A signaling storm detection method and device, electronic equipment and storage medium

Abstract

The application discloses a signaling storm detection method and device, electronic equipment and storage medium, comprising: acquiring a plurality of traffic messages corresponding to N1, N2 and N12 interfaces in a 5G core network respectively; analyzing the traffic messages corresponding to the N1 interface and the N12 interface to obtain decoding parameters corresponding to NAS-PDU in the N1 interface, analyzing the traffic messages corresponding to the N2 interface, and generating XDR logs of the N2 interface according to the analysis result; decoding the load content of NAS-PDU in the N1 interface according to the decoding parameters, and generating XDR logs of the N1 interface according to the decoding result; and according to the XDR logs corresponding to the N1 interface and the N2 interface respectively, counting interaction information corresponding to a target transaction process in the core network, and determining a signaling storm detection result corresponding to the core network according to the interaction information. The technical scheme of the embodiment of the application can guarantee the accuracy of the signaling storm detection result.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a signaling storm detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the development of communication technology, 5G (5th Generation Mobile Communication Technology) has achieved initial development and application. Currently, more and more smart devices are beginning to connect to 5G networks.

[0003] In such a scenario, if a hacker maliciously hijacks the network or the equipment malfunctions, a large number of abnormal interactive signaling messages will exist in the core network, posing a challenge to the security and stability of the 5G network environment.

[0004] Therefore, it is essential to analyze and manage the signaling interaction traffic of the 5G core network and identify signaling storms within the core network. Current technology lacks an effective method to accurately identify signaling storms within the 5G core network. Summary of the Invention

[0005] This invention provides a signaling storm detection method, apparatus, electronic device, and storage medium, which can ensure the accuracy of signaling storm detection results.

[0006] According to one aspect of the present invention, a signaling storm detection method is provided, comprising:

[0007] Obtain multiple traffic packets corresponding to interfaces N1, N2, and N12 within the 5G core network;

[0008] The traffic packets corresponding to the N1 and N12 interfaces are parsed to obtain the decoding parameters of the NAS-PDU corresponding to the N1 interface. The traffic packets corresponding to the N2 interface are also parsed, and the XDR log corresponding to the N2 interface is generated based on the parsing results.

[0009] Based on the decoding parameters, the payload content of the NAS-PDU in the N1 interface is decoded, and based on the decoding result, the XDR log corresponding to the N1 interface is generated.

[0010] Based on the XDR logs corresponding to the N1 and N2 interfaces respectively, the interaction information corresponding to the target transaction process in the core network is statistically analyzed, and the signaling storm detection result corresponding to the core network is determined based on the interaction information.

[0011] Optionally, obtain multiple traffic packets corresponding to the N1 and N2 interfaces within the 5G core network, including:

[0012] Among all the original traffic packets corresponding to the core network, traffic packets that meet the Next Generation Application Protocol (NGAP) are selected.

[0013] Determine whether the traffic packet includes the payload content of the NAS-PDU in the N1 interface;

[0014] If so, the traffic packet will be used as the traffic packet corresponding to the N1 interface;

[0015] If not, the traffic packet will be treated as the traffic packet corresponding to the N2 interface.

[0016] Optionally, the traffic packets corresponding to interfaces N1 and N12 are parsed to obtain the decoding parameters corresponding to the NAS-PDU in interface N1, including:

[0017] Based on the traffic packets corresponding to the N1 interface, the payload content of the NAS-PDU in the N1 interface is parsed to obtain the first decoding derivation parameters and the first authentication verification parameters.

[0018] Based on each traffic packet corresponding to the N12 interface, the payload content of the HTTPv2 protocol data unit in the N12 interface is parsed to obtain the second decoding derivation parameters and the second authentication verification parameters.

[0019] Based on the first authentication verification parameter and the second authentication verification parameter, the first decoding derivation parameter and the second decoding derivation parameter are processed to obtain the decoding parameters corresponding to the NAS-PDU in the N1 interface.

[0020] Optionally, each traffic packet corresponding to the N2 interface is parsed, and an XDR log corresponding to the N2 interface is generated based on the parsing results, including:

[0021] Obtain the transaction process dictionary table corresponding to the N2 interface. The transaction process dictionary table pre-stores multiple transaction processes monitored by the N2 interface.

[0022] The traffic packets corresponding to the N2 interface are parsed, and multiple target process fields corresponding to the N2 interface are determined in the parsing results based on the transaction process dictionary table corresponding to the N2 interface.

[0023] Based on the multiple target process fields corresponding to the N2 interface, generate the XDR log corresponding to the N2 interface.

