A network data analysis method, device, system, equipment and storage medium

Abstract

The application discloses a network data analysis method, system and storage medium, the method is applied to a regional NWDAF node, and the method comprises the following steps: receiving first target network data; inputting the first target network data into a first machine learning model constructed in advance to output corresponding first data analysis results; the construction process of the first machine learning model comprises the following steps: determining a plurality of NFs with learning ability; acquiring a plurality of trained model parameters sent by the plurality of NFs, and aggregating the plurality of model parameters to obtain regional aggregation model parameters; wherein, an MTLF in each NF is used to train a machine learning model based on training network data to obtain a trained model parameter; and the first machine learning model is constructed locally based on the regional aggregation model parameters. The application realizes network data analysis under the premise of guaranteeing the safety of 5G core network data.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to a network data analysis method, apparatus system, electronic device, and computer-readable storage medium. Background Technology

[0002] The Network Data Analytics Function (NWDAF) proposed in 3GPP Releases 16 and 17 supports the intelligence of 5G networks. Federated learning technology reduces the computational burden on central nodes in traditional machine learning methods by uploading model updates, thus enhancing the security of traditional machine learning approaches. Integrating federated learning into the 5G core network can improve the security of 5G core network data services while reducing the amount of information transmitted between NFs (Network Functions), thereby improving communication efficiency.

[0003] Under the existing 5G core network service architecture, current NWDAF nodes can only perform traditional machine learning. NFs themselves do not have learning capabilities. Introducing learning capabilities into the existing core network architecture requires adding machine learning functionality to the NFs. Furthermore, after the NFs are trained using local data, the NWDAF nodes retrieve data from different NFs for model training and analysis. This data flows out of the network elements themselves, impacting privacy and data security, and directly applying NFs for model training leads to a decrease in NF performance.

[0004] Therefore, how to achieve network data analysis while ensuring the security of 5G core network data is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a network data analysis method, system, and computer-readable storage medium that enables network data analysis while ensuring the data security of the 5G core network.

[0006] To achieve the above objectives, this application provides a network data analysis method applied to regional NWDAF nodes, the method comprising:

[0007] Receive first target network data, input the first target network data into a pre-constructed first machine learning model, and output the corresponding first data analysis result;

[0008] The construction process of the first machine learning model includes:

[0009] Identify multiple NFs that possess learning capabilities;

[0010] Multiple trained model parameters sent by multiple NFs are obtained, and the multiple model parameters are aggregated to obtain region aggregated model parameters; wherein, the MTLF in each NF is used to train a machine learning model based on the training network data to obtain the trained model parameters.

[0011] The first machine learning model is constructed locally based on the parameters of the regional aggregation model.

[0012] The process of aggregating multiple model parameters to obtain regional aggregated model parameters further includes:

[0013] The regional aggregation model parameters are sent to the corresponding operator NWDAF node; wherein, the operator NWDAF node is used to aggregate all the received regional aggregation model parameters to obtain operator aggregation model parameters, and return the operator aggregation model parameters to the regional NWDAF node;

[0014] Receive the operator aggregation model parameters sent by the operator's NWDAF node, and update the local first machine learning model based on the operator aggregation model parameters.

[0015] Sending the regional aggregation model parameters to the corresponding operator NWDAF node includes:

[0016] When a first model parameter request is received from the corresponding operator NWDAF node, the regional aggregation model parameters are sent to the corresponding operator NWDAF node; wherein, the operator NWDAF node is used to determine all corresponding regional NWDAF nodes through NRF, and send the first model parameter request to all corresponding regional NWDAF nodes.

[0017] The operator's NWDAF node is also used to build a second machine learning model locally based on the operator's aggregation model parameters. The second machine learning model is used to infer the corresponding second data analysis result based on the second target network data.

[0018] The operator NWDAF node is further configured to send the operator aggregation model parameters to the top-level NWDAF node, and the top-level NWDAF node is configured to aggregate all the received operator aggregation model parameters to obtain top-level aggregation model parameters, and return the top-level aggregation model parameters to the operator NWDAF node.

[0019] The operator NWDAF node is also used to receive the top-level aggregation model parameters sent by the top-level NWDAF node, and update the local second machine learning model based on the top-level aggregation model parameters.

[0020] The operator NWDAF node is used to send the operator aggregated model parameters to the top-level NWDAF node when it receives the second model parameter request from the top-level NWDAF node. The top-level NWDAF node is also used to obtain the service addresses of all operator NWDAF nodes through NEF and send the second model parameter request to all operator NWDAF nodes based on the service addresses.

[0021] The top-level NWDAF node is also used to build a third machine learning model locally based on the parameters of the top-level aggregation model. The third machine learning model is used to perform inference based on the third target network data to obtain the corresponding third data analysis results.

[0022] The determination of multiple NFs with learning capabilities includes:

[0023] Multiple learning nodes (NFs) with learning capabilities were identified using NRF.

[0024] Each of the NFs is configured to: receive a registration request from the MTLF; wherein the registration request contains information indicating that the MTLF has learning capabilities; send the registration request to the NRF to complete the registration of the MTLF; and send training network data to the MTLF so that the MTLF can train a machine learning model based on the training network data to obtain the trained model parameters.

[0025] To achieve the above objectives, this application provides a network data analysis device applied to a regional NWDAF node, the device comprising:

[0026] The analysis module is used to receive the first target network data, input the first target network data into a pre-built first machine learning model, and output the corresponding first data analysis result.

[0027] The device further includes:

[0028] The determination module is used to identify multiple NFs that have learning capabilities;

[0029] The fusion module is used to obtain multiple trained model parameters sent by multiple NFs, and aggregate the multiple model parameters to obtain regional aggregated model parameters; wherein, the MTLF in each NF trains a machine learning model based on the training network data to obtain the trained model parameters.

