Online log generation method and device, equipment, storage medium and program product

Abstract

The invention relates to an internet log generation method and device, equipment, a storage medium and a program product. Comprising the following steps: in response to an internet access request initiated by user equipment, determining signaling data corresponding to the internet access request, and obtaining the signaling data through a first interface corresponding to a first target network element; user plane data corresponding to the internet surfing request is acquired through a second interface corresponding to a second target network element, and the second target network element is a network element in an internet of things core network of a province to which a user belongs; under the condition that the second target network element transmits user plane data to the target data network according to the address information, acquiring network address translation data from a preset firewall; and generating an internet log corresponding to the user equipment according to the signaling data, the user plane data and the network address translation data. Visibly, according to the embodiment of the invention, the signaling monitoring system can generate the internet surfing log according to the data acquired by the data acquisition equipment by adjusting the position of the data acquisition equipment.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and in particular to a method, device, equipment, storage medium and program product for generating a surfing log. Background Art

[0002] User plane data and signaling data of 4G and 5G users can be generated after accessing the network through user plane network elements and control plane network elements.

[0003] In the related technology, IoT users not only use general APN services, but also use dedicated APN services. Therefore, in the roaming scenario, when IoT users use dedicated APN services to access external networks from the mobile communication core network of the visited province, the signaling monitoring system can obtain user plane data from the mobile communication core network of the visited province, and obtain the user's network address translation data on the firewall side of the mobile communication core network of the home province. Since the user plane data and network address translation data are provided by the visited province and the home province respectively, the data synthesis equipment centrally deployed by province cannot synthesize the user plane data and network address translation data, that is, it cannot generate a complete Internet access log. Summary of the invention

[0004] In view of this, the embodiments of the present disclosure provide a method, apparatus, device, storage medium and program product for generating a surfing log to solve the problems existing in the related art.

[0005] According to a first aspect of an embodiment of the present disclosure, a method for generating an Internet access log is provided, the method comprising: in response to an Internet access request initiated by a user device, determining signaling data corresponding to the Internet access request, and obtaining the signaling data through a first interface corresponding to a first target network element, wherein the first target network element is a network element in an Internet of Things core network of a province to which the user belongs; obtaining user plane data corresponding to the Internet access request through a second interface corresponding to a second target network element, wherein the user plane data includes address information of a target data network, and the second target network element is a network element in an Internet of Things core network of a province to which the user belongs; when the second target network element transmits the user plane data to the target data network according to the address information, obtaining network address translation data from a preset firewall; and generating an Internet access log corresponding to the user device according to the signaling data, the user plane data and the network address translation data.

[0006] According to a second aspect of an embodiment of the present disclosure, there is provided a device for generating an Internet access log, which is applied to a method for generating an Internet access log as in the first aspect, and the device comprises: a first acquisition module, which is used to respond to an Internet access request initiated by a user device, determine signaling data corresponding to the Internet access request, and obtain the signaling data through a first interface corresponding to a first target network element, wherein the first target network element is a network element in an Internet of Things core network of a province to which the user belongs; a second acquisition module, which is used to obtain user plane data corresponding to the Internet access request through a second interface corresponding to a second target network element, wherein the user plane data includes address information of a target data network, and the second target network element is a network element in an Internet of Things core network of a province to which the user belongs; a third acquisition module, which is used to obtain network address translation data from a preset firewall when the second target network element transmits user plane data to the target data network according to the address information; and a generation module, which is used to generate an Internet access log corresponding to the user device according to the signaling data, the user plane data and the network address translation data.

[0007] According to a third aspect of the embodiments of the present disclosure, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-mentioned method for generating a surfing log.

[0008] According to a fourth aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the above-mentioned method for generating a surfing log are implemented.

[0009] According to a fifth aspect of the present disclosure, a computer program product is provided. When the computer program / instructions are executed by a processor, the steps of the above-mentioned method for generating a surfing log are implemented.

[0010] At least one of the above technical solutions adopted in the embodiments of the present disclosure can achieve the following beneficial effects: in response to an Internet access request initiated by a user device, determine the signaling data corresponding to the Internet access request, and obtain the signaling data through a first interface corresponding to a first target network element, wherein the first target network element is a network element in the Internet of Things core network of the user's province; obtain the user plane data corresponding to the Internet access request through a second interface corresponding to a second target network element, wherein the user plane data includes the address information of the target data network, and the second target network element is a network element in the Internet of Things core network of the user's province; when the second target network element transmits the user plane data to the target data network according to the address information, obtain the network address translation data from the preset firewall; generate the Internet access log corresponding to the user device according to the signaling data, the user plane data and the network address translation data. It can be seen that the embodiments of the present disclosure only collect data in the network elements included in the Internet of Things core network of the user's province, so that the user plane data and the network address translation data are both provided by the province, so that the data synthesis device centrally deployed by province can generate the Internet access log. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0012] Figure 1 A schematic diagram of a process when 4G and 5G users use different APNs to access the Internet is provided as an exemplary embodiment of the present disclosure;

[0013] Figure 2 A flowchart of a method for generating a surfing log provided by an exemplary embodiment of the present disclosure;

[0014] Figure 3 A structural diagram of a method for generating a surfing log provided by an exemplary embodiment of the present disclosure;

[0015] Figure 4 A flowchart of another method for generating a surfing log provided by an exemplary embodiment of the present disclosure;

[0016] Figure 5 A schematic diagram of the structure of a device for generating a surfing log provided by an exemplary embodiment of the present disclosure;

[0017] Figure 6 A schematic diagram of the structure of an electronic device provided for an exemplary embodiment of the present disclosure;

[0018] Figure 7 A schematic diagram of the structure of a computer system provided for an exemplary embodiment of the present disclosure;

[0019] Figure 8 A schematic diagram of a computer program product provided for an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0020] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0021] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0022] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc. mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0023] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0024] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0025] In actual applications, the IoT core network is mainly composed of two main parts: user plane network elements and control plane network elements. Among them, the user plane network elements are mainly responsible for carrying data traffic and realizing fast and efficient data transmission; while the control plane network elements are mainly responsible for processing network control information to ensure network security and stable operation. It should be understood that the control plane network elements are mainly used to process user data service functions, mainly including AMF / MME, SMF / SAEGW-C, PCF / UDR, UDM / UDR / HSS, UPF / SAEGW-U and other control plane network elements; user plane network elements can realize the user's data Internet access function, and the main network elements involved are the same as those of the Internet of Things. Among them, the main network elements included in the control plane network elements and the user plane network elements are constructed in an independent and separate manner.