[0024] Optionally, the payload content of the NAS-PDU in the N1 interface is decoded according to the decoding parameters, including:

[0025] Determine whether the multiple traffic packets corresponding to the N2 interface include the payload content of the NAS-PDU in the N1 interface;

[0026] If so, the payload content of the NAS-PDU is extracted from the multiple traffic packets corresponding to the N2 interface, and the payload content is decoded according to the decoding parameters.

[0027] Optionally, based on the decoding results, generate the XDR log corresponding to the N1 interface, including:

[0028] Obtain the transaction process dictionary table corresponding to the N1 interface. The transaction process dictionary table pre-stores multiple transaction processes monitored by the N1 interface.

[0029] The decoding result is parsed, and multiple target process fields corresponding to the N1 interface are determined in the parsing result based on the transaction process dictionary table corresponding to the N1 interface.

[0030] Based on the multiple target process fields corresponding to the N1 interface, generate the XDR log corresponding to the N1 interface.

[0031] According to another aspect of the present invention, a signaling storm detection device is provided, the device comprising:

[0032] The message acquisition module is used to acquire multiple traffic messages corresponding to the N1, N2 and N12 interfaces in the 5G core network, respectively.

[0033] The first log generation module is used to parse the traffic packets corresponding to the N1 and N12 interfaces to obtain the decoding parameters of the non-access stratum protocol data unit (NAS-PDU) in the N1 interface, and to parse the traffic packets corresponding to the N2 interface to generate the XDR log corresponding to the N2 interface based on the parsing results.

[0034] The second log generation module is used to decode the payload content of the NAS-PDU in the N1 interface according to the decoding parameters, and generate the XDR log corresponding to the N1 interface according to the decoding result.

[0035] The signaling detection module is used to collect statistics on the interaction information corresponding to the target transaction process in the core network based on the XDR logs corresponding to the N1 interface and the N2 interface, and to determine the signaling storm detection result of the core network based on the interaction information.

[0036] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0037] At least one processor; and

[0038] A memory communicatively connected to the at least one processor; wherein,

[0039] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the signaling storm detection method according to any embodiment of the present invention.

[0040] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the signaling storm detection method according to any embodiment of the present invention.

[0041] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the signaling storm detection method according to any embodiment of the present invention.

[0042] The technical solution provided by this invention provides an effective way to identify signaling storms in the 5G core network. This involves acquiring multiple traffic packets corresponding to interfaces N1, N2, and N12 within the 5G core network; parsing each traffic packet corresponding to interfaces N1 and N12 to obtain decoding parameters for the Non-Access Stratum Protocol Data Unit (NAS-PDU) in interface N1; parsing each traffic packet corresponding to interface N2; generating XDR logs for interface N2 based on the parsing results; decoding the payload content of the NAS-PDU in interface N1 based on the decoding parameters; generating XDR logs for interface N1 based on the decoding results; and statistically analyzing the interaction information corresponding to the target transaction process in the core network based on the XDR logs corresponding to interfaces N1 and N2, and determining the signaling storm detection results for the core network based on the interaction information. This approach ensures the accuracy of signaling storm detection results, accurately calculates the decoding parameters for the NAS-PDU in interface N1, improves the decoding efficiency of NAS-PDU, increases the generation efficiency of XDR logs, and enhances the scalability of the signaling storm detection method.

[0043] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart of a signaling storm detection method provided by an embodiment of the present invention;

[0046] Figure 2 This is a flowchart of another signaling storm detection method provided by an embodiment of the present invention;

[0047] Figure 3 This is a flowchart of another signaling storm detection method provided by an embodiment of the present invention;

[0048] Figure 4 This is a schematic diagram of a signaling storm detection device according to an embodiment of the present invention;

[0049] Figure 5 This is a schematic diagram of the structure of an electronic device that implements the signaling storm detection method of this invention. Detailed Implementation

[0050] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0051] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0052] Figure 1 This is a flowchart illustrating a signaling storm detection method provided in an embodiment of the present invention. This embodiment is applicable to signaling storm detection in 5G core networks. The method can be executed by a signaling storm detection device, which can be implemented in hardware and / or software. This signaling storm detection device can be configured in an electronic device (e.g., a terminal or server) with data processing capabilities. Figure 1 As shown, the method includes:

[0053] Step 110: Obtain multiple traffic packets corresponding to interfaces N1, N2, and N12 within the 5G core network.

[0054] In this embodiment, the N1 interface can be the interface between the User Equipment (UE) in the 5G core network and the Access and Mobility Management Function (AMF) unit. The N2 interface can be the interface between the next-generation Node B (gNB) in the 5G core network and the AMF unit. The N12 interface can be the interface between the AMF in the 5G core network and the Authentication Server Function (AUSF) unit.

