Traffic processing method and system, storage medium and electronic device

Abstract

The present disclosure provides a traffic processing method, system, electronic device and storage medium. The method includes: the service communication agent network element sends traffic detection configuration data to the network function network element through a signaling channel; the network function network element performs anomaly detection on the traffic data arriving at the network function network element according to the traffic detection configuration data to obtain a detection result; wherein the detection result is that the traffic data is abnormal traffic data, or the traffic data is normal traffic data; when the detection result indicates that the traffic data is abnormal traffic data, the network function network element performs anomaly processing on the abnormal traffic data to generate a processing result, and reports the processing result to the service communication agent network element through a signaling channel. The method can reuse the signaling channel between the service communication agent network element and other network elements to realize configuration distribution, and can realize network element-level intrusion detection without affecting the performance of each network element in the 5G core network, thereby improving the overall security protection capability of the 5G core network.

Description

Background Art

[0002] With the development of computer technology and Internet technology, the deployment of 5G networks is becoming more and more extensive, and each network element in the 5G network needs to process a large amount of traffic data.

[0003] In related technologies, each network element in a 5G network usually uses a network firewall to prevent traffic intrusion from external networks. However, network firewalls can usually only identify some common attack methods. Therefore, related technologies lack more effective monitoring methods, resulting in weak security protection capabilities of the 5G core network.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide a traffic processing method, device, electronic device and storage medium to achieve network element-level intrusion detection without affecting the performance of each network element in the 5G core network, thereby improving the security protection capability of the overall 5G core network.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a traffic processing method is provided, including: a service communication proxy network element sends traffic detection configuration data to a network function network element through a signaling channel; the network function network element performs anomaly detection on traffic data arriving at the network function network element according to the traffic detection configuration data to obtain a detection result; wherein the detection result is that the traffic data is abnormal traffic data, or the traffic data is normal traffic data; when the detection result indicates that the traffic data is abnormal traffic data, the network function network element performs exception processing on the abnormal traffic data to generate a processing result, and reports the processing result to the service communication proxy network element through the signaling channel.

[0008] In one embodiment of the present disclosure, a service communication agent network element sends flow detection configuration data to a network function network element through a signaling channel, including: the network function network element sends a configuration acquisition request to the service communication agent network element through the signaling channel; the service communication agent network element queries the target configuration data corresponding to the network function network element as flow detection configuration data according to the configuration acquisition request; the service communication agent network element sends the flow detection configuration data to the network function network element through the signaling channel.

[0009] In one embodiment of the present disclosure, a network function network element includes an ingress service container group, and the ingress service container group includes a traffic processing sidecar container; the network function network element performs anomaly detection on traffic data arriving at the network function network element according to traffic detection configuration data to obtain a detection result, including: the ingress service container group receives the traffic data arriving at the network function network element; the traffic processing sidecar container intercepts the traffic data, and performs anomaly detection on the traffic data according to the traffic detection configuration data to obtain a detection result.

[0010] In one embodiment of the present disclosure, traffic detection configuration data includes one or more abnormal feature rule data; the traffic processing sidecar container intercepts the traffic data, and performs anomaly detection on the traffic data according to the traffic detection configuration data to obtain a detection result, including: the traffic processing sidecar container intercepts the business message in the traffic data; the traffic processing sidecar container parses the business message to obtain a parsing result; the traffic processing sidecar container compares the parsing result with each abnormal feature rule data to determine the number of abnormal feature rule data that the parsing result complies with; wherein, if the number is greater than or equal to 1, the traffic processing sidecar container determines that the detection result indicates that the traffic data is abnormal traffic data.

[0011] In one embodiment of the present disclosure, the ingress service container group also includes an exception reporting sidecar container; the network function network element performs exception processing on the abnormal traffic data to generate a processing result, and reports the processing result to the service communication agent network element through a signaling channel, including: the traffic processing sidecar container forwards the abnormal traffic data to the exception reporting sidecar container; the exception reporting sidecar container performs exception processing on the abnormal traffic data based on a preset processing method, and generates a processing result according to the detection result and processing method of the abnormal traffic data; the exception reporting sidecar container reports the processing result to the service communication agent network element through the signaling channel.

[0012] In one embodiment of the present disclosure, the ingress business container group also includes a business container; wherein the traffic processing method also includes: when the detection result indicates that the traffic data is normal traffic data, the traffic processing sidecar container sends the normal traffic data to the business container, so that the business container performs business processing according to the normal traffic data.

[0013] In one embodiment of the present disclosure, the ingress service container group also includes a configuration receiving side car container; the network function network element sends a configuration acquisition request to the service communication agent network element through a signaling channel, including: the configuration receiving side car container sends a configuration acquisition request to the service communication agent network element through the signaling channel; the service communication agent network element sends flow detection configuration data to the network function network element through the signaling channel, including: the service communication agent network element sends flow detection configuration data to the configuration receiving side car container through the signaling channel; and the flow processing method also includes: the configuration receiving side car container synchronizes the flow detection configuration data to the flow processing side car container.

[0014] In one embodiment of the present disclosure, the traffic processing method further includes: the service communication proxy network element generates alarm information according to the processing result; and the service communication proxy network element calls a preconfigured communication system to report the alarm information.

[0015] In one embodiment of the present disclosure, the traffic processing method also includes: the service communication agent network element receives the configuration write data of the user for the network function network element; when it is determined that the user has the configuration authority, the service communication agent network element stores the traffic detection configuration data for the network function network element in the configuration write data.

[0016] According to another aspect of the present disclosure, a traffic processing system is provided, including: a service communication proxy network element, which is used to send traffic detection configuration data to a network function network element through a signaling channel; the network function network element is used to perform anomaly detection on traffic data arriving at the network function network element according to the traffic detection configuration data to obtain a detection result; wherein the detection result is that the traffic data is abnormal traffic data, or the traffic data is normal traffic data; when the detection result indicates that the traffic data is abnormal traffic data, the network function network element is used to perform exception processing on the abnormal traffic data to generate a processing result, and report the processing result to the service communication proxy network element through the signaling channel.

