaining at least one communication information set based on the data packets, wherein the communication information included in the same communication information set is the communication information in the data packets generated by the same service, and the communication information included in the communication information set is sorted according to the time of calling the network element; Traversing the communication information in any communication information set, and obtaining a network element calling sequence according to the traversal result; Each time a communication message is traversed, the following process is performed: If the currently traversed first communication information is different from the last second communication information in the communication information set to which the first communication information belongs, determining the types of the first communication information and the second communication information; If the type of the first communication information is a request, and the type of the second communication information is a request, storing the first communication information in a stack; If the type of the first communication information is a response, and the type of the second communication information is a request, popping the communication information at the top of the stack and adding it to the preset storage character; If the type of the first communication information is a request, and the type of the second communication information is a response, the first communication information is stored in a stack, and all the communication information in the storage character is obtained, and the obtained communication information is combined into a call sequence in reverse order according to the time sequence of adding to the storage character; If the type of the first communication information is a response, and the type of the second communication information is a response, the communication information at the top of the stack is popped out and added to the preset storage character.

2. The method according to claim 1, characterized in that Target user devices are identified through the following methods, including: Determine device identity from core network traffic; The user equipment corresponding to the device identification conforming to the preset identification format rule is taken as the target user equipment.

3. The method according to claim 1, characterized in that Whether the currently traversed first communication information is the same as the previous second communication information in the communication information set to which the first communication information belongs is determined in the following manner: If the information items of the first communication information and the second communication information are not completely identical except for the communication time, it is determined that the first communication information is different from the second communication information; The information item is pre-recorded information used to represent different attributes of the communication information.

4. The method according to claim 3, characterized in that Determining the types of the first communication information and the second communication information includes: When a request mode exists in the information item of the first communication information, determining that the type of the first communication information is a request; When the information item of the second communication information contains a request mode, determining that the type of the second communication information is a request When a response code exists in the information item of the first communication information, determining that the type of the first communication information is a response; When a response code exists in the information item of the second communication information, it is determined that the type of the second communication information is a response.

5. The method according to claim 1, characterized in that The method further comprises: For any communication information set, after traversing the communication information set, if the storage character is not empty, the communication information in the preset storage character is combined into a calling sequence in reverse order according to the time sequence of adding the storage character.

6. The method according to claim 1, characterized in that The method further comprises: If the first communication information currently traversed is the first communication information in the communication information set to which the first communication information belongs, the first communication information is defined as the first communication information, and when the first communication information is different from the next communication information in the communication information set to which the first communication information belongs, the first communication information is stored in the stack.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: If the first communication information is the same as the second communication information, the second communication information is deleted.

8. A 5G network element call sequence restoration device, characterized in that: The device includes: A screening module, used to screen out data packets generated by a service associated with a target user equipment from historical data packets of core network traffic, and obtain at least one communication information set based on the data packets, wherein the communication information included in the same communication information set is the communication information in the data packets generated by the same service, and the communication information included in the communication information set is sorted according to the time of calling the network element; A traversal restoration module, used to traverse the communication information in any communication information set, and obtain a network element calling sequence according to the traversal result; The traversal restoration module is specifically used for: If the currently traversed first communication information is different from the last second communication information in the communication information set to which the first communication information belongs, determining the types of the first communication information and the second communication information; If the type of the first communication information is a request, and the type of the second communication information is a request, storing the first communication information in a stack; If the type of the first communication information is a response, and the type of the second communication information is a request, popping the communication information at the top of the stack and adding it to the preset storage character; If the type of the first communication information is a request, and the type of the second communication information is a response, the first communication information is stored in a stack, and all the communication information in the storage character is obtained, and the obtained communication information is combined into a call sequence in reverse order according to the time sequence of adding to the storage character; If the type of the first communication information is a response, and the type of the second communication information is a response, the communication information at the top of the stack is popped out and added to the preset storage character.

9. An electronic device, characterized in that: It comprises at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the method as described in any one of claims 1-7.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to make a computer execute the method according to any one of claims 1 to 7.

Images