[0055] In this step, optionally, all traffic packets generated in the 5G core network within a specific time period can be obtained, and then the traffic packets corresponding to interfaces N1, N2, and N12 can be determined based on the packet information of each traffic packet. Each traffic packet may include a source Internet Protocol (IP) address, a destination IP address, a source Media Access Control (MAC) address, a destination MAC address, and data content.

[0056] In one specific embodiment, before obtaining multiple traffic packets corresponding to interfaces N1, N2, and N12 respectively, optical splitter devices can be deployed on the N1, N2, and N12 interface links respectively, so as to obtain the traffic packets matching the corresponding interface through each optical splitter device.

[0057] Step 120: Parse each traffic packet corresponding to the N1 and N12 interfaces to obtain the decoding parameters corresponding to the Non-access stratum protocol data unit (NAS-PDU) in the N1 interface, and parse each traffic packet corresponding to the N2 interface. Generate the XDR log corresponding to the N2 interface based on the parsing results.

[0058] In this embodiment, optionally, the traffic packets corresponding to the N1 and N12 interfaces can be parsed to obtain the Subscription Permanent Identifier (SUPI) included in the core network, and the NAS-PDU decoding parameters corresponding to the SUPI identifier. Simultaneously, the traffic packets corresponding to the N2 interface can be parsed to obtain the fields related to signaling storm detection in each traffic packet, and an Extended Detection and Response (XDR) log corresponding to the N2 interface can be generated based on these fields.

[0059] Step 130: Decode the payload content of the NAS-PDU in the N1 interface according to the decoding parameters, and generate the XDR log corresponding to the N1 interface based on the decoding result.

[0060] Optionally, in this step, the payload content of the NAS-PDU can be decoded according to the decoding parameters and the encryption algorithm corresponding to the payload content of the NAS-PDU in the N1 interface, and the fields related to signaling storm detection corresponding to the N1 interface can be obtained according to the decoding result. Then, the XDR log corresponding to the N1 interface can be generated according to each field.

[0061] Step 140: Based on the XDR logs corresponding to the N1 and N2 interfaces respectively, collect the interaction information corresponding to the target transaction process in the core network, and determine the signaling storm detection result corresponding to the core network based on the interaction information.

[0062] In this embodiment, optionally, the target transaction process matching the XDR logs can be determined in each traffic packet based on the XDR logs corresponding to the N1 and N2 interfaces respectively. Then, the interaction information of each target transaction process (e.g., interaction time, interaction object, number of successful interactions, and number of failed interactions) is statistically analyzed, and the interaction information is compared with preset standard information. The signaling storm detection result corresponding to the core network is determined based on the comparison result. The standard information can be pre-set normal interaction information corresponding to the target transaction process.

[0063] In a specific embodiment, the number of successful interactions and the number of failed interactions corresponding to the target transaction process can be compared with the thresholds set in the standard information, and the signaling storm detection result corresponding to the core network can be determined based on the comparison result.

[0064] In another specific embodiment, after obtaining the XDR logs corresponding to the N1 and N2 interfaces respectively, it is also possible to statistically analyze the interaction information of the target transaction process under specific indicators within a specific time period, and compare this interaction information with preset standard information. Optionally, the indicators may include specific SUPI identifiers, gNB network elements, AMF network elements, and regional locations, etc.

[0065] In this embodiment, by parsing the traffic packets corresponding to the N1 and N12 interfaces, the decoding parameters corresponding to the NAS-PDU in the N1 interface can be obtained, which can save the time spent in the decoding process of the NAS-PDU payload content and improve the reliability of the decoding results. Secondly, by generating XDR logs that match the N1 and N2 interfaces respectively, it is convenient to statistically analyze the interaction information of the target transaction process in the core network under multiple different dimensions. Thus, the signaling storm in the core network can be accurately identified based on the interaction information, thereby improving the effectiveness of the signaling storm detection results.

[0066] The technical solution provided by this invention provides an effective way to identify signaling storms in the 5G core network by acquiring multiple traffic packets corresponding to interfaces N1, N2, and N12 in the 5G core network; parsing each traffic packet corresponding to interfaces N1 and N12 to obtain decoding parameters for the Non-Access Stratum Protocol Data Unit (NAS-PDU) in interface N1; parsing each traffic packet corresponding to interface N2 and generating XDR logs for interface N2 based on the parsing results; decoding the payload content of the NAS-PDU in interface N1 based on the decoding parameters and generating XDR logs for interface N1 based on the decoding results; and statistically analyzing the interaction information corresponding to the target transaction process in the core network based on the XDR logs corresponding to interfaces N1 and N2, and determining the signaling storm detection results for the core network based on the interaction information. This approach ensures the accuracy of signaling storm detection results.

