User plane traffic checking method and device, equipment and storage medium

Abstract

The invention discloses a user plane traffic checking method and device, equipment and a storage medium, and relates to the technical field of communication. The method comprises the steps that data packets transmitted through a target interface are acquired, a source address and a target address of each data packet are determined, and the target interface is used for connecting a base station and a user plane function node; determining a first address set according to the source address and the target address of each data packet; determining a predicted network element role of the communication equipment corresponding to each address according to a historical network element role of the communication equipment corresponding to each address in the first address set; finding out an address corresponding to the communication equipment in which the predicted network element role is a user plane function node from the first address set to obtain a second address set; and comparing the second address set with a preset address set, and determining a verification result of the user plane traffic according to a comparison result, the preset address set being an address set of a preset user plane function node. Through the technical scheme of the embodiment of the invention, the user plane traffic checking efficiency can be improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of communication technology, and in particular to a user plane flow verification method, device, equipment and storage medium. Background Art

[0002] In the 5th Generation Mobile Communication Technology (5G) network, the N3 interface is the key interface between the User Plane Function (UPF) and the gNode Base Station (gNodeB), responsible for transmitting user data traffic. Its stability and efficiency directly affect user experience and network performance. However, with the popularization of 5G networks and the diversification of services, there are many types of user plane traffic. How to efficiently process and verify the user plane traffic of the N3 interface has become a major challenge faced by enterprises when monitoring and managing their network traffic.

[0003] Existing user plane traffic verification methods often rely on comparing the Internet Protocol (IP) addresses of all data packets passing through the N3 interface with the UPF engineering parameter table one by one to determine the verification results, but this method is inefficient when dealing with high-speed, large-scale traffic.

[0004] Therefore, it is urgent to propose a new method to solve the above problems. Summary of the invention

[0005] The present invention provides a user plane flow checking method, device, equipment and storage medium, which can improve the efficiency of user plane flow checking.

[0006] In a first aspect, an embodiment of the present invention provides a method for checking user plane traffic, including:

[0007] Acquire data packets transmitted through a target interface, and determine a source address and a destination address of each data packet, wherein the target interface is used to connect a base station and a user plane function node;

[0008] Determine a first address set according to the source address and the destination address of each data packet;

[0009] Determine a predicted network element role of the communication device corresponding to each address in the first address set according to a historical network element role of the communication device corresponding to each address;

[0010] Finding an address of a predicted network element role of a corresponding communication device as a user plane function node from the first address set to obtain a second address set;

[0011] The second address set is compared with a preset address set, and a verification result of the user plane traffic is determined according to the comparison result, wherein the preset address set is an address set of preset user plane function nodes.

[0012] The technical solution of the present invention first obtains the data packets transmitted through the target interface, and determines the source address and the target address of each data packet, and the target interface is used to connect the base station and the user plane function node; then determines the first address set according to the source address and the target address of each data packet; then determines the predicted network element role of each address corresponding to the communication device according to the historical network element role of each address corresponding to the communication device in the first address set; then finds the address of the predicted network element role of the corresponding communication device as the user plane function node from the first address set to obtain the second address set; finally, compares the second address set with the preset address set, and determines the verification result of the user plane traffic according to the comparison result, and the preset address set is the address set of the preset user plane function node. The above technical solution, by obtaining the data packets transmitted through the target interface and determining the source address and the target address of each data packet, provides a data basis for determining the first address set later. Then determines the first address set according to the source address and the target address of each data packet, and provides a data basis for determining the predicted network element role of each address corresponding to the communication device later. Then determines the predicted network element role of each address corresponding to the communication device according to the historical network element role of each address corresponding to the communication device in the first address set, and provides a data basis for determining the second address set later. Then, the address of the predicted network element role of the corresponding communication device is the user plane function node from the first address set to obtain the second address set, which provides a data basis for determining the verification result of the user plane traffic. Finally, the second address set is compared with the preset address set, and the verification result of the user plane traffic is determined based on the comparison result, which greatly reduces the number of IP addresses that need to be compared during the verification, thereby improving the efficiency of the user plane traffic verification. Compared with the prior art, when performing user plane traffic verification, the IP addresses of all data packets transmitted through the target interface will be compared one by one with the engineering parameter table of the UPF to determine the verification result. The present invention determines the historical network element role of the communication device corresponding to each address according to the source address and the destination address of the data packet transmitted by the target interface, and then determines the predicted network element role of the communication device corresponding to each address according to the historical network element role of the communication device corresponding to each address; then determines the second address set according to the predicted network element role of the communication device corresponding to each address; finally, compares the second address set with the preset address set to obtain a comparison result, and determines the verification result of the user plane traffic according to the comparison result, which greatly reduces the number of IP addresses to be compared during the verification, thereby significantly improving the efficiency of the user plane traffic verification. The low efficiency problem of the prior art in processing high-speed and large-scale traffic is solved.

