Behavior processing method and apparatus, terminal, network-side device, and medium

Abstract

The application discloses a behavior processing method and device, a terminal, a network side equipment and a medium, and belongs to the technical field of communication. The behavior processing method of the application comprises the following steps: a terminal receives target information from a network side equipment, the target information containing an analysis result of an abnormal behavior of the terminal; and the terminal makes a decision on the behavior of the terminal based on the target information.

Description

Technical Field

[0001] This application belongs to the field of communication technology, specifically relating to a behavior processing method, apparatus, terminal, network-side equipment, and medium. Background Technology

[0002] Currently, terminals can select and / or establish corresponding PDU sessions for application traffic based on the traffic characteristics associated with the application. However, after selecting and / or establishing a PDU session, the terminal may exhibit some abnormal behavior on that PDU session. How to intelligently handle the terminal's abnormal behavior in order to select and / or establish a suitable PDU session has become an urgent problem to be solved. Summary of the Invention

[0003] This application provides a behavior processing method, apparatus, terminal, network-side device, and medium, which can solve the problem of how to intelligently process abnormal behavior of a terminal in order to select and / or establish a suitable PDU session.

[0004] Firstly, a behavior processing method is provided, which includes: a terminal receiving target information from a network-side device, the target information containing analysis results of the terminal's abnormal behavior; and the terminal making a decision on its behavior based on the target information.

[0005] Secondly, a behavior processing device is provided, comprising: a receiving module for receiving target information from a network-side device, the target information including analysis results of abnormal behavior of a terminal; and a decision module for making decisions on the behavior of the terminal based on the target information.

[0006] Thirdly, a behavior processing method is provided, which includes: a network-side device analyzing the behavior of a terminal; and the network-side device sending target information to the terminal, the target information containing the analysis results of the terminal's abnormal behavior.

[0007] Fourthly, a behavior processing device is provided, comprising: an analysis module for analyzing the behavior of a terminal; and a sending module for sending target information to the terminal, the target information containing the analysis results of the abnormal behavior of the terminal.

[0008] Fifthly, a terminal is provided, the terminal including a processor and a memory, the memory storing a program or instructions executable on the processor, the program or instructions, when executed by the processor, implementing the steps of the method as described in the first aspect.

[0009] In a sixth aspect, a terminal is provided, including a processor and a communication interface, wherein the communication interface is used to receive target information from a network-side device, the target information including analysis results of abnormal behavior of the terminal, and the processor is used to make decisions on the behavior of the terminal based on the target information.

[0010] In a seventh aspect, a network-side device is provided, the network-side device including a processor and a memory, the memory storing a program or instructions executable on the processor, the program or instructions, when executed by the processor, implementing the steps of the method as described in the third aspect.

[0011] Eighthly, a network-side device is provided, including a processor and a communication interface, wherein the processor is used to analyze the behavior of a terminal, and the communication interface is used to send target information to the terminal, the target information including the analysis results of the abnormal behavior of the terminal.

[0012] A ninth aspect provides a communication system comprising: a terminal and a network-side device, wherein the terminal is configured to perform the steps of the behavior processing method as described in the first aspect, and the network-side device is configured to perform the steps of the behavior processing method as described in the third aspect.

[0013] In a tenth aspect, a readable storage medium is provided, on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect, or implement the steps of the method described in the third aspect.

[0014] Eleventhly, a chip is provided, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the method as described in the first aspect, or to implement the method as described in the third aspect.

[0015] In a twelfth aspect, a computer program / program product is provided, which is stored in a storage medium and is executed by at least one processor to implement the steps of the behavior processing method as described in the first aspect.

[0016] In this embodiment, the network-side device can detect and analyze the terminal's behavior, and then send the analysis results of the terminal's abnormal behavior to the terminal. After receiving the analysis results sent by the network-side device, the terminal can make decisions about its behavior based on these results. Through this solution, the terminal can make decisions about its behavior based on the analysis results of the terminal's abnormal behavior by the network-side device, thereby enabling the terminal to handle abnormal behavior more intelligently and accurately with the assistance of the network. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the architecture of a communication system provided in an embodiment of this application;

[0018] Figure 2 This is a schematic diagram of a behavior processing method provided in an embodiment of this application;

[0019] Figure 3 This is one of the structural schematic diagrams of a behavior processing device provided in the embodiments of this application;

[0020] Figure 4 This is a second schematic diagram of the structure of a behavior processing device provided in an embodiment of this application;

[0021] Figure 5 This is a schematic diagram of the hardware structure of a communication device provided in an embodiment of this application;

[0022] Figure 6 This is a schematic diagram of the hardware structure of a terminal provided in an embodiment of this application;

[0023] Figure 7 This is a schematic diagram of the hardware structure of a network-side device provided in an embodiment of this application. Detailed Implementation

[0024] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0025] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0026] It is worth noting that the technologies described in this application are not limited to Long Term Evolution (LTE) / LTE-Advanced (LTE-A) systems, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency Division Multiple Access (SC-FDMA), and other systems. The terms "system" and "network" in this application are often used interchangeably, and the described technologies can be used with the systems and radio technologies mentioned above, as well as with other systems and radio technologies. The following description describes New Radio (NR) systems for illustrative purposes, and NR terminology is used in most of the following description; however, these technologies can also be applied to applications beyond NR systems, such as 6th generation (6G) radio systems. th Generation 6G communication system.

