Joint air interface electromagnetic data and system measurement data interference monitoring method and apparatus

Abstract

The application discloses a kind of interference monitoring method and device of combined air interface electromagnetic data and system measurement data, the method comprises: obtaining the combined air interface electromagnetic data and system measurement data of mobile communication network;Based on system measurement data, it is judged whether the mobile communication network exists interference;In the case where mobile communication network exists interference, the type of interference is obtained based on combined air interface electromagnetic data or system measurement data.The present application can detect the interference event that threatens the air interface signal quality of mobile communication network, and alarm and disposal.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of mobile communication network security technology, and in particular to a method and device for monitoring interference by combining air interface electromagnetic data and system measurement data. BACKGROUND

[0002] With the rapid development of mobile communication technology, mobile communication networks have been widely used in people's daily life, and have profoundly changed the way people produce, live and even work. The network scale of mobile communication networks and the types of Internet services they carry continue to increase, and wireless links are open, so attacks on wireless air interface signals have become a serious problem in mobile communication networks.

[0003] Interference with air interface signals affects the quality of communication services and the reliability of communication transmission in mobile communication networks. There are many types of air interface interference, which can be divided into two aspects according to their sources: internal interference and external interference. The source of internal interference is the mobile communication network itself, which mainly includes co-channel interference, adjacent channel interference and intermodulation interference. Among them, co-channel interference is interference caused by frequency reuse within the system; adjacent channel interference is interference from adjacent or similar channels; intermodulation interference is caused by the nonlinearity of communication circuits, which causes new frequencies to be superimposed on input frequencies, affecting the original channel or external channel. The source of external interference is very diverse, and the sources of interference or attacks are mainly external to the mobile communication network, including interference shielding devices, private amplifiers, high-power home appliances and illegal communication equipment.

[0004] How to monitor air interface interference threats in a timely manner is a problem that network operators need to solve. For internal interference, network throughput or latency and other network indicators are analyzed to determine the specific interference type, and then network parameter optimization methods are used to solve internal interference. Since external interference is complex and has many types, the location and number of interference sources are unknown, so it is difficult to detect the type of external interference. Traditional external interference detection or identification generally uses manual analysis, and checks each point for potential interference source locations. This approach can solve some external interference, but it is time-consuming and labor-intensive, and the interference detection effect is not ideal. SUMMARY

[0005] The present application proposes a method and device for monitoring interference by combining air interface electromagnetic data and system measurement data. The method analyzes and processes the characteristics of air interface signals such as spectrum and signal quality, detects interference events that threaten the quality of mobile communication network air interface signals, and performs alarm and disposal.

[0006] The technical content of the present application includes:

[0007] A method for monitoring interference by combining air interface electromagnetic data and system measurement data, the method comprising:

[0008] acquiring joint air interface electromagnetic data and system measurement data of a mobile communication network;

[0009] judging whether the mobile communication network has interference based on the system measurement data;

[0010] in the case that the mobile communication network has interference, obtaining a type of the interference based on the joint air interface electromagnetic data or the system measurement data.

[0011] Further, the mobile communication network comprises a 4G mobile communication network.

[0012] The joint air interface electromagnetic data comprises I / Q data and spectrum trace data collected from an air interface.

[0013] The system measurement data comprises uplink channel measurement information and downlink channel measurement information.

[0014] The uplink channel measurement information comprises uplink interference noise mean value, uplink interference noise maximum value, cell information, frequency information and time information.

[0015] The downlink channel measurement information comprises reference signal strength, signal interference noise ratio, cell information and measurement time information.

[0016] Further, the acquiring of the uplink interference noise mean value and the uplink interference noise maximum value comprises:

[0017] establishing a two-dimensional matrix comprising cell ID value and user ID value based on the cell information;

[0018] using the two-dimensional matrix to count uplink interference noise mean value and uplink interference noise maximum value reported by access users in each cell within a period of time.

