A 5G private network signaling attack detection method based on multidimensional statistical analysis

Abstract

The present invention relates to the field of information security technology, and in particular to a 5G private network signaling attack detection method based on multidimensional statistical analysis, including: collecting original signaling data of N1&N2 and N4 interfaces in the 5G private network, and analyzing and associating synthetic XDR logs in real time; completing signaling process statistics of different terminals at different time granularities according to the XDR logs; formulating multi-dimensional signaling process statistical templates according to the service form and terminal type of the 5G private network; when performing signaling attack detection on the 5G private network, configuring a statistical template that matches the service form of the current 5G private network and the signaling process statistical characteristics of the terminal in the private network, and comparing the statistical value of the statistical template with a preset threshold value. If the threshold value is exceeded, it is considered that there is a signaling attack, otherwise, the current detection is terminated and the next cycle is entered. The present invention can improve the accuracy of signaling attack detection in the 5G private network.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to a 5G private network signaling attack detection method based on multi-dimensional statistical analysis. Background Art

[0002] As the construction of 5G networks matures, applications based on the high speed, large bandwidth, low latency, and high connection density of 5G networks emerge in an endless stream, and mobile communications are no longer limited to meeting the communication needs of human society, but involve telemedicine, VR / AR, industrial automation, smart cities, autonomous driving, the Internet of Things, and other fields. Different industries have different business formats, needs, and requirements for data security. Traditional 5G networks built by telecommunications companies can no longer meet the needs. Building 5G private networks has become the key to satisfying industries and enterprises to apply 5G technology to achieve technological innovation and create value.

[0003] The deployment scenarios and forms of 5G private networks in different industries and enterprises are different, and the network security protection capabilities are insufficient compared with telecom operators. The resource allocation of private networks is based on specific business scenarios, and its resources are relatively limited. If the private network uses public frequency bands, other terminals will illegally access the private network, consume the resources of the private network, and cause major security risks. Due to the different types of terminals, the terminal signaling protocol stack is not completely provided by mainstream manufacturers, there are security risks, and there is even the possibility of being tampered by hackers. After such terminals are connected to the 5G private network, there will be great risks to the security of the private network. For example, for private network terminals with fixed locations, the mobile management resources allocated by the core network are often very small. After the terminal is compromised, it may frequently initiate mobile registration. The mobile registration process involves many network elements of the 5G core network, which will cause signaling amplification attacks. When many compromised terminals frequently initiate mobile registration at the same time, the 5G private network resources will be exhausted, resulting in a denial of service attack.

[0004] The traditional means of detecting signaling attacks is to count the frequency of a certain type of signaling process, perform statistical calculations offline, and detect by comparing with the threshold. In different application scenarios in 5G private networks, the signaling model no longer presents a simple periodicity. Simply setting a threshold will lead to inaccurate detection or missed detection. Summary of the invention

[0005] In view of this, the present invention provides a 5G private network signaling attack detection method based on multi-dimensional statistical analysis to solve the technical problem of inaccurate or missed detection of signaling attacks in 5G private networks in the prior art.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A 5G private network signaling attack detection method based on multi-dimensional statistical analysis includes the following steps:

[0008] Collect the original signaling data of N1&N2 and N4 interfaces in the 5G private network, and parse and associate the synthesized XDR logs in real time;

[0009] Complete signaling process statistics of different terminals at different time granularities based on XDR logs;

[0010] Develop a multi-dimensional signaling process statistics template based on the service form and terminal type of the 5G private network;

[0011] When performing signaling attack detection on a 5G private network, configure a statistical template that matches the current 5G private network's service form and the statistical characteristics of the signaling process of the terminals in the private network, and compare the statistical value of the statistical template with a preset threshold. If the threshold is exceeded, it is considered that a signaling attack exists; otherwise, terminate this detection and enter the next cycle.

[0012] Furthermore, the XDR log includes the signaling process type and terminal identification information.

[0013] Further, signaling flow statistics are performed on different terminals based on a statistical architecture, the statistical architecture including: a statistical information node, a terminal information node, a terminal identification hash table and a time slice counter;

[0014] Among them, the statistical information node stores the number of times different signaling processes occur within one minute;

[0015] The terminal information node contains: terminal identification, time slice counter and a red-black tree mapping table. The red-black tree mapping table uses minute-level timestamps as keys and statistical information nodes as values. Different terminal information nodes form a bidirectional linked list.