[0013] In a second aspect, an embodiment of the present invention further provides a user plane flow verification device, the device comprising:

[0014] An acquisition module, used to acquire data packets transmitted through a target interface and determine a source address and a target address of each data packet, wherein the target interface is used to connect a base station and a user plane function node;

[0015] A first determination module, configured to determine a first address set according to a source address and a destination address of each data packet;

[0016] A second determination module, configured to determine a predicted network element role of a communication device corresponding to each address in the first address set according to a historical network element role of the communication device corresponding to each address in the first address set;

[0017] A third determination module is used to find out the address of the predicted network element role of the corresponding communication device as a user plane function node from the first address set to obtain a second address set;

[0018] The verification module is used to compare the second address set with a preset address set, and determine a verification result of the user plane traffic according to the comparison result, wherein the preset address set is an address set of preset user plane function nodes.

[0019] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0020] at least one processor; and a memory communicatively coupled to the at least one processor;

[0021] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can implement any user plane traffic verification method described in the first aspect.

[0022] In a fourth aspect, an embodiment of the present invention further provides a storage medium including computer executable instructions,

[0023] The computer executable instructions, when executed by a computer processor, implement any user plane traffic verification method described in the first aspect.

[0024] It should be noted that the above computer instructions may be stored in whole or in part on a computer-readable storage medium. The computer-readable storage medium may be packaged together with the processor of the user plane flow verification device, or may be packaged separately from the processor of the user plane flow verification device, and this application does not limit this.

[0025] The description of the second, third and fourth aspects in this application can refer to the detailed description of the first aspect; and the beneficial effects of the description of the second, third and fourth aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0026] In this application, the name of the user plane flow verification device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalent technologies.

[0027] These and other aspects of the present application will become more apparent from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 A flow chart of a method for checking user plane traffic provided by an embodiment of the present invention;

[0030] Figure 2 A flowchart of another method for checking user plane traffic provided by an embodiment of the present invention;

[0031] Figure 3 A schematic diagram of the structure of a user plane flow verification device provided by an embodiment of the present invention;

[0032] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0034] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0035] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0036] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0037] It should be mentioned before discussing exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe various operations (or steps) as sequential processes, many operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of various operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to methods, functions, procedures, subroutines, subprograms, etc. In addition, the embodiments in the present invention and the features in the embodiments can be combined with each other without conflict.

[0038] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0039] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0040] Figure 1 A flowchart of a user plane traffic verification method provided in an embodiment of the present invention. This embodiment can be applied to situations where user plane traffic needs to be verified. The method can be executed by a user plane traffic verification device, which can be implemented in software and / or hardware. Exemplarily, the device can be a computer.

[0041] refer to Figure 1 The user plane flow verification method of this embodiment specifically includes the following steps:

[0042] Step 110: Acquire data packets transmitted through the target interface, and determine the source address and target address of each data packet.

[0043] Specifically, the target interface refers to the network interface for capturing data packets. In this embodiment, the target interface is used to connect the base station and the user plane function node. The base station is a core component in the wireless communication system. It is responsible for wireless connection with user devices (such as mobile phones, tablets, etc.) and serves as a bridge between user devices and the 5G core network. The user plane function node is a key component in the 5G core network. It is mainly responsible for processing the forwarding and routing of user data. The data packet is the basic unit in network communication, which includes the source address and the destination address. In this embodiment, the data packet refers to a data packet encapsulated under the Transmission Control Protocol (TCP) that carries only the Synchronize Sequence Numbers (SYN) flag and does not carry the Acknowledgment (ACK) flag. The source address refers to the IP address of the device that sends the data packet. The destination address refers to the IP address of the device to which the data packet is sent.

[0044] In the specific implementation, you can select a suitable packet capture tool according to the actual situation or needs, and then use the selected packet capture tool to obtain the data packets transmitted by the target interface, and then use the packet capture tool to determine the source address and destination address of the outer layer of each data packet. For example: for each captured data packet, you can use the packet capture tool to parse the IP layer of each data packet, so as to extract the source address and destination address of the outer layer of each data packet.

[0045] It should be noted that in the communication process of the N3 interface, it is usually the base station side that initiates the Internet access process and is responsible for sending data packets to the user plane function node, while the user plane function node processes the data packets from the base station as the receiving end. Therefore, the target address of the outer layer of the data packet that initiates the Internet access process transmitted on the N3 interface corresponds to the user plane function node in most cases, and the source address of the outer layer of the data packet that initiates the Internet access process corresponds to the base station in most cases. Based on this, the source address and target address of the outer layer of each data packet that initiates the Internet access process can be analyzed to help determine the historical network element role of the communication device corresponding to the address of each data packet.

[0046] In this embodiment, by determining the source address and the destination address of each data packet, a data basis is provided for subsequently determining the first address set.

[0047] Step 120: Determine a first address set according to the source address and the destination address of each data packet.

[0048] Specifically, the first address set refers to a set of all unique IP addresses extracted and sorted out from the acquired data packets transmitted by the target interface.