[0017] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned traffic processing method is implemented.

[0018] According to another aspect of the present disclosure, there is provided an electronic device, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-mentioned traffic processing method by executing the executable instructions.

[0019] The traffic processing method provided by the embodiment of the present disclosure can enable the service communication agent to send traffic detection configuration data to the network function network element through the signaling channel, so that the network function network element performs abnormal detection on the traffic data arriving at the network element according to the traffic detection configuration data, and processes the abnormal traffic data to generate processing results, and then reports the processing results to the service communication agent network element through the signaling channel. It can be seen that on the one hand, by only configuring the traffic detection configuration data of each network function network element in the service communication agent and then enabling the service communication agent to send the traffic detection configuration data, the problem of cumbersome operation and complicated process caused by configuring in each network function network element separately is avoided; on the other hand, this scheme can use the service communication agent network element as a unified deployment point, and then reuse the signaling channel between the service communication agent network element and other network function network elements to realize configuration sending, so that it can effectively prevent the aggressive traffic data from causing damage to the network function network element without affecting the performance of each network function network element in the 5G core network, realize network element-level intrusion detection, and thus improve the overall security protection capability of the 5G core network.

[0020] Furthermore, the traffic processing method provided by the embodiment of the present disclosure can be applied to cloud-based 5G core network elements. The method is a 1+N mode, that is, it is composed of an intrusion detection controller deployed in the service communication agent network element and N sidecar containers located in various types of 5G core network elements. In the traffic processing method provided by the present disclosure, the sidecar container can be used to implement intrusion detection and abnormality reporting of each network element. At the same time, it can rely on the architecture of the service communication agent network element in the signaling agent core node in 5G, and use the signaling channel for configuration distribution and abnormality reporting, thereby simplifying the design and debugging process of the traffic processing method. And because the sidecar container is easy to expand, update and manage, the functions involved in the steps of applying the sidecar container in this application have the advantages of easy expansion, updating and management.

[0021] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0023] Figure 1 A schematic diagram showing an exemplary system architecture to which the traffic processing method according to an embodiment of the present disclosure can be applied;

[0024] Figure 2 A flow chart of a traffic processing method according to an embodiment of the present disclosure is shown;

[0025] Figure 3 A flow chart showing a flow processing method according to an embodiment of the present disclosure in which a service communication proxy network element sends flow detection configuration data to a network function network element;

[0026] Figure 4 A flow chart showing abnormality detection of traffic data by a traffic processing sidecar container in a traffic processing method according to an embodiment of the present disclosure is shown;

[0027] Figure 5 A flow chart showing abnormal processing of abnormal traffic data by a network function network element in a traffic processing method according to an embodiment of the present disclosure is shown;

[0028] Figure 6 A schematic diagram showing another exemplary system architecture to which the traffic processing method according to an embodiment of the present disclosure can be applied;

[0029] Figure 7 A schematic diagram showing a framework of a method for processing traffic in an ingress service container group according to an embodiment of the present disclosure is shown;

[0030] Figure 8 A flow chart showing a flow chart of a traffic processing method according to an embodiment of the present disclosure is shown;

[0031] Fig. 9 A block diagram showing a flow processing device according to an embodiment of the present disclosure; and

[0032] Fig.10 A structural block diagram of a traffic processing computer device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0033] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0034] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0035] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present disclosure, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0036] In view of the technical problems existing in the above-mentioned related technologies, the embodiments of the present disclosure provide a traffic processing method to solve at least one or all of the above-mentioned technical problems.

[0037] Figure 1 A schematic diagram showing an exemplary system architecture to which the traffic processing method according to an embodiment of the present disclosure can be applied.

[0038] like Figure 1 As shown, the system architecture may include a service communication proxy network element (SCP, Service Communication Proxy) 101, a network function network element (NF, Network Function) 102 and a signaling channel 103. The service communication proxy network element 101 and the network function network element 102 may be network elements in the same 5G core network (5GC). In the communication architecture of the 5G core network, direct signaling interaction can be achieved between the network function network elements 102, and the network function network element 102 may also be interconnected with the service communication proxy network element 101, that is, indirect communication between the network function network elements 102 may be achieved through information forwarding of the service communication proxy network element 101, for example, signaling or data information related to service discovery and service request may be forwarded through the service communication proxy network element 101.

[0039] The signaling channel 103 may be a channel in a signaling network belonging to the 5G core network, and is used to carry the transmission of message data or other data information (such as request messages, notification messages, access information configuration data, etc.) related to signaling between the service communication agent network element 101 and the network function network element 102. In an exemplary embodiment, the signaling channel 103 may support various communication methods, such as a local area network (LAN), a wide area network (WAN), and the Internet. For example, the communication protocol used by the signaling channel may adopt the TCP protocol (also called the TCP channel), which can ensure data accessibility based on the TCP protocol, and can achieve reliable transmission of message data or other data information related to signaling.

[0040] In an exemplary embodiment, in addition to transmitting data with the service communication agent network element 101 through the signaling channel 103, the network function network element 102 can also receive traffic data sent from the outside (such as other network elements) for business processing. The network function network element 102 may include but is not limited to UDM network element (Unified Data Management, unified data management function), AMF network element (Access and Mobility Management Function, access and mobility management function), AUSF network element (Authentication Server Function, authentication service function), PCF network element (Policy Control function, policy control function), NRF network element (NF Repository Function, network data repository function), SMF network element (Session Management Function, session management function), AF network element (Application Function, application layer function), CHF network element (Charging Function, billing function), NEF network element (Network Exposure Function, network service presentation function) and other network elements.