[0067] Figure 2 A flowchart of another signaling storm detection method provided in an embodiment of the present invention is shown below. Figure 2 As shown, the method includes:

[0068] Step 210: Obtain multiple traffic packets corresponding to interfaces N1, N2 and N12 in the 5G core network.

[0069] In one embodiment of the present invention, obtaining multiple traffic packets corresponding to interfaces N1 and N2 in the 5G core network includes: filtering traffic packets that satisfy the Next Generation Application Protocol (NGAP) from all original traffic packets corresponding to the core network; determining whether the traffic packets include the payload content of the NAS-PDU in the N1 interface; if yes, then the traffic packets are used as the traffic packets corresponding to the N1 interface; if no, then the traffic packets are used as the traffic packets corresponding to the N2 interface.

[0070] In this embodiment, optionally, after obtaining all the original traffic packets corresponding to the 5G core network, it can be determined whether each original traffic packet meets the NGAP protocol through a preset port (e.g., port 38412). If so, the original traffic packet is parsed, and it is determined whether the parsing result includes the payload content of the N1 interface NAS-PDU. If so, the original traffic packet is used as the traffic packet corresponding to the N1 interface; otherwise, the original traffic packet is used as the traffic packet corresponding to the N2 interface.

[0071] In a specific embodiment, after obtaining all the original traffic packets corresponding to the 5G core network, it can also be determined whether each original traffic packet meets the HTTPv2 protocol. If so, the original traffic packet is parsed according to the HTTPv2 protocol, and then it is determined whether the parsing result meets the ue-authentications process of the N12 interface. If so, the original traffic packet is used as the traffic packet corresponding to the N12 interface.

[0072] The advantage of this setup is that by judging the protocols supported by each original traffic packet, the traffic packets corresponding to interfaces N1, N2, and N12 can be accurately filtered out, thereby improving the accuracy of subsequent signaling storm detection results.

[0073] Step 220: Based on the traffic packets corresponding to the N1 interface, parse the load content of the NAS-PDU in the N1 interface to obtain the first decoding derivation parameters and the first authentication verification parameters.

[0074] In this step, optionally, the payload content of the NAS-PDU in the N1 interface can be parsed according to the protocol specifications set by the 3rd Generation Partnership Project (3GPP) and the authentication process to obtain the first decoding derivation parameters and the first authentication verification parameters.

[0075] Specifically, the first decoding derivation parameter may include multiple Authentication and Key Agreement challenge (ABBA) parameters and the length of the ABBA parameters (abba_len). The ABBA parameters can be used for authentication and authorization of traffic packets. The first authentication verification parameter may include multiple verification parameters resStar1. Each parameter in the first decoding derivation parameter corresponds one-to-one with each parameter in the first authentication verification parameter.

[0076] Step 230: Based on each traffic packet corresponding to the N12 interface, parse the payload content of the HTTPv2 protocol data unit in the N12 interface to obtain the second decoding derivation parameter and the second authentication verification parameter.

[0077] In this step, optionally, the second decoding derivation parameters may include multiple SUPI identifiers and a security anchor key Kseaf. The second authentication verification parameters may include multiple verification parameters resStar2. Each parameter in the second decoding derivation parameters corresponds one-to-one with each parameter in the second authentication verification parameters.

[0078] Step 240: Based on the first authentication verification parameter and the second authentication verification parameter, process the first decoding derivation parameter and the second decoding derivation parameter to obtain the decoding parameter corresponding to the NAS-PDU in the N1 interface.

[0079] Optionally, in this step, the same verification parameter can be obtained from the first authentication verification parameter and the second authentication verification parameter. Based on the verification parameter, the matching target decoding derivation parameter can be obtained from the first decoding derivation parameter and the second decoding derivation parameter respectively. Then, multiple target decoding derivation parameters are combined to obtain a decoding parameter group. Finally, the derivation function defined by the 3GPP protocol specification is used to process the decoding parameter group to obtain the decoding parameters corresponding to the NAS-PDU in the N1 interface.

[0080] In a specific embodiment, assuming that the first authentication verification parameter and the second authentication verification parameter have the same verification parameter resStar, the matching target decoding derivation parameters "abba, abba_len" can be obtained from the first decoding derivation parameter based on resStar, and the matching target decoding derivation parameters "SUPI identifier, Kseaf" can be obtained from the second decoding derivation parameter, and then the decoding parameter group "abba, abba_len, SUPI identifier, Kseaf" can be generated.

