A data analysis method and device

Abstract

The present application discloses a data analysis method and device, the method comprising: a data analysis network element sends a first request message to a security network element, the first request message is used to request a security check on first data, the first data is data for which the data analysis network element performs data analysis on a specified data analysis type; then the security network element performs a security check on the first data, obtains a security check result, and sends the security check result to the data analysis network element, the data analysis network element generates or updates a data analysis result corresponding to the data analysis type according to the security check result. Through the method of the present application, the security network element can perform a security check on the first data, separate abnormal data from the first data, so that the data analysis network element can establish a model based on data other than the abnormal data, thereby improving the accuracy of the model and the accuracy of the data analysis results.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data analysis method and device. Background Art

[0002] In the fifth generation (5G) mobile communication system, the network data analytics function (NWDAF) network element is introduced. The NWDAF network element can first obtain data related to the communication network and terminal equipment, and then generate an artificial intelligence (AI) model based on the acquired data training, and obtain data analysis results based on the AI ​​model, and finally send the analysis results to other functional network elements. Other functional network elements can refer to the analysis results to execute corresponding communication service strategies.

[0003] During this process, an attacker may add abnormal data to the data related to the communication network and terminal equipment obtained by the NWDAF network element, so that abnormal data exists in the data obtained by the NWDAF network element, which will make the data analysis results generated by NWDAF inaccurate. Summary of the invention

[0004] The present application provides a data analysis method and device for improving the accuracy of data analysis results.

[0005] In a first aspect, the present application provides a data analysis method, which includes: a data analysis network element sends a first request message to a security network element, the first request message is used to request a security check on first data, the first data being data for which the data analysis network element performs data analysis on a specified data analysis type; the data analysis network element receives a security check result fed back by the security network element; the data analysis network element generates or updates a data analysis result corresponding to the data analysis type based on the security check result.

[0006] Based on the above technical solution, the data analysis network element can send a request message to the security network element, and the security network element will perform security checks on the data to be analyzed. The data analysis network element then generates or updates the data analysis results based on the security check results, which can improve the accuracy of the data analysis results.

[0007] In the embodiment of the present application, the data analysis network element may trigger a security detection request in the following situations, as follows:

[0008] Scenario 1: When the data analysis network element determines that the accuracy of the first analysis result is low, a security detection request may be triggered to the security network element. It can be understood that the security detection request is the first request message.

[0009] In a possible implementation, before the data analysis network element sends a first request message to the first network element, the method also includes: the data analysis network element generates a first analysis result corresponding to the data analysis type based on the first data; and the data analysis network element determines that the accuracy of the first analysis result is less than a first threshold.

[0010] Based on the above technical solution, the data analysis network element can obtain the first analysis result based on the data to be analyzed in advance, and when the accuracy of the first analysis result is relatively low, it can request the security network element to perform a security check. In this way, the data analysis network element can update the first analysis result after the security check, thereby improving the accuracy of the data analysis result.

[0011] Scenario 2: When the data analysis network element receives a notification message sent by the subscription network element, it can trigger a security detection request to the security network element.

[0012] In a possible implementation, before the data analysis network element sends a first request message to the first network element, the method also includes: the data analysis network element generates a first analysis result corresponding to the data analysis type based on the first data; the data analysis network element sends the first analysis result and a first threshold to the subscription network element, and the first threshold is used by the subscription network element to determine that the accuracy of the first analysis result is less than the first threshold; the data analysis network element receives the notification message sent by the subscription network element when the accuracy of the first analysis result is less than the first threshold; the data analysis network element sends the first request message to the security network element based on the notification message.

[0013] Based on the above technical solution, the subscription network element can determine the accuracy of the first analysis result. When the accuracy of the first analysis result is low, the data analysis network element is notified, and then the data analysis network element requests the security network element to perform security detection.

[0014] Scenario 3: When the data analysis request message sent by the subscribing network element is a data analysis result corresponding to the set range, the data analysis network element may trigger a security detection request.

[0015] In one possible implementation, before the data analysis network element sends a first request message to the network element, the method also includes: the data analysis network element receives a data analysis request message sent by the subscription network element, and the data analysis request message is used to request a data analysis result corresponding to the data analysis type; the data analysis network element determines the data analysis result corresponding to the set range requested by the data analysis request message.

[0016] Based on the above technical solution, if the data analysis result subscribed by the subscribing network element is a data analysis result within a set range, the data analysis network element can request the security network element to perform security detection.

[0017] In a possible implementation, the set range includes a range corresponding to at least one of the following information: set time information, set area information, set slice information, set user information, and set service type information.

[0018] Scenario 4: The data analysis network element can actively send security detection requests to the security network element at fixed time intervals.

[0019] Based on the above-mentioned situations, the data analysis network element may send a first request message to the security network element so that the security network element performs a security check on the first data.

[0020] In a possible implementation, the data analysis network element may send the data analysis result to the subscribing network element so that the subscribing network element can view the data analysis result of the subscribed specified data analysis type.

[0021] In one possible implementation, the first request message includes at least one of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is a model established by the data analysis network element based on the first data or a model predetermined by the data analysis network element for the data analysis type, and the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model.

[0022] It should be noted that the information of the first data may be the first data itself, or the storage address of the first data, or of course the file name of the first data, etc., and this application does not limit this.

[0023] Based on the above technical solution, the security network element can use the information included in the first request message to perform security detection on the first data, thereby separating abnormal data from the first data and improving the accuracy of the data analysis results.

[0024] In a possible implementation, the security detection is abnormal data detection; the first request message includes: abnormal data ratio, where the abnormal data ratio is used to indicate the ratio of the data volume of the abnormal data to the data volume of the first data.

[0025] In the above technical solution, the proportion of abnormal data can be estimated by the data analysis network element or the security network element, so that the security network element can know the proportion of abnormal data in the first data, so that the security network element can perform targeted security detection, making the results of the security detection more accurate.

[0026] In one possible implementation, the security detection result includes at least one of the following information: information about abnormal data, information about second data, and a second algorithm; wherein the second data is data in the first data excluding the abnormal data, and the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.

[0027] Based on the above technical solution, the data analysis network element requests the security network element to perform a security check on the first data. After the security network element performs the security check, abnormal data and / or data other than the abnormal data can be obtained. In this way, the abnormal data can be separated from the first data, and the data analysis results can be obtained using the data other than the abnormal data, thereby improving the accuracy of the data analysis results.

[0028] In a possible implementation, the security detection result includes: a second model, where the second model is a model established by the first network element based on the second data.

[0029] The data analysis network element generates or updates the data analysis result corresponding to the data analysis type according to the security detection result, including: the data analysis network element generates or updates the data analysis result corresponding to the data analysis type based on the second model.

[0030] It should be noted that the second model can be understood as a recommended model obtained after the security network element performs security testing.

[0031] Based on the above technical solution, if the security detection result includes a recommended model, the data analysis network element can directly use the recommended model to obtain the data analysis result, which can improve the accuracy of the data analysis result.

[0032] In a possible implementation, the data analysis network element generates or updates the data analysis results corresponding to the data analysis type based on the security detection results, including: the data analysis network element obtains second data based on the security detection results, and the second data is data in the first data excluding abnormal data; the data analysis network element trains the second data to obtain a third model, and generates or updates the data analysis results corresponding to the data analysis type based on the third model.

[0033] It should be noted that the data analysis network element may obtain the second data based on the security detection results in two situations: (1) the data analysis network element directly obtains the second data from the security detection results; (2) the data analysis network element obtains the second data based on abnormal data in the security detection results.

[0034] Based on the above technical solution, the data analysis network element can use data other than abnormal data to retrain to obtain a new model, and then obtain data analysis results based on the new model, which can improve the accuracy of the AI ​​model and the accuracy of the data analysis results.

[0035] In a possible implementation, when the security detection result includes a second algorithm, the data analysis network element trains the second data to obtain a third model, including: the data analysis network element uses the second algorithm to train the second data to obtain the third model.

[0036] In a possible implementation, the first data is training data or inference data corresponding to the data analysis type.

[0037] In a possible implementation, the security network element is a security network data analysis function NWDAF network element.

[0038] In a possible implementation, the safety detection is bait data detection.

[0039] It should be noted that drugged data refers to abnormal data or attack data generated by attackers whose distribution is similar to normal data distribution and will affect the accuracy of data analysis results. Such drugged data cannot be easily identified using existing data cleaning or outlier detection methods.