[0041] In an exemplary embodiment, the process for implementing the traffic processing method in the present application may be: the service communication agent network element 101 sends traffic detection configuration data to the network function network element 102 through a signaling channel, including: the network function network element 102 sends a configuration acquisition request to the service communication agent network element 101 through the signaling channel; the service communication agent network element 101 queries the target configuration data corresponding to the network function network element 102 as traffic detection configuration data according to the configuration acquisition request, and then sends the traffic detection configuration data to the network function network element 102 through the signaling channel.

[0042] In addition, it should be noted that Figure 1 What is shown is only one application environment of the traffic processing method provided by the present disclosure. Figure 1 The number of service communication proxy network elements, network function network elements and signaling channels in the embodiment is only for illustration, and any number of service communication proxy network elements, network function network elements and signaling channels may be provided according to actual needs.

[0043] In order to enable ordinary persons in the art to better understand the technical solution of the present disclosure, each step of the traffic processing method in the exemplary embodiment of the present disclosure will be described in more detail below with reference to the accompanying drawings and embodiments.

[0044] Figure 2 A flow chart of a traffic processing method according to an embodiment of the present disclosure is shown. Figure 2 As shown, the traffic processing method provided by the embodiment of the present disclosure may include the following steps:

[0045] Step S201: The service communication proxy network element sends flow detection configuration data to the network function network element through a signaling channel.

[0046] In this step, the number of network function network elements may be one or more, and different signaling channels may exist between each network function network element and the service communication agent network element. Traffic detection configuration data may be periodically sent to the network function network element based on a preset frequency (such as every 1 hour, every 24 hours, etc.). The traffic detection configuration data may be pre-configured in the service communication agent network element, and the traffic detection configuration data may include detection rules for traffic data. The detection rules may be used to detect whether the traffic data is normal traffic data or abnormal traffic data, and then determine how to handle the traffic data. The traffic detection configuration data may be set for internal attack behaviors, external attack behaviors, misoperation behaviors, and the like. For example, the traffic detection configuration data may be configured based on the characteristics of traffic data that is known to be aggressive (for example, it may pose a threat to the network function network element, or trigger an abnormal event in the network function network element).

[0047] In some practical applications, an intrusion detection controller can be set in the service communication agent network element, and the intrusion detection controller can be used to configure, deploy and distribute traffic detection configuration data. That is, the service communication agent network element can be used as a unified deployment point of the intrusion detection controller, and the signaling channel between the service communication agent network element and other network function network elements can be reused to realize configuration distribution.

[0048] In some practical applications, when there are multiple network function network elements, the same general flow detection configuration data can be set for all network function network elements; different flow detection configuration data can also be configured for different network function network elements based on factors such as common application scenarios or commonly processed business types of different network function network elements, so that the flow detection configuration data received by different network function network elements is more targeted. In addition, the service communication proxy network element can use the signaling channel corresponding to each network function network element to send flow detection configuration data to each network function network element respectively, and then send the flow detection configuration data required by multiple network function network elements to each other at the same time, which is more efficient.

[0049] Step S203, the network function network element performs anomaly detection on the flow data arriving at the network function network element according to the flow detection configuration data to obtain a detection result; wherein the detection result is that the flow data is abnormal flow data, or the flow data is normal flow data.

[0050] In this step, the traffic data arriving at the network function network element may be the traffic data arriving at the entrance of the network function network element, for example, the traffic data filtered by the network firewall on the network function network element and just received by the traffic receiving entrance (such as the entrance microservice) of the network function network element. At this time, the traffic data has not yet participated in the business processing. Therefore, if the traffic data is detected for abnormalities at this time, it can effectively prevent the aggressive traffic data from causing damage to the network function network element, realize network element-level intrusion detection, and thus enhance the overall 5G core network security protection capability.

[0051] Step S205: When the detection result indicates that the traffic data is abnormal traffic data, the network function network element performs abnormal processing on the abnormal traffic data to generate a processing result, and reports the processing result to the service communication proxy network element through the signaling channel.

[0052] The processing result may include information about abnormal traffic data, the basis for determining the traffic data as abnormal traffic data (such as which rule in the traffic detection configuration data is hit), the method of abnormal processing of abnormal traffic data, etc. Different network function network elements may report the processing results through the signaling channel between them and the service communication agent network element.

[0053] In some embodiments, after step S205, the traffic processing method may further include: the service communication agent network element generates alarm information according to the processing result; the service communication agent network element calls a preconfigured communication system to report the alarm information.

[0054] In this embodiment, the alarm information may include the network function network element that reports the processing result and the processing result. The preconfigured communication system may be, for example, a text message system, an email system, etc. The service communication agent network element may send the alarm information to relevant users (such as administrators, etc.) so that the relevant users can update the traffic detection configuration data or network firewall of the corresponding network function network element according to the collected alarm information, so that the network function network element has a better protection effect and enhances the network protection capability of the 5G core network.

[0055] Through the traffic processing method provided by the present disclosure, the service communication agent can send traffic detection configuration data to the network function network element through the signaling channel, so that the network function network element performs abnormal detection on the traffic data arriving at the network element according to the traffic detection configuration data, and processes the abnormal traffic data to generate processing results, and then reports the processing results to the service communication agent network element through the signaling channel. It can be seen that on the one hand, by only configuring the traffic detection configuration data of each network function network element in the service communication agent and then letting the service communication agent send the traffic detection configuration data, the problem of cumbersome operation and complicated process caused by configuring in each network function network element separately is avoided; on the other hand, this scheme can use the service communication agent network element as a unified deployment point, and then reuse the signaling channel between the service communication agent network element and other network function network elements to realize configuration sending, so it can effectively prevent the aggressive traffic data from causing damage to the network function network element without affecting the performance of each network function network element in the 5G core network, realize network element-level intrusion detection, and thus improve the overall security protection capability of the 5G core network.

[0056] Figure 3 A flow chart showing a flow processing method according to an embodiment of the present disclosure in which a service communication proxy network element sends flow detection configuration data to a network function network element is shown. Figure 3 As shown, in some embodiments, step S201 may further include:

[0057] Step S301: The network function network element sends a configuration acquisition request to the service communication proxy network element through a signaling channel.