[0026] In the related technology, not only the Internet of Things core network but also the mobile communication core network is deployed in the communication network. The mobile communication core network can be a 4G core network or a 5G core network, or a 4G / 5G converged core network. The mobile communication core network can obtain the data generated by the user terminal through the base station, and can also establish a connection with the Internet of Things core network to realize data transmission.

[0027] It should be understood that the above-mentioned access and mobility management function (Access and Mobility Management Function, AMF) is used for access and mobility management functions, and performs registration, connection, reachability, and mobility management; the mobility management entity (Mobility Management Entity, MME) is a signaling entity, which is mainly responsible for mobility management, bearer management, user authentication and other functions; the session management function (Session Management function, SMF) is mainly responsible for tunnel maintenance, IP address allocation and management, policy implementation, billing data collection, roaming, etc.; the control plane gateway (System Architecture Evolution Gateway-Control Plane, SAEGW-C) is mainly responsible for processing the functions of the control plane, such as mobile terminal addressing and identification, user location tracking, wireless resource management and control, etc. It coordinates and communicates with mobile terminals and other core network elements to ensure that mobile users can seamlessly access and roam the network; the policy control function (Policy Control function, PCF) supports a unified policy framework to manage network behavior, provides policy rules to network entities for implementation, and accesses subscription information of the unified data warehouse (UDR); the unified data warehouse function (UnifiedData The Unified Data Management (UDM) is responsible for the management of user identification, contract data, authentication data, and service network element registration management of users; the Home Subscriber Server (HSS) is a server used to store user contract information in the evolved packet system. It is the evolution and upgrade of 2G / 3G network elements and is mainly responsible for managing user contract data and location information of mobile users; the User Port Function (UPF) mainly includes signal conversion and signaling conversion; the User Plane Gateway (SAEGW-U) is mainly responsible for processing the data transmission of mobile users. It is responsible for receiving and forwarding data packets of mobile users, realizing data routing, forwarding and policy control. SAEGW-U communicates with the mobile access gateway and the packet data network to ensure that the data packets of mobile users can be transmitted quickly and routed efficiently;The Packet Data Network Gateway-UserPlane (PGW-U) is responsible for processing data transmission between mobile devices and the Internet, including the routing, forwarding and policy control of data packets; the Packet Data Network Gateway Control Plane (PGW-C) is mainly responsible for controlling the routing, forwarding and policy control of user data traffic.

[0028] In the related technologies, the cloud-based control plane network elements of the core network can be built on the basis of a centralized network cloud resource pool, with the core network vendor providing the software and the centralized network cloud resource pool providing the hardware. In the centralized network cloud resource pool, control plane network elements such as AMF / MME, SMF / SAEGW-C, PCF / UDR, UDM / UDR / HSS are deployed on a provincial basis, mainly responsible for user signaling connections. The user plane network elements include provincial dedicated line UPF / SAEGW-U and edge UPF and other user plane network elements, which are respectively set up in each province. Among them, the provincial dedicated line UPF / SAEGW-U is deployed at the provincial center node, the edge UPF is deployed at the prefecture-level city or park node, the user plane network element UPF / SAEGW-U is deployed at the prefecture-level city node, and the user plane network element is mainly responsible for clearing the user plane data for users to access the Internet.

[0029] Since the communication between any two terminals in the Internet of Things is inseparable from signaling, a signaling monitoring system is also deployed in the relevant technology. The signaling monitoring system is an important part of the communication network construction. It usually collects various types of signaling data and user-plane data in a branching manner (mainly optical splitting) that does not affect the operation of the network, and then decodes the signaling data and user-plane data, synthesizes detailed records of users' Internet access, reproduces the entire process of business continuity, and realizes functions such as tracing back users' Internet behavior and statistics of various network and business indicators.

[0030] In the prior art, IoT is usually divided into two types of services: general APN and dedicated APN. However, existing network operators usually adopt different service routing organization principles. Therefore, 4G users and 5G users can use different APNs to access the Internet. It should be understood that Access Point Name (APN) is used to identify and locate the data network required by mobile devices in mobile communication networks.

[0031] Figure 1 A flowchart of a 4G and 5G user using different APNs to access the Internet is provided in an exemplary embodiment of the present disclosure. Figure 1As shown in the figure, 4G and 5G users can access the target data network through the mobile communication core network and IoT core network of the visited province respectively. Signaling data and user plane data will be generated in the process of accessing the target network. In this case, the signaling data is generally the same, but the user plane data will be different, as follows:

[0032] Case 1: When the user uses a general APN to access the Internet, the user plane data corresponding to the 4G user can access the target data network 105 through the 4G base station 101 and the user plane network element UPF / SAEGW-U in the mobile communication core network 102 of the visited province, and clear the service to the target data network 105 through the provincial dedicated line UPF / SAEGW-U in the Internet of Things core network 103 of the visited province.

[0033] The 5G user plane data can be directly accessed to the target data network 105 through the 5G base station 104 and the edge UPF in the IoT core network 103 of the visited province. It should be understood that for 5G user plane data, regardless of whether the user roams, the user plane data only flows in the visited province.