[0016] The terminal identification hash table uses the terminal identification as the key and the terminal information node as the value;

[0017] The time slice counter starts from 0 and increases by seconds. XDR logs occurring at different times are counted in different time slices. A circular queue consisting of 61 nodes is established. Each node points to a bidirectional linked list. The time slice corresponding to each node is 1 second.

[0018] Furthermore, the process of performing signaling flow statistics on different terminals includes:

[0019] When a new XDR log is generated, the terminal identifier hash table is queried through the terminal identifier in the XDR log. If the terminal identifier does not exist, a terminal information node is created; a red-black tree mapping table is created on the terminal information node, and a statistical information node is created at the same time to count the current signaling process. The current timestamp is divided by 60, which is used as the key and the newly created statistical information node is inserted into the red-black tree mapping table as the value; the time slice counter is used to take the modulus of 61 to obtain the position of the processing time slice node in the circular queue, and the terminal information node pointer is inserted into the tail of the bidirectional linked list pointed to by the position;

[0020] If there is a terminal information node, use the current timestamp to divide 60, use it as the key to search the red-black tree mapping table, if the corresponding statistical information node is found, count the current signaling process on the found statistical information node; if not found, create a statistical information node, count the current signaling process events, use the current timestamp to divide 60, use it as the key, and insert the newly created statistical information node into the red-black tree mapping table as the value;

[0021] The terminal information node records the value of the time slice counter when the last XDR log was generated, and compares it with the value of the time slice counter when the current XDR log was generated. If they are consistent, the terminal information node position remains unchanged; if they are inconsistent, the terminal information node is deleted from the bidirectional linked list pointed to by the old time slice, and the current time slice counter is used to take modulus 61 to obtain the new position of the time slice node in the circular queue, and the terminal information node pointer is inserted into the tail of the bidirectional linked list pointed to by the position;

[0022] As the time slice counter increases, the ring queue moves in a clockwise direction.

[0023] Furthermore, the multi-dimensional signaling process statistical templates include: a statistical template for the number of times a certain type of signaling process occurs within a period of time, a statistical template for the occurrence of a certain type of signaling process at a certain moment, a statistical template for a certain type of signaling process not occurring for a period of time, and a statistical template for the difference in the number of times a certain signaling process occurs based on the month-on-month or geometric ratio.

[0024] Furthermore, the threshold setting method of the statistical template is as follows: in a secure environment, a statistical template is configured that matches the signaling process statistical characteristics of the private network service form and the terminal; a statistical template for the number of times a certain type of signaling process occurs within a period of time and a statistical template for the difference in the number of times a certain signaling process occurs based on the month-on-month, hour-on-day, week-on-month, and geometric ratio; the statistical value output by the statistical template is used as the baseline, and a certain percentage of the fluctuation above and below the baseline is used as the threshold; for the statistical template for a certain type of signaling process occurring at a certain moment, the time of occurrence is used as the baseline, and the period of time before and after this moment is used as the threshold.

[0025] Furthermore, for the statistical template of the number of times a certain type of signaling process occurs within a period of time and the statistical template of the difference in the number of times a certain signaling process occurs based on the month-on-month or geometric ratio, the threshold value is 50%-150% of the baseline; for the statistical template of the occurrence of a certain type of signaling process at a certain moment, the threshold value is half an hour before and after the baseline.

[0026] Furthermore, a secure environment refers to an environment in which the terminal runs in an intranet, a test environment, an environment reinforced with security measures, or a tested secure environment that has not been subject to signaling attacks.

[0027] Furthermore, when statistical data is collected based on the statistical template, when the time slice counter is equal to 60, start from 0 of the circular queue and traverse the circular queue clockwise. During the traversal, the terminal information nodes in the bidirectional linked list pointed to by each node in the circular queue are all inserted in the past minute or earlier, and the minute-level signaling process frequency information of each terminal is fully counted; according to the statistical information on the occurrence frequency of different signaling processes stored in order according to minute-level timestamps in the red-black tree mapping table, the statistical value of a certain signaling process at any time and any period of time is calculated.