[0030] A building module is used to build the first machine learning model locally based on the parameters of the regional aggregation model.

[0031] To achieve the above objectives, this application provides a network data analysis system, including a top-level NWDAF node, multiple operator NWDAF nodes, multiple regional NWDAF nodes, and multiple NFs, wherein each operator NWDAF node corresponds to multiple regional NWDAF nodes, and each regional NWDAF node corresponds to multiple NFs.

[0032] The MTLF in the NF is used to train a machine learning model based on the training network data to obtain the parameters of the trained model.

[0033] The regional NWDAF node is used to aggregate multiple model parameters obtained from the training of multiple NFs to obtain regional aggregated model parameters, and to build a first machine learning model locally based on the regional aggregated model parameters. When receiving the first target network data, the first target network data is input into the first machine learning model to output the corresponding first data analysis result.

[0034] The operator NWDAF node is used to aggregate the regional aggregation model parameters obtained by aggregating multiple corresponding regional NWDAF nodes to obtain operator aggregation model parameters, and to build a second machine learning model locally based on the operator aggregation model parameters. When receiving second target network data, the second target network data is input into the second machine learning model to output the corresponding second data analysis results.

[0035] The top-level NWDAF node is used to aggregate the operator aggregation model parameters obtained from all the operator NWDAF nodes to obtain the top-level aggregation model parameters, and to build a third machine learning model locally based on the top-level aggregation model parameters. When receiving third target network data, the third target network data is input into the third machine learning model to output the corresponding third data analysis results.

[0036] The operator NWDAF node is also used to return the operator aggregation model parameters to the corresponding NWDAF nodes in all regions.

[0037] The regional NWDAF node is also used to update the local first machine learning model based on the operator aggregation model parameters sent by the corresponding operator NWDAF node.

[0038] The top-level NWDAF node is also used to return the top-level aggregation model parameters to all the operator NWDAF nodes;

[0039] The operator's NWDAF node is also used to update a local second machine learning model based on the received parameters of the top-level aggregation model.

[0040] To achieve the above objectives, this application provides an electronic device, comprising:

[0041] Memory, used to store computer programs;

[0042] A processor is used to implement the steps of the network data analysis method described above when executing the computer program.

[0043] To achieve the above objectives, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the network data analysis method described above.

[0044] As can be seen from the above scheme, the network data analysis method provided in this application is applied to a regional NWDAF node. The method includes: receiving first target network data, inputting the first target network data into a pre-constructed first machine learning model to output a corresponding first data analysis result; the construction process of the first machine learning model includes: determining multiple NFs with learning capabilities; obtaining multiple trained model parameters sent by the multiple NFs, and aggregating the multiple model parameters to obtain regional aggregated model parameters; wherein, the MTLF in each NF is used to train the machine learning model based on the training network data to obtain the trained model parameters; and constructing the first machine learning model locally based on the regional aggregated model parameters.

[0045] In this application, the regional NWDAF node is only used for model parameter aggregation and data analysis, and not for training the machine learning model. That is, the regional NWDAF node only stores the model parameters of the machine learning model, and does not store any training network data. The training of the machine learning model is completed by the MTLF in the NF, meaning that the training network data is only stored in the NF. This ensures that the original training network data of the NF inside the 5G core network will not be leaked when the NWDAF node is attacked. Therefore, the network data analysis method provided in this application achieves network data analysis while ensuring the data security of the 5G core network. This application also discloses a network data analysis device, system, and a computer-readable storage medium, which can achieve the same technical effects.

[0046] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. The drawings are used to provide a further understanding of this disclosure and constitute a part of the specification. They are used together with the following detailed description to explain this disclosure, but do not constitute a limitation of this disclosure. In the drawings:

[0048] Figure 1 This is a flowchart illustrating the construction process of a machine learning model according to an exemplary embodiment;

[0049] Figure 2 This is a flowchart illustrating a network data analysis method according to an exemplary embodiment;

[0050] Figure 3 This is a structural diagram illustrating a network data analysis system according to an exemplary embodiment;

[0051] Figure 4 A multi-layered NWDAF architecture diagram is provided in one application embodiment of this application;

[0052] Figure 5 A flowchart illustrating machine learning model training in one application embodiment provided in this application;

[0053] Figure 6 This is a structural diagram illustrating a network data analysis apparatus according to an exemplary embodiment;

[0054] Figure 7 This is a structural diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0055] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Furthermore, in the embodiments of this application, "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0056] This application discloses a network data analysis method that achieves network data analysis while ensuring the data security of the 5G core network.

[0057] The network data analysis method includes:

[0058] Receive first target network data, input the first target network data into a pre-constructed first machine learning model, and output the corresponding first data analysis result;

[0059] In practice, users locate the regional NWDAF node providing data analysis services through NEF, requesting the service from that node along with their user ID (used to define the user's context) and target network data. The regional NWDAF node then inputs the target network data into its locally built machine learning model for inference, obtaining the corresponding data analysis results. For example, the target network data could be UE (User Equipment) location data from the AMF and OAM modules, and the data analysis results could be UE mobility data and UE location prediction information.

[0060] The construction process of the first machine learning model is described in [reference needed]. Figure 1 , Figure 1 This is a flowchart illustrating the construction process of a machine learning model according to an exemplary embodiment, such as... Figure 1 As shown, it includes:

[0061] S101: Identify multiple NFs that have learning capabilities;

[0062] The execution entity in this embodiment is the regional NWDAF node. It is understood that a 5G network contains multiple NFs, such as AMF (Access and Mobility Management Function), AF (Application Function), and OAM (Operation Administration and Maintenance), all of which need to register with the NRF (NF Repository Function). NFs in a 5G network may or may not have learning capabilities. In this step, the regional NWDAF node determines the multiple NFs with learning capabilities through the NRF.