[0034] Case 2: When IoT users use a dedicated APN to access the Internet, 4G and 5G user plane data access the target data network 105 through the user plane network element UPF / SAEGW-U or edge UPF in the mobile communication core network 102 of the visited province, and can be routed to the IoT provincial dedicated line UPF / SAEGW-U in the IoT core network 106 of the belonging province, and then the UPF / SAEGW-U clears the service to the target data network 105.

[0035] In the scenario where the user does not roam (mobile phone service), the visited province is the home province, and the user plane data still flows within the same province; if the user roams, there is cross-provincial user plane data between the user plane network element UPF / SAEGW-U or edge UPF in the mobile communication core network 102 of the visited province and the Internet of Things provincial dedicated line UPF / SAEGW-U in the Internet of Things core network 106 of the home province.

[0036] In the IPv4 scenario, when a user initiates an Internet access request through a terminal, the provincial dedicated line UPF / SAEGW-U or edge UPF responsible for accessing the target data network will first assign a source private network IP address and a source private network IP port to the terminal used by the user. However, since the private network address cannot be routed in the target data network, before the provincial dedicated line UPF / SAEGW-U can clear the user plane data to the target data network, the firewall device of the target data network will assign a source public network IP address and source public network IP port corresponding to the private network IP address and private network IP port to the user, so as to achieve normal Internet access services. It should be understood that since each user will only use a unique source public network IP address and source public network IP port number during each Internet access process, this information can be used as one of the important traceability methods of the signaling monitoring system. It should be understood that IPv4 is the fourth version of the Internet Protocol (IP), and it is also the first widely used protocol, which constitutes the cornerstone of today's Internet technology; IP refers to the Internet Protocol, the abbreviation of Internet Protocol, which is the network layer protocol in the TCP / IP system.

[0037] In actual applications, the signaling monitoring system can deploy data collection equipment on the control plane network element, the user plane network element and the firewall side connected to the target data network, and parse the data collected by the data collection equipment to obtain the control plane call list, the user plane call list and the network address translation data (NAT data). It should be understood that the network address translation (NAT) can convert the IP address in the IP data packet header to another IP address, and achieve the purpose of address reuse by converting the port number.

[0038] Normally, the user-side call list may contain user Internet access data such as the user's source private network IP address, source private network IP port, destination IP address, destination IP port, and user access URL; NAT data may contain information such as the user's source private network IP address, the mapping relationship between the source private network IP address and the source public network IP address and source public network port number, and the above call lists need to be associated through specific fields (source private network IP address, source private network IP port, Internet access time, etc.) as the primary key. Based on this, the fields such as the mobile phone number in the control-side call list, the user-side call list, and the NAT data can be synthesized to obtain the user's complete Internet access log.

[0039] In the existing network environment, the signaling monitoring system can be built in the centralized network cloud resource pool where the control plane network elements such as AMF / MME in the provincial core network are located to collect the signaling data corresponding to the control plane call list, and transmit it back to the control plane network elements such as AMF / MME in the province where the user belongs. Among them, the data generated by 4G users is mainly collected through the S1-MME, S11 and S6a interfaces on the MME side, and the data generated by 5G users is mainly collected through the N1, N2, N11 and N8 interfaces on the AMF side. It should be understood that the S1 interface is the communication interface between the base station and the packet core network; the S11 interface is the user plane protocol used to connect the terminal and the core network; the S6a interface is the interface between the MME and the HSS; the N1 interface is the signaling plane interface between the UE and the AMF; the N2 interface is the signaling plane interface between the access network and the AMF; the N11 interface is the communication interface between the AMF and the SMF; the N8 interface refers to the communication interface between the AMF and the UDM.

[0040] At the same time, the S1-U interface and N3 interface links corresponding to the UPF / SAEGW-U in the mobile communication core network and the edge UPF in the IoT core network can be split to collect user plane data; NAT data can also be obtained at the firewall for accessing the target data network close to the provincial dedicated line UPF / SAEGW-U and edge UPF in the IoT core network. It should be understood that the S1-U interface is the interface between the 4G base station and the SGW-U; the N3 interface is the interface between the 5G base station and the edge UPF.

[0041] Based on this, by deploying data collection equipment at the above three locations to analyze the collected data respectively, generate control plane call records, user plane call records and NAT data, and send them to the data synthesis equipment centrally deployed in the province for association, so as to synthesize the complete Internet access logs of 4G and 5G users.

[0042] It can be seen that in the prior art, since the user plane data of any 4G and 5G user surfing the Internet are respectively cleared through the S1-U interface and the N3 interface, the S1-U interface and the N3 interface collected in the mobile communication core network and the Internet of Things core network can contain the user plane data of all 4G and 5G users. However, in the existing network, there is still a problem of low backfill rate of source public network IP addresses and source public network port numbers in Internet access logs. The main reasons are analyzed as follows:

[0043] In addition to the general APN service, a large number of users of the Internet of Things also use dedicated APN services. According to the existing routing organization principles of the Internet of Things core network, in roaming scenarios, when users use dedicated APNs to access the target data network from the mobile communication core network element UPF / SAEGW-U in the visited province or the edge UPF in the Internet of Things core network, the server will clear all user-plane data to the provincial dedicated UPF / SAEGW-U in the home province. The signaling monitoring system can collect data and generate user-plane call records in the mobile communication core network element UPF / SAEGW-U in the visited province or the edge UPF in the Internet of Things core network, and obtain the user's NAT data at the firewall near the provincial dedicated line UPF / SAEGW-U in the home province. Since the above call records are provided by the visited province and the home province respectively, the data synthesis equipment centrally deployed in the province cannot merge the user-plane call records and NAT data into a complete Internet access log.