[0019] Further, the judging whether the mobile communication network has interference based on the system measurement data comprises:

[0020] in the case that the uplink interference noise mean value is greater than a first set value and the uplink interference noise maximum value is greater than a second set value, judging that the mobile communication network has uplink communication link interference;

[0021] in the case that the uplink interference noise mean value is not greater than the first set value or the uplink interference noise maximum value is not greater than the second set value, judging that the mobile communication network has no uplink communication link interference;

[0022] or,

[0023] in a case where the reference signal strength is greater than a third set value and the signal-to-interference-and-noise ratio is greater than a fourth set value, judging that the downlink communication link of the mobile communication network has interference;

[0024] in a case where the reference signal strength is not greater than the third set value or the signal-to-interference-and-noise ratio is not greater than the fourth set value, judging that the downlink communication link of the mobile communication network has no interference.

[0025] Further, in a case where the mobile communication network has interference, the type of the interference is obtained based on the joint air interface electromagnetic data or the system measurement data, comprising:

[0026] calculating an energy value of a signal in a time domain based on I / Q data collected from an air interface;

[0027] drawing a dynamic spectrum trace based on spectrum trace data collected from the air interface, and calculating a power variation of a signal in a frequency domain according to the dynamic spectrum trace;

[0028] if the energy value of the signal in the time domain is greater than a fifth set value and the power variation of the signal in the frequency domain indicates that power of at least one mobile communication frequency point or at least one large-range frequency band is greater than a sixth set value, obtaining the type of the interference as power suppression type interference;

[0029] or,

[0030] obtaining a variation feature of signal strength based on the reference signal strength;

[0031] if the variation feature of the signal strength is abnormal or the signal strength is greater than a seventh set value, obtaining the type of the interference as pseudo base station interference;

[0032] or,

[0033] identifying demodulation parameters, pilot information and synchronization information according to the I / Q data collected from the air interface, and matching the demodulation parameters, the pilot information and the synchronization information with corresponding information sent by a 4G base station respectively;

[0034] if the matching is successful, obtaining the type of the interference as spoofing type interference.

[0035] Further, the mobile communication network comprises a 5G mobile communication network;

[0036] the joint air interface electromagnetic data comprises I / Q data and spectrum trace data collected from an air interface;

[0037] the system measurement data comprises uplink channel measurement information and downlink channel measurement information;

[0038] The uplink channel measurement information comprises: uplink interference noise mean value, uplink interference noise maximum value, cell information, frequency information and time information.

[0039] The downlink channel measurement information comprises: channel state information reference signal strength, channel state information interference noise ratio, cell information and measurement time information.

[0040] Further, the judging whether the mobile communication network exists interference based on the system measurement data comprises:

[0041] in the case that the uplink interference noise mean value is greater than a first set value and the uplink interference noise maximum value is greater than a second set value, judging that the mobile communication network uplink communication link exists interference;

[0042] in the case that the uplink interference noise mean value is not greater than the first set value or the uplink interference noise maximum value is not greater than the second set value, judging that the mobile communication network uplink communication link does not exist interference.

[0043] or,

[0044] in the case that the channel state information reference signal strength is greater than an eighth set value and the channel state information interference noise ratio is greater than a ninth set value, judging that the mobile communication network downlink communication link exists interference;

[0045] in the case that the channel state information reference signal strength is not greater than the eighth set value or the channel state information interference noise ratio is not greater than the ninth set value, judging that the mobile communication network downlink communication link does not exist interference.

[0046] Further, the obtaining the type of the interference based on the joint air interface electromagnetic data or the system measurement data in the case that the mobile communication network exists interference comprises:

[0047] calculating the energy value of the signal in time domain based on the I / Q data collected from the air interface;

[0048] drawing dynamic spectrum trace based on the spectrum trace data collected from the air interface, and calculating the power variation of the signal in frequency domain according to the dynamic spectrum trace;

[0049] if the energy value of the signal in time domain is greater than a fifth set value and the power variation of the signal in frequency domain indicates that the power of at least one mobile communication frequency point or at least one large range frequency band is greater than a sixth set value, obtaining the type of the interference as power suppression type interference;

[0050] or,

[0051] Based on the channel state information reference signal strength, a signal strength variation feature is obtained;

[0052] If the signal strength variation feature is abnormal or the signal strength is greater than a tenth set value, it is determined that the type of the interference is pseudo base station interference;

[0053] Or,

[0054] According to the I / Q data collected from the air interface, demodulation parameters, pilot information and synchronization information are identified, and the demodulation parameters, the pilot information and the synchronization information are matched with corresponding information sent by a 5G base station respectively;

[0055] If the matching is successful, it is determined that the type of the interference is spoofing interference.