[0063] S102: Obtain multiple trained model parameters sent by multiple NFs, and aggregate the multiple model parameters to obtain regional aggregated model parameters; wherein, the MTLF (Model Training logical function) in each NF is used to train a machine learning model based on the training network data to obtain the trained model parameters;

[0064] In this step, the regional NWDAF node sends a request to the NF to obtain model parameters and waits for the NF to respond with model parameters. If the number of received model parameters is greater than or equal to 2 within the waiting time, the received model parameters are aggregated to obtain the regional aggregated model parameters. As a feasible implementation, the regional aggregated model parameters can be obtained by weighted averaging of the multiple model parameters.

[0065] In this implementation, the MTLF in each NF trains a machine learning model based on the training network data to obtain the trained model parameters. As one possible implementation, the NF receives a registration request from the MTLF; the registration request includes information indicating that the MTLF has learning capabilities; the NF sends the registration request to the NRF to complete the registration of the MTLF; the NF sends training network data to the MTLF so that the MTLF can train a machine learning model based on the training network data to obtain the trained model parameters.

[0066] In practical implementation, a machine learning learning (NF) with learning capabilities deploys an MTLF module locally for training machine learning models. The MTLF training process can be handled on a single core without affecting the NF's business processes, avoiding high CPU usage that could weaken the NF's processing power. Upon startup, the MTLF sends a registration request to the NF. Upon receiving the request, the NF registers or updates its registration with the NRF, indicating in the registration request that it possesses data learning capabilities. The MTLF subscribes to training network data from the NF and receives a successful subscription response from the NF. When network data in the NF is updated, it notifies the MTLF and transmits this network data as training network data to the MTLF. The MTLF trains a machine learning model based on the received training network data. The model parameters after training are stored locally, awaiting a request from the regional NWDAF node to retrieve the model parameters before transmission. Preferably, when the amount of received training network data reaches a preset value, the MTLF trains the machine learning model based on the training network data to obtain the trained model parameters.

[0067] S103: Construct the first machine learning model locally based on the parameters of the regional aggregation model.

[0068] In this step, the regional NWDAF node builds a first machine learning model locally based on the regional aggregation model parameters obtained from the aggregation. This first machine learning model is used to implement data inference.

[0069] In this embodiment, the regional NWDAF node is only used for model parameter aggregation and data analysis, and not for training the machine learning model. That is, the regional NWDAF node only stores the model parameters of the machine learning model, and does not store any training network data. The training of the machine learning model is completed by the MTLF in the NF, meaning that the training network data is only stored in the NF. This ensures that the original training network data of the NF inside the 5G core network will not be leaked when the NWDAF node is attacked. Therefore, the network data analysis method provided in this embodiment achieves network data analysis while ensuring the data security of the 5G core network.

[0070] This application discloses a network data analysis method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution. Specifically, based on the size of the data service area, NWDAF nodes are divided into top-level NWDAF nodes, operator NWDAF nodes, and regional NWDAF nodes. Each top-level NWDAF node corresponds to multiple operator NWDAF nodes, each operator NWDAF node corresponds to multiple regional NWDAF nodes, and each regional NWDAF node corresponds to multiple NFs.

[0071] See Figure 2 A flowchart illustrating a network data analysis method according to an exemplary embodiment, such as... Figure 2 As shown, it includes:

[0072] S201: The NWDAF node in the region identifies multiple NFs with learning capabilities;

[0073] S202: The regional NWDAF node obtains multiple trained model parameters sent by multiple NFs, and aggregates the multiple model parameters to obtain regional aggregated model parameters; wherein, the MTLF in each NF trains a machine learning model based on the training network data to obtain the trained model parameters;

[0074] S203: The regional NWDAF node constructs a first machine learning model locally based on the regional aggregation model parameters; wherein, when the first target network data is received, the first target network data is input into the first machine learning model to output the corresponding first data analysis result;

[0075] S204: The regional NWDAF node sends the regional aggregation model parameters to the corresponding operator NWDAF node;

[0076] In this embodiment, the regional NWDAF node sends the aggregated regional aggregation model parameters to the corresponding upper-layer NWDAF node, namely the operator NWDAF node.

[0077] As a possible implementation, when a regional NWDAF node receives a first model parameter request from a corresponding operator NWDAF node, it sends the regional aggregated model parameters to the corresponding operator NWDAF node; wherein, the operator NWDAF node determines all corresponding regional NWDAF nodes through NRF and sends the first model parameter request to all corresponding regional NWDAF nodes.

[0078] In practice, the operator's NWDAF node finds the regional NWDAF node through NRF. The parameters it carries can be slice granularity or TAI (Tracking Area Identity) granularity. The operator's NWDAF node sends a request to the regional NWDAF node to obtain model parameters and waits for the regional NWDAF node to respond with regional aggregated model parameters.

[0079] S205: The operator's NWDAF node aggregates all the received regional aggregation model parameters to obtain the operator's aggregation model parameters;

[0080] In this step, if the number of regional aggregation model parameters received by the operator's NWDAF node within the waiting time is greater than or equal to 2, then the received regional aggregation model parameters are aggregated to obtain the operator's aggregation model parameters. As a feasible implementation, the operator's aggregation model parameters can be obtained by weighted averaging of the multiple regional aggregation model parameters.

[0081] S206: The operator NWDAF node constructs a second machine learning model locally based on the operator aggregation model parameters, and returns the operator aggregation model parameters to the regional NWDAF node; wherein, upon receiving the second target network data, the second target network data is input into the second machine learning model to output the corresponding second data analysis result;

[0082] In this step, the operator's NWDAF node builds a machine learning model locally based on the aggregated operator model parameters. This machine learning model is used to perform inference based on the target network data to obtain data analysis results. Simultaneously, the operator's NWDAF node returns the aggregated operator model parameters to all its corresponding regional NWDAF nodes.