[0049] In a specific implementation, after determining the source address and destination address of each data packet, all determined addresses are deduplicated to ensure that each address in the set is unique, and finally the deduplicated addresses are combined into a set, namely the first address set. Specifically, when extracting the source address and destination address of each data packet, the extracted addresses can be stored in a data structure (such as a hash table or a linked list), and in the process of storing the addresses, duplication is avoided by checking whether the address already exists in the data structure. If the address already exists, no operation is performed; if the address does not exist, it is added to the data structure. After completing the address extraction and deduplication of all data packets, the addresses included in the aforementioned data structure constitute the first address set.

[0050] In this embodiment, by determining the first address set, a data basis is provided for subsequently determining the predicted network element role of the communication device corresponding to each address.

[0051] Step 130: Determine a predicted network element role of the communication device corresponding to each address in the first address set according to the historical network element role of the communication device corresponding to each address.

[0052] Specifically, the historical network element role refers to the role played by the communication device in the network in the past period of time. For example, the historical network element role can be a base station or a user plane function node. The predicted network element role refers to the role that the communication device will play in the present or future based on the historical network element role of the communication device. For example, the predicted network element role can be a base station or a user plane function node.

[0053] In a specific implementation, before determining the predicted network element role of the communication device corresponding to each address according to the historical network element role of the communication device corresponding to each address in the first address set, the initial network element role of the communication device corresponding to each address in the first address set that is only the target address in the acquired data packet can be determined as a user plane function node, and the initial network element role of the communication device corresponding to each address in the first address set that is only the source address in the acquired data packet can be determined as a base station. The initial network element role of the communication device corresponding to each address in the first address set that is the source address and the target address in the acquired data packet is determined as a base station / user plane function node. Then, according to the number of occurrences of each address in the first address set, the historical network element role of the communication device corresponding to each address is determined. Specifically, for the current address in the first address set, the number of times the current address is used as the target address and the source address in the acquired data packet can be determined to obtain the number of target addresses and the number of source addresses. If the initial network element role of the current address is a user plane function node, determine whether the target address number is greater than the preset target number threshold, if greater, it can be determined that the historical network element role of the communication device corresponding to the current address is a user plane function node, if not greater, a new data packet can be obtained, and the historical network element role of the communication device corresponding to the current address can be determined according to the number of times the current address is used as the target address and the source address in the obtained new data packet. If the initial network element role of the current address is a base station, determine whether the source address number is greater than the preset source number threshold, if greater, it can be determined that the historical network element role of the communication device corresponding to the current address is a base station, if not greater, a new data packet can be obtained, and the historical network element role of the communication device corresponding to the current address can be determined according to the number of times the current address is used as the target address and the source address in the obtained new data packet. If the initial network element role of the current address is a base station / user plane function node, determine whether the difference between the target address number and the source address number is greater than the preset difference threshold, if greater, it can be determined that the historical network element role of the communication device corresponding to the current address is a user plane function node, if not greater, it can be determined that the historical network element role of the communication device corresponding to the current address is a base station. After determining the historical network element role of the communication device corresponding to each address, the historical network element role of the communication device corresponding to each address can be determined as the predicted network element role of the communication device corresponding to each address. Among them, the preset target number threshold is the threshold of the number of times the target address needs to appear determined according to the actual situation or demand. The preset source number threshold is the threshold of the number of times the source address needs to appear determined according to the actual situation or demand. The preset difference threshold is the threshold of the difference between the number of target address times and the number of source address times determined according to the actual situation or demand.

[0054] In this embodiment, by determining the predicted network element role of the communication device corresponding to each address, a data basis is provided for subsequently determining the second address set.

[0055] Step 140: Find the address of the predicted network element role of the corresponding communication device as a user plane function node from the first address set to obtain a second address set.

[0056] Specifically, the second address set refers to the address in the first address set, where the predicted network element role of the corresponding communication device is a user plane function node.

[0057] In a specific implementation, after determining the predicted network element role of the communication device corresponding to each address in the first address set, the predicted network element role as a user plane function node can be used as a query condition to filter out the addresses whose predicted network element role corresponding to the communication device is a user plane function node from the first address set, and then combine the filtered addresses into a set, namely, the second address set.

[0058] In this embodiment, by obtaining the second address set, a data basis is provided for subsequently determining the verification result of the user plane traffic.

[0059] Step 150: Compare the second address set with the preset address set, and determine the verification result of the user plane traffic according to the comparison result.

[0060] Specifically, the preset address set is a preset address set of user plane function nodes.

[0061] In a specific implementation, after obtaining the second address set, the second address set and the preset address set can be compared, and the verification result of the user plane traffic can be determined based on the comparison result. Specifically, if the comparison result of the second address set and the preset address set is that the second address set is equal to the preset address set, then the verification result of the user plane traffic can be determined to be normal. If the second address set is not equal to the preset address set, then the verification result of the user plane traffic can be determined to be abnormal. At this time, an abnormality report can be generated based on the comparison result and the verification result, and then the abnormality report can be displayed to the staff through a computer. Among them, the abnormality report can include time, cause analysis and repair measures, etc.