[0056] Further, after the type of the interference is obtained based on the joint air interface electromagnetic data or the system measurement data in the case that the mobile communication network exists interference, the method further comprises:

[0057] Based on the determined type of the interference, an interference threat event is evaluated and analyzed;

[0058] A behavior threatening network security in the evaluation and analysis result is alarmed and decision processed.

[0059] A joint air interface electromagnetic data and system measurement data interference monitoring device, the device comprises:

[0060] A data acquisition module is configured to acquire joint air interface electromagnetic data and system measurement data of a mobile communication network;

[0061] An interference threat monitoring module is configured to determine whether the mobile communication network exists interference based on the system measurement data;

[0062] An interference attack monitoring module is configured to obtain the type of the interference based on the joint air interface electromagnetic data or the system measurement data in the case that the mobile communication network exists interference.

[0063] Compared with a traditional interference attack identification scheme, the present application supports more types of identified interference attacks, and has the functions of alarming and processing behaviors threatening network security, and can well adapt to the demand of interference attack identification in the current mobile communication network scene. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 A schematic diagram of a mobile communication network using the present application.

[0065] Figure 2 A flowchart of a joint air interface electromagnetic data and system measurement data interference monitoring method.

[0066] Figure 3 Block diagram of the interference monitoring device combining air interface electromagnetic data and system measurement data. DETAILED DESCRIPTION

[0067] In order to make the above features and advantages of the present application more obvious and easy to understand, the technical solutions of the present application are further described below through specific examples.

[0068] The interference monitoring method combining air interface electromagnetic data and system measurement data proposed by the present application, as shown in Figure 1 is applied in a mobile communication network, and the detection and identification of air interface interference attacks are realized by deploying electromagnetic monitoring devices in the access network and deploying an interference threat monitoring platform in the core network.

[0069] The data sources of the interference threat monitoring platform include two parts: air interface electromagnetic data and system measurement data. Among them, the air interface electromagnetic data is the I / Q data and spectrum trace data collected from the air interface by the electromagnetic monitoring device, and includes data such as modulation patterns for specific frequency points or frequency bands; The configuration parameters of the air interface electromagnetic data can be adjusted by the interference threat monitoring platform according to the demand of the configuration instruction. The system measurement data is the channel measurement data fed back by the OMC (Operations & Maintenance Center, Operations and Maintenance Center) system northbound interface, mainly including uplink channel measurement information and downlink channel measurement information in the mobile communication network.

[0070] The feedback mode of the above measurement data includes periodic feedback and event triggered feedback. Periodic feedback refers to reporting air interface electromagnetic data and system measurement data according to the agreed time period; Event triggered feedback refers to issuing instructions by the interference threat monitoring platform to report measurement data when interference events occur or there are business needs.

[0071] At present, the commonly used mobile communication network is 4G mobile communication network and 5G mobile communication network. Due to the certain difference between the structures of the two, two examples are given below to illustrate respectively.

[0072] Embodiment 1

[0073] This embodiment takes the 4G mobile communication network as an example, as shown in Figure 2 The implementation process of the interference monitoring method combining air interface electromagnetic data and system measurement data is as follows:

[0074] Step 1: Data acquisition

[0075] The measurement data required by the interference threat monitoring platform comes from air interface electromagnetic data and system measurement data, and the data acquisition mode includes periodic feedback and event triggered feedback, and the data content is as follows:

[0076] The first is air interface electromagnetic data, mainly including I / Q data and spectrum trace data collected from the air interface, and containing modulation patterns and other data for specific frequency points or frequency bands.

[0077] The second is system measurement data, from uplink channel measurement information and downlink channel measurement information in a mobile communication network. For the uplink channel measurement information, it contains the mean and maximum of the uplink interference noise at the RB (Resource Block) level, cell information, frequency information (such as RB number), and time information of the measured RB; for the downlink channel measurement information, it includes RSRP (Reference Signal Received Power), SINR (Signal Interference Noise Ratio), and cell information and time information of the measurement.

[0078] Step two: interference attack detection

[0079] The interference threat monitoring platform analyzes the data from step one comprehensively to determine whether interference exists and the specific type of interference attack.