[0027] Figure 1This diagram illustrates a block diagram of a wireless communication system applicable to embodiments of this application. The wireless communication system includes a terminal 11 and a network-side device 12. Terminal 11 can be a mobile phone, tablet computer, laptop computer, personal digital assistant (PDA), handheld computer, netbook, ultra-mobile personal computer (UMPC), mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, vehicle-mounted device (VUE), pedestrian terminal (PUE), smart home (home devices with wireless communication capabilities, such as refrigerators, televisions, washing machines, or furniture), game console, personal computer (PC), ATM, or self-service machine, etc. Wearable devices include: smartwatches, smart bracelets, smart headphones, smart glasses, smart jewelry (smart bracelets, smart chains, smart rings, smart necklaces, smart anklets, smart anklets, etc.), smart wristbands, smart clothing, etc. It should be noted that the specific type of terminal 11 is not limited in this embodiment. Network-side equipment 12 may include access network equipment or core network equipment. Access network equipment 12 may also be referred to as radio access network equipment, radio access network (RAN), radio access network function, or radio access network unit. Access network equipment 12 may include base stations, WLAN access points, or WiFi nodes, etc. Base stations may be referred to as Node B, evolved Node B (eNB), access point, base transceiver station (BTS), radio base station, radio transceiver, Basic Service Set (BSS), Extended Service Set (ESS), home B node, home evolved B node, Transmitting Receiving Point (TRP), or any other suitable term in the field, as long as the same technical effect is achieved. The base station is not limited to specific technical terms. It should be noted that in this application embodiment, only a base station in an NR system is used as an example for description, and the specific type of base station is not limited.Core network equipment may include, but is not limited to, at least one of the following: core network node, core network function, Mobility Management Entity (MME), Access and Mobility Management Function (AMF), Session Management Function (SMF), User Plane Function (UPF), Policy Control Function (PCF), Policy and Charging Rules Function (PCRF), Edge Application Server Discovery Function (EASDF), Unified Data Management (UDM), Unified Data Repository (UDR), Home Subscriber Server (HSS), Centralized network configuration (CNC), Network Repository Function (NRF), Network Exposure Function (NEF), Local NEF (or L-NEF), Binding Support Function (BSF), and Application Function. Function (AF), etc. It should be noted that the embodiments of this application only use the core network equipment in the NR system as an example for introduction, and do not limit the specific type of core network equipment.

[0028] The following explains some concepts and / or terms involved in the behavior processing method provided in the embodiments of this application.

[0029] Currently, the 3rd Generation Partnership Project (3GPP) protocol incorporates NWDAF (Near-Wide Data Analyzer) for intelligent analysis. NWDAF possesses intelligent analysis capabilities; it collects data, uses built-in algorithms and analytical capabilities to analyze the results, and provides these results to 5G core network elements for operational optimization or statistical analysis.

[0030] For example, a network data analytics function (NWDAF) can provide an observation service experience analysis function. By collecting service quality (QoS) information of a terminal accessing a server, such as uplink or downlink speed, packet loss rate, etc., it outputs statistical information, which includes the user experience of the terminal accessing the server. Alternatively, NWDAF can make predictions based on the historical experience of the terminal accessing the server. For example, if the terminal accesses the server in a certain area at a certain time in the future, what kind of user experience (e.g., QoS) the terminal may obtain.

[0031] Typically, the analysis and / or prediction content provided by NWDAF is distinguished by an analysis ID. By sending different analysis IDs and some parameters to NWDAF, NWDAF can provide corresponding analysis and / or prediction results. For example, if analysis ID = Service Experience, then NWDAF provides observation service experience analysis. Therefore, as long as a network element obtains NWDAF service, it can input the analysis ID when requesting analysis or prediction, and NWDAF can provide the corresponding analysis and / or prediction results. The analysis or prediction results corresponding to the analysis IDs that NWDAF can currently provide are shown in Table 1.

[0032] Table 1. Analysis identifiers and corresponding analysis results

[0033]

[0034] For example, NWDAF can provide the following performance analytics for different analytics IDs:

[0035] For analytics ID="Service Experience" or analytics ID="WLAN performance", NWDAF can provide the performance of the access method, such as the performance of 3GPP access (e.g., 4G and 5G access) or non-3GPP access (e.g., WLAN access). The performance of the access method includes: uplink or downlink rate after using the access method, packet loss rate after using the access method, reference signal received power (RSRP), reference signal received quality (RSRQ), and received signal strength indicator (RSSI) after using the access method.