[0040] In a second aspect, the present application provides a data analysis method, which includes: a security network element receives a first request message sent by a data analysis network element, the first request message is used to request a security check on first data, the first data being a data set for the data analysis network element to perform data analysis on a specified data analysis type; the security network element performs a security check on the first data to obtain a security check result; the security network element sends the security check result to the data analysis network element.

[0041] Based on the above technical solution, the security network element can perform security detection on the first data, thereby separating abnormal data from the first data, so that the data analysis network element can obtain data analysis results based on the results of the security detection, thereby improving the accuracy of the data analysis results.

[0042] In one possible implementation, the first request message includes at least one of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is a model established by the data analysis network element based on the first data or a model predetermined by the data analysis network element for the data analysis type, and the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model.

[0043] In a possible implementation, the security detection is abnormal data detection; the first request message includes: abnormal data ratio, where the abnormal data ratio is used to indicate the ratio of the data volume of the abnormal data to the data volume of the first data.

[0044] In one possible implementation, the security detection result includes at least one of the following information: information about abnormal data, information about second data, and a second algorithm; wherein the second data is data in the first data excluding the abnormal data, and the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.

[0045] In a possible implementation, the security detection result includes: a second model, where the second model is a model established by the security network element based on the second data.

[0046] In a possible implementation, the security network element performs a security check on the first data, including: the security network element performs a security check on the first data using the second algorithm.

[0047] In a possible implementation, the method also includes: the security network element determines the second algorithm based on the first algorithm and / or the third algorithm, the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model, and the third algorithm is at least one algorithm pre-saved in the security network element.

[0048] In a possible implementation, the security network element determines the second algorithm according to the first algorithm and / or the third algorithm, including: the security network element determines the intersection of the first algorithm and the third algorithm as the second algorithm.

[0049] Of course, it is understandable that the security network element can also decide the algorithm for security detection on its own, that is, it does not need to refer to the first algorithm, and this application does not limit this.

[0050] In a possible implementation, the first data is training data or inference data corresponding to the data analysis type.

[0051] In a possible implementation, the security network element is a security network data analysis function NWDAF network element.

[0052] In a possible implementation, the safety detection is bait data detection.

[0053] In a third aspect, the present application provides a data analysis device, which has the function of implementing the behavior in the method instance of the first aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The data analysis device includes: a communication unit, which is used to send a first request message to a security network element, the first request message is used to request a security check on first data, the first data is data for the data analysis network element to perform data analysis on a specified data analysis type; and receive the security check result fed back by the security network element; a processing unit, which is used to generate or update the data analysis result corresponding to the data analysis type according to the security check result.

[0054] In a possible implementation, the processing unit is further used to: before sending the first request message to the first network element, generate a first analysis result corresponding to the data analysis type based on the first data, and determine that the accuracy of the first analysis result is less than a first threshold.

[0055] In a possible implementation, the processing unit is also used to: generate a first analysis result corresponding to the data analysis type based on the first data before sending a first request message to the first network element; the communication unit is also used to: send the first analysis result and a first threshold to the subscribing network element, the first threshold being used by the subscribing network element to determine that the accuracy of the first analysis result is less than the first threshold, and receive the notification message sent by the subscribing network element when the accuracy of the first analysis result is less than the first threshold; the communication unit is specifically used to send the first request message to the security network element in the following manner: send the first request message to the security network element according to the notification message.

[0056] In a possible implementation, the communication unit is also used to: receive a data analysis request message sent by a subscribed network element before sending a first request message to the network element, and the data analysis request message is used to request a data analysis result corresponding to the data analysis type; the processing unit is also used to: determine the data analysis result corresponding to the set range requested by the data analysis request message.

[0057] In a possible implementation, the set range includes a range corresponding to at least one of the following information: set time information, set area information, set slice information, set user information, and set service type information.

[0058] In one possible implementation, the first request message includes at least one of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is a model established by the data analysis network element based on the first data or a model predetermined by the data analysis network element for the data analysis type, and the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model.

[0059] In a possible implementation, the security detection is abnormal data detection; the first request message includes: abnormal data ratio, where the abnormal data ratio is used to indicate the ratio of the data volume of the abnormal data to the data volume of the first data.

[0060] In one possible implementation, the security detection result includes at least one of the following information: information about abnormal data, information about second data, and a second algorithm; wherein the second data is data in the first data excluding the abnormal data, and the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.

[0061] In a possible implementation, the security detection result includes: a second model, where the second model is a model established by the first network element based on the second data;

[0062] The processing unit is specifically used to generate or update the data analysis result corresponding to the data analysis type according to the security detection result in the following manner: generate or update the data analysis result corresponding to the data analysis type based on the second model.

[0063] In one possible implementation, the processing unit is specifically used to generate or update the data analysis results corresponding to the data analysis type based on the security detection results in the following manner: obtain second data based on the security detection results, the second data being data other than abnormal data in the first data; train the second data to obtain a third model, and generate or update the data analysis results corresponding to the data analysis type based on the third model.

[0064] In a possible implementation, when the security detection result includes a second algorithm, the processing unit is specifically used to train the second data to obtain a third model in the following manner, including: using the second algorithm to train the second data to obtain the third model.

[0065] In a possible implementation, the first data is training data or inference data corresponding to the data analysis type.

[0066] In a possible implementation, the security network element is a security network data analysis function NWDAF network element.

[0067] In a possible implementation, the safety detection is bait data detection.

[0068] In a fourth aspect, the present application provides a data analysis device, which has the function of implementing the behavior in the method instance of the second aspect above. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. In one possible design, the data analysis device includes: a communication unit, which is used to receive a first request message sent by a data analysis network element, the first request message is used to request a security check on first data, and the first data is a data set for the data analysis network element to perform data analysis on a specified data analysis type; a processing unit, which is used to perform a security check on the first data and obtain a security check result; the communication unit is also used to: send the security check result to the data analysis network element.

[0069] In one possible implementation, the first request message includes at least one of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is a model established by the data analysis network element based on the first data or a model predetermined by the data analysis network element for the data analysis type, and the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model.

[0070] In a possible implementation, the security detection is abnormal data detection; the first request message includes: abnormal data ratio, where the abnormal data ratio is used to indicate the ratio of the data volume of the abnormal data to the data volume of the first data.

[0071] In one possible implementation, the security detection result includes at least one of the following information: information about abnormal data, information about second data, and a second algorithm; wherein the second data is data in the first data excluding the abnormal data, and the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.

[0072] In a possible implementation, the security detection result includes: a second model, where the second model is a model established by the security network element based on the second data.

[0073] In a possible implementation, the processing unit is specifically configured to perform security check on the first data in the following manner: perform security check on the first data using the second algorithm.

[0074] In a possible implementation, the processing unit is also used to: determine the second algorithm based on a first algorithm and / or a third algorithm, wherein the first algorithm includes at least one algorithm used by the data analysis network element to establish the first model, and the third algorithm is at least one algorithm pre-saved in the security network element.

[0075] In a possible implementation, the processing unit is specifically configured to determine the second algorithm according to the first algorithm and / or the third algorithm in the following manner: determining an intersection of the first algorithm and the third algorithm as the second algorithm.

[0076] In a possible implementation, the first data is training data or inference data corresponding to the data analysis type.

[0077] In a possible implementation, the data analysis device is a secure network data analysis function NWDAF network element.

[0078] In a possible implementation, the safety detection is bait data detection.

[0079] In a fifth aspect, a data analysis device is provided, which may be a data analysis network element in the above method embodiment. The data analysis device may include a transceiver and at least one processor, wherein the transceiver is used to execute the operations of receiving and sending messages in the above first aspect or any one of the methods described in the first aspect; and the at least one processor calls instructions to execute the message processing operations performed by the data analysis device in the above second aspect or any one of the methods described in the second aspect.

[0080] In a sixth aspect, a data analysis device is provided, which may be a security network element in the above method embodiment. The data analysis device may include a transceiver and at least one processor, wherein the transceiver is used to execute the above second aspect or the method described in any one of the second aspects, wherein the data analysis device performs message receiving and sending operations; and the at least one processor calls instructions to execute the above second aspect or the method described in any one of the second aspects, wherein the data analysis device performs message processing operations.

[0081] In a seventh aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run in parallel, the methods performed by the data analysis network element in the above aspects are executed.

[0082] In an eighth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run, the method performed by the security network element in the above aspects is executed.

[0083] In a ninth aspect, the present application provides a chip system, the chip system comprising at least one processor and a transceiver, the processor executing instructions to execute the method described in any one of the first and second aspects. The chip system may be composed of a chip, or may include a chip and other discrete devices.

[0084] In the tenth aspect, the present application also provides a data analysis system, comprising the data analysis device described in any one of the third aspect and the data analysis device described in any one of the fourth aspect.