[0080] 1. Determine whether interference exists

[0081] (1) Uplink channel interference detection

[0082] A two-dimensional matrix is established with the IDs of cells and users, and the mean and maximum of the uplink interference noise reported by access users in each cell within a period of time are counted. According to the statistical information, the normal range of the mean or maximum of the uplink interference noise of each user in each cell is obtained. The user's reported information is continuously monitored, and once it is found that the mean and maximum of the interference noise reported by a user both exceed the normal range by more than 10 dB, it is considered that the uplink channel has been interfered.

[0083] (2) Downlink channel interference detection

[0084] A two-dimensional matrix is established with the IDs of cells and users, and the RSRP and SINR values reported by each cell within a period of time are counted. According to the statistical information, the normal range of the RSRP and SINR of each user in each cell is obtained. The user's reported information is continuously monitored, and once it is found that the RSRP and SINR values both exceed the normal range by more than 10 dB, it is considered that the downlink channel has been interfered.

[0085] 2. Analyze the specific type of interference attack

[0086] The following gives the identification methods of power suppression interference, pseudo base station interference, and deception interference.

[0087] (1)Power suppression interference: This type of interference is mainly identified by collecting air interface signals and drawing dynamic spectrum.

[0088] The I / Q data collected by the air interface can be used to calculate the energy value of the signal in the time domain; the dynamic spectrum trace drawn can be used to count the power change of the signal in the frequency domain. When the time domain energy of the collected signal increases significantly, and when some mobile communication frequency points or a certain range of frequency bands remain in a state of significantly high power in the spectrum diagram, it indicates that there is a power suppression interference source in the signal collection environment, and the frequency band range of the interference can be further determined.

[0089] (2) Pseudo base station interference: The BCCH (Broadcast Control Channel) configured by the pseudo base station

[0090] It is usually the same as the BCCH of a nearby cell, which causes the mobile phone to misjudge the pseudo base station as a normal cell and forces the mobile phone to perform cell reselection through higher signal strength, and then access to the pseudo base station. By monitoring the RSRP of each cell for a long time, the characteristics of the signal strength change are summarized, and once it is found that the signal of a certain cell does not meet the characteristics or always maintains high signal strength, it indicates that there may be a pseudo base station interference.

[0091] (3) Deception interference: By detecting the air interface signal received by the device, identifying its demodulation parameters, pilot information, synchronization information, etc., and comparing with the information sent by the 4G base station, it can be detected whether such interference exists.

[0092] Step three: alarm and disposal

[0093] When the specific air interface interference threat is determined, the interference threat monitoring platform can evaluate and analyze the interference threat event, and timely alarm and decision processing for the behavior threatening network security.

[0094] Embodiment 2

[0095] This embodiment takes the 5G mobile communication network as an example, and the implementation process of the interference monitoring method combined with air interface electromagnetic data and system measurement data is as follows:

[0096] Step one: data acquisition

[0097] The measurement data required by the interference threat monitoring platform comes from air interface electromagnetic data and system measurement data, and the data acquisition methods include periodic feedback and event triggered feedback, and the data content is as follows:

[0098] First, the air interface electromagnetic data mainly includes the I / Q data collected from the air interface and the spectrum trace data, and contains the modulation style data for specific frequency points or frequency bands.

[0099] Second, the system measures data, from the mobile communication network in the uplink channel measurement information and downlink channel measurement information. For uplink channel measurement information, including RB level of uplink interference noise mean and maximum, the measured RB of cell information, frequency information (such as RB number) and time information, etc.; for downlink channel measurement information includes CSI-RSRP (Channel State Information Reference Signal Received Power, channel state information reference signal strength), CSI-SINR (Channel State Information Signal Interference Noise Ratio, channel state information interference noise ratio) and cell information and measurement time information.

[0100] Step two: interference attack detection

[0101] The interference threat monitoring platform analyzes the data from step one, judges whether the interference exists and the specific type of interference attack.

[0102] 1. Determine whether the interference exists

[0103] (1) uplink channel interference detection

[0104] A two-dimensional matrix is established with the ID value of the cell and the user, the uplink interference noise mean and maximum reported by the access user in each cell within a period of time are counted, and the normal change range of the uplink interference noise mean or maximum of each user in each cell is obtained according to the statistical information. Continuously monitor the user reported information, once it is found that the interference noise mean and maximum reported by a user exceed the normal change range by more than 10dB, it is considered that the uplink channel is interfered.