[0036] For analytics ID="Load level information" or analytics ID="Service Experience", NWDAF can provide slice performance information, such as the load status of the currently used slice or the service experience of the currently used slice. The load status of the currently used slice includes: the resource usage of the currently used slice, the load level of the currently used slice, etc. The service experience of the currently used slice includes: the uplink or downlink rate after using the slice, the packet loss rate after using the slice, the latency after using the slice, etc.

[0037] For analytics ID="Service Experience" or analytics ID="DNPerformance", NWDAF can provide the performance of a DN, such as the average uplink or downlink rate of accessing a DN, the packet loss rate of accessing a DN, the packet latency of accessing a DN, and the maximum packet latency of accessing a DN.

[0038] For analytics ID="UE Mobility", NWDAF can provide location analysis of the terminal, such as the start and end time of the terminal at a certain location, the dwell time of the terminal at a certain location, etc.

[0039] The technical solutions provided in this application will be described in detail below with reference to the accompanying drawings and through some embodiments and application scenarios.

[0040] This application provides a behavior processing method. Figure 2 A flowchart of a behavior processing method provided in an embodiment of this application is shown. Figure 2 As shown, the behavior processing method provided in this application embodiment includes the following steps 201 to 204.

[0041] Step 201: The network-side device analyzes the behavior of the terminal.

[0042] In this embodiment, the network-side device can detect and analyze the behavior of the terminal, and then send the analysis results of the abnormal behavior of the terminal to the terminal. After receiving the analysis results sent by the network-side device, the terminal can make decisions on its behavior based on the analysis results, thereby handling the abnormal behavior of the terminal more intelligently and accurately.

[0043] It should be noted that in the embodiments of this application, the network-side device can be an NWDAF, or other network elements with the same function or type. The embodiments of this application do not limit this.

[0044] Optionally, in one embodiment of this application, the network-side device can detect and analyze the terminal's behavior after receiving a request message from the terminal. In another embodiment, the network-side device can automatically detect and analyze whether the terminal has engaged in abnormal behavior without requiring a request from the terminal.

[0045] Step 202: The network-side device sends the target information to the terminal.

[0046] In this embodiment of the application, the target information includes the analysis results of abnormal behavior of the terminal.

[0047] Optionally, in this embodiment of the application, when the network-side device determines that the terminal has engaged in abnormal behavior, the network-side device may send target information to the terminal.

[0048] Optionally, in this embodiment of the application, the target information may include the analysis results of the terminal's historical behavior, or it may include the prediction results of the terminal's future performance.

[0049] Optionally, in this embodiment of the application, the analysis results of the abnormal behavior of the terminal mentioned above include at least one of the following: exception ID, traffic description information, protocol data unit (PDU) session identifier, single network slice selection assistance information (S-NSSAI), target data network name (DNN) information, target QoS parameters, periodic time, scheduled communication time, scheduled communication type, communication duration time, traffic profile, and expected transaction dispersion.

[0050] The aforementioned anomaly identifier is used to indicate the risks detected by the network-side device. The risks include at least one of the following: unexpected long-live / large rate flows, suspected distributed denial of service (DDoS) attack, and too frequent service access.

[0051] The traffic description information mentioned above includes at least one of the following: application descriptors, Internet protocol (IP) descriptors, domain descriptors, non-IP descriptors, DNN, and connection capabilities.

[0052] Optionally, in this embodiment, the application descriptor may include an operating system identifier (OS ID) and an operating system application identifier (OS APPID). The IP descriptor may be a destination IP triple (IP address or IPv6 network prefix, port number, protocol ID of a protocol above IP) or IP 5-tuple information. The domain name descriptor may be a fully qualified domain name (FQDN) used as a domain name matching condition. The non-IP descriptor may be source and / or destination information for non-IP traffic. The DNN is the data network accessed or connected to by the application traffic. The connectivity capabilities are matched with the information provided by the application when requesting network connectivity with certain capabilities.

[0053] Optionally, in the embodiments of this application, the DNN in the above-mentioned traffic description information can be a feature description of abnormal traffic.

[0054] Optionally, in this embodiment, the target S-NSSAI can be the S-NSSAI recommended by the network-side device or the S-NSSAI corresponding to abnormal traffic. The target QoS parameter can be the QoS parameter recommended by the network-side device or the QoS parameter corresponding to abnormal traffic. The target DNN information can be the DNN recommended by the network-side device or the DNN corresponding to abnormal traffic. Specifically, it can be determined according to actual usage requirements, and this embodiment does not impose any limitations.

[0055] It should be noted that if the target DNN information corresponds to the abnormal traffic, then the target DNN information and the DNN content in the traffic description information are the same, but the transmission format is different. In other words, network-side devices can send the DNN directly to the terminal, or they can send the DNN through traffic description.

[0056] Step 203: The terminal receives target information from the network-side device.

[0057] Step 204: The terminal makes a decision on its behavior based on the target information.

[0058] It is understood that in this embodiment of the application, the behavior of the terminal is first detected and analyzed by the network side device to obtain the analysis results of the abnormal behavior of the terminal. Then, the terminal can judge the behavior of the terminal again based on the analysis results in order to process the abnormal behavior of the terminal.