[0081] The advantage of this setup is that by parsing the payload content of the NAS-PDU in the N1 interface and the payload content of the HTTPv2 protocol data unit in the N12 interface respectively, the decoding parameters corresponding to the NAS-PDU in the N1 interface can be accurately calculated, thereby improving the reliability of the NAS-PDU decoding results in the N1 interface.

[0082] Step 250: Parse each traffic packet corresponding to the N2 interface, and generate the XDR log corresponding to the N2 interface based on the parsing results.

[0083] Step 260: Decode the payload content of the NAS-PDU in the N1 interface according to the decoding parameters, and generate the XDR log corresponding to the N1 interface based on the decoding result.

[0084] In one embodiment of the present invention, decoding the payload content of the NAS-PDU in the N1 interface according to the decoding parameters includes: determining whether the multiple traffic packets corresponding to the N2 interface include the payload content of the NAS-PDU in the N1 interface; if so, extracting the payload content of the NAS-PDU from the multiple traffic packets corresponding to the N2 interface, and decoding the payload content according to the decoding parameters.

[0085] In practical applications, the payload content of NAS-PDU in N1 interface is usually included in the traffic information of N2 interface. By determining whether there is NAS-PDU payload content of N1 interface in the traffic packets of N2 interface, the extraction time of NAS-PDU payload content can be saved, thereby improving the decoding efficiency of NAS-PDU and the detection efficiency of signaling storm in core network.

[0086] In one specific embodiment, optionally, the traffic packet corresponding to the N2 interface can be determined according to a preset identifier to determine whether it includes the payload content of the NAS-PDU of the N1 interface. If so, the payload content of the NAS-PDU is extracted using a preset delimiter; if not, the traffic packet corresponding to the N1 interface can be parsed, and the payload content of the NAS-PDU in the N1 interface can be obtained according to the parsing result.

[0087] Step 270: Based on the XDR logs corresponding to the N1 and N2 interfaces respectively, collect the interaction information corresponding to the target transaction process in the core network, and determine the signaling storm detection result corresponding to the core network based on the interaction information.

[0088] The technical solution provided in this embodiment of the invention obtains multiple traffic packets corresponding to interfaces N1, N2, and N12 in the 5G core network. Based on each traffic packet corresponding to interface N1, the payload content of the NAS-PDU in interface N1 is parsed to obtain first decoding derivation parameters and first authentication verification parameters. Based on each traffic packet corresponding to interface N12, the payload content of the HTTPv2 protocol data unit in interface N12 is parsed to obtain second decoding derivation parameters and second authentication verification parameters. Based on the first authentication verification parameters and the second authentication verification parameters, the first decoding derivation parameters and the second decoding... The derivation parameters are processed to obtain the decoding parameters corresponding to the NAS-PDU in the N1 interface. The traffic packets corresponding to the N2 interface are parsed, and the XDR log corresponding to the N2 interface is generated based on the parsing results. The payload content of the NAS-PDU in the N1 interface is decoded according to the decoding parameters, and the XDR log corresponding to the N1 interface is generated based on the decoding results. Based on the XDR logs corresponding to the N1 and N2 interfaces respectively, the interaction information corresponding to the target transaction process in the core network is statistically analyzed, and the technical means to determine the signaling storm detection results corresponding to the core network based on the interaction information can ensure the accuracy of the signaling storm detection results.

[0089] Figure 3 A flowchart of another signaling storm detection method provided in an embodiment of the present invention is shown below. Figure 3 As shown, the method includes:

[0090] Step 310: Obtain multiple traffic packets corresponding to interfaces N1, N2 and N12 in the 5G core network.

[0091] Step 320: Parse each traffic packet corresponding to the N1 and N12 interfaces to obtain the decoding parameters corresponding to the NAS-PDU in the N1 interface.

[0092] Step 330: Obtain the transaction process dictionary table corresponding to the N2 interface. The transaction process dictionary table stores multiple transaction processes monitored by the N2 interface in advance.

[0093] In a specific embodiment, the transaction process dictionary table corresponding to the N2 interface can be as shown in Table 1. This transaction process dictionary table stores multiple transaction processes monitored by the N2 interface. Users can add, modify, or delete transaction processes in the transaction process dictionary table according to the actual signaling storm detection direction.