[0085] In an eleventh aspect, the present application provides a computer-readable storage medium storing a computer program, which, when executed, implements the methods performed by the data analysis network element in the above aspects.

[0086] In a twelfth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed, the method performed by the security network element in the above aspects is implemented.

[0087] It should be understood that the beneficial effects achieved by the technical solutions of the third to twelfth aspects of the embodiments of the present application and the corresponding feasible implementation methods can be referred to the technical effects of the first aspect, the second aspect and their corresponding possible implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] Figure 1 A schematic diagram of a 5G network architecture based on a service-oriented interface provided in an embodiment of the present application;

[0089] Figure 2 A flow chart of a data analysis method provided in an embodiment of the present application;

[0090] Figure 3 A flow chart of a data analysis method provided in an embodiment of the present application;

[0091] Figure 4 A flow chart of another data analysis method provided in an embodiment of the present application;

[0092] Figure 5 A schematic diagram of a data analysis device provided in an embodiment of the present application;

[0093] Figure 6 A schematic diagram of the structure of a data analysis network element provided in an embodiment of the present application;

[0094] Figure 7 A schematic diagram of another data analysis device provided in an embodiment of the present application;

[0095] Figure 8 A schematic diagram of the structure of a security network element provided in an embodiment of the present application;

[0096] Fig. 9 A schematic diagram of a data analysis system provided for this application. DETAILED DESCRIPTION

[0097] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings.

[0098] At present, the process of data analysis may include the following steps: First, the data analysis result subscriber (consumer) triggers the service operation of NWDAF, which is used to subscribe to the data analysis result type. After NWDAF receives the service operation triggered by the consumer, it can obtain relevant network data, terminal device data, third-party application data, etc. from the corresponding network element according to the data analysis result type subscribed by the consumer, and then use the various acquired data to train and generate the corresponding AI model, and perform data reasoning based on the AI ​​model to obtain the data analysis results. Finally, NWDAF feeds back the AI ​​model or data analysis results to the consumer. In this process, the attacker may inject bait data similar to the real data into the network data obtained by NWDAF, which will cause abnormal data in the network data, thereby making the trained model less accurate and the inference data analysis results obtained inaccurate.

[0099] It should be noted that bait data is a data sample designed by attackers when they launch bait attacks on AI models. It can be used to contaminate the training data used to train the model or the inference data used for model inference, thereby endangering the normal function of the entire AI system and the accuracy of data analysis results.

[0100] It is understandable that the types of data analysis results may include but are not limited to: service experience data analysis results, network element load data analysis results, UE service behavior analysis results, UE mobility analysis results, UE interactivity analysis results, UE abnormal behavior analysis results, etc.

[0101] In addition, before using the acquired data to train and generate the corresponding AI model, data cleaning is required to obtain accurate and high-quality data. Since the distribution of drug bait data is similar to that of real data, it is difficult to completely remove drug bait data during the data cleaning process, thus endangering the normal function of the AI ​​system.

[0102] In view of the above-mentioned technical problems, in an embodiment of the present application, a new network element is added to the 5G network architecture, and the newly added network element is used to detect abnormal data. The detection results are then fed back to the NWDAF network element. The NWDAF network element then performs AI model training or generates data analysis results based on the fed-back detection results. This can improve the accuracy of the data analysis results and ensure the security of the AI ​​model.

[0103] It should be noted that the newly added network element in the 5G network architecture may be a network element responsible for security. More specifically, in this application, it may be a NWDAF network element specifically responsible for security.

[0104] like Figure 1 As shown, a schematic diagram of a 5G network architecture based on a service-oriented interface provided in an embodiment of the present application is provided. In an embodiment of the present application, the network architecture includes three parts, namely, a data analysis result subscriber (consumer), a data provider network element, and a data analysis function network element.

[0105] Among them, the data analysis function network element may include: NWDAF network element and security NWDAF network element.

[0106] NWDAF network elements can collect data from network function (NF) network elements, operation, administration, maintenance (OAM) systems, terminal devices or application function (AF) network elements, and perform data analysis on the collected data to obtain data analysis results. NWDAF network elements can also send the obtained data analysis results to NF, OAM systems, terminal devices or AF network elements, so that these entities can make corresponding policies, execute operations, etc.

[0107] security NWDAF network element is used to provide data analysis functions for security services. It can provide security services such as abnormal data detection by interacting with NWDAF network elements.

[0108] Data provider network element refers to a node or physical device in the network, which can provide corresponding functional support for user equipment (UE) access to the network, session, authentication, policy control, etc., and will also generate corresponding network data. For example, it may include: access and mobility management function (AMF) network element, session management function (SMF) network element, AF, etc.

[0109] The AMF network element is a control plane network element provided by the operator network. It is responsible for access control and mobility management of terminal devices accessing the operator network, such as mobility status management, allocation of user temporary identity, authentication and authorization of users, etc.

[0110] The SMF network element is a control plane network element provided by the operator network, which is responsible for managing the protocol data unit (PDU) session of the terminal device. The PDU session is a channel for transmitting PDUs. The terminal device needs to transmit PDUs to and from the data network (DN) through the PDU session. The SMF network element is responsible for establishing, maintaining and deleting PDU sessions. The SMF network element includes session management (such as session establishment, modification and release, including tunnel maintenance between the user plane function (UPF) and the access network (AN)), selection and control of UPF network elements, service and session continuity (SSC) mode selection, roaming and other session-related functions.

[0111] AF network elements mainly provide application layer services and also support interaction with the 5G core network to provide services, such as influencing data routing decisions, policy control functions, or providing some third-party services to the network side.

[0112] Data analysis result subscribers (consumers) refer to some NFs (e.g., policy control function (PCF) etc.), UE, RAN, AF etc. in OAM or 5G network structure, which can subscribe to corresponding data analysis results from NWDAF and make corresponding adjustments according to the data analysis results. For example, PCF can adjust the QoS parameters of the service according to the service-level service experience fed back by NWDAF to better guarantee the service experience of the service.

[0113] The PCF network element is a control plane function provided by the operator, which is used to provide policies to network network elements. As an implementation method, the policies may include access control policies, mobility management policies, charging-related policies, QoS-related policies, and authorization-related policies.

[0114] Terminal equipment, also known as user equipment (UE), is a device with wireless transceiver function, which can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on the water (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.). The terminal equipment can be a mobile phone, a tablet computer (pad), a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc.

[0115] The above-mentioned terminal device can establish a connection with the operator network through the interface provided by the operator network (such as N1, etc.), and use the data and / or voice services provided by the operator network. The terminal device can also access the DN through the operator network, use the operator services deployed on the DN, and / or services provided by a third party. Among them, the above-mentioned third party may be a service provider other than the operator network and the terminal device, and can provide other data and / or voice services to the terminal device. Among them, the specific form of the above-mentioned third party can be determined according to the actual application scenario, and is not limited here.

[0116] It should be noted that the network architecture may also include: network exposure function (NEF) network element, unified data management (UDM) network element, network function repository function (NRF) network element, authentication server function (AUSF) network element, (radio) access network (R)AN) and user plane function (UPF) network element, etc.

[0117] Among them, RAN is a subnetwork of the operator network and an implementation system between the service node and the terminal device in the operator network. To access the operator network, the terminal device must first pass through RAN, and then connect to the service node of the operator network through RAN. The RAN equipment in this application is a device that provides wireless communication functions for terminal devices. Access network equipment includes but is not limited to: next-generation base stations (g nodeB, gNB) in 5G, evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B (node ​​B, NB), base station controller (basestation controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.

[0118] DN, also known as packet data network (PDN), is a network located outside the operator network. The operator network can access multiple DNs. Various services can be deployed on DN, which can provide data and / or voice services to terminal devices. For example, DN is the private network of a smart factory. The sensors installed in the workshop of the smart factory can be terminal devices. The control server of the sensors is deployed in DN, and the control server can provide services for the sensors. The sensors can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions. For another example, DN is the internal office network of a company. The mobile phones or computers of the company's employees can be terminal devices. The employees' mobile phones or computers can access information, data resources, etc. on the company's internal office network.