[0105] (2) downlink channel interference detection

[0106] A two-dimensional matrix is established with the ID value of the cell and the user, the RSRP and SINR values reported by each cell within a period of time are counted, and the normal change range of the CSI-RSRP and CSI-SINR of each user in each cell is obtained according to the statistical information. Continuously monitor the user reported information, once it is found that the RSRP and SINR values exceed the normal change range by more than 10dB, it is considered that the downlink channel is interfered.

[0107] 2. Analysis of the specific type of interference attack

[0108] The following gives the identification method of power suppression type interference, pseudo base station interference and deception type interference.

[0109] (1)Power suppression interference: This type of interference is mainly identified by collecting air interface signals and drawing dynamic spectrum.

[0110] The I / Q data collected by the air interface can calculate the energy value of the signal in the time domain; the dynamic spectrum trace drawn can count the power change of the signal in the frequency domain. When the time energy of the collected signal increases significantly, and when some mobile communication frequency points or a certain range of frequency bands in the spectrum diagram remain in a state of obviously high power, it indicates that there is a power suppression interference source in the signal collection environment, and the frequency band range of the interference can be further determined.

[0111] (2) Pseudo base station interference: The BCCH configured by the pseudo base station is usually the same as the BCCH of a nearby cell, which causes the mobile phone to misjudge the pseudo base station as a normal cell and forces the mobile phone to perform cell reselection and access to the pseudo base station through high signal strength. By monitoring the CSI-RSRP of each cell for a long time, the change characteristics of the signal strength are summarized. Once it is found that the signal of a certain cell does not meet the characteristics or always maintains high signal strength, it indicates that there may be a pseudo base station interference.

[0112] (3) Deception interference: By detecting the air interface signals received by the equipment, the demodulation parameters, pilot information, synchronization information, etc. are identified, and compared with the information sent by the 5G base station, to detect whether such interference exists.

[0113] Step three: alarm and disposal

[0114] When the specific air interface interference threat is determined, the interference threat monitoring platform can evaluate and analyze the interference threat event, and alarm and make decisions to deal with the behavior that threatens network security in a timely manner.

[0115] The application also proposes an interference monitoring device combining air interface electromagnetic data and system measurement data, as shown in Figure 3 The device comprises:

[0116] A data acquisition module is configured to acquire the combined air interface electromagnetic data and system measurement data of the mobile communication network.

[0117] An interference threat monitoring module is configured to determine whether the mobile communication network has interference based on the system measurement data.

[0118] An interference attack monitoring module is configured to obtain the type of interference based on the combined air interface electromagnetic data or the system measurement data in the case of whether the mobile communication network has interference.

[0119] Optionally, the device further comprises an alarm and disposal module configured to evaluate and analyze the interference threat event based on the determined interference type, and alarm and make decisions to deal with the behavior that threatens network security in the evaluation and analysis result.

[0120] The interference monitoring device for combining air interface electromagnetic data and system measurement data provided by the embodiments of the present disclosure can realize the various processes realized by the method embodiments, and can achieve the same beneficial effects. To avoid repetition, they will not be described here.