[0062] In this embodiment, the second address set is compared with the preset address set, and the verification result of the user plane traffic is determined based on the comparison result, which greatly reduces the number of IP addresses that need to be compared during verification, thereby improving the efficiency of user plane traffic verification.

[0063] In the embodiment of the present invention, by obtaining the data packets transmitted through the target interface and determining the source address and the destination address of each data packet, a data basis is provided for determining the first address set later. Then, the first address set is determined according to the source address and the destination address of each data packet, which provides a data basis for determining the predicted network element role of the communication device corresponding to each address later. Then, the predicted network element role of each address corresponding to the communication device is determined according to the historical network element role of each address corresponding to the communication device in the first address set, which provides a data basis for determining the second address set later. Then, the address of the predicted network element role of the corresponding communication device is the user plane function node from the first address set to obtain the second address set, which provides a data basis for determining the verification result of the user plane flow later. Finally, the second address set is compared with the preset address set, and the verification result of the user plane flow is determined according to the comparison result, which greatly reduces the number of IP addresses to be compared during the verification, thereby improving the efficiency of the user plane flow verification. Compared with the prior art, when performing the user plane flow verification, the IP addresses of all data packets transmitted through the target interface are compared one by one with the engineering parameter table of the UPF to determine the verification result. The present invention determines the historical network element role of the communication device corresponding to each address according to the source address and the destination address of the data packet transmitted by the target interface, and then determines the predicted network element role of the communication device corresponding to each address according to the historical network element role of the communication device corresponding to each address; then determines the second address set according to the predicted network element role of the communication device corresponding to each address; finally, compares the second address set with the preset address set, and determines the verification result of the user plane traffic according to the comparison result, which greatly reduces the number of IP addresses to be compared during the verification, thereby significantly improving the efficiency of the user plane traffic verification. The low efficiency problem of the prior art in processing high-speed and large-scale traffic is solved.

[0064] Figure 2 A flowchart of another user plane traffic verification method provided by an embodiment of the present invention, which is specific based on the above embodiment. In this embodiment, the method may also include:

[0065] Step 210: Acquire data packets transmitted through the target interface, and determine the source address and target address of each data packet.

[0066] Step 211: For the current data packet, determine whether the first address set contains the source address or the destination address of the current data packet.

[0067] If it is included, execute step 212; if it is not included, execute step 213.

[0068] In a specific implementation, for the current data packet, the source address and destination address of the current data packet can be matched with each address in the first address set. If the source address of the current data packet successfully matches an address in the first address set, it is determined that the first address set contains the source address of the current data packet, and the source address of the current data packet is not stored in the first address set. If the destination address of the current data packet successfully matches an address in the first address set, it is determined that the first address set contains the destination address of the current data packet, and the destination address of the current data packet is not stored in the first address set. If the source address of the current data packet does not match each address in the first address set, it is determined that the source address of the current data packet is not contained in the first address set, and the source address of the current data packet is stored in the first address set. If the destination address of the current data packet does not match each address in the first address set, it is determined that the first address set does not contain the destination address of the current data packet, and the destination address of the current data packet is stored in the first address set.

[0069] In this embodiment, by determining whether the first address set contains the source address or the destination address of the current data packet, a basis for determining whether to store the source address or the destination address of the current data packet in the first address set is provided.

[0070] Step 212: Do not store the source address or the destination address of the current data packet into the first address set.

[0071] In a specific implementation, if the first address set contains the source address of the current data packet, the source address of the current data packet is not stored in the first address set. If the first address set contains the destination address of the current data packet, the destination address of the current data packet is not stored in the first address set. If the first address set contains the source address and destination address of the current data packet, the source address and destination address of the current data packet are not stored in the first address set.

[0072] Step 213: Store the source address or the destination address of the current data packet into the first address set.

[0073] In a specific implementation, if the first address set does not contain the source address of the current data packet, the source address of the current data packet is stored in the first address set. If the first address set does not contain the destination address of the current data packet, the destination address of the current data packet is stored in the first address set. If the first address set does not contain the source address and destination address of the current data packet, the source address and destination address of the current data packet are stored in the first address set.

[0074] Step 214: for the current address in the first address set, determine the number of times the current address is used as the source address in each data packet to obtain a first count, and determine the number of times the current address is used as the destination address in each data packet to obtain a second count.

[0075] Specifically, the first number refers to the total number of times the current address in the first address set appears as the source address of the data packet transmitted through the target interface. The second number refers to the total number of times the current address in the first address set appears as the target address of the data packet transmitted through the target interface.

[0076] In a specific implementation, two counters can be initialized for the current address in the first address set, which are used to record the number of times the address is used as the source address of a data packet (the first count) and the number of times the address is used as the target address of a data packet (the second count), and both counters are set to zero. Then, the source address and the target address of each data packet are matched with the current address in the first address set. Specifically, if the source address of the current data packet matches the current address in the first address set, the first count is increased by one; if the target address of the current data packet matches the current address in the first address set, the second count is increased by one; until all data packets are traversed.