[0119] The UDM network element is a control plane network element provided by the operator, which is responsible for storing the subscriber permanent identifier (SUPI), credential, security context, contract data and other information of the subscribers in the operator network. The information stored by the UDM network element can be used for the authentication and authorization of the terminal device to access the operator network. Among them, the subscribers of the above-mentioned operator network can specifically be users who use the services provided by the operator network, such as users who use China Telecom's mobile phone SIM cards, or users who use China Mobile's mobile phone SIM cards, etc. The permanent subscription identifier (SUPI) of the above-mentioned subscriber can be the number of the mobile phone SIM card, etc. The credential and security context of the above-mentioned subscriber can be small files storing the encryption key of the mobile phone SIM card or information related to the encryption of the mobile phone SIM card, which are used for authentication and / or authorization. The above-mentioned security context can be data (cookie) or token stored on the user's local terminal (such as a mobile phone). The contract data of the above-mentioned subscriber can be the supporting services of the mobile phone SIM card, such as the traffic package of the mobile phone SIM card or the use of the network, etc. It should be noted that permanent identifiers, credentials, security contexts, authentication data (cookies), and tokens are equivalent to authentication and authorization related information. In this application document of the present invention, no distinction or restriction is made for the convenience of description. Unless otherwise specified, the embodiments of the present application will be described using security contexts as an example, but the embodiments of the present application are also applicable to authentication and / or authorization information expressed in other ways.

[0120] NEF network element is a control plane network element provided by the operator. NEF network element opens the external interface of the operator network to third parties in a secure manner. When the SMF network element needs to communicate with the network elements of a third party, the NEF network element can serve as a relay for the communication between the SMF network element and the third-party network elements. When the NEF network element acts as a relay, it can translate the identification information of the contracted user, as well as the identification information of the third-party network elements. For example, when NEF sends the SUPI of the contracted user from the operator network to the third party, it can translate the SUPI into its corresponding external identity (identity, ID). Conversely, when the NEF network element sends the external ID (third-party network element ID) to the operator network, it can translate it into SUPI.

[0121] NRF network elements can be used to provide network element discovery functions, and based on requests from other network elements, provide network element information corresponding to the network element type, such as address information and / or identification information. NRF also provides network element management services, such as network element registration, update, deregistration, and network element status subscription and push.

[0122] The AUSF network element is a control plane network element provided by the operator, which can usually be used for level 1 authentication, i.e., authentication between the terminal device (subscriber) and the operator network. After the AUSF network element receives the authentication request initiated by the subscriber, it can authenticate and / or authorize the subscriber through the authentication information and / or authorization information stored in the UDM network element, or generate the authentication and / or authorization information of the subscriber through the UDM network element. The AUSF network element can feedback the authentication information and / or authorization information to the subscriber.

[0123] The UPF network element is a gateway provided by the operator and is the gateway for the operator network to communicate with the DN. The UPF network element includes functions related to the user plane, such as data packet routing and transmission, packet detection, service usage reporting, Quality of Service (QoS) processing, legal monitoring, uplink packet detection, and downlink packet storage.

[0124] Figure 1 Among them, Nnef, Nausf, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, etc. are interface serial numbers. The meanings of these interface serial numbers can be found in the meanings defined in the third generation partnership project (3GPP) standard protocol, and are not limited here.

[0125] It should be noted that this application is not limited to Figure 1 The 5G system shown can also be applied to future communication systems, such as the sixth generation (6G) system.

[0126] In the following, for the convenience of description, the NWDAF network element is referred to as NWDAF, or as "data analysis network element", the data provider network element is referred to as "first network element", the security NWDAF network element is referred to as security NWDAF, or as "security network element", and the data analysis result subscriber is referred to as "subscription network element". The following takes the data analysis network element as NWDAF and the security network element as security NWDAF as an example for introduction.

[0127] In an embodiment of the present application, the NWDAF network element may be a separate network element or may be co-located with other network elements. For example, the NWDAF network element may be co-located with an AMF network element or an SMF network element. In another possible implementation, other network elements may have the relevant functions of the NWDAF network element. For example, an AMF network element or an SMF network element may have the relevant functions of the NWDAF network element.

[0128] like Figure 2As shown, it is a flow chart of a data analysis method provided in an embodiment of the present application, see Figure 2 As shown, the method may include the following steps:

[0129] Step 201: The data analysis network element sends a first request message to the security network element. Correspondingly, the security network element receives the first request message sent by the data analysis network element.

[0130] The first request message is used to perform security detection on first data, where the first data is data analyzed by the data analysis network element for a specified data analysis type.

[0131] Step 202: The security network element performs a security check on the first data to obtain a security check result.

[0132] Step 203: The data analysis network element receives the security detection result fed back by the security network element.

[0133] After receiving the first request message, the security network element may perform a security check on the first data to obtain a security check result, and the security network element may feed back the security check result to the data analysis network element.

[0134] Step 204: The data analysis network element generates or updates the data analysis result corresponding to the data analysis type according to the security detection result.

[0135] In an embodiment of the present application, after receiving the security detection result, the data analysis network element may generate a data analysis result corresponding to the data analysis type according to the security detection result, or update the data analysis result corresponding to the data analysis type.

[0136] In some embodiments, the data analysis network element may first analyze the first data to obtain the data analysis results, and then request the security network element to perform a security check on the first data based on the data analysis results to obtain the security check results. Finally, the data analysis network element updates the first obtained data analysis results according to the security check results to obtain new data analysis results.

[0137] In other embodiments, the data analysis network element may directly trigger a security check request to the security network element after acquiring the first data. The security network element then performs a security check on the first data to obtain a security check result. Finally, the data analysis network element generates a data analysis result based on the security check result of the security network element on the first data.

[0138] The following is a specific embodiment of the invention. Figure 2 The illustrated embodiment is described in detail.

[0139] like Figure 3 As shown, it is a flow chart of a data analysis method provided by this application, see Figure 3As shown, the method may include the following steps:

[0140] Step 301: The subscribing network element sends a data analysis request message to the NWDAF.

[0141] The data analysis request message is used to request the data analysis result corresponding to the data analysis type to be analyzed, and the data analysis request message may carry the type of the data analysis result (Analytics ID), so that the NWDAF can collect corresponding data according to the type of the data analysis result.

[0142] Exemplarily, the data analysis request message may also be a subscription request message, for example, the subscribing network element calls the Nnwdaf_AnalyticsSubscription_Subscribe service operation of NWDAF or calls the Nnwdaf_analyticsrequest service operation to subscribe to or request the data analysis results it wants from NWDAF, such as service experience data analysis results, network element load data analysis results, or UE interaction information analysis results, etc. The subscription request message may carry Analytics ID, for example, the subscribing network element subscribes to the service experience data analysis results from NWDAF, and the Analytics ID carried in the subscription request message is Service Experience.

[0143] For another example, if the subscribing network element subscribes to the network element load data analysis results from NWDAF, the Analytics ID carried in the subscription request message is NF load information; or if the subscribing network element subscribes to the UE interaction information analysis results from NWDAF, the Analytics ID carried in the subscription request message is UE communication information.

[0144] Step 302: NWDAF obtains first data from a first network element.

[0145] After NWDAF receives the data analysis request message sent by the subscription network element, it can determine the data provider network element (Data provider) according to the Analytics ID carried in the data analysis request message. In one possible implementation, the correspondence between the data analysis type and the data provider network element can be pre-stored, that is, different data analysis types can correspond to different data provider network elements. In addition, NWDAF can obtain different information from different data provider network elements. Exemplarily, when the data provider network element is AMF, NWDAF can obtain UE location information (UELocation) from AMF, such as network location or other geographical location information, such as base station, cell identification, etc.; when the data provider network element is UPF, NWDAF can obtain service experience flow (Quality of Service Flow) information from UPF; when the data provider network element is OAM, NWDAF can obtain radio access type / radio frequency priority (radio accesstype frequency selection priority, RFSP) information from OAM.

[0146] Assuming that in the embodiment of the present application, the data analysis result subscribed by the subscribing network element to the NWDAF is of the first data analysis type, the data provider network element corresponding to the first data analysis type may be the first network element. Of course, it is understandable that the number of first network elements may be one or more.

[0147] As a possible implementation manner, the first data obtained by the NWDAF from the first network element may be all data in the first network element corresponding to the specified data analysis type.

[0148] As another possible implementation, the first data obtained by the NWDAF from the first network element may be part of the data in the first network element, for example, some specific data. For example, when the NWDAF obtains data from the first network element, it also provides a data type, so that the first data obtained by the NWDAF from the first network element is data corresponding to the data type.

[0149] Step 303: NWDAF generates a first analysis result corresponding to the data analysis type based on the first data.

[0150] The first data here can be training data or inference data, which is used as input data for model training or data inference. In addition, the first data is the data that NWDAF performs data analysis on the specified data analysis type. The first data analysis result here can be the model itself or the result obtained based on model inference, which is not limited.