[0058] In this step, the network function network element may periodically request the service communication agent network element to send down the flow detection configuration data based on a preset frequency (such as every 1 hour, every 24 hours, etc.).

[0059] Step S303: the service communication proxy network element queries the target configuration data corresponding to the network function network element according to the configuration acquisition request to use it as traffic detection configuration data.

[0060] Step S305: The service communication proxy network element sends flow detection configuration data to the network function network element through a signaling channel.

[0061] In some practical applications, the service communication proxy network element may store configuration data for traffic detection for different network function network elements, and the configuration acquisition request may include relevant information of the network function network element, such as the name, address, NFID (Network Function ID, network function network element identification number) of the network function network element, so that the service communication proxy network element can query the target configuration data corresponding to the network function network element according to the configuration acquisition request, and issue it as the traffic detection configuration data of the network function network element.

[0062] In some embodiments, the network function network element includes an ingress service container group, and the ingress service container group includes a traffic processing sidecar container; the network function network element performs anomaly detection on the traffic data arriving at the network function network element according to the traffic detection configuration data to obtain a detection result, including: the ingress service container group receives the traffic data arriving at the network function network element; the traffic processing sidecar container intercepts the traffic data, and performs anomaly detection on the traffic data according to the traffic detection configuration data to obtain a detection result.

[0063] In some practical applications, the 5G core network can be cloudified. For example, the 5G core network elements can be deployed based on a container orchestration engine such as Kubernetes (hereinafter referred to as K8s). Specifically, a K8s cluster can be created, and K8s can manage hardware resources in a unified manner. One (or several) hosts can be installed as K8s control nodes, and other hosts can be added to the cluster as working nodes to carry workloads. Other entities (such as virtual network function manager VNFM, network function virtualization orchestrator NFVO, 5G core network entities, etc.) can be run in the K8s cluster as a k8s container group, and the K8s container group can contain one or more collocated containers.

[0064] Based on this, in this embodiment, the functional modules responsible for different functions of the service proxy network element and the network function network element can be run on multiple computing nodes in the form of containers. Communication between clusters or communication within clusters can be achieved according to the deployment mode of the service proxy network element and the network function network element in the same or different K8s clusters. For example, an inlet service container group can be set in the network function network element to receive traffic data arriving at the entrance of the network function network element, and a traffic processing sidecar container for detecting traffic can be flexibly set in the inlet service container group, thereby expanding and enhancing the container group's processing function for traffic without changing the original function of the inlet service container group.

[0065] Figure 4 A flow chart showing anomaly detection of traffic data by a traffic processing sidecar container in a traffic processing method according to an embodiment of the present disclosure is shown. Figure 4As shown, in some embodiments, the traffic processing sidecar container intercepts traffic data, and performs anomaly detection on the traffic data according to the traffic detection configuration data to obtain a detection result, including:

[0066] Step S401: The traffic processing sidecar container intercepts business messages in the traffic data.

[0067] In this step, the service message may be, for example, HTTP (Hyper Text Transfer Protocol) message data.

[0068] Step S403: The traffic processing sidecar container parses the service message to obtain a parsing result.

[0069] In this step, the business message can be parsed and split to obtain the message header or payload data, for example, the request line, request header, and request body of the request business message can be obtained, and the response header and response body of the response business message can be obtained; the traffic processing sidecar container can then determine the parsing result based on the data obtained after the parsing and splitting, for example, only the request body or the response body can be used as the parsing result, or the relevant request line, request header, and request body can be used as the parsing result.

[0070] In step S405, the traffic processing sidecar container compares the parsing result with each abnormal feature rule data to determine the number of abnormal feature rule data that the parsing result complies with. In some practical applications, the traffic detection configuration data may include one or more abnormal feature rule data. If the number of abnormal feature rule data that the parsing result complies with is greater than or equal to 1 in step S405, the traffic processing sidecar container may determine that the detection result indicates that the traffic data is abnormal traffic data.

[0071] Through this embodiment, the traffic processing sidecar container can be used to add a traffic detection function to the ingress business container group, and because the sidecar container is easy to expand, update and manage, the traffic detection function in this application has the advantage of being easy to expand, update and manage.

[0072] In some practical applications, the abnormal feature rule data may be a detection rule for traffic data, and the detection rule may be used to compare with the traffic data to determine whether the traffic data matches the detection rule. For example, the detection rule may be a configured regular expression, and the comparison process may be to use the regular expression to perform regular matching with the parsing result. If they match, it can be determined that the parsing result complies with the detection rule. In some practical applications, a parsing result may comply with more than one detection rule, and all the detection rules that the parsing result complies with may be recorded for subsequent reporting or analysis.

[0073] In some embodiments, the ingress service container group may further include an abnormal reporting sidecar container for processing and reporting abnormal traffic data; based on this, when the detection result indicates that the traffic data is abnormal traffic data, Figure 5 A flow chart showing an example of a network function network element performing abnormal processing on abnormal traffic data in a traffic processing method according to an embodiment of the present disclosure is shown. Figure 5 As shown, in some embodiments, step S205 may further include:

[0074] Step S501: The traffic processing sidecar container forwards the abnormal traffic data to the abnormal reporting sidecar container.

[0075] In step S503, the exception reporting sidecar container performs exception processing on the abnormal traffic data based on a preset processing method, and generates a processing result according to the detection result and processing method of the abnormal traffic data.

[0076] Among them, the preset processing method can be directly set in the exception reporting sidecar container, or the preset processing method can be written into the traffic detection configuration data. The exception reporting sidecar container can first obtain or access the traffic detection configuration data stored in the traffic processing sidecar container, and then determine the processing method. In addition, the preset processing method can be, for example, discarding abnormal traffic data, temporarily tracking abnormal traffic data, or adding the sender corresponding to the abnormal traffic data to the blacklist. In some practical applications, the corresponding processing method can be further determined based on the abnormal feature rule data that the abnormal traffic data conforms to.