[0059] This application provides a behavior processing method. A network-side device can detect and analyze the behavior of a terminal, and then send the analysis results of the terminal's abnormal behavior to the terminal. After receiving the analysis results sent by the network-side device, the terminal can make decisions about its behavior based on these results. Through this solution, the terminal can make decisions about its behavior based on the analysis results of the terminal's abnormal behavior by the network-side device, thereby enabling the terminal to handle abnormal behavior more intelligently and accurately with the assistance of the network.

[0060] Optionally, in this embodiment of the application, before step 201 above, the behavior processing method provided in this embodiment of the application further includes the following steps 301 and 302.

[0061] Step 301: The terminal sends the first message to the network-side device.

[0062] The first message includes an abnormal behavior identifier, which is used to request analysis or prediction of whether the terminal has abnormal behavior.

[0063] It is understood that the above target information is the analysis result corresponding to the abnormal behavior identifier.

[0064] Step 302: The network-side device receives the first message sent by the terminal.

[0065] Optionally, in the embodiments of this application, step 204 can be implemented by steps 204a and 204b as described below.

[0066] Step 204a: If the terminal's behavior is determined to be abnormal based on the target information, the terminal performs the target operation.

[0067] Step 204b: If the terminal's behavior is determined to be normal based on the target information, the terminal ignores the target information.

[0068] In this embodiment, the terminal can determine whether its behavior is abnormal based on the target information. If the terminal's behavior is determined to be abnormal, the terminal performs the target operation. If the terminal's behavior is determined to be normal, the terminal ignores the target information.

[0069] For example, assuming the aforementioned risks include unexpected long-duration / high-rate traffic, if the terminal determines that the unexpected long-duration / high-rate traffic is normal operation, then the target information is ignored.

[0070] Normally, when a network-side device detects abnormal behavior from a terminal, it will handle the abnormal behavior autonomously. However, in this embodiment, the network-side device can analyze the terminal's abnormal behavior, and then the terminal can make decisions about its behavior based on the analysis results. This allows for more intelligent and accurate handling of the terminal's abnormal behavior.

[0071] Optionally, in this embodiment of the application, the analysis results of the abnormal behavior of the terminal include traffic description information.

[0072] The target operation mentioned above includes any one of the following:

[0073] Release the PDU session that carries the data packet corresponding to the traffic description information;

[0074] Initiate the modification process of the PDU session for the data packet corresponding to the traffic description information;

[0075] PDU sessions are not allowed to be established for data packets corresponding to traffic description information;

[0076] The terminal discards or ignores the uplink or downlink data packets corresponding to the traffic description information.

[0077] Optionally, in this embodiment of the application, the analysis results of the abnormal behavior of the terminal include the PDU session identifier.

[0078] The target operation mentioned above includes any one of the following:

[0079] Release the PDU session corresponding to the PDU session identifier;

[0080] Initiate the modification process for the PDU session corresponding to the PDU session identifier;

[0081] Establishing a PDU session corresponding to a PDU session identifier is not allowed;

[0082] Among them, the PDU session mentioned above is the PDU session that carries abnormal traffic.

[0083] Optionally, in the embodiments of this application, the analysis results of the abnormal behavior of the terminal mentioned above may include at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information.

[0084] The process of modifying the PDU session corresponding to the aforementioned PDU session identifier includes at least one of the following:

[0085] If the analysis results include target QoS parameters, modify the QoS parameters in the PDU session to the target QoS parameters;

[0086] If the analysis results include the target S-NSSAI, modify the S-NSSAI in the PDU session to the target S-NSSAI;

[0087] If the analysis results include target DNN information, modify the DNN information in the PDU session to reflect the target DNN information.

[0088] In this embodiment of the application, the target S-NSSAI is the S-NSSAI recommended by the network-side device, the target QoS parameter is the QoS parameter recommended by the network-side device, and the target DNN information is the DNN recommended by the network-side device.

[0089] It is understandable that the terminal can modify certain parameters in the PDU session to the parameters recommended by the network-side device, thereby enabling intelligent and accurate selection and / or establishment of appropriate PDU sessions.

[0090] Optionally, in this embodiment of the application, if the analysis result of the abnormal behavior of the terminal includes at least one of the following: target QoS parameters, target S-NSSAI, target DNN information, the above target operation is to disallow the establishment of a PDU session corresponding to the target information.

[0091] In this embodiment of the application, the target S-NSSAI is the S-NSSAI corresponding to the abnormal traffic, the target QoS parameter is the QoS parameter corresponding to the abnormal traffic, and the target DNN information is the DNN corresponding to the abnormal traffic.

[0092] It is understandable that, since the target information is the information corresponding to the abnormal traffic, the terminal is not allowed to establish a PDU session corresponding to the target information, so that it can intelligently and accurately select and / or establish a suitable PDU session.