[0121] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the above embodiments, those skilled in the art should understand: it can still modify the technical solutions recorded in the above embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of interference monitoring that combines air interface electromagnetic data with system measurement data, characterized by, The method comprises: acquiring joint air interface electromagnetic data and system measurement data of a mobile communication network; judging whether the mobile communication network has interference based on the system measurement data; in the case where the mobile communication network has interference, obtaining the type of the interference based on the joint air interface electromagnetic data or the system measurement data; wherein, in the case where the mobile communication network is a 4G mobile communication network, the joint air interface electromagnetic data comprises I / Q data and spectrum trace data collected from an air interface, and the system measurement data comprises uplink channel measurement information and downlink channel measurement information, the uplink channel measurement information comprises uplink interference noise mean value, uplink interference noise maximum value, cell information, frequency information and time information, and the downlink channel measurement information comprises reference signal strength, signal-to-interference noise ratio, cell information and measurement time information; in the case where the mobile communication network has interference, obtaining the type of the interference based on the joint air interface electromagnetic data or the system measurement data comprises: calculating the energy value of a signal in the time domain based on the I / Q data collected from the air interface; plotting a dynamic spectrum trace based on the spectrum trace data collected from the air interface, and calculating the power variation of the signal in the frequency domain according to the dynamic spectrum trace; if the energy value of the signal in the time domain is greater than a fifth set value, and the power variation of the signal in the frequency domain indicates that the power of at least one mobile communication frequency point or at least one large-range frequency band is greater than a sixth set value, then the type of the interference is obtained as power suppression interference; or, obtaining the variation feature of signal strength based on the reference signal strength; if the variation feature of signal strength is abnormal, or the signal strength is greater than a seventh set value, then the type of the interference is obtained as pseudo base station interference; or, identifying demodulation parameters, pilot information and synchronization information according to the I / Q data collected from the air interface, and matching the demodulation parameters, the pilot information and the synchronization information with corresponding information sent by a 4G base station respectively; if the matching is successful, then the type of the interference is obtained as spoofing interference; in the case where the mobile communication network is a 5G mobile communication network, the joint air interface electromagnetic data comprises I / Q data and spectrum trace data collected from an air interface, and the system measurement data comprises uplink channel measurement information and downlink channel measurement information, the uplink channel measurement information comprises uplink interference noise mean value, uplink interference noise maximum value, cell information, frequency information and time information, and the downlink channel measurement information comprises channel state information reference signal strength, channel state information interference noise ratio, cell information and measurement time information; in the case where the mobile communication network has interference, obtaining the type of the interference based on the joint air interface electromagnetic data or the system measurement data comprises: calculating the energy value of a signal in the time domain based on the I / Q data collected from the air interface; plotting a dynamic spectrum trace based on the spectrum trace data collected from the air interface, and calculating the power variation of the signal in the frequency domain according to the dynamic spectrum trace; If the energy value of the signal in the time domain is greater than a fifth set value, and the power variation of the signal in the frequency domain indicates that the power of at least one mobile communication frequency point or at least one large range frequency band is greater than a sixth set value, it is determined that the type of the interference is power suppression type interference; Or, Based on the channel state information reference signal strength, a signal strength variation feature is obtained; If the signal strength variation feature is abnormal, or the signal strength is greater than a tenth set value, it is determined that the type of the interference is pseudo base station interference; Or, According to the I / Q data collected from the air interface, demodulation parameters, pilot information and synchronization information are identified, and the demodulation parameters, the pilot information and the synchronization information are matched with corresponding information sent by a 5G base station respectively; If the matching is successful, it is determined that the type of the interference is spoofing type interference.

2. The method of claim 1, wherein, The obtaining of the uplink interference noise mean and the uplink interference noise maximum value comprises: Based on the cell information, a two-dimensional matrix containing cell ID values and user ID values is established; Using the two-dimensional matrix, the uplink interference noise mean and the uplink interference noise maximum value reported by access users in each cell within a period of time are counted.

3. The method of claim 1, wherein, The determining whether the mobile communication network exists interference based on the system measurement data comprises: In the case that the uplink interference noise mean is greater than a first set value, and the uplink interference noise maximum value is greater than a second set value, it is determined that the uplink communication link of the mobile communication network exists interference; In the case that the uplink interference noise mean is not greater than the first set value, or the uplink interference noise maximum value is not greater than the second set value, it is determined that the uplink communication link of the mobile communication network does not exist interference; Or, In the case that the reference signal strength is greater than a third set value, and the signal interference noise ratio is greater than a fourth set value, it is determined that the downlink communication link of the mobile communication network exists interference; In the case that the reference signal strength is not greater than the third set value, or the signal interference noise ratio is not greater than the fourth set value, it is determined that the downlink communication link of the mobile communication network does not exist interference.

4. The method of claim 1, wherein, The determining whether the mobile communication network exists interference based on the system measurement data comprises: In the case that the uplink interference noise mean is greater than a first set value, and the uplink interference noise maximum value is greater than a second set value, it is determined that the uplink communication link of the mobile communication network exists interference; In the case that the uplink interference noise mean is not greater than the first set value, or the uplink interference noise maximum value is not greater than the second set value, it is determined that the uplink communication link of the mobile communication network does not exist interference; Or, In the case that the channel state information reference signal strength is greater than an eighth set value, and the channel state information interference noise ratio is greater than a ninth set value, it is determined that the downlink communication link of the mobile communication network exists interference; In the case that the channel state information reference signal strength is not greater than the eighth set value, or the channel state information interference noise ratio is not greater than the ninth set value, it is determined that the downlink communication link of the mobile communication network does not exist interference.