[0083] S207: The regional NWDAF node receives the operator aggregation model parameters sent by the operator NWDAF node, and updates its local first machine learning model based on the operator aggregation model parameters.

[0084] In this step, the regional NWDAF node receives operator aggregation model parameters from the upper-layer operator NWDAF node and updates its local machine learning model based on the received operator aggregation model parameters.

[0085] S208: The operator NWDAF node sends the operator aggregation model parameters to the top-level NWDAF node;

[0086] In this step, the operator NWDAF node sends the aggregated operator aggregation model parameters to the corresponding upper-layer NWDAF node, i.e., the top-level NWDAF node.

[0087] As a possible implementation, when the operator NWDAF node receives the second model parameter request from the top-level NWDAF node, the operator NWDAF node sends the operator aggregated model parameters to the top-level NWDAF node; wherein, the top-level NWDAF node obtains the service addresses of all operator NWDAF nodes through NEF, and sends the second model parameter request to all operator NWDAF nodes based on the service addresses.

[0088] In practice, the top-level NWDAF node obtains the service addresses of different operator NWDAF nodes through NEF (Network Exposure Function), sends a request to the operator NWDAF node to obtain model parameters based on the service address, and the operator NWDAF node waits for the operator to aggregate model parameters.

[0089] S209: The top-level NWDAF node aggregates all the received operator aggregation model parameters to obtain the top-level aggregation model parameters;

[0090] In this step, if the top-level NWDAF node receives more than or equal to two operator aggregation model parameters within the waiting time, it aggregates these multiple operator aggregation model parameters to obtain the top-level aggregation model parameters. As a feasible implementation, a weighted average of the multiple operator aggregation model parameters can be used to obtain the top-level aggregation model parameters.

[0091] S210: The top-level NWDAF node constructs a third machine learning model locally based on the top-level aggregation model parameters, and returns the top-level aggregation model parameters to the operator NWDAF node; wherein, upon receiving third target network data, the third target network data is input into the third machine learning model to output the corresponding third data analysis result;

[0092] In this step, the top-level NWDAF node builds a machine learning model locally based on the top-level aggregated model parameters obtained from the aggregation. This machine learning model is used to perform inference based on the target network data to obtain data analysis results. Simultaneously, the top-level NWDAF node returns the top-level aggregated model parameters obtained from the aggregation to all its corresponding operator NWDAF nodes.

[0093] S211: The operator's NWDAF node receives the top-level aggregation model parameters sent by the top-level NWDAF node, and updates its local second machine learning model based on the top-level aggregation model parameters.

[0094] In this step, the operator's NWDAF node receives the top-level aggregation model parameters from the previous layer, i.e., the top-level NWDAF node, and updates its local machine learning model based on the received top-level aggregation model parameters.

[0095] In other words, in this embodiment, NF is responsible for training the model parameters, and each NWDAF node, including the top-level NWDAF node, the operator NWDAF node, and the regional NWDAF node, has data inference capabilities. It should be noted that in this embodiment, the first target network data, the second target network data, and the third target network data can be the same data or different data; no specific limitation is made here.

[0096] This application embodiment divides NWDAF nodes into top-level NWDAF nodes, operator NWDAF nodes, and regional NWDAF nodes based on the size of the data service area. Regardless of the type of NWDAF node, it is only used for model parameter aggregation and data analysis, not for training machine learning models. That is, the NWDAF node only stores the model parameters of the machine learning model and does not store any training network data. The training of the machine learning model is completed by the MTLF in the NF, meaning that the training network data is only stored in the NF. This ensures that the original training network data of the NF inside the 5G core network will not be leaked when the NWDAF node is attacked. Therefore, the network data analysis method provided by this application embodiment achieves network data analysis while ensuring the data security of the 5G core network.

[0097] This application discloses a network data analysis system, specifically:

[0098] See Figure 3 A structural diagram of a network data analysis system according to an exemplary embodiment is shown below. Figure 3As shown, it includes a top-level NWDAF node 100, multiple operator NWDAF nodes 200, multiple regional NWDAF nodes 300, and multiple NF400. Each operator NWDAF node 200 corresponds to multiple regional NWDAF nodes 300, and each regional NWDAF node 300 corresponds to multiple NF400.

[0099] In this embodiment, based on the size of the data service area, NWDAF nodes are divided into top-level NWDAF nodes, carrier NWDAF nodes, and regional NWDAF nodes. One top-level NWDAF node corresponds to multiple carrier NWDAF nodes, one carrier NWDAF node 200 corresponds to multiple regional NWDAF nodes, and one regional NWDAF node 300 corresponds to multiple NFs.

[0100] The MTLF in the NF is used to train a machine learning model based on the training network data to obtain the parameters of the trained model.

[0101] In practical implementation, a machine learning learning (NF) with learning capabilities deploys an MTLF module locally for training machine learning models. The MTLF training process can be handled on a single CPU core without affecting the NF's business processes, avoiding high CPU usage that could weaken the NF's processing power. Upon startup, the MTLF sends a registration request to the NF. Upon receiving the request, the NF registers or updates its registration with the NRF, indicating in the registration request that it possesses data learning capabilities. The MTLF subscribes to training network data from the NF and receives a successful subscription response from the NF. When network data in the NF is updated, it notifies the MTLF and transmits this updated network data as training network data to the MTLF. The MTLF trains the machine learning model based on the received training network data. The model parameters after training are stored locally, awaiting a request from the regional NWDAF node to retrieve the model parameters before transmission. Preferably, the MTLF trains the machine learning model based on the received training network data to obtain the trained model parameters when the amount of received training network data reaches a preset value.