[0028] Furthermore, the process of signaling attack detection on 5G private network is as follows:

[0029] In a non-secure environment, configure a statistical template, traverse the terminal information nodes by time slice based on the currently configured statistical template, and output statistical values. According to the statistical values ​​output by the statistical template, determine whether the baseline has been configured. If the baseline has been configured, it means that the statistical template has been adjusted to match the service form of the private network and the signaling process statistical characteristics of the private network terminal; if the baseline is not configured, end this detection;

[0030] At the same time, the statistical values ​​output by the statistical template are compared with the statistical characteristics of the signaling process of the private network service form and the private network terminal. If they match, the baseline and threshold are configured; otherwise, the statistical template is adjusted until the adjusted statistical template matches the statistical characteristics of the signaling process of the private network service form and the private network terminal.

[0031] If the baseline has been configured, the statistical value output by the statistical template is compared with the baseline to determine whether it exceeds the threshold. If it exceeds the threshold, it is determined to be a signaling attack. If it does not exceed the threshold, the current detection ends and enters the next cycle.

[0032] It can be seen from the above technical solutions that, compared with the prior art, the present invention has the following beneficial effects:

[0033] The present invention collects signaling traffic from different interfaces of the private network, analyzes and associates it in real time to generate XDR, and adopts an online real-time parallel statistical calculation architecture to perform statistical calculations on the number of different types of XDRs for all terminals, similar terminals, and single terminals by minute, hour, day, week, and month, thus achieving real-time, efficient, and multi-dimensional statistics. When performing signaling attack detection on a 5G private network, a statistical template is selected based on the current business form of the 5G private network and the statistical characteristics of the signaling process of the terminals in the private network. The statistical characteristics of the signaling process of the private network can be self-learned, and a statistical characteristic model benchmark can be generated. Detection is performed based on the statistical characteristic model, with higher sensitivity and accuracy and lower missed detection rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0035] Figure 1 A flow chart of a 5G private network signaling attack detection method based on multi-dimensional statistical analysis provided by the present invention;

[0036] Figure 2 A schematic diagram of a 5G private network signaling collection node provided by the present invention;

[0037] Figure 3 A schematic diagram of the structure of the signaling process statistics architecture provided by the present invention;

[0038] Figure 4 A statistical flow chart of the signaling process provided by the present invention;

[0039] Figure 5 This is a flow chart of signaling attack detection provided by the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] like Figure 1 As shown, the embodiment of the present invention discloses a 5G private network signaling attack detection method based on multi-dimensional statistical analysis, comprising the following steps:

[0042] S1, collects the original signaling data of N1&N2 and N4 interfaces in the 5G private network, and parses and associates the synthesized XDR logs in real time;

[0043] S2. Complete the signaling process statistics of different terminals at different time granularities according to the XDR log;

[0044] S3. Develop a multi-dimensional signaling process statistics template based on the service form and terminal type of the 5G private network;

[0045] S4. When performing signaling attack detection on the 5G private network, configure a statistical template that matches the current 5G private network's service form and the statistical characteristics of the signaling process of the terminals in the private network, and compare the statistical value of the statistical template with the pre-set threshold. If it exceeds the threshold, it is considered that a signaling attack exists. Otherwise, end this detection and enter the next cycle.

[0046] The above steps are further explained below.

[0047] S1. Private network signaling collection and analysis.

[0048] One of the main deployment methods of 5G private network is to move base stations and UPF to the campus side and centrally deploy 5GC, such as Figure 2 As shown in the figure, the original signaling data of N1&N2 and N4 ports are collected on the campus side.

[0049] Parse the original signaling data of the N4 interface. The main signaling processes parsed are N4 PFCP SessionEstablishment, N4 PFCP Session Modification, and N4 PFCP Session Delete. N4PFCPSession Establishment, N4 PFCP SessionModification, and N4 PFCP Session Delete are all related to user PDU sessions. In the N4 PFCP Session Establishment process, the terminal identification information can be extracted, and the PDU session creation, modification, and deletion XDR logs are generated through parsing, correlation, and synthesis. The XDR log mainly includes the signaling process type and terminal identification information.