[0151] When the first data is training data, NWDAF can train the training data to obtain an AI model, and obtain a first analysis result based on the AI ​​model; when the first data is inference data, NWDAF can input the inference data into the trained AI model to obtain the first analysis result. This process belongs to the prior art and will not be described in detail here.

[0152] Through steps 201 to 203, NWDAF can obtain one or more network elements corresponding to the specified data analysis type based on the pre-stored correspondence between the data analysis type and the data provider network element, and obtain data from these network elements, and use the obtained data for training and reasoning to obtain data analysis results, which helps to improve the efficiency and accuracy of data analysis.

[0153] Step 304: NWDAF sends the first analysis result to the subscribing network element.

[0154] After the NWDAF obtains the first analysis result, it may send the first analysis result to the subscribing network element. Correspondingly, the subscribing network element may receive the analysis result.

[0155] As a possible implementation, when sending the first analysis result to the subscribing network element, the NWDAF may send a preset accuracy threshold value (eg, recorded as a "first threshold value") to the subscribing network element. The threshold value may be used by the subscribing network element to determine the accuracy of the first analysis result.

[0156] Step 305: The subscribing network element feeds back the accuracy of the first analysis result to the NWDAF.

[0157] After the subscribing network element receives the first analysis result and the first threshold, if the accuracy of the first analysis result is less than the first threshold, it means that abnormal data may exist in the first data acquired by the NWDAF, resulting in a relatively low accuracy of the first analysis result.

[0158] On the contrary, if the accuracy of the first analysis result is greater than the first threshold, it means that the possibility that abnormal data exists in the first data acquired by NWDAF is relatively low, and therefore, the accuracy of the first analysis result is relatively high.

[0159] In some embodiments, the first threshold value can be used for the subscription network element to send a notification message to the NWDAF when determining that the accuracy of the first analysis result is less than the first threshold value. Accordingly, the NWDAF can receive the notification message sent by the subscription network element. The notification message can be used to feedback the accuracy of the data analysis result to the NWDAF, so that the NWDAF sends a data detection request message to the security network element.

[0160] Step 306: The NWDAF sends a first request message to the security NWDAF, where the first request message is used to request a security check on the first data.

[0161] In the embodiment of the present application, the NWDAF sends a first request message to the security NWDAF, which may include the following situations:

[0162] The first method: When the NWDAF receives a notification message sent by a subscription network element, it can send a request message for security detection to the security NWDAF.

[0163] Second: Since the first analysis result is generated by NWDAF based on the first data, NWDAF can also determine the accuracy of the first analysis result according to the first analysis result. That is, when NWDAF determines that the accuracy of the first analysis result is less than the first threshold, it can send a request message for security detection to the security NWDAF.

[0164] Alternatively, NWDAF can also automatically trigger security detection requirements based on the accuracy requirements of AI model training results, etc. That is, NWDAF does not need to wait for notification messages sent by subscribed network elements, but can directly send security detection request messages to security NWDAF.

[0165] The third type: NWDAF can periodically send a request message for security check to security NWDAF. In other words, NWDAF can send a request message for security check to security NWDAF at fixed time intervals. For example, NWDAF can send a request message for security check to security NWDAF every 3 minutes. Of course, NWDAF can also send a request message for security check to security NWDAF every 1 minute, etc. This application does not limit this.

[0166] Fourth: When the data analysis request sent by the subscription network element is used to request the data analysis result corresponding to the set range, the NWDAF can send a request message for security detection to the security NWDAF.

[0167] Among them, the setting range may include a range corresponding to at least one of the following information: setting time information, setting area information, setting slice information, setting user information, and setting service type information.

[0168] Specifically, the setting time information may be a setting time period or a setting time point; the setting area information may be one or more cell identifiers, one or more tracking area identities (TAI), administrative area identifiers, geographic area longitude and latitude identifiers, etc.; the setting slice information may be network slicing selection assistance information (NSSAI), single network slice selection assistance information (S-NSSAI), network slice instance (NSI) information, network slice subnetinstance (NSSI) information, etc.; the setting user information may be a specified network element or a specified terminal device (UE) or user object (user); wherein the user information may be a user type (such as a network element type, a UE type, a user type, etc.), or a user identifier (such as a network element identifier, a UE identifier, a user type), etc.

[0169] Based on one of the above situations, NWDAF can send a first request message to security NWDAF, and the request message can be used to perform security detection on the first data. In other words, the security detection is abnormal data detection, that is, the request message can be used to detect abnormal data in the first data, so that the abnormal data existing in the first data can be determined, so as to process the abnormal data in time and improve the accuracy of the data analysis results.

[0170] It should be noted that the abnormal data in the present application may be bait data (abnormal data or attack data whose distribution is similar to that of normal data and which will affect the accuracy of the data analysis results. Such bait data cannot be easily identified using existing data cleaning or outlier detection methods). The security network element may perform a security check on the first data to obtain the bait data present in the first data, thereby helping the data analysis network element to clear the bait data in the acquired data and improve the accuracy of the data analysis results.

[0171] Specifically, the first request message may include at least one of the following information: information about the first data, a first model, and a first algorithm. The first model is a model established by NWDAF based on the first data or a model predetermined by NWDAF for the data analysis type, and the first algorithm is an algorithm recommended by NWDAF to security NWDAF, and may include at least one algorithm used by NWDAF when establishing the first model. Exemplarily, the first algorithm may be a linear regression algorithm, a recurrent neural network algorithm, etc.

[0172] It should be noted that the information of the first data may be the data itself, or may be the storage address of the first data, or may be the file name storing the first data, etc., and this application does not limit this.

[0173] In some other embodiments, the first request message may further include: abnormal data ratio, and the abnormal data ratio is used to indicate the ratio of the data volume of abnormal data to the data volume of the first data. In other words, the first request message may also include the ratio of the data volume of abnormal data to the data volume of the first data. It is understandable that the data ratio may also be the ratio of the data volume of abnormal data to the data volume of normal data (data in the first data other than abnormal data), and the present application does not limit this.

[0174] The abnormal data ratio can be obtained in the following ways in the embodiment of the present application:

[0175] Mode 1: The subscribing network element may estimate the proportion of the amount of abnormal data in the amount of the first data according to the accuracy of the first analysis result. That is, in step 205, when the subscribing network element feeds back the accuracy of the first data analysis result to the NWDAF, it may also feed back its own estimated proportion of abnormal data to the NWDAF.

[0176] Method 2: NWDAF can estimate the proportion of abnormal data based on information such as the accuracy requirements of the AI ​​model training results. For example, NWDAF can obtain an AI model based on the first data training, and then use the AI ​​model on the test data to obtain the analysis results of the test data, and estimate the proportion of abnormal data based on the mean square error of the analysis results.

[0177] Method 3: security NWDAF can set or estimate the proportion of abnormal data.

[0178] Step 307: security NWDAF performs a security check on the first data to obtain a security check result.

[0179] As a possible implementation method, safety detection can be abnormal data detection. Exemplarily, the safety detection can be bait data detection, such as the TRIM algorithm. When using the TRIM algorithm for bait data detection, it is not simply to remove outliers, but to use the bait data and normal data together to train a linear regression model, and TRIM iteratively estimates the regression parameters. In each iteration, a data subset that minimizes the loss function is selected, and then training is performed again on this data subset until the loss function converges. After convergence, the identified data subset is used as normal data (ie, the second data), and the other data is used as bait data (ie, abnormal data). Optionally, the AI ​​model generated by the last iteration can be used as the model recommended to NWDAF (ie, the second model).

[0180] Specifically, the security detection result may include at least one of the following information: information about abnormal data, information about second data, and a second algorithm. The second data is data in the first data other than the abnormal data, and the second algorithm is a detection algorithm used by the security NWDAF to obtain the abnormal data or the second data. Exemplarily, the second algorithm may be a linear regression algorithm, a deep neural network algorithm, etc.

[0181] It should be noted that the information of the abnormal data can be the abnormal data itself, the storage address of the abnormal data, or the file name corresponding to the abnormal data, etc. The information of the second data can be the second data itself, the storage address of the second data, or the file name corresponding to the second data, etc. This application does not limit this.

[0182] After the security NWDAF receives the first request message sent by the NWDAF, it can use the second algorithm to perform security detection on the first data to obtain a security detection result. The number of the second algorithms can be one or more, which is not limited in this application. It should be noted that when the number of the second algorithms is more than one, it may correspond to the detection results of multiple abnormal data and the detection results of the second data.