[0094] Table 1

[0095]

[0096] Step 340: Parse each traffic packet corresponding to the N2 interface, and determine multiple target process fields corresponding to the N2 interface in the parsing result according to the transaction process dictionary table corresponding to the N2 interface. Generate the XDR log corresponding to the N2 interface based on the multiple target process fields corresponding to the N2 interface.

[0097] Optionally, in this step, each traffic packet corresponding to the N2 interface can be parsed, and according to the multiple transaction processes stored in the transaction process dictionary table, the field matching each transaction process (i.e., the target process field) can be obtained from the parsing result, and each of the target process fields can be stored in a preset data table. Then, according to the data table and each traffic packet corresponding to the N2 interface, the XDR log corresponding to the N2 interface can be generated.

[0098] In a specific embodiment, the target process fields corresponding to the N2 interface can be as shown in Table 2.

[0099] Table 2

[0100]

[0101] Step 350: Decode the payload content of the NAS-PDU in the N1 interface according to the decoding parameters.

[0102] Step 360: Obtain the transaction process dictionary table corresponding to the N1 interface. The transaction process dictionary table pre-stores multiple transaction processes monitored by the N1 interface.

[0103] In a specific embodiment, the transaction process dictionary table corresponding to the N1 interface can be as shown in Table 3. This transaction process dictionary table stores multiple transaction processes monitored by the N1 interface. Users can add, modify, or delete transaction processes in the transaction process dictionary table according to the actual signaling storm detection direction.

[0104] Table 3

[0105]

[0106] Step 370: Parse the decoding result and, based on the transaction process dictionary table corresponding to the N1 interface, determine multiple target process fields corresponding to the N1 interface in the parsing result. Based on the multiple target process fields corresponding to the N1 interface, generate the XDR log corresponding to the N1 interface.

[0107] In this step, optionally, the fields matching each transaction process (i.e., target process fields) can be obtained from the parsing results based on the transaction process dictionary table corresponding to the N1 interface, and each target process field can be stored in a preset data table. Then, based on the data table and each traffic packet corresponding to the N1 interface, the XDR log corresponding to the N1 interface can be generated.

[0108] The advantages of this setup are twofold: firstly, by pre-constructing transaction process dictionary tables corresponding to the N1 and N2 interfaces, the target process fields corresponding to the N1 and N2 interfaces can be quickly determined, improving the efficiency of XDR log generation; secondly, by constructing transaction process dictionary tables, richer signaling interaction processes can be identified, improving the scalability of the signaling storm detection method; and thirdly, if the direction of signaling storm detection changes, only the transaction process dictionary tables and XDR logs need to be updated accordingly, thereby improving the versatility of the signaling storm detection method.

[0109] Step 380: Based on the XDR logs corresponding to the N1 and N2 interfaces respectively, collect the interaction information corresponding to the target transaction process in the core network, and determine the signaling storm detection result corresponding to the core network based on the interaction information.

[0110] The technical solution provided by this invention obtains multiple traffic packets corresponding to interfaces N1, N2, and N12 in the 5G core network, parses the traffic packets of interfaces N1 and N12 to obtain the decoding parameters corresponding to the NAS-PDU in interface N1, obtains the transaction process dictionary table of interface N2, parses the traffic packets of interface N2, determines the target process field corresponding to interface N2 in the parsing result, generates XDR logs corresponding to interface N2, decodes the payload content of NAS-PDU in interface N1 according to the decoding parameters, obtains the transaction process dictionary table of interface N1, parses the decoding result, determines the target process field corresponding to interface N1 in the parsing result, generates XDR logs corresponding to interface N1, and statistically analyzes the interaction information corresponding to the target transaction process in the core network based on the XDR logs corresponding to interfaces N1 and N2, and determines the signaling storm detection result corresponding to the core network based on the interaction information. This technical means can ensure the accuracy of signaling storm detection results.

[0111] Figure 4 This is a schematic diagram of a signaling storm detection device provided in an embodiment of the present invention, as shown below. Figure 4 As shown, the device includes: a message acquisition module 410, a first log generation module 420, a second log generation module 430, and a signaling detection module 440.

[0112] Among them, the message acquisition module 410 is used to acquire multiple traffic messages corresponding to the N1, N2 and N12 interfaces in the 5G core network respectively;

[0113] The first log generation module 420 is used to parse the traffic packets corresponding to the N1 interface and the N12 interface to obtain the decoding parameters corresponding to the NAS-PDU in the N1 interface, and to parse the traffic packets corresponding to the N2 interface to generate the XDR log corresponding to the N2 interface based on the parsing results.

[0114] The second log generation module 430 is used to decode the payload content of the NAS-PDU in the N1 interface according to the decoding parameters, and generate the XDR log corresponding to the N1 interface according to the decoding result.