[0050] Parse the original signaling data of the N1&N2 interface. The main signaling processes parsed are Registration, De-registration, Service Request, PDU Session Establishment, PDU Session Modification, PDU Session Release, N2 HO Out, N2 HO In, N2 HO Cancel, Xn HO, and UEContext Release. Associate the PDU session creation process of the N1&N2 interface with the PDU session process of the N4 interface and fill in the user terminal identification. Generate XDR logs such as registration, de-registration, service request, PDU session creation, PDU session modification, PDU session release, N2 cut-out, N2 cut-in, N2 switch cancellation, Xn switch, and N2 interface context release through association and synthesis. The XDR log mainly includes the signaling process type and terminal identification information.

[0051] S2. Signaling process statistics.

[0052] In the present invention, signaling flow statistics are performed on different terminals based on a statistical framework, and the statistical framework is as follows: Figure 3 As shown, it includes: a statistical information node, a terminal information node, a terminal identification hash table and a time slice counter;

[0053] Among them, the statistical information node stores the number of times different signaling processes occur within one minute;

[0054] The terminal information node contains: terminal identification, time slice counter and a red-black tree mapping table. The red-black tree mapping table uses minute-level timestamps as keys and statistical information nodes as values. Different terminal information nodes form a bidirectional linked list.

[0055] The terminal identification hash table uses the terminal identification as the key and the terminal information node as the value;

[0056] To improve the efficiency and real-time performance of statistics, a high-precision timer is used to maintain a counter that starts at 0 and increases by seconds. This counter is called a time slice counter. XDR logs that occur at different times are counted in different time slices. A circular queue consisting of 61 nodes is established. Each node points to a bidirectional linked list. The time slice corresponding to each node is 1 second.

[0057] The process of performing signaling flow statistics for different terminals based on the above architecture is as follows: Figure 4 As shown, specifically including:

[0058] When a new XDR log is generated, the terminal identifier hash table is queried through the terminal identifier in the XDR log. If the terminal identifier does not exist, a terminal information node is created; a red-black tree mapping table is created on the terminal information node, and a statistical information node is created at the same time to count the current signaling process. The current timestamp is divided by 60, which is used as the key and the newly created statistical information node is inserted into the red-black tree mapping table as the value; the time slice counter is used to take the modulus of 61 to obtain the position of the processing time slice node in the circular queue, and the terminal information node pointer is inserted into the tail of the bidirectional linked list pointed to by the position;

[0059] If there is a terminal information node, use the current timestamp to divide 60, use it as the key to search the red-black tree mapping table, if the corresponding statistical information node is found, count the current signaling process on the found statistical information node; if not found, create a statistical information node, count the current signaling process events, use the current timestamp to divide 60, use it as the key, and insert the newly created statistical information node into the red-black tree mapping table as the value;

[0060] The terminal information node records the value of the time slice counter when the last XDR log was generated, and compares it with the value of the time slice counter when the current XDR log was generated. If they are consistent, the terminal information node position remains unchanged; if they are inconsistent, the terminal information node is deleted from the bidirectional linked list pointed to by the old time slice, and the current time slice counter is modulo 61 to obtain the new position of the time slice node in the circular queue, and the terminal information node pointer is inserted into the tail of the bidirectional linked list pointed to by the position. The value of the time slice counter here is actually a timestamp, which is incremented by seconds starting from 0. The value of the time slice counter generated by the last XDR log records the position of the circular queue where the statistical information node is located. If the value of the time slice counter of the current XDR is the same, it means that the position of the circular queue is the same and does not need to be processed. The purpose of comparing the value of the time slice counter when the last XDR was generated with the value of the time slice counter when the current XDR was generated is to accurately calculate the statistical information of all XDR events that occurred in the last minute when performing statistical calculations. Consistency indicates that the XDR events occurred in the same second, and the position in the circular queue remains unchanged, that is, the time slice of the statistical task execution remains unchanged, and the position does not need to be moved.

[0061] As the time slice counter increases, the ring queue moves in a clockwise direction.

[0062] Through the above process, the frequency statistics of different terminals, different time granularities, and different signaling processes are completed.