[0183] As a possible implementation method, NWDAF itself may pre-store one or more algorithms. For example, the algorithm pre-saved by NWDAF is recorded as the "third algorithm". The first algorithm included in the first request message sent by NWDAF to security NWDAF may be one or more algorithms. Security NWDAF may determine the second algorithm based on the first algorithm and / or the third algorithm.

[0184] Specifically, when the number of first algorithms included in the first request message is 0, the security NWDAF may decide on its own which algorithm to use for security detection. For example, the security NWDAF may select one or more pre-stored third algorithms for security detection.

[0185] When the number of first algorithms included in the first request message is one, the security NWDAF may use only one of the first algorithms for security detection. Of course, the security NWDAF may also not use only one of the first algorithms for security detection, but select any one of the pre-saved third algorithms for security detection, etc., which is not limited in this application.

[0186] When the number of first algorithms included in the first request message is multiple, security NWDAF can determine the intersection of the first algorithm and the third algorithm as the second algorithm, that is, security NWDAF uses the algorithm that exists simultaneously in the first algorithm and the third algorithm to perform security detection. Of course, it is understandable that security NWDAF may not select the intersection of the first algorithm and the third algorithm, and decide the algorithm to be used by itself, etc., and this application does not limit this.

[0187] Step 308: security NWDAF feeds back the security detection result to NWDAF.

[0188] After the security NWDAF performs abnormal data detection on the first data, the security detection result may be sent to the NWDAF. Accordingly, the NWDAF may receive the security detection result.

[0189] Step 309: NWDAF generates or updates the data analysis result corresponding to the data analysis type according to the security detection result.

[0190] In some embodiments, the security detection result may also include: a second model, which is a model established by securityNWDAF based on the second data. In other words, the second model may be a recommended model generated by security NWDAF after performing security detection, so that NWDAF can generate or update the data analysis result corresponding to the data analysis type based on the second model.

[0191] In other embodiments, NWDAF can obtain the second data from the security detection results, then train the second data to obtain a third model, and generate or update the data analysis results corresponding to the data analysis type based on the third model. The second data is the data other than the abnormal data in the first data. In other words, NWDAF can obtain the data other than the abnormal data from the security detection results, and then train based on this data to obtain a new AI model, and then obtain the data analysis results.

[0192] It should be noted that NWDAF can also obtain abnormal data from the security detection results, then extract the abnormal data from the first data, and then obtain the second data, and then train the second data to obtain the third model, and generate or update the data analysis results corresponding to the data analysis type based on the third model. This application does not limit this.

[0193] Further, when the security detection result includes the second algorithm, NWDAF can use the second algorithm to train the second data to obtain a third model.

[0194] In this way, the AI ​​model trained by NWDAF based on data without abnormal data is more accurate, and the data analysis results obtained are also more accurate.

[0195] Step 3010: NWDAF sends the data analysis results to the subscribing network element.

[0196] Based on the above steps, NWDAF can obtain new data analysis results, and then feed back the data analysis results to the subscribing network element.

[0197] In an embodiment of the present application, security NWDAF can extract abnormal data from the first data by detecting the first data, and then train a model based on the data after the abnormal data is extracted to obtain new data analysis results, which can improve the accuracy of the data analysis results and the stability of the AI ​​system.

[0198] like Figure 4 As shown, it is a flow chart of another data analysis method provided in the embodiment of the present application, see Figure 4 As shown, the method includes:

[0199] It should be noted that step 401, step 402, step 404, step 405 and step 406 are Figure 3 Step 301, step 302, step 307, step 308, step 309, and step 3010 in the embodiment shown are the same, and can be referred to in Figure 3 The description in the illustrated embodiment will not be described in detail in this embodiment.

[0200] Step 401: The subscribing network element sends a data analysis request message to the NWDAF.

[0201] Step 402: NWDAF obtains first data from the first network element.

[0202] Step 403: The NWDAF sends a first request message to the security NWDAF, where the first request message is used to request a security check on the first data.

[0203] In the embodiment of the present application, the NWDAF may send a first request message to the security NWDAF based on the following situations:

[0204] The first case: NWDAF can periodically send a first request message to security NWDAF. In other words, NWDAF can send a request message for security detection to security NWDAF at a fixed time interval. For example, NWDAF can send a request message for security detection to security NWDAF every 5 minutes. Of course, NWDAF can also send a request message for security detection to security NWDAF every 2 minutes, etc. This application does not limit this.

[0205] The second case: when the data analysis request sent by the subscription network element is used to request the data analysis result corresponding to the set range, the NWDAF can send a request message for security detection to the security NWDAF.

[0206] Among them, the setting range may include a range corresponding to at least one of the following information: setting time information, setting area information, setting slice information, setting user information, and setting service type information.

[0207] In one of the above two situations, the NWDAF may send a first request message to the security NWDAF to detect abnormal data in the first data, thereby obtaining data other than the abnormal data, thereby making the data analysis result subscribed by the subscribing network element more accurate.

[0208] As a possible implementation, the first request message may include at least one of the following information: information of the first data, a first model, and a first algorithm. The first model is a model predetermined by NWDAF for the data analysis type, and the first algorithm is at least one algorithm used by NWDAF to establish the first model.

[0209] It should be noted that the information of the first data may be the data itself, or the storage address of the data, or the file name of the data, etc., and this application does not limit this.

[0210] The step 403 and Figure 3 The difference from step 306 in the illustrated embodiment is that the first model in step 403 is only a model predetermined by the NWDAF for the data analysis type, and there is no need to interact with the subscribing network element in advance for the first analysis result.

[0211] It is worth noting that Figure 3 In the illustrated embodiment, before the NWDAF sends the first request message to the security NWDAF, the first data has been analyzed once. Figure 4 In the illustrated embodiment, before sending the first request message to the securityNWDAF, the NWDAF does not perform data analysis on the first data, but directly performs security detection on the acquired data. In other words, Figure 3 The embodiment shown is a security check performed on the data after obtaining the data analysis results. Figure 4 The illustrated embodiment is a security check performed on data before obtaining the data analysis results.

[0212] Step 404: security NWDAF performs a security check on the first data to obtain a security check result.

[0213] Step 405: security NWDAF feeds back the security detection result to NWDAF.

[0214] Step 406: NWDAF generates a data analysis result corresponding to the data analysis type according to the security detection result.

[0215] Step 407: NWDAF sends the data analysis result to the subscribing network element.

[0216] Through the method of the embodiment of the present application, before NWDAF performs model training, the acquired data is subjected to security detection, and then model training is performed based on the data after detection except for abnormal data, which can improve the accuracy of the model and make the data analysis results more accurate.

[0217] It is important to understand that Figure 3 The data analysis method of the embodiment shown is Figure 4 Compared with the data analysis method of the embodiment shown, Figure 4 The method of the embodiment shown is to first perform a security check on the acquired data, and then generate a data analysis result based on the security check result, that is, first perform a data security check and then use the AI ​​model, so Figure 4 The method of the illustrated embodiment is applicable to scenarios requiring higher security of the AI ​​model and can ensure the security of the AI ​​model.

[0218] It should be noted that the steps in the embodiments of the present application are not limited to all steps to be executed, and one or more steps of the above embodiments may be optionally executed.

[0219] The above mainly introduces the solution provided by the present application from the perspective of the interaction between various network elements. It can be understood that in order to realize the above functions, the above-mentioned network elements include hardware structures and / or software modules corresponding to the execution of various functions. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed in this document, the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0220] The following describes the device used to implement the above method in the embodiment of the present application in conjunction with the accompanying drawings. Therefore, the above content can be used in subsequent embodiments, and the repeated content will not be repeated.

[0221] Based on the same concept as the above method embodiment, the present application embodiment provides a data analysis device. In the case of using an integrated unit, such as Figure 5 The figure shows a logical structure diagram of a data analysis device, which can be applied to a data analysis network element. Figure 5 As shown, the data analysis device 500 includes a communication unit 501 and a processing unit 502. As an example, the device 500 is used to implement the function of the data analysis network element in the above method. For example, the device can be a data analysis network element, or a device in the data analysis network element, such as a chip system.

[0222] Among them, the communication unit 501 is used to send a first request message to the security network element, wherein the first request message is used to request a security check on the first data, and the first data is the data analyzed by the data analysis network element for a specified data analysis type; and receive the security check result fed back by the security network element; the processing unit 502 is used to generate or update the data analysis result corresponding to the data analysis type according to the security check result.

[0223] In a possible implementation, the processing unit 502 is further used to: before sending a first request message to the first network element, generate a first analysis result corresponding to the data analysis type based on the first data, and determine that the accuracy of the first analysis result is less than a first threshold.