[0044] In addition, since the signaling data of 4G and 5G users first access the target data network through the control plane network elements such as AMF / MME of the mobile communication core network element of the visited province, the user plane data is first transmitted to the target data network through the mobile communication core network element UPF / SAEGW-U of the visited province. Therefore, when the mobile communication core network collects data through interfaces such as S1-MME, S11, S6a and S1-U, since users or physical objects access the network through the mobile communication core network, after access, mobile communication data and IoT data may exist in the mobile communication core network at the same time, and mobile communication data and IoT data may be mixed together, and the mixed data is difficult to distinguish at the original data level. In addition, after the original data is parsed and synthesized, it can theoretically be identified through the user number information in the call bill, but the user numbers corresponding to the mobile communication core network and the user numbers corresponding to the IoT core network in the existing network are usually mixed, which makes it impossible to use effective rules to accurately distinguish the data. It should be understood that the physical object here refers to the object corresponding to the Internet of Things, which can be a physical device embedded with sensors, software and network connections, etc.

[0045] In actual applications, user Internet log backtracking is an important technical means of national information security supervision, and the backfill rate of the user's source public network IP address and source public network IP port number is one of the most core indicators in the national assessment requirements. Therefore, the lack of the above-mentioned field content in the Internet log will seriously affect the data quality of the information security system, and it will be impossible to reversely check the source public network IP address, source public network port number and other information used by the user to surf the Internet through mobile phone numbers, URLs, etc., which will have an adverse impact on the timely and accurate positioning and tracing work of national power departments. At the same time, because user-side data and signaling data will be mixed together, it is impossible to effectively distinguish the content in the data, which will seriously affect the upper-level system's accurate statistical analysis of the data.

[0046] In response to the above problems, the embodiments of the present disclosure provide a method, device, equipment, storage medium and program product for generating an Internet access log. In the signaling monitoring system of the embodiments of the present disclosure, the user plane data is no longer collected through the S1-U interface corresponding to the user plane network element UPF / SAEGW-U in the mobile communication core network of the visited province, but is collected at the S5 / S8-U interface corresponding to the user plane network element UPF / SAEGW-U in the Internet of Things core network of the belonging province, and the user plane data is collected at the newly added N9 interface on the side of the user plane network element UPF / SAEGW-U in the Internet of Things core network of the belonging province; NAT data is collected at the firewall close to the user plane network element UPF / SAEGW-U in the Internet of Things core network of the belonging province; at the same time, signaling data is collected at the S5 / S8-C interface and N16 interface corresponding to the control plane network element SMF / SAEGW-C in the Internet of Things core network. It should be understood that the S5 / S8-U interface is the interface between the user plane SGW-U and the provincial dedicated line PGW-U; the N9 interface is the interface between the edge UPF and the provincial dedicated line UPF; the S5 / S8-C interface is the interface between the user plane SGW-C and PGW-C; the N16 interface is the interface on the control plane network element SMF.

[0047] Based on this, by adjusting the collection location, the problem that the signaling monitoring system cannot associate and synthesize complete Internet access logs containing information such as the source public network IP address and the source public network IP port number can be solved for the scenario where 4G / 5G users using dedicated APN services roam out of the province. At the same time, since the signaling data and user plane data of 4G users are all cleared in the Internet of Things core network after access through the mobile communication core network, based on this, the collection location of the user plane data can be adjusted to the Internet of Things core network, so that the data generated by the mobile communication core network will not be collected during data collection, thereby realizing the accurate collection of Internet of Things data, improving the efficiency of Internet access log generation, and then improving the backfill rate of the source public network IP address and source public network port number in the Internet access log.

[0048] Figure 2 The following is a flow chart of a method for generating a surfing log provided by an exemplary embodiment of the present disclosure. Figure 2 As shown, specifically including:

[0049] S201, in response to an Internet access request initiated by a user device, data generated after the Internet access request is initiated is collected by a corresponding data collection device.

[0050] Specifically, in response to an Internet access request initiated by a user device, a preset first data acquisition device is used to obtain signaling data from a first target network element in the Internet of Things core network of the province to which the user belongs through a first interface, and the signaling data is transmitted to a second target network element in the Internet of Things core network of the province to which the user belongs.

[0051] In actual applications, when a user uses a user device to initiate an Internet access request, the corresponding base station will first obtain the Internet access request from the user device, and establish a connection between the user device and the mobile communication core network of the current province being visited, and the corresponding signaling data and user plane data will be accessed by the mobile communication core network and then all be cleared by the Internet of Things core network. Based on this, signaling data can be collected in the centralized network cloud resource pool where the control plane network element SMF / SAEGW-C in the Internet of Things core network of the province to which the user belongs is located for Internet access requests, and returned to the SMF / SAEGW-C in the Internet of Things core network of the province to which the user belongs. The signaling data obtained by the SMF / SAEGW-C can also be simultaneously returned to the user plane network element and the corresponding first data acquisition device in the Internet of Things core network of the province to which the user belongs through the S5 / S8-C interface and the N16 interface on the SMF / SAEGW-C side. Therefore, the S5 / S8-C interface and the N16 interface can be directly designed as a splitter interface to meet the needs of data transmission.

[0052] In some embodiments, the second data acquisition device can obtain user plane data through the user plane network element UPF / SAEGW-U side. In addition, the user plane network element will also transmit the user plane data to the target data network and the third data acquisition device. During this process, the transmitted user plane data will pass through the firewall. Therefore, the S5 / S8-U interface and the N9 interface can be designed as splitter interfaces, one of which can be connected to the corresponding second data acquisition device, and the other can be used to access the target data network through the firewall. In this way, NAT data can be collected at the firewall of the target data network through the third data acquisition device, and user plane data can be transmitted to the target data network.

[0053] S202, respectively parse the signaling data, the user plane data and the NAT data, and respectively generate a control plane call record, a user plane call record and a NAT log.