[0093] Optionally, in this embodiment of the application, the above-mentioned target operation is to set a session management (SM) back-off timer.

[0094] Specifically, the terminal is not allowed to initiate service requests before the session management backoff timer expires.

[0095] Optionally, in this embodiment, the terminal may use the default parameter settings for the SM back-off timer; or, the terminal may set the SM back-off timer according to target information (e.g., periodic time).

[0096] The behavior processing method provided in this application can be executed by a behavior processing device. This application uses the example of a behavior processing device executing the behavior processing method to illustrate the behavior processing device provided in this application.

[0097] This application provides a behavior processing device applied to a terminal, such as... Figure 3 As shown, the behavior processing device 500 includes a receiving module 501 and a decision module 502. The receiving module 501 receives target information from a network-side device, the target information containing analysis results of abnormal terminal behavior. The decision module 502 makes decisions about the terminal's behavior based on the target information.

[0098] Optionally, in this embodiment, the behavior processing device 500 further includes a sending module. The sending module is configured to send a first message to the network-side device before the receiving module 501 receives target information from the network-side device. The first message includes an abnormal behavior identifier, which is used to request analysis or prediction of whether the terminal has engaged in abnormal behavior.

[0099] Optionally, in this embodiment of the application, the decision module 502 is specifically used to perform a target operation when the behavior of the terminal is determined to be abnormal based on the target information; and to ignore the target information when the behavior of the terminal is determined to be normal based on the target information.

[0100] Optionally, in the embodiments of this application, the above analysis results include at least one of the following: anomaly identifier, traffic description information, PDU session identifier, target S-NSSAI, target DNN information, target QoS parameters, periodic time, predetermined communication time, predetermined communication type, communication duration, traffic overview, and expected service dispersion.

[0101] The aforementioned anomaly identifier is used to indicate risks detected by the network-side device. These risks include at least one of the following: unexpected long-duration / high-rate traffic, suspected DDoS attack, or excessively frequent service access. The aforementioned traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connectivity.

[0102] Optionally, in this embodiment of the application, the above analysis results include traffic description information.

[0103] The target operation mentioned above includes any one of the following:

[0104] Release the PDU session that carries the data packet corresponding to the traffic description information;

[0105] Initiate the modification process of the PDU session for the data packet corresponding to the traffic description information;

[0106] PDU sessions are not allowed to be established for data packets corresponding to traffic description information;

[0107] The terminal discards or ignores the uplink or downlink data packets corresponding to the traffic description information.

[0108] Optionally, in this embodiment of the application, the above analysis results include the PDU session identifier.

[0109] The target operation mentioned above includes any one of the following:

[0110] Release the PDU session corresponding to the PDU session identifier;

[0111] Initiate the modification process for the PDU session corresponding to the PDU session identifier;

[0112] Establishing a PDU session corresponding to a PDU session identifier is not allowed;

[0113] This PDU session is a PDU session that carries abnormal traffic.

[0114] Optionally, in the embodiments of this application, the above analysis results may further include at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information.

[0115] The process of modifying the PDU session corresponding to the aforementioned PDU session identifier includes at least one of the following:

[0116] If the analysis results include target QoS parameters, modify the QoS parameters in the PDU session to the target QoS parameters;

[0117] If the analysis results include the target S-NSSAI, modify the S-NSSAI in the PDU session to the target S-NSSAI;

[0118] If the analysis results include target DNN information, modify the DNN information in the PDU session to reflect the target DNN information.

[0119] Optionally, in the embodiments of this application, when the analysis results include at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information, the above target operation is to disallow the establishment of a PDU session corresponding to the target information.

[0120] Optionally, in this embodiment of the application, the above-mentioned target operation is to set a session management back-off timer.

[0121] Specifically, the terminal is not allowed to initiate service requests before the session management backoff timer expires.

[0122] This application provides a behavior processing device that can make decisions about the terminal's behavior based on the analysis results of abnormal terminal behavior by network-side devices, thereby enabling the terminal to handle abnormal behavior more intelligently and accurately with the assistance of the network.

[0123] This application provides a behavior processing device applied to network-side equipment, such as... Figure 4 As shown, the behavior processing device 600 includes an analysis module 601 and a sending module 602. The analysis module 601 is used to analyze the behavior of the terminal. The sending module 602 is used to send target information to the terminal, which contains the analysis results of the terminal's abnormal behavior.

[0124] Optionally, in this embodiment of the application, the behavior processing device 600 further includes a receiving module. The receiving module is configured to receive a first message sent by the terminal before the analysis module 601 analyzes the terminal's behavior. The first message includes an abnormal behavior identifier, which is used to request analysis or prediction of whether the terminal has engaged in abnormal behavior.

[0125] Optionally, in the embodiments of this application, the above analysis results include at least one of the following: anomaly identifier, traffic description information, PDU session identifier, target S-NSSAI, target DNN information, target QoS parameters, periodic time, predetermined communication time, predetermined communication type, communication duration, traffic overview, and expected service dispersion.