[0224] In a possible implementation, the processing unit 502 is further configured to: before sending the first request message to the first network element, generate a first analysis result corresponding to the data analysis type based on the first data.

[0225] The communication unit 501 is also used to: send the first analysis result and a first threshold to the subscribing network element, the first threshold is used by the subscribing network element to determine that the accuracy of the first analysis result is less than the first threshold, and receive the notification message sent by the subscribing network element when determining that the accuracy of the first analysis result is less than the first threshold.

[0226] The communication unit 501 is specifically configured to send the first request message to the security network element in the following manner: sending the first request message to the security network element according to the notification message.

[0227] In a possible implementation, the communication unit 501 is further used to: before sending the first request message to the network element, receive a data analysis request message sent by the subscription network element, wherein the data analysis request message is used to request a data analysis result corresponding to the data analysis type.

[0228] The processing unit 502 is further configured to determine a data analysis result corresponding to the range set in the data analysis request message.

[0229] In a possible implementation, the set range includes a range corresponding to at least one of the following information: set time information, set area information, set slice information, set user information, and set service type information.

[0230] In a possible implementation manner, the first request message includes at least one of the following information: information of the first data, a first model, and a first algorithm;

[0231] Among them, the first model is a model established by the data analysis network element based on the first data or a model predetermined by the data analysis network element for the data analysis type, and the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model.

[0232] In a possible implementation, the security detection is abnormal data detection; the first request message includes: abnormal data ratio, where the abnormal data ratio is used to indicate the ratio of the data volume of the abnormal data to the data volume of the first data.

[0233] In a possible implementation, the security detection result includes at least one of the following information: information about abnormal data, information about second data, and a second algorithm; wherein the second data is data in the first data excluding the abnormal data, and the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.

[0234] In a possible implementation, the security detection result includes: a second model, where the second model is a model established by the first network element based on the second data.

[0235] The processing unit 502 is specifically used to generate or update the data analysis result corresponding to the data analysis type according to the security detection result in the following manner: generate or update the data analysis result corresponding to the data analysis type based on the second model.

[0236] In a possible implementation, the processing unit 502 is specifically used to generate or update the data analysis results corresponding to the data analysis type based on the security detection results in the following manner: obtaining second data based on the security detection results, the second data being data other than abnormal data in the first data; training the second data to obtain a third model, and generating or updating the data analysis results corresponding to the data analysis type based on the third model.

[0237] In a possible implementation, when the security detection result includes a second algorithm, the processing unit 402 is specifically used to train the second data to obtain a third model in the following manner, including: using the second algorithm to train the second data to obtain the third model.

[0238] In a possible implementation, the first data is training data or inference data corresponding to the data analysis type.

[0239] In a possible implementation manner, the security network element is a security network data analysis function NWDAF network element.

[0240] In a possible implementation, the safety detection is bait data detection.

[0241] When implemented in hardware, in the embodiment of the present application, the communication unit 501 may be a communication interface, a receiver, a transmitter, a transceiver circuit, etc. The communication interface is a general term and may include one or more interfaces.

[0242] When the communication unit 501 is a transceiver and the processing unit 502 is a processor, the data analysis device 500 involved in the embodiment of the present application can be as follows: Figure 6 See Figure 6As shown, a data analysis network element 600 provided in an embodiment of the present application. The data analysis network element 600 may include a transceiver 601, a processor 602, and a memory 603. Among them, the memory 603 stores instructions or programs, and the processor 602 is used to execute the instructions or programs stored in the memory 603. The transceiver 601 is used to execute the operations performed by the communication unit 501 in the above embodiment. The processor 602 is used to execute the operations performed by the processing unit 502 in the above embodiment.

[0243] It should be understood that the data analysis device 500 or the data analysis network element 600 according to the embodiment of the present application may correspond to Figure 2 , Figure 3 as well as Figure 4 The data analysis network element in the embodiment shown, and the operations and / or functions of each module in the data analysis device 500 or the data analysis network element 600 are respectively to achieve Figure 2 , Figure 3 as well as Figure 4 For the sake of brevity, the corresponding processes in the illustrated embodiment will not be described in detail here.

[0244] like Figure 7 FIG. 1 is a schematic diagram of the logical structure of a data analysis device provided in an embodiment of the present application. The data analysis device can be applied to a security network element. Figure 7 As shown, the data analysis device 700 includes a communication unit 701 and a processing unit 702. As an example, the device 700 is used to implement the function of the security network element in the above method. For example, the device can be a security network element, or a device in a security network element, such as a chip system.

[0245] The communication unit 701 is used to receive a first request message sent by a data analysis network element, wherein the first request message is used to request a security check on first data, where the first data is a data set for the data analysis network element to perform data analysis on a specified data analysis type; the processing unit 702 is used to perform a security check on the first data to obtain a security check result. The communication unit 701 is also used to: send the security check result to the data analysis network element.

[0246] In a possible implementation, the first request message includes at least one of the following information: information of the first data, a first model, and a first algorithm; wherein the first model is a model established by the data analysis network element based on the first data or a model predetermined by the data analysis network element for the data analysis type, and the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model.

[0247] In a possible implementation, the security detection is abnormal data detection; the first request message includes: abnormal data ratio, where the abnormal data ratio is used to indicate the ratio of the data volume of the abnormal data to the data volume of the first data.

[0248] In a possible implementation, the security detection result includes at least one of the following information: information about abnormal data, information about second data, and a second algorithm; wherein the second data is data in the first data excluding the abnormal data, and the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.

[0249] In a possible implementation, the security detection result includes: a second model, where the second model is a model established by the security network element based on the second data.

[0250] In a possible implementation manner, the processing unit 702 is specifically configured to perform security check on the first data in the following manner: perform security check on the first data using the second algorithm.

[0251] In a possible implementation, the processing unit 702 is also used to determine the second algorithm based on a first algorithm and / or a third algorithm, wherein the first algorithm includes at least one algorithm used by the data analysis network element to establish the first model, and the third algorithm is at least one algorithm pre-saved in the security network element.

[0252] In a possible implementation manner, the processing unit 702 is specifically configured to determine the second algorithm according to the first algorithm and / or the third algorithm in the following manner: determining an intersection of the first algorithm and the third algorithm as the second algorithm.

[0253] In a possible implementation, the first data is training data or inference data corresponding to the data analysis type.

[0254] In a possible implementation, the data analysis device is a secure network data analysis function NWDAF network element.

[0255] In a possible implementation, the safety detection is bait data detection.

[0256] When implemented in hardware, in the embodiment of the present application, the communication unit 701 may be a communication interface, a receiver, a transmitter, a transceiver circuit, etc. The communication interface is a general term and may include one or more interfaces.

[0257] When the communication unit 701 is a transceiver and the processing unit 702 is a processor, the data analysis device 700 involved in the embodiment of the present application can be as follows: Figure 8 See Figure 8 As shown, a security network element 800 provided in an embodiment of the present application is provided. The security network element 800 may include a transceiver 801, a processor 802, and a memory 803. The memory 803 stores instructions or programs, and the processor 802 is used to execute the instructions or programs stored in the memory 803. The transceiver 801 is used to execute the operations performed by the communication unit 701 in the above embodiment. The processor 802 is used to execute the operations performed by the processing unit 702 in the above embodiment.

[0258] It should be understood that the data analysis device 700 or the security network element 800 according to the embodiment of the present application may correspond to Figure 2 , Figure 3 as well as Figure 4 The security network element in the embodiment shown, and the operations and / or functions of each module in the data analysis device 700 or the security network element 800 are respectively to achieve Figure 2 , Figure 3 as well as Figure 4 For the sake of brevity, the corresponding processes in the illustrated embodiment will not be described in detail here.

[0259] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0260] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0261] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated in the processor.

[0262] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0263] Further, such as Fig. 9As shown, a schematic diagram of a data analysis system 900 provided in an embodiment of the present application, the system 900 may include a data analysis device 901 and a data analysis device 902. Exemplarily, the data analysis device 901 may be used to: send a first request message to a security network element, the first request message is used to request a security check on first data, the first data being data analyzed by the data analysis network element for a specified data analysis type; and receive a security check result fed back by the security network element. The data analysis device 902 may be used to: receive a first request message sent by the data analysis network element, the first request message is used to request a security check on first data, the first data being data analyzed by the data analysis network element for a specified data analysis type, perform a security check on the first data, and obtain a security check result.

[0264] It can be understood that the specific implementation process and corresponding beneficial effects of the system when used for the above-mentioned data analysis method can be referred to the relevant description in the aforementioned method embodiment, and will not be repeated here.