[0102] The regional NWDAF node is used to aggregate multiple model parameters obtained from the training of multiple NFs to obtain regional aggregated model parameters, and to build a first machine learning model locally based on the regional aggregated model parameters. When receiving the first target network data, the first target network data is input into the first machine learning model to output the corresponding first data analysis result.

[0103] In practice, the regional NWDAF node sends a request to the NF to obtain model parameters and waits for the NF to respond with model parameters. If the number of received model parameters is greater than or equal to two within the waiting time, the received model parameters are aggregated to obtain the regional aggregated model parameters. As a feasible implementation method, the regional aggregated model parameters can be obtained by weighted averaging of the multiple model parameters.

[0104] Furthermore, the regional NWDAF node is also used to build a first machine learning model locally based on the regional aggregation model parameters obtained from the aggregation. This first machine learning model is used for data inference based on the first target network data received from the client.

[0105] The operator NWDAF node is used to aggregate the regional aggregation model parameters obtained by aggregating multiple corresponding regional NWDAF nodes to obtain operator aggregation model parameters, and to build a second machine learning model locally based on the operator aggregation model parameters. When receiving second target network data, the second target network data is input into the second machine learning model to output the corresponding second data analysis results.

[0106] In practice, the operator's NWDAF node locates the regional NWDAF node via NRF. The parameters carried by the operator's NWDAF node can be at the slice granularity or TAI (Tracking Area Identity) granularity. The operator's NWDAF node sends a request to the regional NWDAF node to obtain model parameters and waits for the regional NWDAF node's response regarding the regional aggregated model parameters. If, within the waiting time, the number of received regional aggregated model parameters is greater than or equal to two, the received regional aggregated model parameters are aggregated to obtain the operator's aggregated model parameters. As a feasible implementation, a weighted average of the multiple regional aggregated model parameters can be used to obtain the operator's aggregated model parameters.

[0107] Furthermore, the operator's NWDAF node is also used to build a second machine learning model locally based on the operator aggregation model parameters obtained from the aggregation. This second machine learning model is used for data inference based on the second target network data received from the client.

[0108] The top-level NWDAF node is used to aggregate the operator aggregation model parameters obtained from all the operator NWDAF nodes to obtain the top-level aggregation model parameters, and to build a third machine learning model locally based on the top-level aggregation model parameters. When receiving third target network data, the third target network data is input into the third machine learning model to output the corresponding third data analysis results.

[0109] In practical implementation, the top-level NWDAF node obtains the service addresses of different operator NWDAF nodes through NEF, and sends a request to the operator NWDAF nodes to obtain model parameters based on the service address. The operator NWDAF nodes wait for the response to obtain the operator aggregated model parameters. If the number of received operator aggregated model parameters is greater than or equal to 2 within the waiting time, the received multiple operator aggregated model parameters are aggregated to obtain the top-level aggregated model parameters. As a feasible implementation method, the top-level aggregated model parameters can be obtained by weighted averaging of multiple operator aggregated model parameters. Further, the top-level NWDAF node distributes the top-level aggregated model parameters to all corresponding operator NWDAF nodes, and all operator NWDAF nodes update their model parameters.

[0110] Furthermore, the top-level NWDAF node is also used to build a third machine learning model locally based on the parameters of the top-level aggregation model obtained from the aggregation. This third machine learning model is used for data inference based on the target network data received from the client.

[0111] In a preferred embodiment, the operator NWDAF node is further configured to return the operator aggregation model parameters to all corresponding regional NWDAF nodes; the regional NWDAF node is further configured to update its local first machine learning model based on the operator aggregation model parameters received from the corresponding operator NWDAF node.

[0112] In practice, the operator NWDAF node is also used to return the aggregated operator model parameters to all its corresponding regional NWDAF nodes. The regional NWDAF node is also used to update its local first machine learning model based on the operator aggregated model parameters received from the corresponding operator NWDAF node.

[0113] In a preferred embodiment, the top-level NWDAF node is further configured to return the top-level aggregated model parameters to all the operator NWDAF nodes; the operator NWDAF node is further configured to update its local second machine learning model based on the received top-level aggregated model parameters.

[0114] In practice, the top-level NWDAF node is also used to return the top-level aggregation model parameters obtained from the aggregation to all regional NWDAF nodes, and the operator's NWDAF node is also used to update the local second machine learning model based on the received top-level aggregation model parameters.

[0115] This application embodiment divides NWDAF nodes into top-level NWDAF nodes, operator NWDAF nodes, and regional NWDAF nodes based on the size of the data service area. Regardless of the type of NWDAF node, it is only used for model parameter aggregation and data analysis, not for training machine learning models. That is, the NWDAF node only stores the model parameters of the machine learning model and does not store any training network data. The training of the machine learning model is completed by the MTLF in the NF, meaning that the training network data is only stored in the NF. This ensures that the original training network data of the NF inside the 5G core network will not be leaked when the NWDAF node is attacked. Therefore, this application embodiment achieves network data analysis while ensuring the data security of the 5G core network.

[0116] The following describes an application embodiment provided by this application, such as... Figure 4 As shown, Figure 4 The application embodiment provided in this application presents a multi-layered NWDAF architecture diagram, which includes a top-level NWDAF, a carrier NWDAF, and a regional NWDAF; regardless of the type of NWDAF, it only includes an aggregation module and an inference module, and does not have a data training module.

[0117] Top-level NWDAF can be a third-party application that provides a series of data analysis functions for the core network. The data it collects includes all data from China Unicom and China Mobile. Operator NWDAFs include those from China Mobile and China Unicom; their SupiRange (representing a range of user IDs) registered in the NRF contains all data from that network. Regional NWDAFs can be NWDAFs for a specific region, and their SupiRanges registered in the NRF correspond only to user data within that region. NFs include AMF1, AMF2, and OAM. Regional NWDAFs can collect UE location data for location services from the AMF and OAM modules in that region, and use machine learning models to predict UE mobility data and UE mobility location prediction information.