[0126] The aforementioned anomaly identifier is used to indicate risks detected by the network-side device. These risks include at least one of the following: unexpected long-duration / high-rate traffic, suspected DDoS attack, or excessively frequent service access. The aforementioned traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connectivity.

[0127] This application provides a behavior processing device that can analyze the behavior of a terminal and send the analysis results of the terminal's abnormal behavior to the terminal, so that the terminal can make decisions on its behavior based on the analysis results, thereby enabling the terminal to handle abnormal behavior more intelligently and accurately with the assistance of the network.

[0128] The behavior processing device in this application embodiment can be an electronic device, such as an electronic device with an operating system, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or other devices besides a terminal. For example, the terminal can include, but is not limited to, the type of terminal 11 listed above; other devices can be servers, network attached storage (NAS), etc., and this application embodiment does not specifically limit the type.

[0129] The behavior processing device provided in this application embodiment can achieve... Figure 2 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0130] Optionally, such as Figure 5 As shown in the illustration, this application also provides a communication device 700, including a processor 701 and a memory 702. The memory 702 stores programs or instructions that can run on the processor 701. For example, when the communication device 700 is a terminal, the program or instructions executed by the processor 701 implement the various steps of the above-described behavior processing method embodiments and achieve the same technical effect. When the communication device 700 is a network-side device, the program or instructions executed by the processor 701 implement the various steps of the above-described behavior processing method embodiments and achieve the same technical effect. To avoid repetition, further details are omitted here.

[0131] This application also provides a terminal, including a processor and a communication interface. The communication interface is used to receive target information from a network-side device. The target information includes analysis results of abnormal behavior of the terminal. The processor is used to make decisions about the terminal's behavior based on the target information. This terminal embodiment corresponds to the above-described terminal-side method embodiment. All implementation processes and methods of the above-described method embodiments can be applied to this terminal embodiment and achieve the same technical effects. Specifically, Figure 6 A schematic diagram of the hardware structure of a terminal to implement an embodiment of this application.

[0132] The terminal 800 includes, but is not limited to, at least some of the following components: radio frequency unit 801, network module 802, audio output unit 803, input unit 804, sensor 805, display unit 806, user input unit 807, interface unit 808, memory 809, and processor 810.

[0133] Those skilled in the art will understand that the terminal 800 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 810 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 6The terminal structure shown does not constitute a limitation on the terminal. The terminal may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here.

[0134] It should be understood that, in this embodiment, the input unit 804 may include a graphics processing unit (GPU) 8041 and a microphone 8042. The GPU 8041 processes image data of still images or videos obtained by an image capture device (such as a camera) in video capture mode or image capture mode. The display unit 806 may include a display panel 8061, which may be configured in the form of a liquid crystal display, an organic light-emitting diode, or the like. The user input unit 807 includes at least one of a touch panel 8071 and other input devices 8072. The touch panel 8071 is also called a touch screen. The touch panel 8071 may include a touch detection device and a touch controller. Other input devices 8072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be described in detail here.

[0135] In this embodiment, after receiving downlink data from the network-side device, the radio frequency unit 801 can transmit it to the processor 810 for processing; in addition, the radio frequency unit 801 can send uplink data to the network-side device. Typically, the radio frequency unit 801 includes, but is not limited to, antennas, amplifiers, transceivers, couplers, low-noise amplifiers, duplexers, etc.

[0136] The memory 809 can be used to store software programs or instructions, as well as various data. The memory 809 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory 809 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 809 in the embodiments of this application includes, but is not limited to, these and any other suitable types of memory.

[0137] Processor 810 may include one or more processing units; optionally, processor 810 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into processor 810.

[0138] The radio frequency unit 801 is used to receive target information from network-side devices, which includes the analysis results of abnormal behavior of the terminal. The processor 810 is used to make decisions about the terminal's behavior based on the target information.

[0139] Optionally, in this embodiment, the radio frequency unit 801 is further configured to send a first message to the network-side device before receiving target information from the network-side device. The first message is used to request analysis or prediction of whether the terminal is exhibiting abnormal behavior.

[0140] Optionally, in this embodiment, the processor 810 is specifically configured to perform a target operation when the behavior of the terminal is determined to be abnormal based on the target information; and to ignore the target information when the behavior of the terminal is determined to be normal based on the target information.

[0141] This application also provides a network-side device, including a processor and a communication interface. The processor is used to analyze the behavior of a terminal, and the communication interface is used to send target information to the terminal. The target information includes the analysis results of the terminal's abnormal behavior. This network-side device embodiment corresponds to the above-described network-side device method embodiment. All implementation processes and methods of the above-described method embodiments can be applied to this network-side device embodiment and can achieve the same technical effects.

[0142] This application also provides a network-side device. For example... Figure 7 As shown, the network-side device 900 includes a processor 901, a network interface 902, and a memory 903. The network interface 902 is, for example, a common public radio interface (CPRI).