[0077] In this embodiment, by obtaining the first number and the second number, a data basis is provided for subsequently determining the historical network element role of the communication device corresponding to the current address.

[0078] Step 215: Determine the historical network element role of the communication device corresponding to the current address according to the first number and the second number.

[0079] In a specific implementation, if the first number is zero and the second number is not zero, it can be determined that the historical network element role of the communication device corresponding to the current address is a user plane function node base station. If the first number is not zero and the second number is zero, it can be determined that the historical network element role of the communication device corresponding to the current address is a base station. If the first number is not zero and the second number is not zero, the historical network element role of the communication device corresponding to the current address can be determined based on the difference between the second number and the first number. Specifically, if the difference between the second number and the first number is greater than or equal to zero, it can be determined that the historical network element role of the communication device corresponding to the current address is a user plane function node. If the difference between the second number and the first number is less than zero, it can be determined that the historical network element role of the communication device corresponding to the current address is a base station.

[0080] In this embodiment, the historical network element role of the communication device corresponding to the current address is determined according to the first number and the second number, thereby improving the accuracy of the determined historical network element role.

[0081] Further, step 215 may specifically include: if the difference between the second number and the first number is greater than a preset difference, determining that the historical network element role of the communication device corresponding to the current address is a user plane function node.

[0082] Specifically, the preset difference refers to a difference set according to actual conditions or requirements for determining the historical network element role of the communication device corresponding to the current address. For example, the preset difference may be 8600000.

[0083] In a specific implementation, if the first number is not zero and the second number is not zero, the historical network element role of the communication device corresponding to the current address can be determined based on the difference between the second number and the first number. Specifically, if the difference between the second number and the first number is greater than the preset difference, it can be determined that the historical network element role of the communication device corresponding to the current address is a user plane function node; if the difference between the second number and the first number is not greater than the preset difference, it can be determined that the historical network element role of the communication device corresponding to the current address is a base station. For example: the second number of the current address is 718, the first number is 8633334, and the preset difference is 8600000. It can be determined that the historical network element role of the communication device corresponding to the current address is a base station. For example: the second number of the current address is 8658238, the first number is 38, and the preset difference is 8600000. It can be determined that the historical network element role of the communication device corresponding to the current address is a user plane function node.

[0084] In this embodiment, by judging whether the difference between the second number and the first number is greater than a preset difference, the historical network element role of the communication device corresponding to the current address can be accurately determined.

[0085] Step 216: Determine a predicted network element role of the communication device corresponding to each address in the first address set according to the historical network element role of the communication device corresponding to each address.

[0086] Step 217: Find the address of the predicted network element role of the corresponding communication device as a user plane function node from the first address set to obtain a second address set.

[0087] Step 218: Determine whether the second address set is equal to the preset address set.

[0088] If they are equal, execute step 219; if they are not equal, execute step 220.

[0089] In a specific implementation, after obtaining the second address set, the two sets can be compared to see whether they contain exactly the same elements to determine whether the second address set is equal to the preset address set. If the second address set and the preset address set contain exactly the same addresses, it can be determined that the second address set is equal to the preset address set, which means that the verification result of the user plane traffic is normal. If the second address set and the preset address set do not contain exactly the same addresses, it can be determined that the second address set is not equal to the preset address set, which means that the verification result of the user plane traffic is abnormal.

[0090] In this embodiment, by judging whether the second address set is equal to the preset address set, a data basis is provided for determining the verification result.

[0091] Step 219: Determine that the verification result is normal.

[0092] In a specific implementation, after determining that the second address set is equal to the preset address set, it can be determined that the verification result is normal.

[0093] Step 220: Determine whether the verification result is abnormal.

[0094] In a specific implementation, after determining that the second address set is not equal to the preset address set, it can be determined that the verification result is abnormal.

[0095] Further, if the second address set is not equal to the preset address set, the verification result is determined to be abnormal, including: if the second address set lacks the address of the user plane function node in the preset address set, the verification result is determined to be too little traffic; if the second address set contains the addresses of all user plane function nodes in the preset address set, but there is an address of a user plane function node that is not in the preset address set, the verification result is determined to be too much traffic; if the second address set does not contain the address of any user plane function node in the preset address set, the verification result is determined to be wrong traffic.

[0096] For example, if the second address set is {2408:8140:c0f0:3c00:100:1:2:4, 2408:8140:c0f0:3c00:100:1:2:5, 2408:8140:c0f0:3c00:100:1:2:6, 2408:8140:c0f0:3c00:100:1:2:7}, the preset address set is {2408:8140:c0f0:3c00:100:1:2:8}. :2:4,2408:8140:c0f0:3c00:100:1:2:5,2408:8140:c0f0:3c00:100:1:2:6,2408:8140:c0f0:3c00:100:1:2:7,2408:8140:c0f0:3c00:100:1:2:8,2408:8140:c0f0:3c00:100:1:2:9}, then the verification result is that less traffic is received.