[0265] Based on the same concept as the above-mentioned method embodiment, a computer-readable storage medium is also provided in the embodiment of the present application, on which a computer program is stored. When the program is executed by the processor, the computer executes the operations performed by the data analysis network element or the security network element in the above-mentioned method embodiment or any possible implementation method of the method embodiment.

[0266] Based on the same concept as the above-mentioned method embodiment, the present application also provides a computer program product, which, when called and executed by a computer, can enable the computer to implement the operations performed by the data analysis network element or the security network element in the above-mentioned method embodiment or any possible implementation method of the method embodiment.

[0267] Based on the same concept as the above method embodiment, the present application also provides a chip or chip system, which may include a processor. The chip may also include a memory (or storage module) and / or a transceiver (or communication module), or the chip is coupled to a memory (or storage module) and / or a transceiver (or communication module), wherein the transceiver (or communication module) can be used to support the chip for wired and / or wireless communication, and the memory (or storage module) can be used to store programs, and the processor calls the program to implement the above method embodiment and any possible implementation of the method embodiment. The operation performed by the data analysis network element or the security network element. The chip system may include the above chip, and may also include the above chip and other discrete devices, such as a memory (or storage module) and / or a transceiver (or communication module).

[0268] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0269] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0270] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0271] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0272] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0273] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0274] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0275] The above is only a specific implementation of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the embodiments of the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the embodiments of the present application should be based on the protection scope of the claims.

Claims

1. A data analysis method, characterized in that: include: The data analysis network element sends a first request message to the security network element, where the first request message is used to request a security check on the first data, where the security check is an abnormal data check; The first request message includes: abnormal data proportion, where the abnormal data proportion is used to indicate the proportion of the data volume of abnormal data to the data volume of the first data, where the first data is data analyzed by the data analysis network element for a specified data analysis type; The data analysis network element receives the security detection result fed back by the security network element; The data analysis network element generates or updates the data analysis result corresponding to the data analysis type according to the security detection result.

2. The method according to claim 1, characterized in that Before the data analysis network element sends the first request message to the security network element, the method further includes: The data analysis network element generates a first analysis result corresponding to the data analysis type based on the first data; The data analysis network element determines that the accuracy of the first analysis result is less than a first threshold.

3. The method according to claim 1, characterized in that Before the data analysis network element sends the first request message to the security network element, the method further includes: The data analysis network element generates a first analysis result corresponding to the data analysis type based on the first data; The data analysis network element sends the first analysis result and a first threshold to the subscription network element, where the first threshold is used by the subscription network element to determine that the accuracy of the first analysis result is less than the first threshold; The data analysis network element receives a notification message sent by the subscription network element when the accuracy of the first analysis result is less than the first threshold; The data analysis network element sends a first request message to the security network element, including: The data analysis network element sends the first request message to the security network element according to the notification message.

4. The method according to claim 1, characterized in that Before the data analysis network element sends the first request message to the security network element, the method further includes: The data analysis network element receives a data analysis request message sent by a subscription network element, where the data analysis request message is used to request a data analysis result corresponding to the data analysis type; The data analysis network element determines a data analysis result corresponding to the range set by the data analysis request message.

5. The method according to claim 4, characterized in that The setting range includes a range corresponding to at least one of the following information: setting time information, setting area information, setting slice information, setting user information, and setting service type information.

6. The method according to any one of claims 1 to 5, characterized in that: The first request message includes at least one of the following information: information of the first data, a first model, and a first algorithm; Among them, the first model is a model established by the data analysis network element based on the first data or a model predetermined by the data analysis network element for the data analysis type, and the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model.

7. The method according to claim 1, characterized in that The security detection result includes at least one of the following information: information of abnormal data, information of second data, and a second algorithm; The second data is data in the first data excluding the abnormal data, and the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.

8. The method according to claim 7, characterized in that The security detection result includes: a second model, where the second model is a model established by the security network element based on the second data; The data analysis network element generates or updates the data analysis result corresponding to the data analysis type according to the security detection result, including: The data analysis network element generates or updates the data analysis result corresponding to the data analysis type based on the second model.

9. The method according to claim 1, characterized in that The data analysis network element generates or updates the data analysis result corresponding to the data analysis type according to the security detection result, including: The data analysis network element acquires second data according to the security detection result, where the second data is data other than abnormal data in the first data; The data analysis network element trains the second data to obtain a third model, and generates or updates a data analysis result corresponding to the data analysis type based on the third model.

10. The method according to claim 9, characterized in that When the security detection result includes the second algorithm, the data analysis network element trains the second data to obtain a third model, including: The data analysis network element uses the second algorithm to train the second data to obtain the third model.

11. The method according to claim 1, characterized in that The first data is training data or inference data corresponding to the data analysis type.

12. The method according to claim 1, characterized in that The security network element is a security network data analysis function NWDAF network element.

13. The method according to claim 1, characterized in that The safety detection is a drug bait data detection.

14. A data analysis method, characterized in that: include: The security network element receives a first request message sent by the data analysis network element, where the first request message is used to request a security check on the first data, where the security check is an abnormal data check; The first request message includes: abnormal data proportion, where the abnormal data proportion is used to indicate the proportion of the data volume of the abnormal data to the data volume of the first data, where the first data is a data set for the data analysis network element to perform data analysis on a specified data analysis type; The security network element performs a security check on the first data to obtain a security check result; The security network element sends the security detection result to the data analysis network element.

15. The method according to claim 14, characterized in that The first request message includes at least one of the following information: information of the first data, a first model, and a first algorithm; Among them, the first model is a model established by the data analysis network element based on the first data or a model predetermined by the data analysis network element for the data analysis type, and the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model.

16. The method according to any one of claims 14 to 15, characterized in that: The security detection result includes at least one of the following information: information of abnormal data, information of second data, and a second algorithm; The second data is data in the first data excluding the abnormal data, and the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.

17. The method according to claim 16, characterized in that The security detection result includes: a second model, where the second model is a model established by the security network element based on the second data.

18. The method according to claim 16, characterized in that The security network element performs security detection on the first data, including: The security network element performs security detection on the first data using the second algorithm.

19. The method according to claim 16, characterized in that The method further comprises: The security network element determines the second algorithm based on a first algorithm and / or a third algorithm, wherein the first algorithm includes at least one algorithm used by the data analysis network element when establishing the first model, and the third algorithm is at least one algorithm pre-saved in the security network element.

20. The method of claim 19, wherein: The security network element determines the second algorithm according to the first algorithm and / or the third algorithm, including: The security network element determines the intersection of the first algorithm and the third algorithm as the second algorithm.

21. The method of claim 14, wherein: The first data is training data or inference data corresponding to the data analysis type.

22. The method of claim 14, wherein: The security network element is a security network data analysis function NWDAF network element.

23. The method of claim 14, wherein: The safety detection is a drug bait data detection.

24. A data analysis device, characterized in that: include: A communication unit, configured to send a first request message to a security network element, wherein the first request message is used to request a security check to be performed on the first data, wherein the security check is an abnormal data check; The first request message includes: abnormal data proportion, the abnormal data proportion is used to indicate the proportion of the data volume of abnormal data to the data volume of the first data, the first data is the data analyzed by the data analysis device for the specified data analysis type; and receiving the security detection result fed back by the security network element; A processing unit is used to generate or update a data analysis result corresponding to the data analysis type according to the security detection result.

25. A data analysis device, characterized in that: include: A communication unit, configured to receive a first request message sent by a data analysis network element, wherein the first request message is used to request a security check to be performed on the first data, wherein the security check is an abnormal data detection; The first request message includes: abnormal data proportion, where the abnormal data proportion is used to indicate the proportion of the data volume of the abnormal data to the data volume of the first data, where the first data is a data set for the data analysis network element to perform data analysis on a specified data analysis type; A processing unit, configured to perform a security check on the first data to obtain a security check result; The communication unit is also used to send the security detection result to the data analysis network element.

26. A data analysis device, characterized in that: include: Processor and memory; The memory is used to store one or more programs, and the one or more programs include computer-executable instructions. When the device is running, the processor executes the one or more programs stored in the memory to enable the device to perform the method as described in any one of claims 1-13.

27. A data transmission device, characterized in that: include: Processor and memory; The memory is used to store one or more programs, and the one or more programs include computer-executable instructions. When the device is running, the processor executes the one or more programs stored in the memory to enable the device to perform the method as described in any one of claims 14-23.

28. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 13 or the method according to any one of claims 14 to 23 is implemented.

29. A data analysis system, characterized in that: Comprising the data analysis device as claimed in claim 24 and the data analysis device as claimed in claim 25.

Images