5. The method according to any one of claims 1 to 4, characterized in that, The obtaining the type of the interference based on the joint air interface electromagnetic data or the system measurement data in the case that the mobile communication network exists the interference further comprises: performing evaluation analysis on the interference threat event based on the determined type of the interference; performing alarm and decision processing on the behavior threatening network security in the evaluation analysis result.

6. An interference monitoring apparatus that combines air interface electromagnetic data with system measurement data, characterized by, The device comprises: a data acquisition module configured to acquire joint air interface electromagnetic data and system measurement data of a mobile communication network; an interference threat monitoring module configured to determine whether the mobile communication network exists interference based on the system measurement data; an interference attack monitoring module configured to obtain the type of the interference based on the joint air interface electromagnetic data or the system measurement data in the case that the mobile communication network exists the interference; In the case that the mobile communication network is a 4G mobile communication network, the joint air interface electromagnetic data comprises I / Q data and spectrum trace data collected from an air interface, and the system measurement data comprises uplink channel measurement information and downlink channel measurement information, the uplink channel measurement information comprises uplink interference noise mean value, uplink interference noise maximum value, cell information, frequency information and time information, and the downlink channel measurement information comprises reference signal strength, signal interference noise ratio, cell information and measurement time information; in the case that the mobile communication network exists the interference, the obtaining the type of the interference based on the joint air interface electromagnetic data or the system measurement data comprises: calculating energy value of a signal in a time domain based on the I / Q data collected from the air interface; drawing a dynamic spectrum trace based on spectrum trace data collected from the air interface, and calculating power variation of the signal in a frequency domain according to the dynamic spectrum trace; if the energy value of the signal in the time domain is greater than a fifth set value, and the power variation of the signal in the frequency domain indicates that power of at least one mobile communication frequency point or at least one large range frequency band is greater than a sixth set value, then obtaining the type of the interference as power suppression type interference; or, obtaining variation feature of signal strength based on the reference signal strength; if the variation feature of the signal strength is abnormal, or the signal strength is greater than a seventh set value, then obtaining the type of the interference as pseudo base station interference; or, identifying demodulation parameters, pilot information and synchronization information according to the I / Q data collected from the air interface, and matching the demodulation parameters, the pilot information and the synchronization information with corresponding information sent by a 4G base station respectively; if the matching is successful, then obtaining the type of the interference as spoofing type interference. In the case that the mobile communication network is a 5G mobile communication network, the joint air interface electromagnetic data comprises I / Q data and spectrum trace data collected from an air interface, and the system measurement data comprises uplink channel measurement information and downlink channel measurement information, the uplink channel measurement information comprises uplink interference noise mean value, uplink interference noise maximum value, cell information, frequency information and time information, and the downlink channel measurement information comprises channel state information reference signal strength, channel state information interference noise ratio, cell information and measurement time information; in the case that the mobile communication network exists interference, the type of the interference is obtained based on the joint air interface electromagnetic data or the system measurement data, comprising: calculating energy value of a signal in a time domain based on the I / Q data collected from the air interface; drawing a dynamic spectrum trace based on spectrum trace data collected from the air interface, and calculating power variation of a signal in a frequency domain according to the dynamic spectrum trace; if the energy value of the signal in the time domain is greater than a fifth set value, and the power variation of the signal in the frequency domain indicates that power of at least one mobile communication frequency point or at least one large range frequency band is greater than a sixth set value, then the type of the interference is obtained as power suppression type interference; or, obtaining variation characteristics of signal strength based on the channel state information reference signal strength; if the variation characteristics of signal strength are abnormal, or signal strength is greater than a tenth set value, then the type of the interference is obtained as pseudo base station interference; or, identifying demodulation parameters, pilot information and synchronization information according to the I / Q data collected from the air interface, and matching the demodulation parameters, the pilot information and the synchronization information with corresponding information sent by a 5G base station respectively; if the matching is successful, then the type of the interference is obtained as spoofing type interference.

Images