[0054] Specifically, the signaling data can be parsed by the first data acquisition device to generate a control plane call bill; the user plane data can be parsed by the second data acquisition device to generate a user plane call bill; and the NAT data can be parsed by the third data acquisition device to generate a NAT log. Among them, the control plane call bill contains identity information such as the user's mobile phone number; the user plane call bill contains information such as the user's source private network IP address, source private network IP port, destination IP address, destination IP port, and user access URL; the NAT log contains information such as the user's source private network IP address, source private network IP port, source public network IP address, source public network IP port, NAT time, etc. It should be understood that the data corresponding to the NAT log is network address translation data.

[0055] In actual applications, the control plane call record may be presented in the form of Table 1, which may be:

[0056] Table 1 Control plane call list

[0057] phone number …… 139xxx ……

[0058] The user-side call record may be presented in the form of Table 2, which may be:

[0059] Table 2 User call list

[0060]

[0061]

[0062] The NAT log can be presented in the form of Table 3, which can be:

[0063] Table 3 NAT log

[0064] Source private IP address Source private IP port Destination IP address Destination IP Port NAT Time 1.1.1.1 500 2.2.2.2 1000 12：00

[0065] S203, synthesizing the control plane call record, the user plane call record and the NAT log through a data synthesis device to generate a user's Internet access log.

[0066] Specifically, the data collection device sends the above three types of call records to the back-end data synthesis device for association, and synthesizes the user's complete Internet log, including the user's mobile phone number, source public IP address, source public IP port, destination IP address, destination IP port, user access URL and other information.

[0067] In practical applications, Table 1, Table 2, and Table 3 can be associated to synthesize a complete online log of the user, as shown in Table 4:

[0068] Table 4. Internet logs after correlation and synthesis

[0069]

[0070] Figure 3 The structure diagram of a method for generating a surfing log provided by an exemplary embodiment of the present disclosure is as follows. Figure 3As shown, the user can control the user device to send an Internet access request. In response to the user's Internet access request, the 4G / 5G base station 301 will first obtain the Internet access request and transmit the Internet access request to the Internet of Things core network. After the control plane network element 302 in the Internet of Things core network receives the Internet access request from the user device, it will first collect the signaling data corresponding to the Internet access request in the centralized network cloud resource pool where the control plane network element 302 is located, and return the signaling data to the control plane network element 302 in the Internet of Things core network of the province to which the user belongs. At this time, the signaling data in the control plane network element 302 can be collected by the pre-set first data acquisition device 308.

[0071] The user plane network element 303 will establish a connection with the base station according to the signaling data, and then obtain the Internet access request, and determine the corresponding user plane data according to the Internet access request. After the user plane network element 303 obtains the user plane data, it can also transmit the user plane data to the second data acquisition device 307 and the target data network 305 through the user plane network element 303, that is, the S5 / S8-U interface and the N9 interface on the UPF / SAEGW-U side. Specifically, splitting can be performed at the S5 / S8-U interface and the N9 interface, or splitting can be performed on the corresponding physical link, so that the corresponding second data acquisition device 307 and the target data network 305 can both obtain the user plane data.

[0072] In actual applications, the user plane network element 303 also needs to transmit the user plane data to the target data network 305. During this process, it will first pass through the firewall 304. The firewall 304 can first perform security monitoring on the user plane data. After meeting the security conditions, the user plane data will be transmitted to the target data network 305. At this time, NAT data can be collected at the firewall 304 through the corresponding third data acquisition device 306.

[0073] In some embodiments, after acquiring data through the first data acquisition device 308, the second data acquisition device 307 and the third data acquisition device 306, the signaling data can also be parsed by the first data acquisition device 308 to generate a control plane call record; the user plane data can be parsed by the second data acquisition device 307 to generate a user plane call record; the NAT data can be parsed by the third data acquisition device 306 to generate a NAT log; then the first data acquisition device 308, the second data acquisition device 307 and the third data acquisition device 306 respectively send the corresponding call records to the back-end data synthesis device 309 for association, so as to synthesize a complete Internet log of the user.

[0074] It can be seen that the signaling monitoring system of the disclosed embodiment adjusts the collection location of user plane data. It no longer collects user plane data through the S1-U interface of the mobile communication core network element UPF / SAEGW-U in the visited province. Instead, the Internet of Things core network element UPF / SAEGW-U in the belonging province collects user plane data through the S5 / S8-U interface, and a new collection interface N9 is added to collect user plane data. At the same time, NAT data is obtained at the firewall of the provincial dedicated line UPF / SAEGW-U connected to the target data network in the Internet of Things core network, thereby ensuring that 4G / 5G users can collect and generate user plane call records and NAT logs at the same time on the provincial dedicated line UPF / SAEGW-U side and the firewall connected to the target data network in the same province when using dedicated APN service scenarios, regardless of whether roaming occurs, and transmit them to the data synthesis device for correlation and synthesis of user Internet access logs containing information such as the source public network IP address and the source public network IP port number.

[0075] It can be seen that the disclosed embodiment adjusts the collection location to the UPF / SAEGW-U device side of the provincial dedicated line of the IoT core network deployed in the provincial center, and only needs to centrally deploy the collection equipment in a small number of core computer rooms, which converges the collection points to the greatest extent, reduces the occupation of computer room resources, and reduces investment and maintenance costs. According to the routing organization principle of the IoT core network, the 4G IoT service will eventually be cleared through the IoT core network network elements, and the signaling data such as the S5 / S8-C interface will be collected on the SMF / SAEGW-C device side of the IoT core network, and the media data such as the S5 / S8-U interface will be collected on the UPF / SAEGW-U device side of the provincial dedicated line. Only the Internet access logs of 4G IoT users will be parsed and generated, which solves the problem that the data corresponding to the mobile communication core network and the IoT core network cannot be distinguished, and enhances the accuracy of the signaling monitoring system for user tracing or business analysis.