[0143] Specifically, the network-side device 900 of this embodiment further includes: instructions or programs stored in a memory 903 and executable on a processor 901, wherein the processor 901 calls the instructions or programs in the memory 903 to execute. Figure 4 The methods executed by each module shown achieve the same technical effect, and to avoid repetition, they will not be described in detail here.

[0144] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described behavior processing method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0145] The processor is the processor in the terminal described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0146] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described behavior processing method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0147] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0148] This application also provides a computer program / program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above-described behavior processing method embodiments, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0149] This application also provides a communication system, including: a terminal and a network-side device, wherein the terminal can be used to execute the steps of the behavior processing method described above, and the network-side device can be used to execute the steps of the behavior processing method described above.

[0150] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0151] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0152] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A behavior processing method, characterized in that, include: The terminal receives target information from the network-side device, the target information including the analysis results of the terminal's abnormal behavior; The terminal makes decisions about its behavior based on the target information; The terminal makes decisions about its behavior based on the target information, including: If the terminal's behavior is determined to be abnormal based on the target information, the terminal performs the target operation; The analysis results include Protocol Data Unit (PDU) session identifiers; The target operation includes any of the following: Release the PDU session corresponding to the PDU session identifier; Initiate the modification process for the PDU session corresponding to the PDU session identifier; Establishing a PDU session corresponding to the PDU session identifier is not allowed; The PDU session mentioned above is a PDU session that carries abnormal traffic.

2. The method according to claim 1, wherein before the terminal receives target information from the network-side device, the method further includes: The terminal sends a first message to the network-side device; The first message includes an abnormal behavior identifier, which is used to request analysis or prediction of whether the terminal has abnormal behavior.

3. The method according to claim 1, wherein the terminal makes a decision on the terminal's behavior based on the target information, further comprising: If the terminal's behavior is determined to be normal based on the target information, the terminal ignores the target information.

4. The method according to any one of claims 1 to 3, wherein the analysis result further includes at least one of the following: anomaly identifier, traffic description information, target single network slice selection auxiliary information S-NSSAI, target data network name DNN information, target quality of service (QoS) parameters, periodic time, predetermined communication time, predetermined communication type, communication duration, traffic overview, and expected service dispersion; in, The anomaly identifier is used to indicate the risks detected by the network-side device. The risks include at least one of the following: unexpected long-duration / high-rate traffic, suspected distributed denial-of-service (DDoS) attack, and excessively frequent service access. The traffic description information includes at least one of the following: application descriptor, Internet Protocol (IP) descriptor, domain name descriptor, non-IP descriptor, DNN, and connectivity.

5. The method according to claim 4, wherein the analysis result includes traffic description information; The target operation includes any of the following: Release the PDU session that carries the data packet corresponding to the traffic description information; Initiate the modification process of the PDU session carrying the data packet corresponding to the traffic description information; PDU sessions are not allowed to be established for the data packets corresponding to the traffic description information; Discard or ignore the uplink or downlink data packets corresponding to the traffic description information.

6. The method according to claim 1, wherein the analysis result further includes at least one of the following: target QoS parameters, target S-NSSAI, and target DNN information; The process of initiating the modification of the PDU session corresponding to the PDU session identifier includes at least one of the following: If the analysis results include the target QoS parameter, the QoS parameter in the PDU session is modified to the target QoS parameter; If the analysis results include the target S-NSSAI, the S-NSSAI in the PDU session will be modified to the target S-NSSAI; If the analysis results include the target DNN information, the DNN information in the PDU session is modified to the target DNN information.

7. The method according to claim 1, wherein when the analysis result includes at least one of the following: target QoS parameters, target S-NSSAI, target DNN information, the target operation is to disallow the establishment of a PDU session corresponding to the target information.

8. The method according to claim 1, wherein the target operation is setting a session management back-off timer; in, The terminal is not allowed to initiate service requests before the session management backoff timer expires.

9. A behavior processing method, characterized in that, include: Network-side devices analyze the behavior of terminals; The network-side device sends target information to the terminal, the target information including the analysis results of the terminal's abnormal behavior; The analysis results include Protocol Data Unit (PDU) session identifiers; the target information is used to enable the terminal to perform a target operation when the terminal's behavior is determined to be abnormal based on the target information. The target operation includes any of the following: Release the PDU session corresponding to the PDU session identifier; Initiate the modification process for the PDU session corresponding to the PDU session identifier; Establishing a PDU session corresponding to the PDU session identifier is not allowed; The PDU session mentioned above is a PDU session that carries abnormal traffic.

10. The method according to claim 9, wherein before the network-side device analyzes the behavior of the terminal, the method further comprises: The network-side device receives the first message sent by the terminal; The first message includes an abnormal behavior identifier, which is used to request analysis or prediction of whether the terminal has abnormal behavior.

11. The method according to claim 9 or 10, wherein the analysis results further include at least one of the following: anomaly identifier, traffic description information, target S-NSSAI, target DNN information, target QoS parameters, periodic time, predetermined communication time, predetermined communication type, communication duration, traffic overview, and expected service dispersion; in, The anomaly identifier is used to indicate the risks detected by the network-side device, and the risks include at least one of the following: unexpected long-duration / high-rate traffic, suspected DDoS attack, or excessively frequent service access; The traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connectivity.