[0077] In this step, the processing result may include the abnormal characteristic rule data that the abnormal traffic data complies with and the corresponding processing method.

[0078] Step S505: The exception reporting sidecar container reports the processing result to the service communication proxy network element through the signaling channel.

[0079] Through this embodiment, the exception reporting sidecar container can be used to add the processing function of abnormal traffic data (including exception processing and reporting) to the ingress business container group, and because the sidecar container is easy to expand, update and manage, the processing function of abnormal traffic data in this application has the advantage of being easy to expand, update and manage.

[0080] In some embodiments, based on step S405, if the number of abnormal feature rule data that the analysis result complies with is 0, the traffic processing sidecar container can determine that the detection result indicates that the traffic data is normal traffic data.

[0081] In some embodiments, the ingress service container group may further include a service container for performing service processing according to normal traffic data when it is determined that the detection result indicates that the traffic data is normal traffic data. Based on this, the traffic processing method may further include: when the detection result indicates that the traffic data is normal traffic data, the traffic processing sidecar container may send the normal traffic data to the service container, so that the service container performs service processing according to the normal traffic data.

[0082] In some embodiments, the ingress service container group further includes a configuration receiving sidecar container for requesting traffic detection configuration data from the service communication agent network element in the network function network element and processing the received traffic detection configuration data.

[0083] Based on this, step S301 may further include: configuring the receiving sidecar container to send a configuration acquisition request to the service communication proxy network element through a signaling channel.

[0084] Step S201 or step S305 may further include: the service communication proxy network element sends traffic detection configuration data to the configuration receiving side car container through the signaling channel.

[0085] Among them, in the service communication proxy network element where the intrusion detection controller is deployed, a configuration delivery module can also be set in the form of a container group to cooperate with the configuration receiving side car container to transmit the traffic detection configuration data configured in the service communication proxy network element to the network function network element. Specifically, the configuration delivery module can receive a configuration acquisition request sent by the configuration receiving side car container, and then the configuration delivery module delivers the traffic detection configuration data to the configuration receiving side car container.

[0086] Furthermore, the traffic processing method may further include: configuring the receiving sidecar container to synchronize the traffic detection configuration data to the traffic processing sidecar container.

[0087] Among them, the configuration receiving sidecar container can first store the traffic detection configuration data into a preset storage space and then synchronize it.

[0088] In some embodiments, the traffic processing method may also include: the service communication agent network element receives the configuration write data of the user for the network function network element; when it is determined that the user has configuration authority, the service communication agent network element stores the traffic detection configuration data for the network function network element in the configuration write data.

[0089] In this embodiment, the user with configuration authority may be a system administrator, who may first perform a login authentication, and then write configuration write data containing traffic detection configuration data to the intrusion detection controller located in the service communication proxy network element through a web command line or other means after the authentication is passed.

[0090] Figure 6 A schematic diagram showing another exemplary system architecture to which the traffic processing method of the embodiment of the present disclosure can be applied is shown as follows: Figure 6 As shown, it includes: a service communication agent network element 601, a first network function network element 602 and a first network function network element 604. Specifically, the service communication agent network element 601 includes an intrusion detection controller, and the intrusion detection controller may include a configuration acceptance module, a configuration delivery module, an abnormality receiving module and an alarm module; the first network function network element 602 includes a first ingress service container group 603, and the first ingress service container group 603 may include a first service container, a first configuration receiving side car container, a first traffic processing side car container and a first abnormality reporting side car container; similarly, the second network function network element 604 includes a second ingress service container group 605, and the second ingress service container group 605 may include a second service container, a second configuration receiving side car container, a second traffic processing side car container and a second abnormality reporting side car container.

[0091] It should be noted that Figure 6 The figure is merely a schematic diagram of an exemplary system architecture of the traffic processing method provided by the present disclosure. Figure 6 The number of network function elements in the diagram is only for reference only, and any number of network function elements may be provided according to actual needs.

[0092] References Figure 6 In the system shown, the intrusion detection controller can be deployed together with the service communication agent network element 601, wherein the main functions of each module include:

[0093] 1) The configuration acceptance module can be used by the system administrator to configure the flow detection configuration data (such as intrusion rules) of the entire system;

[0094] 2) After receiving a configuration acquisition request from the network element (including the first network function network element 602 and the first network function network element 604) through the signaling channel, the configuration delivery module may deliver the corresponding traffic detection configuration data through the signaling channel;

[0095] 3) The abnormality receiving module can be used to receive abnormality reports from the network element side;

[0096] 4) The alarm module can be integrated with other pre-configured human-machine monitoring terminals (such as OSS, email, SMS, etc.) to report abnormal intrusions of the system to the administrator.

[0097] Continue to refer Figure 6Each tested 5GC network element (including the first network function network element 602 and the first network function network element 604) includes an ingress service container group (including the first ingress service container group 603 and the second ingress service container group 605). A service container for processing services can be set in the ingress service container group. Three sidecar containers can also be inserted using the sidecar technology, namely: a configuration receiving sidecar container, a traffic processing sidecar container, and an abnormality reporting sidecar container. The main functions of each sidecar container include:

[0098] 1) The configuration receiving sidecar container can periodically obtain the traffic detection configuration data from the intrusion detection controller through the signaling channel through https messages, save the traffic detection configuration data, and then synchronize the traffic detection configuration data to the traffic processing sidecar container;

[0099] 2) The traffic processing sidecar container can parse the ingress traffic (i.e., the traffic data arriving at the network function network element) and compare it with the traffic detection configuration data. When it meets one or more intrusion rules in the traffic detection configuration data, the ingress traffic is forwarded to the anomaly reporting sidecar container; when none of them meet the requirements, the traffic can be forwarded to the business container;

[0100] 3) The anomaly reporting sidecar container also acts as a blackhole container. After receiving abnormal traffic, it records it and reports it to the intrusion detection controller through the signaling channel in real time, while discarding the intrusion traffic.