[0076] The method for generating a surfing log provided by the embodiment of the present disclosure may be executed by a terminal or by a chip applied to the terminal.

[0077] Exemplarily, the above-mentioned terminals may include one or more of mobile phones, tablet computers, wearable devices, vehicle-mounted devices, laptop computers, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), and wearable devices based on augmented reality (AR) and / or virtual reality (VR) technology, and may also include but not be limited to remote control devices, wearable devices, street lamps, home appliances and other smart terminals, which are not specifically limited in the embodiments of the present disclosure.

[0078] Figure 4 The flowchart of another method for generating a surfing log provided by an exemplary embodiment of the present disclosure is as follows. Figure 4 As shown, specifically including:

[0079] S401, in response to an Internet access request initiated by a user device, determine signaling data corresponding to the Internet access request, and obtain the signaling data through a first interface corresponding to a first target network element, wherein the first target network element is a network element in an Internet of Things core network of a province to which the user belongs.

[0080] In some embodiments, the first target network element may be a control plane network element, which is mainly used to transmit signaling data. Based on this, when a user initiates an Internet access request using a user device, the corresponding base station will first receive the Internet access request, and then transmit the Internet access request to the corresponding IoT core network. After receiving the user's Internet access request, the control plane network element in the IoT core network can obtain signaling data from the corresponding centralized network cloud resource pool. At this time, a first data acquisition device connected to the first target network element can be deployed in advance, and then the signaling data can be obtained from the first target network element through the first data acquisition device.

[0081] S402, obtaining user plane data corresponding to the Internet access request through the second interface corresponding to the second target network element, wherein the user plane data includes address information of the target data network, wherein the second target network element is a network element in the Internet of Things core network of the user's home province.

[0082] In some embodiments, the second target network element may be a user plane network element, which is used to transmit actual data, such as video data or voice data, etc. The user plane network element is mainly used to route and forward the user plane data corresponding to the Internet access request. Therefore, the second data acquisition device may be deployed in advance for the second target network element. When the second target network element obtains the Internet access request, the user plane data corresponding to the Internet access request may be determined, so that the second data acquisition device may obtain the user plane data from the second target network element.

[0083] S403, when the second target network element transmits user plane data to the target data network according to the address information, obtain network address translation data from a preset firewall.

[0084] In some embodiments, when the Internet access request is to access the target data network, it is necessary to first obtain the address information corresponding to the target data network, and then access the target data network according to the address information. However, when accessing the target network, the network address conversion will first be performed at the firewall corresponding to the target network, that is, the address information corresponding to the target data network will be converted. Therefore, a third data acquisition device can be deployed in advance at the firewall corresponding to the target network. When an Internet access request is detected at the firewall, the third data acquisition device can obtain the network address conversion data from the firewall corresponding to the firewall.

[0085] S404: Generate an Internet access log corresponding to the user equipment according to the signaling data, the user plane data and the network address translation data.

[0086] In some embodiments, after acquiring signaling data through a first data acquisition device, acquiring user plane data through a second data acquisition device, and acquiring network address translation data through a third data acquisition device, the signaling data, user plane data, and network address translation data may be merged to generate a final Internet access log.

[0087] It can be seen that the embodiments of the present disclosure can deploy different data collection devices for different collection locations, and different data collection devices collect different data. Therefore, confusion of different types of data can be avoided, which can not only improve the efficiency of Internet log generation but also ensure the success rate of Internet log generation.

[0088] In some embodiments, the first target network element is a control plane network element, and the first interface is an S5 / S8-C interface and / or an N16 interface; the second target network element is a user plane network element, and the second interface is an S5 / S8-U interface and / or an N9 interface.

[0089] In actual applications, signaling data can be collected in the centralized network cloud resource pool where the control plane network element SMF / SAEGW-C is located, and the signaling data is returned to the user plane network element of the user's home province and the corresponding first data collection device through the S5 / S8-C interface and N16 interface on the SMF / SAEGW-C side. The user plane network element can also obtain the user plane data corresponding to the Internet access request, so that the second data collection device can obtain the user plane data through the user plane network element UPF / SAEGW-U.

[0090] In actual applications, the user plane network element will also transmit user data to the target data network, and during this process, the transmitted data will pass through the firewall. Therefore, the S5 / S8-U interface and the N9 interface can be designed as split optical interfaces, one of which can be connected to the corresponding second data acquisition device, and the other can be used to access the target data network. In this way, NAT data can be collected at the firewall of the target data network through the third data acquisition device, and user plane data can be transmitted to the target data network.

[0091] Based on this, different interfaces can be set for different network elements, and different types of data can be collected through different data collection devices, thereby improving the efficiency of generating Internet logs.

[0092] In some embodiments, an Internet access log corresponding to a user device is generated based on signaling data, user plane data, and network address translation data, including: parsing the signaling data to obtain a control plane call record; parsing the user plane data to obtain a user plane call record; parsing the network address translation data to obtain a network address translation log; generating an Internet access log corresponding to the user device based on the control plane call record, user plane call record, and network address translation log.

[0093] Specifically, the signaling data can be parsed by the first data collection device to generate a control plane call bill; the user plane data can be parsed by the second data collection device to generate a user plane call bill; and the NAT data can be parsed by the third data collection device to generate a NAT log. Among them, the control plane call bill contains the user's identity information such as the mobile phone number; the user plane call bill contains the user's source private network IP address, source private network IP port, destination IP address, destination IP port, user access URL and other information; the NAT log contains the user's source private network IP address, source private network IP port, source public network IP address, source public network IP port, NAT time and other information.