[0115] The signaling detection module 440 is used to collect statistics on the interaction information corresponding to the target transaction process in the core network based on the XDR logs corresponding to the N1 interface and the N2 interface respectively, and to determine the signaling storm detection result corresponding to the core network based on the interaction information.

[0116] The technical solution provided by this invention provides an effective way to identify signaling storms in the 5G core network by acquiring multiple traffic packets corresponding to interfaces N1, N2, and N12 in the 5G core network; parsing each traffic packet corresponding to interfaces N1 and N12 to obtain decoding parameters for the Non-Access Stratum Protocol Data Unit (NAS-PDU) in interface N1; parsing each traffic packet corresponding to interface N2 and generating XDR logs for interface N2 based on the parsing results; decoding the payload content of the NAS-PDU in interface N1 based on the decoding parameters and generating XDR logs for interface N1 based on the decoding results; and statistically analyzing the interaction information corresponding to the target transaction process in the core network based on the XDR logs corresponding to interfaces N1 and N2, and determining the signaling storm detection results for the core network based on the interaction information. This approach ensures the accuracy of signaling storm detection results.

[0117] Based on the above embodiments, the message acquisition module 410 includes:

[0118] The packet filtering unit is used to filter traffic packets that meet the Next Generation Application Protocol (NGAP) from all the original traffic packets corresponding to the core network.

[0119] The message judgment unit is used to determine whether the traffic message includes the load content of the NAS-PDU in the N1 interface; if yes, the traffic message is regarded as the traffic message corresponding to the N1 interface; if no, the traffic message is regarded as the traffic message corresponding to the N2 interface.

[0120] The first log generation module 420 includes:

[0121] The first parameter determination unit is used to parse the load content of the NAS-PDU in the N1 interface according to each traffic packet corresponding to the N1 interface, and obtain the first decoding derivation parameter and the first authentication verification parameter.

[0122] The second parameter determination unit is used to parse the payload content of the HTTPv2 protocol data unit in the N12 interface according to each traffic packet corresponding to the N12 interface, and obtain the second decoding derivation parameter and the second authentication verification parameter.

[0123] The decoding parameter determination unit is used to process the first decoding derivation parameter and the second decoding derivation parameter according to the first authentication verification parameter and the second authentication verification parameter to obtain the decoding parameters corresponding to the NAS-PDU in the N1 interface;

[0124] The N2 dictionary table acquisition unit is used to acquire the transaction process dictionary table corresponding to the N2 interface. The transaction process dictionary table pre-stores multiple transaction processes monitored by the N2 interface.

[0125] The N2 field determination unit is used to parse each traffic packet corresponding to the N2 interface and determine multiple target process fields corresponding to the N2 interface in the parsing result based on the transaction process dictionary table corresponding to the N2 interface.

[0126] The N2 log generation unit is used to generate XDR logs corresponding to the N2 interface based on multiple target process fields corresponding to the N2 interface.

[0127] The second log generation module 430 includes:

[0128] The load determination unit is used to determine whether the load content of the NAS-PDU in the N1 interface is included in the multiple traffic packets corresponding to the N2 interface; if so, the load content of the NAS-PDU is extracted from the multiple traffic packets corresponding to the N2 interface, and the load content is decoded according to the decoding parameters.

[0129] The N1 dictionary table acquisition unit is used to acquire the transaction process dictionary table corresponding to the N1 interface. The transaction process dictionary table pre-stores multiple transaction processes monitored by the N1 interface.

[0130] The N1 field determination unit is used to parse the decoding result and determine multiple target process fields corresponding to the N1 interface in the parsing result according to the transaction process dictionary table corresponding to the N1 interface.

[0131] The N1 log generation unit is used to generate XDR logs corresponding to the N1 interface based on multiple target process fields corresponding to the N1 interface.

[0132] The above-described apparatus can execute the methods provided in all the foregoing embodiments of the present invention, and has the corresponding functional modules and beneficial effects for executing the above methods. Technical details not described in detail in the embodiments of the present invention can be found in the methods provided in all the foregoing embodiments of the present invention.

[0133] Figure 5 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0134] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0135] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0136] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as signaling storm detection methods.

[0137] In some embodiments, the signaling storm detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the signaling storm detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the signaling storm detection method by any other suitable means (e.g., by means of firmware).