[0101] like Figure 6 The traffic processing method shown can be applied to cloud-based 5G core network elements. This method is a 1+N mode, that is, it consists of an intrusion detection controller deployed in the service communication agent network element and N sidecar containers located in various types of 5G core network elements. In the traffic processing method provided by the present disclosure, the sidecar container can be used to implement intrusion detection and abnormal reporting of each network element. At the same time, it can rely on the architecture of the service communication agent network element in the 5G signaling agent core node, and use the signaling channel for configuration delivery and abnormal reporting, thereby simplifying the design and debugging process of this traffic processing method.

[0102] Figure 7 A schematic diagram of a traffic processing method in an ingress service container group according to an embodiment of the present disclosure is shown. Figure 7 As shown, the ingress service container group 700 in the network function network element may include a configuration receiving sidecar container 701 , a traffic processing sidecar container 702 , an abnormality reporting sidecar container 703 and a service container 704 .

[0103] Among them, the configuration receiving sidecar container 701 can obtain the traffic detection configuration data, and can synchronize the traffic detection configuration data to the traffic processing sidecar container 702; the traffic processing sidecar container 702 can receive the ingress traffic arriving at the network function network element and detect it to determine whether the ingress traffic is normal traffic or abnormal traffic; if the ingress traffic is normal traffic, the ingress traffic can be forwarded to the business container 704; if the ingress traffic is abnormal traffic, the ingress traffic can be forwarded to the abnormal reporting sidecar container 703; after receiving the ingress traffic judged as abnormal traffic, the abnormal reporting sidecar container 703 can report it as an abnormality.

[0104] Figure 8 A flow chart of a flow processing method according to an embodiment of the present disclosure is shown. Figure 8 As shown, including:

[0105] Step S801, write intrusion detection configuration to the intrusion detection controller located in the service communication proxy network element. In this step, the intrusion detection configuration is the flow detection configuration data; the system administrator can write the intrusion detection configuration to the intrusion detection controller located in the service communication proxy network element through a web command line or the like, wherein the system administrator needs to log in and authenticate first.

[0106] Step S802: The intrusion detection controller sends the intrusion detection configuration to the sidecar containers of all network function network elements. In this step, the configuration receiving sidecar container located in the network element under test (i.e., the network function network element) can periodically make configuration synchronization requests to the configuration sending module in the intrusion detection controller through Https messages. The intrusion detection controller sends the intrusion detection configuration to the configuration receiving sidecar containers of all network function network elements, and the configuration receiving sidecar container then synchronizes it to the traffic processing sidecar container.

[0107] Step S803, the sidecar container in the ingress microservice of the network function network element intercepts the service message entering the microservice. In this step, when any traffic reaches the ingress microservice of the network function network element, the sidecar container in the ingress microservice can intercept the service message entering the microservice. For example, the traffic processing sidecar container can intercept it.

[0108] Step S804: the sidecar container parses the intercepted service message. In this step, the traffic processing sidecar container may parse the service message.

[0109] Step S805: The sidecar container compares the parsing result with the received intrusion detection configuration. In this step, the traffic processing sidecar container may compare the parsing result with the received intrusion detection configuration.

[0110] Step S806, when the sidecar container determines that the service message complies with any interception rule in the intrusion detection configuration, it intercepts the service message to prevent the message from invading the microservice or even the network function network element. In this step, the traffic processing sidecar container can first forward the service message to be intercepted to the exception reporting sidecar container, and then the exception reporting sidecar container intercepts the service message. In addition, when the service message does not comply with any interception rule in the intrusion detection configuration, the traffic can be considered normal traffic, and then the traffic is forwarded to the service container.

[0111] Step S807: The sidecar container reports the interception to the intrusion detection controller. In this step, the anomaly reporting sidecar container can report the interception to the intrusion detection controller and also act as a blackhole container to discard the intercepted traffic.

[0112] Step S808, the intrusion detection controller reports the abnormal statistics to the external human-machine monitoring terminal. In this step, the intrusion detection controller can receive the interception information through the abnormal receiving module set therein, and report the abnormal statistics to the external human-machine monitoring terminal through the alarm module, so that the system administrator of the human-machine monitoring terminal can handle it in time, such as adding new firewall rules at the firewall.

[0113] It should be noted that the above figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0114] Fig. 9 A block diagram of a traffic processing system 900 in the fifth embodiment of the present disclosure is shown; Fig. 9 As shown, including:

[0115] The service communication agent network element 910 is used to send traffic detection configuration data to the network function network element 920 through the signaling channel; the 920 network function network element is used to perform anomaly detection on the traffic data arriving at the network function network element according to the traffic detection configuration data to obtain a detection result; wherein the detection result is that the traffic data is abnormal traffic data, or the traffic data is normal traffic data; when the detection result indicates that the traffic data is abnormal traffic data, the network function network element 920 is used to perform exception processing on the abnormal traffic data to generate a processing result, and report the processing result to the service communication agent network element 910 through the signaling channel.

[0116] Through the traffic processing device provided by the present disclosure, the service communication agent can send traffic detection configuration data to the network function network element through the signaling channel, so that the network function network element performs abnormal detection on the traffic data arriving at the network element according to the traffic detection configuration data, and processes the abnormal traffic data to generate processing results, and then reports the processing results to the service communication agent network element through the signaling channel. It can be seen that on the one hand, by only configuring the traffic detection configuration data of each network function network element in the service communication agent and then letting the service communication agent send the traffic detection configuration data, the problem of cumbersome operation and complicated process caused by configuring in each network function network element separately is avoided; on the other hand, this scheme can use the service communication agent network element as a unified deployment point, and then reuse the signaling channel between the service communication agent network element and other network function network elements to realize configuration sending, so it can effectively prevent the aggressive traffic data from causing damage to the network function network element without affecting the performance of each network function network element in the 5G core network, realize network element-level intrusion detection, and thus improve the overall security protection capability of the 5G core network.