[0118] like Figure 5 As shown, Figure 5 This document provides a flowchart for machine learning model training in one application embodiment. AMF1, AMF2, and OAM deploy a local MTLF through an event subscription process. After registering their services with the NRF, AMF1, AMF2, and OAM send an event notification to the local MTLF. Upon receiving the notification, the local MTLF performs model training. Taking AMF1 as an example, the specific steps are as follows:

[0119] Step S1: When MTLF starts, it registers with AMF1, and AMF1 returns a successful registration response;

[0120] Step S2: AMF1 initiates a service registration process with NRF, writing AMF1 service information into NRF, which includes information about AMF1's support for machine learning;

[0121] Step S3: Configure MTLF service subscription data. MTLF and AMF1 use a private interface. The message data content can be found in the corresponding Namf_EventExposure_Subscribe in 3GPP protocol 23502.h30-5.2.2.3.2 and the corresponding Subscribe(Input) subscription service information in 28.532.

[0122] Step S4: AMF1 initiates an event notification process to the local MTLF. The notification message can be found in the definition of the Namf_EventExposure_Notify protocol, which notifies the MTLF to perform model training.

[0123] Step S5: MTLF performs the model training process.

[0124] Step S6: The local MTLF uploads the trained model parameters to the aggregation module of the regional NWDAF node through the Nnwdaf_AnalyticsInfo_Request / Nnwdaf_AnalyticsInfo_Subscribe process to complete the aggregation.

[0125] The process of operator NWDAF discovering regional NWDAF, operator NWDAF aggregating model parameters, and regional NWDAF updating model parameters is as follows:

[0126] Step S1: The regional NWDAF registers with the NRF of its network;

[0127] Step S2: The operator's NWDAF finds the regional NWDAF through NRF, and the parameters it carries can be slice granularity or TAI granularity;

[0128] Step S3: The operator's NWDAF sends a request to the acquired regional NWDAF to obtain model parameters and waits for a response;

[0129] Step S4: If the operator's NWDAF receives more than or equal to 2 responses within the waiting time, then the model parameters are weighted and averaged, and then proceed to step S5; otherwise, proceed to step S6.

[0130] Step S5: The operator's NWDAF distributes the aggregated model parameters to the acquired regional NWDAF, and the regional NWDAF updates the model parameters.

[0131] Step S6: The operator's NWDAF aggregation process failed. Waiting for the next aggregation process to be started.

[0132] The top-level NWDAF does not need to access the 5G core network; it obtains the model parameters from the operator's NWDAF through the NEF function exposed by various networks. The process of the top-level NWDAF discovering China Mobile's NWDAF and China Unicom's NWDAF, aggregating model parameters, and updating model parameters by the operator's NWDAF is as follows:

[0133] Step S1: China Mobile NWDAF or China Unicom NWDAF registers with the NRF of its network and indicates in the registration information that the SupiRange range is all users of the network;

[0134] Step S2: The top-level NWDAF requests NWDAF services from the NEFs exposed by each network;

[0135] Step S3: Each network-exposed NEF queries the SupiRange range of all operator NWDAFs through its network's NRF and sends a request to obtain model parameters.

[0136] Step S4: The NEF exposed by each network collects the model parameters returned by the NWDAF and returns the results to the top-level NWDAF;

[0137] Step S5: The top-level NWDAF aggregates the parameter models of multiple operators' NWDAFs and uses the aggregation results for inference services;

[0138] Step S6: The top-level NWDAF distributes the aggregation results to the corresponding operator NWDAF through the NEF functions exposed by each network, and the operator NWDAF updates the model parameters.

[0139] The process for users to obtain data inference services is as follows:

[0140] Step S1: The user finds the NWDAF node that provides data analysis services through NEF;

[0141] Step S2: The user requests data inference service from the NWDAF node, carrying information such as user ID, AMF module, and UE location data from the OAM module;

[0142] Step S3: After receiving the information, the NWDAF node obtains the inference service from the inference module. If the inference module does not have model parameters, proceed to S4. Otherwise, the inference module builds a machine learning model based on the model parameters and inputs the UE location data from the AMF module and OAM module into the machine learning model to obtain the inference result containing UE movement data and UE movement location prediction information and returns it to the user.

[0143] Step S4: The inference module notifies the aggregation module to perform an aggregation operation, updates the parameters of the inference module with the aggregation result, and then performs inference.

[0144] The following describes a network data analysis device provided in an embodiment of this application. The network data analysis device described below and the network data analysis method described above can be referred to each other.

[0145] See Figure 6 A structural diagram of a network data analysis apparatus according to an exemplary embodiment is shown, such as... Figure 6 As shown, it includes:

[0146] Module 601 is used to determine multiple NFs that have learning capabilities;

[0147] The fusion module 602 is used to obtain multiple trained model parameters sent by multiple NFs, and to aggregate the multiple model parameters to obtain regional aggregated model parameters; wherein, the MTLF in each NF is used to train a machine learning model based on the training network data to obtain the trained model parameters.

[0148] Module 603 is used to build a first machine learning model locally based on the parameters of the regional aggregation model;

[0149] The analysis module 604 is used to receive the first target network data, input the first target network data into a pre-built first machine learning model, and output the corresponding first data analysis result.

[0150] In this embodiment, the regional NWDAF node is only used for model parameter aggregation and data analysis, and not for training the machine learning model. That is, the regional NWDAF node only stores the model parameters of the machine learning model, and does not store any training network data. The training of the machine learning model is completed by the MTLF in the NF, meaning that the training network data is only stored in the NF. This ensures that the original training network data of the NF inside the 5G core network will not be leaked when the NWDAF node is attacked. Therefore, the network data analysis device provided in this embodiment achieves network data analysis while ensuring the data security of the 5G core network.