[0138] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0139] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0140] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0141] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0142] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0143] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0144] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0145] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A signaling storm detection method, characterized in that, include: Obtain multiple traffic packets corresponding to interfaces N1, N2, and N12 within the 5G core network; Based on the traffic packets corresponding to the N1 interface, the payload content of the NAS-PDU in the N1 interface is parsed to obtain the first decoding derivation parameters and the first authentication verification parameters. Based on each traffic packet corresponding to the N12 interface, the payload content of the HTTPv2 protocol data unit in the N12 interface is parsed to obtain the second decoding derivation parameters and the second authentication verification parameters. Based on the first authentication verification parameter and the second authentication verification parameter, the first decoding derivation parameter and the second decoding derivation parameter are processed to obtain the decoding parameters corresponding to the NAS-PDU in the N1 interface; Parse each traffic packet corresponding to the N2 interface, and generate the XDR log corresponding to the N2 interface based on the parsing results; Based on the decoding parameters, the payload content of the NAS-PDU in the N1 interface is decoded, and based on the decoding result, the XDR log corresponding to the N1 interface is generated. Based on the XDR logs corresponding to the N1 and N2 interfaces respectively, the interaction information corresponding to the target transaction process in the core network is statistically analyzed, and the signaling storm detection result corresponding to the core network is determined based on the interaction information.

2. The method according to claim 1, characterized in that, Retrieve multiple traffic packets corresponding to interfaces N1 and N2 within the 5G core network, including: Among all the original traffic packets corresponding to the core network, traffic packets that meet the Next Generation Application Protocol (NGAP) are selected. Determine whether the traffic packet includes the payload content of the NAS-PDU in the N1 interface; If so, the traffic packet will be used as the traffic packet corresponding to the N1 interface; If not, the traffic packet will be treated as the traffic packet corresponding to the N2 interface.

3. The method according to claim 1, characterized in that, The traffic packets corresponding to the N2 interface are parsed, and the XDR log corresponding to the N2 interface is generated based on the parsing results, including: Obtain the transaction process dictionary table corresponding to the N2 interface. The transaction process dictionary table pre-stores multiple transaction processes monitored by the N2 interface. The traffic packets corresponding to the N2 interface are parsed, and multiple target process fields corresponding to the N2 interface are determined in the parsing results based on the transaction process dictionary table corresponding to the N2 interface. Based on the multiple target process fields corresponding to the N2 interface, generate the XDR log corresponding to the N2 interface.

4. The method according to claim 1, characterized in that, Based on the decoding parameters, the payload content of the NAS-PDU in the N1 interface is decoded, including: Determine whether the multiple traffic packets corresponding to the N2 interface include the payload content of the NAS-PDU in the N1 interface; If so, the payload content of the NAS-PDU is extracted from the multiple traffic packets corresponding to the N2 interface, and the payload content is decoded according to the decoding parameters.

5. The method according to claim 1, characterized in that, Based on the decoding results, generate the XDR log corresponding to the N1 interface, including: Obtain the transaction process dictionary table corresponding to the N1 interface. The transaction process dictionary table pre-stores multiple transaction processes monitored by the N1 interface. The decoding result is parsed, and multiple target process fields corresponding to the N1 interface are determined in the parsing result based on the transaction process dictionary table corresponding to the N1 interface. Based on the multiple target process fields corresponding to the N1 interface, generate the XDR log corresponding to the N1 interface.

6. A signaling storm detection device, characterized in that, include: The message acquisition module is used to acquire multiple traffic messages corresponding to the N1, N2 and N12 interfaces in the 5G core network, respectively. The first log generation module is used to parse the load content of the NAS-PDU in the N1 interface according to each traffic packet corresponding to the N1 interface, and obtain the first decoding derivation parameters and the first authentication verification parameters. Based on the traffic packets corresponding to the N12 interface, the payload content of the HTTPv2 protocol data unit in the N12 interface is parsed to obtain the second decoding derivation parameter and the second authentication verification parameter; based on the first authentication verification parameter and the second authentication verification parameter, the first decoding derivation parameter and the second decoding derivation parameter are processed to obtain the decoding parameter corresponding to the NAS-PDU in the N1 interface, and the traffic packets corresponding to the N2 interface are parsed to generate the XDR log corresponding to the N2 interface based on the parsing result; The second log generation module is used to decode the payload content of the NAS-PDU in the N1 interface according to the decoding parameters, and generate the XDR log corresponding to the N1 interface according to the decoding result. The signaling detection module is used to collect statistics on the interaction information corresponding to the target transaction process in the core network based on the XDR logs corresponding to the N1 interface and the N2 interface, and to determine the signaling storm detection result of the core network based on the interaction information.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the signaling storm detection method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the signaling storm detection method according to any one of claims 1-5.

9. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the signaling storm detection method according to any one of claims 1-5.

Images