[0117] In some embodiments, the service communication agent network element 910 sends traffic detection configuration data to the network function network element 920 through the signaling channel, including: the network function network element 920 sends a configuration acquisition request to the service communication agent network element 910 through the signaling channel; the service communication agent network element 910 queries the target configuration data corresponding to the network function network element 920 as traffic detection configuration data according to the configuration acquisition request; the service communication agent network element 910 sends the traffic detection configuration data to the network function network element 920 through the signaling channel.

[0118] In some embodiments, the network function network element 920 includes an ingress service container group 921, and the ingress service container group 921 includes a traffic processing sidecar container 9211; the network function network element 920 is used to perform anomaly detection on the traffic data arriving at the network function network element 920 according to the traffic detection configuration data to obtain a detection result, including: the ingress service container group 921 is used to receive the traffic data arriving at the network function network element 920; the traffic processing sidecar container 9211 is used to intercept the traffic data, and perform anomaly detection on the traffic data according to the traffic detection configuration data to obtain a detection result.

[0119] In some embodiments, the traffic detection configuration data includes one or more abnormal feature rule data; the traffic processing sidecar container 9211 is used to intercept the traffic data, and perform anomaly detection on the traffic data according to the traffic detection configuration data to obtain a detection result, including: the traffic processing sidecar container 9211 is used to intercept business messages in the traffic data; the traffic processing sidecar container 9211 is used to parse the business messages to obtain a parsing result; the traffic processing sidecar container 9211 is used to compare the parsing result with each abnormal feature rule data, and determine the number of abnormal feature rule data that the parsing result complies with; wherein, if the number is greater than or equal to 1, the traffic processing sidecar container 9211 determines that the detection result indicates that the traffic data is abnormal traffic data.

[0120] In some embodiments, the ingress service container group 921 also includes an exception reporting sidecar container 9212; the network function network element 920 is used to perform exception processing on the abnormal traffic data to generate processing results, and report the processing results to the service communication agent network element 910 through the signaling channel, including: the traffic processing sidecar container 9211 is used to forward the abnormal traffic data to the exception reporting sidecar container 9212; the exception reporting sidecar container 9212 is used to perform exception processing on the abnormal traffic data based on a preset processing method, and generate processing results according to the detection results and processing methods of the abnormal traffic data; the exception reporting sidecar container 9212 is used to report the processing results to the service communication agent network element 910 through the signaling channel.

[0121] In some embodiments, the ingress business container group 921 also includes a business container 9213; wherein, when the detection result indicates that the traffic data is normal traffic data, the traffic processing sidecar container 9211 is also used to send the normal traffic data to the business container 9213, so that the business container 9213 performs business processing according to the normal traffic data.

[0122] In some embodiments, the ingress service container group 921 also includes a configuration receiving side car container 9214; the network function network element 920 is used to send a configuration acquisition request to the service communication agent network element 910 through a signaling channel, including: the configuration receiving side car container 9214 is used to send a configuration acquisition request to the service communication agent network element 910 through a signaling channel; the service communication agent network element 910 is used to send traffic detection configuration data to the network function network element 920 through a signaling channel, including: the service communication agent network element 910 is used to send traffic detection configuration data to the configuration receiving side car container 9214 through a signaling channel; and, the configuration receiving side car container 9214 is also used to synchronize the traffic detection configuration data to the traffic processing side car container 9211.

[0123] In some embodiments, in the traffic processing system, the service communication agent network element 910 is further used to generate alarm information according to the processing result; the service communication agent network element 910 is further used to call a preconfigured communication system to report the alarm information.

[0124] In some embodiments, in the traffic processing system, the service communication agent network element 910 is also used to receive configuration write data from the user for the network function network element 920; when it is determined that the user has configuration authority, the service communication agent network element 910 is also used to store the traffic detection configuration data for the network function network element 920 in the configuration write data.

[0125] Fig. 9 For other contents of the embodiment, reference can be made to the other embodiments mentioned above.

[0126] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0127] Fig.10 The block diagram of a flow processing computer device in the embodiment of the present disclosure is shown. It should be noted that the electronic device shown in the figure is only an example and should not bring any limitation to the function and scope of use of the embodiment of the present invention.

[0128] Refer to the following Fig.10 The electronic device 1000 according to this embodiment of the present invention will be described. Fig.10 The electronic device 1000 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0129] like Fig.10 As shown, the electronic device 1000 is in the form of a general computing device. The components of the electronic device 1000 may include but are not limited to: the at least one processing unit 1010, the at least one storage unit 1020, and a bus 1030 connecting different system components (including the storage unit 1020 and the processing unit 1010).

[0130] The storage unit stores program codes, which can be executed by the processing unit 1010, so that the processing unit 1010 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 1010 can perform the following steps: Figure 2 The method shown in .

[0131] The storage unit 1020 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 10201 and / or a cache storage unit 10202 , and may further include a read-only storage unit (ROM) 10203 .

[0132] The storage unit 1020 may also include a program / utility 10204 having a set (at least one) of program modules 10205, such program modules 10205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0133] Bus 1030 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0134] The electronic device 1000 may also communicate with one or more external devices 1100 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1000, and / or communicate with any device that enables the electronic device 1000 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1050. Furthermore, the electronic device 1000 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1060. As shown, the network adapter 1060 communicates with other modules of the electronic device 1000 via a bus 1030. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0135] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0136] The program product for implementing the above method according to the embodiment of the present invention may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0137] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0138] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0139] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0140] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0141] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0142] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0143] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0144] According to one aspect of the present disclosure, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in various optional implementations of the above-mentioned embodiments.