[0063] The present invention adopts the above-mentioned method to perform signaling flow statistics on different terminals, which has the following characteristics:

[0064] 1) Store the statistical content in a red-black tree according to the minute-level time, and realize statistics by minute, hour, day, week, and month.

[0065] 2) The statistical calculation tasks are distributed and executed in different time slices, which has high statistical efficiency, fully utilizes the computing resources, and avoids the fluctuation of CPU usage, which affects the operation of other functions;

[0066] 3) The stored process implements partial statistical calculations, compresses statistical content, saves computing and storage resources, does not rely on external databases, and has high processing performance;

[0067] 4) It can realize real-time online parallel statistical calculation and output statistical results.

[0068] S3. Development of statistical templates and baseline setting.

[0069] The terminal form in the 5G private network is no longer limited to mobile phones, tablets, and consumer terminals. Different industries and enterprise applications have different business forms and terminal forms, and will present different signaling characteristics. For example, the shuttle transportation tools in ports, warehouses and other parks are frequently moved, and the signaling process is characterized by frequent switching; smart instrument equipment is fixed in position and periodically reports data, and the signaling process is characterized by regularly initiating service requests and updating PDU sessions. The present invention formulates a multi-dimensional signaling process statistical template based on the business form of the private network and the type of terminal, including the following four categories, as shown in Table 1:

[0070] Table 1

[0071]

[0072]

[0073] Of course, the present invention supports but is not limited to the statistical templates described in the above table, supports configuration based on statistical templates, and baselines and thresholds can be set for each type of statistical template, and can be adjusted dynamically.

[0074] When counting data based on the statistical template, when the time slice counter is equal to 60, start from 0 of the circular queue and traverse the circular queue clockwise. During the traversal, the terminal information nodes in the bidirectional linked list pointed to by each node in the circular queue are inserted in the past minute or earlier, and the minute-level signaling process frequency information of each terminal is fully counted; according to the statistical information of the occurrence frequency of different signaling processes stored in the red-black tree mapping table in order according to the minute-level timestamp, the statistical value of a certain signaling process at any time and any period of time is calculated. Since the statistical information of the occurrence frequency of different signaling processes is stored in the red-black tree mapping table in order according to the minute-level timestamp, it is very simple to calculate the statistical value of a certain signaling process at any moment and any period of time. For each terminal information node, statistics are performed according to the configured statistical template, and statistical data can be output.

[0075] The threshold setting method of the statistical template is as follows: in a secure environment, configure a statistical template that matches the private network service form and the statistical characteristics of the terminal's signaling process, and determine the threshold based on the upper and lower fluctuation range of the output value of the statistical template.

[0076] A secure environment refers to an intranet, a test environment, an environment reinforced with security measures, or a tested secure environment that does not have signaling attacks. An unsecure environment refers to a live network environment where the terminal device actually runs.

[0077] Specifically, in a secure environment, statistical data are output based on each terminal and each statistical template, and the statistical template is dynamically adjusted until it matches the service form of the private network and the statistical characteristics of the signaling process of the private network terminal. For example, if the terminal moves frequently, this type of terminal will switch n times within one minute and 60n times within one hour, and the output statistical values ​​will have similar statistical properties. If the terminal sends data periodically, this type of terminal will initiate a service request at a specified time and update the PDU session. The output statistical values ​​will show that this type of signaling process is generated at the specified time.

[0078] After completing the statistical template adjustment, if the template is a statistical template for the number of times a certain type of signaling process occurs in a certain type of terminal within a period of time, or a statistical template based on the difference in the number of times a certain signaling process occurs based on the month, hour, day, week, or month, then in a safe environment, that is, when not attacked by signaling, the output statistical value will be a baseline value, and even if it is affected by other factors, it will only fluctuate within a limited range. This baseline value is set as the baseline, and a certain percentage above and below this baseline value is set as the threshold. In order to improve the readiness of detection, the threshold can be set to 50%-150% of the baseline.

[0079] If the statistical template is a statistical template for a certain type of signaling process occurring at a certain moment, in a safe environment, the output statistical value will follow this rule. Even if there is a deviation in the time of occurrence, the time of occurrence will only fluctuate within a limited range. This moment is set as the baseline, and the period before and after this moment is used as the threshold. To improve the accuracy of detection, the threshold can be set half an hour before and after the baseline.