[0097] For example, if the second address set is {2408:8140:c0f0:3c00:100:1:2:4,2408:8140:c0f0:3c00:100:1:2:5,2408:8140:c0f0:3c00:100:1:2:6,2408:8140:c0f0:3c00:100:1:2:7,2408:8140:c0f0:3c00:100:1:2:8,2408:8140:c0f0:3c00:100:1:2:9, :8140:c0f0:3c00:100:1:2:9}, the preset address set is {2408:8140:c0f0:3c00:100:1:2:4,2408:8140:c0f0:3c00:100:1:2:5,2408:8140:c0f0:3c00:100:1:2:6,2408:8140:c0f0:3c00:100:1:2:7}, then the verification result is that multiple traffic is received.

[0098] For example, if the second address set is {2408:8140:c0f0:3c00:211::4, 2408:8140:c0f0:3c00:211::5, 2408:8140:c0f0:3c00:211::6, 2408:8140:c0f0:3c00:211::7}, the preset address set is {2408:8140:c0f0:3c00:100:1:2:4, 2 408:8140:c0f0:3c00:100:1:2:5,2408:8140:c0f0:3c00:100:1:2:6,2408:8140:c0f0:3c00:100:1:2:7,2408:8140:c0f0:3c00:100:1:2:8,2408:8140:c0f0:3c00:100:1:2:9}, then the verification result is that the wrong traffic is connected.

[0099] In this embodiment, by determining the verification result, a data basis is provided for subsequently determining the traffic adjustment strategy.

[0100] Step 221: Obtain the traffic adjustment strategy corresponding to the verification result and display the traffic adjustment strategy.

[0101] Specifically, traffic shaping strategy refers to a series of measures or plans formulated based on the verification results, including modifying access control lists, reviewing traffic sources, and checking network configurations.

[0102] In the specific implementation, when the verification result is obtained, the corresponding traffic adjustment strategy can be determined by analyzing the abnormal situation corresponding to the verification result. For example, when the verification result is determined to be less traffic, the traffic adjustment strategy can be confirmed to check the routing configuration and add routing or forwarding rules. Then the traffic adjustment strategy corresponding to the verification result is obtained and displayed, so that the operation and maintenance personnel can adjust the network according to the traffic adjustment strategy.

[0103] In this embodiment, by obtaining the traffic adjustment strategy corresponding to the verification result and displaying the traffic adjustment strategy, it helps to improve network performance, prevent illegal traffic and potential network attacks, protect sensitive data and network assets, and improve user satisfaction.

[0104] Therefore, the technical solution of the present invention provides a data basis for determining the first address set later by acquiring the data packets transmitted through the target interface and determining the source address and the destination address of each data packet. Then, by determining whether the source address or the destination address of the current data packet is included in the first address set, a judgment basis is provided for determining whether to store the source address or the destination address of the current data packet in the first address set later. If included, the source address or the destination address of the current data packet is not stored in the first address set. If not included, the source address or the destination address of the current data packet is stored in the first address set. For the current address in the first address set, the number of times the current address is used as the source address in each data packet is determined to obtain the first number, and the number of times the current address is used as the destination address in each data packet is determined to obtain the second number, which provides a data basis for determining the historical network element role of the communication device corresponding to the current address later. Then, the historical network element role of the communication device corresponding to the current address is determined according to the first number and the second number, thereby improving the accuracy of the determined historical network element role. Then, the predicted network element role of the communication device corresponding to each address in the first address set is determined according to the historical network element role of the communication device corresponding to each address, thereby providing a data basis for determining the second address set later. Then find the address of the predicted network element role of the corresponding communication device as the user plane function node from the first address set to obtain the second address set, which provides a data basis for determining the verification result of the user plane traffic. Then determine whether the second address set is equal to the preset address set. If equal, the verification result is determined to be normal. If not equal, the verification result is determined to be abnormal. The verification result of the user plane traffic is determined according to the judgment result, which greatly reduces the number of IP addresses that need to be compared during the verification, thereby improving the efficiency of the user plane traffic verification. Finally, the traffic adjustment strategy corresponding to the verification result is obtained, and the traffic adjustment strategy is displayed, which helps to improve network performance, prevent illegal traffic and potential network attacks, protect sensitive data and network assets, and improve user satisfaction. Compared with the prior art, when performing user plane traffic verification, the IP addresses of all data packets transmitted through the target interface will be compared one by one with the engineering parameter table of UPF to determine the verification result. The present invention determines the historical network element role of the communication device corresponding to each address according to the source address and the destination address of the data packet transmitted through the target interface, and then determines the predicted network element role of the communication device corresponding to each address according to the historical network element role of the communication device corresponding to each address; then determines the second address set according to the predicted network element role of the communication device corresponding to each address; finally, compares the second address set with the preset address set, and determines the verification result of the user plane traffic according to the comparison result, which greatly reduces the number of IP addresses to be compared during the verification, thereby significantly improving the efficiency of the user plane traffic verification. The low efficiency problem of the prior art in processing high-speed and large-scale traffic is solved.