12. A behavior processing device, applied to a terminal, characterized in that, include: A receiving module is used to receive target information from network-side devices, the target information including the analysis results of abnormal behavior of the terminal; The decision module is used to make decisions about the behavior of the terminal based on the target information; The decision module is specifically used to execute a target operation when the terminal's behavior is determined to be abnormal based on the target information. The analysis results include Protocol Data Unit (PDU) session identifiers; The target operation includes any of the following: Release the PDU session corresponding to the PDU session identifier; Initiate the modification process for the PDU session corresponding to the PDU session identifier; Establishing a PDU session corresponding to the PDU session identifier is not allowed; The PDU session mentioned above is a PDU session that carries abnormal traffic.

13. The apparatus of claim 12, further comprising: The sending module is configured to send a first message to the network-side device before the receiving module receives the target information from the network-side device; The first message includes an abnormal behavior identifier, which is used to request analysis or prediction of whether the terminal has abnormal behavior.

14. The apparatus according to claim 12, wherein the decision module is specifically configured to ignore the target information when it is determined that the behavior of the terminal is normal based on the target information.

15. The apparatus according to any one of claims 12 to 14, wherein the analysis result further includes at least one of the following: anomaly identifier, traffic description information, target S-NSSAI, target DNN information, target QoS parameters, periodic time, predetermined communication time, predetermined communication type, communication duration, traffic overview, and expected service dispersion; in, The anomaly identifier is used to indicate the risks detected by the network-side device, and the risks include at least one of the following: unexpected long-duration / high-rate traffic, suspected DDoS attack, or excessively frequent service access; The traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connectivity.

16. The apparatus according to claim 15, wherein the analysis result includes flow rate description information; The target operation includes any of the following: Release the PDU session that carries the data packet corresponding to the traffic description information; Initiate the modification process of the PDU session carrying the data packet corresponding to the traffic description information; PDU sessions are not allowed to be established for the data packets corresponding to the traffic description information; Discard or ignore the uplink or downlink data packets corresponding to the traffic description information.

17. The apparatus of claim 12, wherein the analysis result further includes at least one of the following: target QoS parameters, target S-NSSAI, target DNN information; The process of initiating the modification of the PDU session corresponding to the PDU session identifier includes at least one of the following: If the analysis results include the target QoS parameter, the QoS parameter in the PDU session is modified to the target QoS parameter; If the analysis results include the target S-NSSAI, the S-NSSAI in the PDU session will be modified to the target S-NSSAI; If the analysis results include the target DNN information, the DNN information in the PDU session is modified to the target DNN information.

18. The apparatus of claim 12, wherein when the analysis result includes at least one of the following: target QoS parameters, target S-NSSAI, target DNN information, the target operation is to disallow the establishment of a PDU session corresponding to the target information.

19. The apparatus according to claim 12, wherein the target operation is setting a session management back-off timer; in, The terminal is not allowed to initiate service requests before the session management backoff timer expires.

20. A behavior processing device, applied to a network-side device, characterized in that, include: The analysis module is used to analyze the behavior of the terminal; A sending module is used to send target information to the terminal, the target information including the analysis results of the abnormal behavior of the terminal; The analysis results include Protocol Data Unit (PDU) session identifiers; the target information is used to enable the terminal to perform a target operation when the terminal's behavior is determined to be abnormal based on the target information. The target operation includes any of the following: Release the PDU session corresponding to the PDU session identifier; Initiate the modification process for the PDU session corresponding to the PDU session identifier; Establishing a PDU session corresponding to the PDU session identifier is not allowed; The PDU session mentioned above is a PDU session that carries abnormal traffic.

21. The apparatus of claim 20, further comprising: The receiving module is configured to receive a first message sent by the terminal before the analysis module analyzes the behavior of the terminal; The first message includes an abnormal behavior identifier, which is used to request analysis or prediction of whether the terminal has abnormal behavior.

22. The apparatus according to claim 20 or 21, wherein the analysis results include at least one of the following: anomaly identifier, traffic description information, target S-NSSAI, target DNN information, target QoS parameters, periodic time, predetermined communication time, predetermined communication type, communication duration, traffic overview, and expected service dispersion; in, The anomaly identifier is used to indicate the risks detected by the network-side device, and the risks include at least one of the following: unexpected long-duration / high-rate traffic, suspected DDoS attack, or excessively frequent service access; The traffic description information includes at least one of the following: application descriptor, IP descriptor, domain name descriptor, non-IP descriptor, DNN, and connectivity.

23. A terminal, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the steps of the behavior processing method as described in any one of claims 1 to 8.

24. A network-side device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the steps of the behavior processing method as described in any one of claims 9 to 11.

25. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the behavior processing method as described in any one of claims 1 to 8, or implement the steps of the behavior processing method as described in any one of claims 9 to 11.

Images