[0151] Based on the above embodiments, as a preferred embodiment, it further includes:

[0152] The sending module is used to send the regional aggregation model parameters to the corresponding operator NWDAF node; wherein, the operator NWDAF node is used to aggregate all the received regional aggregation model parameters to obtain operator aggregation model parameters, and return the operator aggregation model parameters to the regional NWDAF node;

[0153] The update module is used to receive the operator aggregation model parameters sent by the operator NWDAF node, and update the local first machine learning model based on the operator aggregation model parameters.

[0154] Based on the above embodiments, as a preferred implementation, the sending module is specifically used to: when receiving a first model parameter request from the corresponding operator NWDAF node, send the regional aggregation model parameters to the corresponding operator NWDAF node; wherein, the operator NWDAF node is used to determine all corresponding regional NWDAF nodes through NRF, and send the first model parameter request to all corresponding regional NWDAF nodes.

[0155] Based on the above embodiments, as a preferred implementation, the operator NWDAF node is further used to construct a second machine learning model locally based on the operator aggregation model parameters. The second machine learning model is used to infer the corresponding second data analysis result based on the second target network data.

[0156] Based on the above embodiments, as a preferred implementation, the operator NWDAF node is further configured to send the operator aggregation model parameters to the top-level NWDAF node, and the top-level NWDAF node is configured to aggregate all the received operator aggregation model parameters to obtain top-level aggregation model parameters, and return the top-level aggregation model parameters to the operator NWDAF node;

[0157] The operator NWDAF node is also used to receive the top-level aggregation model parameters sent by the top-level NWDAF node, and update the local second machine learning model based on the top-level aggregation model parameters.

[0158] Based on the above embodiments, as a preferred implementation, the operator NWDAF node is used to send the operator aggregated model parameters to the top-level NWDAF node when it receives the second model parameter request from the top-level NWDAF node. The top-level NWDAF node is also used to obtain the service addresses of all the operator NWDAF nodes through NEF and send the second model parameter request to all the operator NWDAF nodes based on the service addresses.

[0159] Based on the above embodiments, as a preferred implementation, the top-level NWDAF node is also used to construct a third machine learning model locally based on the parameters of the top-level aggregation model. The third machine learning model is used to perform inference based on the third target network data to obtain the corresponding third data analysis results.

[0160] Based on the above embodiments, as a preferred implementation, the determining module 601 is specifically used to: determine multiple NFs with learning capabilities through NRF.

[0161] Based on the above embodiments, as a preferred implementation, each of the NFs is used to: receive a registration request from the MTLF; wherein the registration request includes information indicating that the MTLF has learning capabilities; send the registration request to the NRF to complete the registration of the MTLF; and send training network data to the MTLF so that the MTLF can train a machine learning model based on the training network data to obtain the trained model parameters.

[0162] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0163] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide an electronic device. Figure 7 This is a structural diagram of an electronic device according to an exemplary embodiment, such as... Figure 7 As shown, the electronic device includes:

[0164] Communication interface 1 enables information exchange with other devices, such as network devices;

[0165] Processor 2 is connected to communication interface 1 to enable information interaction with other devices and, when running a computer program, executes the network data analysis methods provided by one or more of the above-mentioned technical solutions. The computer program is stored in memory 3.

[0166] Of course, in practical applications, the various components in an electronic device are coupled together through bus system 4. It can be understood that bus system 4 is used to achieve communication and connection between these components. In addition to the data bus, bus system 4 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 7 The general will label all buses as Bus System 4.

[0167] The memory 3 in this embodiment is used to store various types of data to support the operation of the electronic device. Examples of such data include any computer program used to operate on the electronic device.

[0168] It is understood that memory 3 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 3 described in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.

[0169] The methods disclosed in the embodiments of this application can be applied to processor 2, or implemented by processor 2. Processor 2 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 2 or by instructions in the form of software. The processor 2 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 2 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 3. Processor 2 reads the program in memory 3 and completes the steps of the aforementioned method in combination with its hardware.

[0170] When processor 2 executes the program, it implements the corresponding processes in the various methods of the embodiments of this application. For the sake of brevity, these will not be described in detail here.

[0171] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 3 storing a computer program, which can be executed by a processor 2 to complete the steps executed by any one of the top-level NWDAF node, operator NWDAF node, regional NWDAF node, and NF in the network data analysis system. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM.

[0172] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of any one of the top-level NWDAF node, operator NWDAF node, regional NWDAF node, and NF in the network data analysis system. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0173] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0174] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network data analysis method, characterized in that, Applied to regional NWDAF nodes, the method includes: Receive first target network data, input the first target network data into a pre-constructed first machine learning model, and output the corresponding first data analysis result; The construction process of the first machine learning model includes: Identify multiple NFs that possess learning capabilities; Multiple trained model parameters sent by multiple NFs are obtained, and the multiple model parameters are aggregated to obtain region aggregated model parameters; wherein, the MTLF in each NF is used to train a machine learning model based on the training network data to obtain the trained model parameters. The first machine learning model is constructed locally based on the parameters of the regional aggregation model. The regional aggregation model parameters are sent to the corresponding operator NWDAF node; wherein, the operator NWDAF node is used to aggregate all the received regional aggregation model parameters to obtain operator aggregation model parameters, and to build a second machine learning model locally based on the operator aggregation model parameters, and the second machine learning model is used to perform inference based on the second target network data to obtain the corresponding second data analysis result; The operator NWDAF node is further configured to send the operator aggregation model parameters to the top-level NWDAF node. The top-level NWDAF node is configured to aggregate all the received operator aggregation model parameters to obtain top-level aggregation model parameters, and to build a third machine learning model locally based on the top-level aggregation model parameters. The third machine learning model is configured to perform inference based on the third target network data to obtain the corresponding third data analysis results. The NWDAF nodes in the region are used only to store the model parameters of the machine learning model, not for training the machine learning model, and do not store the training network data.