[0105] Figure 3A structural schematic diagram of a user plane flow verification device provided for an embodiment of the present invention. The device and the user plane flow verification methods of the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the user plane flow verification device, reference can be made to the embodiment of the user plane flow verification method.

[0106] like Figure 3 As shown, the device comprises:

[0107] An acquisition module 310, configured to acquire data packets transmitted through a target interface and determine a source address and a destination address of each data packet, wherein the target interface is used to connect a base station and a user plane function node;

[0108] A first determination module 320, configured to determine a first address set according to the source address and the destination address of each data packet;

[0109] A second determination module 330, configured to determine a predicted network element role of a communication device corresponding to each address in the first address set according to a historical network element role of the communication device corresponding to each address in the first address set;

[0110] A third determination module 340 is configured to find an address of a corresponding communication device whose predicted network element role is a user plane function node from the first address set to obtain a second address set;

[0111] The verification module 350 is used to compare the second address set with a preset address set, and determine a verification result of the user plane traffic according to the comparison result, wherein the preset address set is an address set of preset user plane function nodes.

[0112] Based on the above embodiment, the first determining module 320 is specifically used for:

[0113] For a current data packet, determining whether the first address set contains a source address or a destination address of the current data packet;

[0114] If the source address of the current data packet is not included, the source address of the current data packet is stored in the first address set; if the destination address of the current data packet is not included, the destination address of the current data packet is stored in the first address set.

[0115] Based on the above embodiment, the device further includes:

[0116] The fourth determination module is used to determine the number of times the current address is used as the source address in each data packet for the current address in the first address set before determining the predicted web page role of the communication device corresponding to each address in the first address set based on the historical network element role of the communication device corresponding to each address in the first address set, and obtain a first number, and determine the number of times the current address is used as the target address in each data packet, and obtain a second number; determine the historical network element role of the communication device corresponding to the current address based on the first number and the second number.

[0117] Based on the above embodiment, the fourth determining module determines the historical network element role of the communication device corresponding to the current address according to the first number of times and the second number of times, including:

[0118] If the difference between the second number of times and the first number of times is greater than a preset difference, it is determined that the historical network element role of the communication device corresponding to the current address is the user plane function node.

[0119] Based on the above embodiment, the verification module 350 is specifically used for:

[0120] If the second address set is equal to the preset address set, determining that the verification result is normal;

[0121] If the second address set is not equal to the preset address set, the verification result is determined to be abnormal.

[0122] Based on the above embodiment, if the second address set is not equal to the preset address set, the checking module 350 determines that the checking result is abnormal, including:

[0123] If the second address set lacks the address of the user plane function node in the preset address set, determining that the verification result is that less traffic is connected;

[0124] If the second address set includes the addresses of all user plane function nodes in the preset address set, and there is an address of a user plane function node that is not in the preset address set, determining that the verification result is receiving multiple traffic;

[0125] If the second address set does not include the address of any user plane function node in the preset address set, it is determined that the verification result is wrong traffic connection.

[0126] Based on the above embodiment, the device further includes:

[0127] The display module is used to obtain the traffic adjustment strategy corresponding to the verification result after determining the verification result of the user plane traffic according to the comparison result, and display the traffic adjustment strategy.

[0128] The user plane traffic checking device provided in the embodiment of the present invention can execute the user plane traffic checking method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0129] It is worth noting that in the embodiment of the above-mentioned user plane traffic verification device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0130] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 4 A block diagram of an exemplary electronic device 4 suitable for implementing embodiments of the present invention is shown. Figure 4 The electronic device 4 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0131] like Figure 4 As shown, the electronic device 4 is in the form of a general purpose computing electronic device. The components of the electronic device 4 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components (including the system memory 28 and the processing unit 16).

[0132] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0133] The electronic device 4 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 4, including volatile and non-volatile media, removable and non-removable media.

[0134] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 4 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 not shown, usually called a "hard drive"). Although Figure 4Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0135] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0136] The electronic device 4 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the electronic device 4, and / or any device that enables the electronic device 4 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the electronic device 4 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 20. Figure 4 As shown, the network adapter 20 communicates with other modules of the electronic device 4 via the bus 18. It should be understood that although Figure 4 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 4, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0137] The processing unit 16 executes various functional applications and page displays by running the program stored in the system memory 28, for example, implementing the user plane traffic verification method provided in an embodiment of the present invention, the method comprising:

[0138] Acquire data packets transmitted through a target interface, and determine a source address and a destination address of each data packet, wherein the target interface is used to connect a base station and a user plane function node;

[0139] Determine a first address set according to the source address and the destination address of each data packet;

[0140] Determine a predicted network element role of the communication device corresponding to each address in the first address set according to a historical network element role of the communication device corresponding to each address;

[0141] Finding an address of a predicted network element role of a corresponding communication device as a user plane function node from the first address set to obtain a second address set;

[0142] The second address set is compared with a preset address set, and a verification result of the user plane traffic is determined according to the comparison result, wherein the preset address set is an address set of preset user plane function nodes.