[0080] S4. Signaling attack detection.

[0081] like Figure 5 As shown, in a non-secure environment, a statistical template is configured, and the terminal information nodes are traversed by time slice based on the currently configured statistical template, and statistical values ​​are output. According to the statistical values ​​output by the statistical template, the statistical values ​​output by the statistical template are compared with the statistical characteristics of the signaling process of the private network service form and the private network terminal. If they match, the baseline and threshold are configured, otherwise the statistical template is adjusted until the adjusted statistical template matches the statistical characteristics of the signaling process of the private network service form and the private network terminal;

[0082] At the same time, according to the statistical values ​​output by the statistical template, determine whether the baseline has been configured. If the baseline has been configured, it means that the statistical template has been adjusted to match the service form of the private network and the statistical characteristics of the signaling process of the private network terminal. The statistical value output by the statistical template is compared with the baseline to determine whether it exceeds the threshold. If it exceeds the threshold, it is determined to be a signaling attack. If it does not exceed the threshold or the baseline is not configured, the detection ends and enters the next cycle.

[0083] In a safe environment, the statistical values ​​output based on the statistical template will be near the baseline and within the threshold range. This is because the baseline and threshold are obtained in a safe environment, using statistical templates that match the service form and terminal form of the private network. After the terminal is attacked, especially by a signaling storm attack, the statistical output value based on this type of statistical template will have a large deviation from the baseline. If it exceeds the threshold, it is determined that a signaling attack has occurred.

[0084] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0085] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A 5G private network signaling attack detection method based on multi-dimensional statistical analysis, characterized in that: The following steps are involved: Collect the original signaling data of N1&N2 and N4 interfaces in the 5G private network, and parse and associate the synthesized XDR logs in real time; Complete signaling process statistics of different terminals at different time granularities based on XDR logs; Develop a multi-dimensional signaling process statistics template based on the service form and terminal type of the 5G private network; When performing signaling attack detection on a 5G private network, configure a statistical template that matches the current 5G private network service form and the signaling process statistical characteristics of the terminals in the private network, and compare the statistical value of the statistical template with the preset threshold. If it exceeds the threshold, it is considered that a signaling attack exists. Otherwise, end this detection and enter the next cycle. Perform signaling process statistics for different terminals based on a statistical architecture, the statistical architecture including: a statistical information node, a terminal information node, a terminal identification hash table and a time slice counter; Among them, the statistical information node stores the number of times different signaling processes occur within one minute; The terminal information node contains: terminal identification, time slice counter and a red-black tree mapping table. The red-black tree mapping table uses minute-level timestamps as keys and statistical information nodes as values. Different terminal information nodes form a bidirectional linked list. The terminal identification hash table uses the terminal identification as the key and the terminal information node as the value; The time slice counter starts from 0 and increases by seconds. XDR logs occurring at different times are counted in different time slices. A circular queue consisting of 61 nodes is established. Each node points to a bidirectional linked list. The time slice corresponding to each node is 1 second. The process of collecting signaling flow statistics for different terminals includes: When a new XDR log is generated, the terminal identifier hash table is queried through the terminal identifier in the XDR log. If the terminal identifier does not exist, a terminal information node is created; a red-black tree mapping table is created on the terminal information node, and a statistical information node is created at the same time to count the current signaling process. The current timestamp is divided by 60, which is used as the key and the newly created statistical information node is inserted into the red-black tree mapping table as the value; the time slice counter is used to take the modulus of 61 to obtain the position of the processing time slice node in the ring queue, and the terminal information node pointer is inserted into the tail of the bidirectional linked list pointed to by the position; If there is a terminal information node, use the current timestamp to divide 60, use it as the key to search the red-black tree mapping table, if the corresponding statistical information node is found, count the current signaling process on the found statistical information node; if not found, create a statistical information node, count the current signaling process events, use the current timestamp to divide 60, use it as the key, and insert the newly created statistical information node into the red-black tree mapping table as the value; The terminal information node records the value of the time slice counter when the last XDR log was generated, and compares it with the value of the time slice counter when the current XDR log was generated. If they are consistent, the terminal information node position remains unchanged; if they are inconsistent, the terminal information node is deleted from the bidirectional linked list pointed to by the old time slice, and the current time slice counter is used to take modulus 61 to obtain the new position of the time slice node in the circular queue, and the terminal information node pointer is inserted into the tail of the bidirectional linked list pointed to by the new position; As the time slice counter increases, the ring queue moves in a clockwise direction.