[0094] In actual applications, the control plane call record may be presented in the form of Table 1, which may be:

[0095] Table 1 Control plane call list

[0096] phone number …… 139xxx ……

[0097] The user-side call record may be presented in the form of Table 2, which may be:

[0098] Table 2 User call list

[0099] Source private IP address Source private IP port Destination IP address Destination IP Port URL 1.1.1.1 500 3.3.3.3 2000 http: / / xx

[0100] The NAT log can be presented in the form of Table 3, which can be:

[0101] Table 3 NAT log

[0102] Source private IP address Source private IP port Destination IP address Destination IP Port NAT Time 1.1.1.1 500 2.2.2.2 1000 12：00

[0103] In some embodiments, an Internet access log corresponding to a user device is generated based on a control plane call record, a user plane call record, and a network address translation log, including: using a preset data synthesis device to merge the control plane call record, the user plane call record, and the network address translation log to generate an Internet access log corresponding to the user device.

[0104] Specifically, the data collection device sends the above three types of call records to the back-end data synthesis device for association, and synthesizes the user's complete Internet log, including the user's mobile phone number, source public IP address, source public IP port, destination IP address, destination IP port, user access URL and other information.

[0105] In practical applications, Table 1, Table 2, and Table 3 can be associated to synthesize a complete online log of the user, as shown in Table 4:

[0106] Table 4. Internet logs after correlation and synthesis

[0107]

[0108]

[0109] In some embodiments, the first interface and the second interface are both optical splitter interfaces; wherein, the first optical path corresponding to the first interface is used to connect the first data acquisition device and the first target network element, the second optical path corresponding to the first interface is used to connect the first data acquisition device and the second target network element, the third optical path corresponding to the second interface is used to connect the second data acquisition device and the second target network element, and the fourth optical path corresponding to the second interface is used to connect the firewall corresponding to the target data network and the second target network element.

[0110] Specifically, the first interface S5 / S8-C interface and / or N16 interface and the second interface S5 / S8-U interface and / or N9 interface can be directly set as splitter interfaces, and splitting can be performed on the physical links corresponding to the interfaces, so that each interface corresponds to two optical paths. Therefore, while ensuring stable data transmission between network elements, different data acquisition devices can be used to collect different data at different collection locations.

[0111] For example, the embodiment of the present disclosure requires and transmits the signaling data back to the user plane network element of the user's province and the corresponding first data acquisition device at the same time through the S5 / S8-C interface and the N16 interface on the SMF / SAEGW-C device side. Therefore, the S5 / S8-C interface and the N16 interface can be directly designed as splitter interfaces to meet the needs of data transmission.

[0112] The user plane network element of the disclosed embodiment will also transmit user data to the target data network and the third data acquisition device. During this process, the transmitted data will pass through the firewall corresponding to the target data network. Therefore, the S5 / S8-U interface and the N9 interface can be designed as splitter interfaces, one of which can be connected to the corresponding second data acquisition device, and the other can be used to access the target data network through the firewall. In this way, NAT data can be collected at the firewall of the target data network through the third data acquisition device, and user plane data can be transmitted to the target data network.

[0113] In some embodiments, when the second target network element transmits user plane data to the target data network according to the address information, network address translation data is obtained from a preset firewall, including: when the firewall receives the user plane data, the firewall can perform address translation on the address information to generate network address translation data.

[0114] Specifically, the firewall can convert the network address to achieve communication between the internal network and the external network, while hiding the real address of the internal network to improve network security. Based on this, the firewall can be used to convert the address information corresponding to the target data network, and then obtain the network address conversion data from the database corresponding to the firewall.

[0115] Based on this, the signaling monitoring system of the disclosed embodiment adjusts the collection location of user plane data, and no longer collects user plane data through the S1-U interface of the mobile communication core network element UPF / SAEGW-U in the visited province. Instead, the Internet of Things core network element UPF / SAEGW-U in the belonging province collects user plane data through the S5 / S8-U interface, and a new collection interface N9 is added to collect user plane data. At the same time, NAT data is obtained at the firewall of the provincial dedicated line UPF / SAEGW-U connected to the target data network in the Internet of Things core network, thereby ensuring that 4G / 5G users can collect and generate user plane call records and NAT logs at the same time on the provincial dedicated line UPF / SAEGW-U side and the firewall connected to the target data network in the same province when using dedicated APN service scenarios, regardless of whether roaming occurs, and transmit them to the data synthesis device for correlation and synthesis of user Internet access logs containing information such as the source public network IP address and the source public network IP port number.

[0116] At the same time, the disclosed embodiment adjusts the collection location to the UPF / SAEGW-U device side of the provincial dedicated line of the IoT core network deployed in the provincial center, and only needs to centrally deploy the collection equipment in a small number of core computer rooms, which converges the collection points to the greatest extent, reduces the occupation of computer room resources, and reduces investment and maintenance costs. According to the routing organization principle of the IoT core network, the 4G IoT service will eventually be cleared through the IoT core network network element, and the S5 / S8-C interface and other signaling data will be collected on the SMF / SAEGW-C device side of the IoT core network, and the S5 / S8-U interface and other media data will be collected on the provincial dedicated line UPF / SAEGW-U device side. Only the Internet access log of 4G IoT users will be parsed and generated, which solves the problem that the data corresponding to the mobile communication core network and the IoT core network cannot be distinguished, and enhances the accuracy of the signaling monitoring system for user tracing or business analysis.

[0117] It can be seen that the disclosed embodiment can solve the problem that the signaling monitoring system cannot associate and synthesize complete Internet access logs containing information such as the source public network IP address and the source public network IP port number, by adjusting the collection location, for the scenario where 4G / 5G users using dedicated APN services roam out of the province. At the same time, since the user's signaling data and user plane data are all cleared by the Internet of Things core network after access through the mobile communication core network, the collection location of the user plane data can be adjusted to the Internet of Things core network, so that the user plane data will not be collected from the mobile communication core network, thereby achieving accurate collection of Internet of Things data. Based on this, the disclosed embodiment can obtain different data through different network elements, and accurately analyze multiple data according to different data categories, so as to improve the generation efficiency of the Internet access log while ensuring the success rate of Internet access log generation, thereby improving the backfill rate of the source public network IP address and the source public network port number in the Internet access log.