[0145] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A traffic processing method, characterized in that: include: The service communication agent network element sends the flow detection configuration data to the network function network element through the signaling channel; wherein the network function network element includes at least one of the following: UDM network element, AMF network element, AUSF network element, PCF network element, NRF network element, SMF network element, AF network element, CHF network element, NEF network element; The network function network element performs an abnormality detection on the flow data arriving at the network function network element according to the flow detection configuration data to obtain a detection result; wherein the detection result is that the flow data is abnormal flow data, or the flow data is normal flow data; In the case where the detection result indicates that the traffic data is abnormal traffic data, the network function network element performs abnormal processing on the abnormal traffic data to generate a processing result, and reports the processing result to the service communication proxy network element through the signaling channel; The network function network element includes an ingress service container group, and the ingress service container group includes a traffic processing sidecar container and an abnormality reporting sidecar container; The network function network element performs anomaly detection on the flow data arriving at the network function network element according to the flow detection configuration data to obtain a detection result, including: The ingress service container group receives the flow data arriving at the network function network element; the flow processing sidecar container intercepts the flow data, and performs anomaly detection on the flow data according to the flow detection configuration data to obtain a detection result; The network function network element performs exception processing on the abnormal traffic data to generate a processing result, and reports the processing result to the service communication proxy network element through the signaling channel, including: The traffic processing sidecar container forwards the abnormal traffic data to the abnormal reporting sidecar container; the abnormal reporting sidecar container performs abnormal processing on the abnormal traffic data based on a preset processing method, and generates a processing result according to the detection result and processing method of the abnormal traffic data; the abnormal reporting sidecar container reports the processing result to the service communication proxy network element through the signaling channel; Among them, the preset processing method is pre-set in the exception reporting sidecar container; or, the preset processing method is determined by the exception reporting sidecar container by accessing the traffic detection configuration data stored in the traffic processing sidecar container.

2. The method according to claim 1, characterized in that The service communication agent NE sends traffic detection configuration data to the network function NE through the signaling channel, including: The network function network element sends a configuration acquisition request to the service communication proxy network element through the signaling channel; The service communication agent network element queries the target configuration data corresponding to the network function network element according to the configuration acquisition request to use it as the traffic detection configuration data; The service communication agent network element sends the flow detection configuration data to the network function network element through the signaling channel.

3. The method according to claim 1, characterized in that The traffic detection configuration data includes one or more abnormal feature rule data; The traffic processing sidecar container intercepts the traffic data, and performs anomaly detection on the traffic data according to the traffic detection configuration data to obtain a detection result, including: The traffic processing sidecar container intercepts the service message in the traffic data; The traffic processing sidecar container parses the service message to obtain a parsing result; The traffic processing sidecar container compares the analysis result with each abnormal feature rule data to determine the number of abnormal feature rule data that the analysis result complies with; Among them, if the number is greater than or equal to 1, the traffic processing sidecar container determines that the detection result indicates that the traffic data is abnormal traffic data.

4. The method according to claim 1, characterized in that: The inlet service container group also includes a service container; wherein the method further includes: When the detection result indicates that the traffic data is normal traffic data, the traffic processing sidecar container sends the normal traffic data to the business container, so that the business container performs business processing according to the normal traffic data.

5. The method according to claim 2, characterized in that: The ingress service container group also includes a configuration receiving sidecar container; The network function network element sends a configuration acquisition request to the service communication proxy network element through the signaling channel, including: the configuration receiving side car container sends a configuration acquisition request to the service communication proxy network element through the signaling channel; The service communication proxy network element sends the flow detection configuration data to the network function network element through the signaling channel, including: the service communication proxy network element sends the flow detection configuration data to the configuration receiving sidecar container through the signaling channel; and The method also includes: the configuration receiving sidecar container synchronizing the traffic detection configuration data to the traffic processing sidecar container.

6. The method according to claim 1, characterized in that The method further comprises: The service communication proxy network element generates alarm information according to the processing result; The service communication proxy network element calls a preconfigured communication system to report the alarm information.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: The service communication proxy network element receives configuration write data from a user for the network function network element; In the case where it is determined that the user has the configuration authority, the service communication agent network element stores the flow detection configuration data for the network function network element in the configuration write data.

8. A flow processing system, characterized in that: include: A service communication agent network element, used to send traffic detection configuration data to a network function network element through a signaling channel; wherein the network function network element includes at least one of the following: a UDM network element, an AMF network element, an AUSF network element, a PCF network element, an NRF network element, an SMF network element, an AF network element, a CHF network element, and a NEF network element; The network function network element is used to perform anomaly detection on the flow data arriving at the network function network element according to the flow detection configuration data to obtain a detection result; wherein the detection result is that the flow data is abnormal flow data, or the flow data is normal flow data; In the case where the detection result indicates that the traffic data is abnormal traffic data, the network function network element is used to perform abnormal processing on the abnormal traffic data to generate a processing result, and report the processing result to the service communication proxy network element through the signaling channel; The network function network element includes an ingress service container group, and the ingress service container group includes a traffic processing sidecar container and an abnormality reporting sidecar container; The network function network element performs anomaly detection on the flow data arriving at the network function network element according to the flow detection configuration data to obtain a detection result, including: The ingress service container group receives the flow data arriving at the network function network element; the flow processing sidecar container intercepts the flow data, and performs anomaly detection on the flow data according to the flow detection configuration data to obtain a detection result; The network function network element performs exception processing on the abnormal traffic data to generate a processing result, and reports the processing result to the service communication proxy network element through the signaling channel, including: The traffic processing sidecar container forwards the abnormal traffic data to the abnormal reporting sidecar container; the abnormal reporting sidecar container performs abnormal processing on the abnormal traffic data based on a preset processing method, and generates a processing result according to the detection result and processing method of the abnormal traffic data; the abnormal reporting sidecar container reports the processing result to the service communication proxy network element through the signaling channel; Among them, the preset processing method is pre-set in the exception reporting sidecar container; or, the preset processing method is determined by the exception reporting sidecar container by accessing the traffic detection configuration data stored in the traffic processing sidecar container.

9. A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the traffic processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the traffic processing method as described in any one of claims 1 to 7.

Images