2. The network data analysis method according to claim 1, characterized in that, The operator NWDAF node is also used to return the operator aggregation model parameters to the regional NWDAF node; The method further includes: Receive the operator aggregation model parameters sent by the operator's NWDAF node, and update the local first machine learning model based on the operator aggregation model parameters.

3. The network data analysis method according to claim 2, characterized in that, Sending the regional aggregation model parameters to the corresponding operator NWDAF node includes: When a first model parameter request is received from the corresponding operator NWDAF node, the regional aggregation model parameters are sent to the corresponding operator NWDAF node; wherein, the operator NWDAF node is used to determine all corresponding regional NWDAF nodes through NRF, and send the first model parameter request to all corresponding regional NWDAF nodes.

4. The network data analysis method according to claim 1, characterized in that, The top-level NWDAF node is also used to return the top-level aggregation model parameters to the operator NWDAF node; The operator NWDAF node is also used to receive the top-level aggregation model parameters sent by the top-level NWDAF node, and update the local second machine learning model based on the top-level aggregation model parameters.

5. The network data analysis method according to claim 4, characterized in that, The operator NWDAF node is used to send the operator aggregated model parameters to the top-level NWDAF node when it receives the second model parameter request from the top-level NWDAF node. The top-level NWDAF node is also used to obtain the service addresses of all the operator NWDAF nodes through NEF and send the second model parameter request to all the operator NWDAF nodes based on the service addresses.

6. The network data analysis method according to claim 1, characterized in that, The determination of multiple NFs with learning capabilities includes: Multiple learning nodes (NFs) with learning capabilities were identified using NRF.

7. The network data analysis method according to claim 1, characterized in that, Each of the NFs is configured to: receive a registration request from an MTLF; wherein the registration request contains information indicating that the MTLF has learning capabilities; send the registration request to the NRF to complete the registration of the MTLF; and send training network data to the MTLF so that the MTLF can train a machine learning model based on the training network data to obtain the trained model parameters.

8. A network data analysis device, characterized in that, The device, applied to regional NWDAF nodes, includes: The analysis module is used to receive the first target network data, input the first target network data into a pre-built first machine learning model, and output the corresponding first data analysis result. The device further includes: The determination module is used to identify multiple NFs that have learning capabilities; The fusion module is used to obtain multiple trained model parameters sent by multiple NFs, and aggregate the multiple model parameters to obtain regional aggregated model parameters; wherein, the MTLF in each NF trains a machine learning model based on the training network data to obtain the trained model parameters. A building module is used to build the first machine learning model locally based on the parameters of the regional aggregation model; The sending module is used to send the regional aggregation model parameters to the corresponding operator NWDAF node; wherein, the operator NWDAF node is used to aggregate all the received regional aggregation model parameters to obtain operator aggregation model parameters, and to build a second machine learning model locally based on the operator aggregation model parameters, and the second machine learning model is used to perform inference based on the second target network data to obtain the corresponding second data analysis result; The operator NWDAF node is further configured to send the operator aggregation model parameters to the top-level NWDAF node. The top-level NWDAF node is configured to aggregate all the received operator aggregation model parameters to obtain top-level aggregation model parameters, and to build a third machine learning model locally based on the top-level aggregation model parameters. The third machine learning model is configured to perform inference based on the third target network data to obtain the corresponding third data analysis results. The NWDAF nodes in the region are used only to store the model parameters of the machine learning model, not for training the machine learning model, and do not store the training network data.

9. A network data analysis system, characterized in that, It includes a top-level NWDAF node, multiple operator NWDAF nodes, multiple regional NWDAF nodes, and multiple NFs, with each operator NWDAF node corresponding to multiple regional NWDAF nodes, and each regional NWDAF node corresponding to multiple NFs; The MTLF in the NF is used to train a machine learning model based on the training network data to obtain the parameters of the trained model. The regional NWDAF node is used to aggregate multiple model parameters obtained from the training of multiple NFs to obtain regional aggregated model parameters, and to build a first machine learning model locally based on the regional aggregated model parameters. When receiving the first target network data, the first target network data is input into the first machine learning model to output the corresponding first data analysis result. The regional NWDAF node is only used to store the model parameters of the machine learning model, not for training the machine learning model, and does not store the training network data. The operator NWDAF node is used to aggregate the regional aggregation model parameters obtained by aggregating multiple corresponding regional NWDAF nodes to obtain operator aggregation model parameters, and to build a second machine learning model locally based on the operator aggregation model parameters. When receiving second target network data, the second target network data is input into the second machine learning model to output the corresponding second data analysis results. The top-level NWDAF node is used to aggregate the operator aggregation model parameters obtained from all the operator NWDAF nodes to obtain the top-level aggregation model parameters, and to build a third machine learning model locally based on the top-level aggregation model parameters. When receiving third target network data, the third target network data is input into the third machine learning model to output the corresponding third data analysis results.

10. The network data analysis system according to claim 9, characterized in that, The operator NWDAF node is also used to return the operator aggregation model parameters to the corresponding NWDAF nodes in all regions. The regional NWDAF node is also used to update the local first machine learning model based on the operator aggregation model parameters sent by the corresponding operator NWDAF node.

11. The network data analysis system according to claim 9, characterized in that, The top-level NWDAF node is also used to return the top-level aggregation model parameters to all the operator NWDAF nodes; The operator's NWDAF node is also used to update a local second machine learning model based on the received parameters of the top-level aggregation model.

12. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the network data analysis method as described in any one of claims 1 to 7.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the network data analysis method as described in any one of claims 1 to 7.

Images