[0143] Of course, those skilled in the art can understand that the processor can also implement the technical solution of the user plane traffic verification method provided by any embodiment of the present invention.

[0144] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, a user plane flow verification method provided by an embodiment of the present invention is implemented, for example, and the method includes:

[0145] Acquire data packets transmitted through a target interface, and determine a source address and a destination address of each data packet, wherein the target interface is used to connect a base station and a user plane function node;

[0146] Determine a first address set according to the source address and the destination address of each data packet;

[0147] Determine a predicted network element role of the communication device corresponding to each address in the first address set according to a historical network element role of the communication device corresponding to each address;

[0148] Finding an address of a predicted network element role of a corresponding communication device as a user plane function node from the first address set to obtain a second address set;

[0149] The second address set is compared with a preset address set, and a verification result of the user plane traffic is determined according to the comparison result, wherein the preset address set is an address set of preset user plane function nodes.

[0150] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0151] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0152] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0153] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0154] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0155] In addition, the acquisition, storage, use, and processing of data in the technical solution of the present invention are in compliance with the relevant provisions of national laws and regulations.

[0156] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for checking user plane traffic, characterized in that: The method comprises: Acquire data packets transmitted through a target interface, and determine a source address and a destination address of each data packet, wherein the target interface is used to connect a base station and a user plane function node; Determine a first address set according to the source address and the destination address of each data packet; Determine a predicted network element role of the communication device corresponding to each address in the first address set according to a historical network element role of the communication device corresponding to each address; Finding an address of a predicted network element role of a corresponding communication device as a user plane function node from the first address set to obtain a second address set; The second address set is compared with a preset address set, and a verification result of the user plane traffic is determined according to the comparison result, wherein the preset address set is an address set of preset user plane function nodes.

2. The method for checking user plane traffic according to claim 1, characterized in that: Determining a first address set according to the source address and the destination address of each data packet includes: For a current data packet, determining whether the first address set contains a source address or a destination address of the current data packet; If the source address of the current data packet is not included, the source address of the current data packet is stored in the first address set; if the destination address of the current data packet is not included, the destination address of the current data packet is stored in the first address set.

3. The method for checking user plane traffic according to claim 1, characterized in that: Before determining the predicted webpage role of the communication device corresponding to each address in the first address set according to the historical network element role of the communication device corresponding to each address, the method further includes: For a current address in the first address set, determining the number of times the current address is used as a source address in each of the data packets to obtain a first number, and determining the number of times the current address is used as a destination address in each of the data packets to obtain a second number; A historical network element role of the communication device corresponding to the current address is determined according to the first number of times and the second number of times.

4. The user plane traffic verification method according to claim 3, characterized in that: Determining a historical network element role of the communication device corresponding to the current address according to the first number of times and the second number of times includes: If the difference between the second number of times and the first number of times is greater than a preset difference, it is determined that the historical network element role of the communication device corresponding to the current address is the user plane function node.

5. The user plane traffic verification method according to claim 1, characterized in that: Comparing the second address set with the preset address set, and determining a verification result of the user plane traffic according to the comparison result, includes: If the second address set is equal to the preset address set, determining that the verification result is normal; If the second address set is not equal to the preset address set, the verification result is determined to be abnormal.

6. The method for checking user plane traffic according to claim 5, characterized in that: If the second address set is not equal to the preset address set, determining that the verification result is abnormal includes: If the second address set lacks the address of the user plane function node in the preset address set, determining that the verification result is that less traffic is connected; If the second address set includes the addresses of all user plane function nodes in the preset address set, and there is an address of a user plane function node that is not in the preset address set, determining that the verification result is receiving multiple traffic; If the second address set does not include the address of any user plane function node in the preset address set, it is determined that the verification result is wrong traffic connection.

7. The method for checking user plane traffic according to claim 1, characterized in that: After determining the verification result of the user plane traffic according to the comparison result, the method further includes: Obtain the traffic adjustment strategy corresponding to the verification result, and display the traffic adjustment strategy.

8. A user plane traffic verification device, characterized in that: The device comprises: An acquisition module, used to acquire data packets transmitted through a target interface and determine a source address and a destination address of each data packet, wherein the target interface is used to connect a base station and a user plane function node; A first determining module, configured to determine a first address set according to a source address and a destination address of each data packet; A second determination module, configured to determine a predicted network element role of a communication device corresponding to each address in the first address set according to a historical network element role of the communication device corresponding to each address in the first address set; A third determination module is used to find out the address of the predicted network element role of the corresponding communication device as a user plane function node from the first address set to obtain a second address set; The verification module is used to compare the second address set with a preset address set, and determine a verification result of the user plane traffic according to the comparison result, wherein the preset address set is an address set of preset user plane function nodes.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the user plane traffic verification method described in any one of claims 1-7.

10. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions, when executed by a computer processor, implement the user plane traffic verification method described in any one of claims 1-7.

Images