2. The 5G private network signaling attack detection method based on multidimensional statistical analysis according to claim 1 is characterized in that: The XDR log contains the signaling process type and terminal identification information.

3. The 5G private network signaling attack detection method based on multidimensional statistical analysis according to claim 1 is characterized in that: The multi-dimensional signaling process statistical templates include: the statistical template for the number of times a certain type of signaling process occurs within a period of time, the statistical template for the occurrence of a certain type of signaling process at a certain moment, the statistical template for the absence of a certain type of signaling process for a period of time, and the statistical template for the difference in the number of times a certain signaling process occurs based on the month-on-month or geometric ratio.

4. The 5G private network signaling attack detection method based on multidimensional statistical analysis according to claim 3 is characterized in that: The threshold setting method of the statistical template is as follows: in a secure environment, a statistical template that matches the private network service form and the terminal's signaling process statistical characteristics is configured. For the statistical template of the number of times a certain type of signaling process occurs within a period of time and the statistical template of the difference in the number of times a certain signaling process occurs based on the month-on-month or geometric ratio, the statistical value output by the statistical template is used as the baseline, and a certain percentage of the baseline fluctuation is used as the threshold; For the statistical template of a certain type of signaling process occurring at a certain moment, the occurrence moment is used as the baseline, and the period before and after this moment is used as the threshold.

5. The 5G private network signaling attack detection method based on multidimensional statistical analysis according to claim 4 is characterized in that: The threshold of the statistical template for the number of times a certain type of signaling process occurs within a period of time and the statistical template for the difference in the number of times a certain signaling process occurs based on the month-on-month, hour-on-hour, day, week, and month is 50%-150% of the baseline; the threshold of the statistical template for the occurrence of a certain type of signaling process at a certain moment is half an hour before and after the baseline.

6. The 5G private network signaling attack detection method based on multidimensional statistical analysis according to claim 4 is characterized in that: A secure environment refers to an environment where the terminal runs in an intranet, a test environment, an environment reinforced with security measures, or a tested secure environment that has not been subject to signaling attacks.

7. The 5G private network signaling attack detection method based on multidimensional statistical analysis according to claim 1 is characterized in that: When counting data based on the statistical template, when the time slice counter is equal to 60, start from 0 of the circular queue and traverse the circular queue clockwise. During the traversal, the terminal information nodes in the bidirectional linked list pointed to by each node in the circular queue are all inserted in the past minute or earlier, and the minute-level signaling process frequency information of each terminal is fully counted; according to the statistical information of the occurrence frequency of different signaling processes stored in order by minute-level timestamps in the red-black tree mapping table, the statistical value of a certain signaling process at any time and any period of time is calculated.

8. The 5G private network signaling attack detection method based on multidimensional statistical analysis according to claim 1 is characterized in that: The process of signaling attack detection on 5G private network is as follows: In a non-secure environment, configure a statistical template, traverse the terminal information nodes by time slice based on the currently configured statistical template, and output statistical values. According to the statistical values ​​output by the statistical template, determine whether the baseline has been configured. If the baseline has been configured, it means that the statistical template has been adjusted to match the service form of the private network and the signaling process statistical characteristics of the private network terminal; if the baseline is not configured, end this detection; At the same time, the statistical values ​​output by the statistical template are compared with the statistical characteristics of the signaling process of the private network service form and the private network terminal. If they match, the baseline and threshold are configured; otherwise, the statistical template is adjusted until the adjusted statistical template matches the statistical characteristics of the signaling process of the private network service form and the private network terminal. If the baseline has been configured, the statistical value output by the statistical template is compared with the baseline to determine whether it exceeds the threshold. If it exceeds the threshold, it is determined to be a signaling attack. If it does not exceed the threshold, the current detection ends and enters the next cycle.

Images