[0118] The above mainly introduces the solution provided by the embodiment of the present disclosure from the perspective of the server. It is understandable that, in order to implement the above functions, the server includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present disclosure.

[0119] The embodiments of the present disclosure may divide the server into functional units according to the above method examples. For example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one management module. The above integrated modules may be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiments of the present disclosure is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0120] In the case of dividing each functional module according to each function, an exemplary embodiment of the present disclosure provides a device for generating a surfing log, and the device for generating a surfing log may be a server or a chip applied to a server. Figure 5 The structure diagram of a device for generating a surfing log provided by an exemplary embodiment of the present disclosure is shown in FIG. Figure 5 As shown, the surfing log generating device 500 includes:

[0121] A first acquisition module 501 is used to respond to an Internet access request initiated by a user device, determine signaling data corresponding to the Internet access request, and obtain the signaling data through a first interface corresponding to a first target network element, wherein the first target network element is a network element in the Internet of Things core network of the province to which the user belongs;

[0122] The second acquisition module 502 is used to obtain user plane data corresponding to the Internet access request through a second interface corresponding to a second target network element, wherein the user plane data includes address information of a target data network, and the second target network element is a network element in the Internet of Things core network of the province to which the user belongs;

[0123] A third acquisition module 503 is configured to obtain network address translation data from a preset firewall when the second target network element transmits the user plane data to the target data network according to the address information;

[0124] The generating module 504 is used to generate an Internet surfing log corresponding to the user equipment according to the signaling data, the user plane data and the network address translation data.

[0125] In an optional manner, the first target network element is a control plane network element, and the first interface is an S5 / S8-C interface and / or an N16 interface; the second target network element is a user plane network element, and the second interface is an S5 / S8-U interface and / or an N9 interface.

[0126] In an optional manner, the generation module 504 is also used to parse the signaling data to obtain a control plane call record; to parse the user plane data to obtain a user plane call record; to parse the network address translation data to obtain a network address translation log; and to generate an Internet access log corresponding to the user device based on the control plane call record, the user plane call record and the network address translation log.

[0127] In an optional manner, the generation module 504 is further configured to use a preset data synthesis device to merge the control plane call record, the user plane call record and the network address translation log to generate an Internet access log corresponding to the user device.

[0128] In an optional manner, the first interface and the second interface are both optical splitter interfaces; wherein the first optical path corresponding to the first interface is used to connect the first data acquisition device and the first target network element, the second optical path corresponding to the first interface is used to connect the first data acquisition device and the second target network element, the third optical path corresponding to the second interface is used to connect the second data acquisition device and the second target network element, and the fourth optical path corresponding to the second interface is used to connect the firewall corresponding to the target data network and the second target network element.

[0129] In an optional manner, the third acquisition module 503 is also used for, when the firewall receives the user plane data, the firewall can perform address conversion on the address information to generate network address conversion data; the third data acquisition device obtains the network address conversion data from the firewall.

[0130] An embodiment of the present disclosure also provides an electronic device, comprising: at least one processor; a memory for storing instructions executable by at least one processor; wherein the at least one processor is used to execute instructions to implement the steps of the above method disclosed in the embodiment of the present disclosure.

[0131] Figure 6 The structure diagram of an electronic device provided by an exemplary embodiment of the present disclosure is shown in FIG. Figure 6 As shown, the electronic device 600 includes at least one processor 601 and a memory 602 coupled to the processor 601 , and the processor 601 can execute corresponding steps in the above method disclosed in the embodiment of the present disclosure.

[0132] The processor 601 may also be referred to as a central processing unit (CPU), which may be an integrated circuit chip having signal processing capabilities. Each step in the method disclosed in the embodiment of the present disclosure may be completed by an integrated logic circuit of hardware in the processor 601 or by instructions in the form of software. The processor 601 may be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present disclosure may be directly embodied as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in a decoding processor. The software module may be located in a memory 602, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, or other mature storage media in the art. The processor 601 reads the information in the memory 602 and completes the steps of the method in combination with its hardware.

[0133] In addition, when various operations / processes according to the present disclosure are implemented by software and / or firmware, they can be transmitted from a storage medium or a network to a computer system having a dedicated hardware structure, for example, Figure 7 The computer system 160 shown installs the programs constituting the software, and when the various programs are installed, the computer system can perform various functions, including the functions described above. Figure 7 A schematic diagram of the structure of a computer system provided by an exemplary embodiment of the present disclosure.

[0134] Computer system 700 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0135] like Figure 7As shown, the computer system 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the computer system 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0136] A plurality of components in the computer system 700 are connected to the I / O interface 705, including: an input unit 706, an output unit 707, a storage unit 708, and a communication unit 709. The input unit 706 may be any type of device capable of inputting information to the computer system 700, and the input unit 706 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 707 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 708 may include, but is not limited to, a disk, an optical disk. The communication unit 709 allows the computer system 700 to exchange information / data with other devices over a network such as the Internet, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, for example, a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0137] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above. For example, in some embodiments, the above methods disclosed in the embodiments of the present disclosure may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via ROM 702 and / or a communication unit 709. In some embodiments, the computing unit 701 may be configured to perform the above methods disclosed in the embodiments of the present disclosure by any other appropriate means (e.g., by means of firmware).

[0138] The embodiment of the present disclosure also provides a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the above method disclosed in the embodiment of the present disclosure.

[0139] The computer-readable storage medium in the disclosed embodiments may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. The computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. More specifically, the computer-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0140] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0141] Figure 8 Schematic diagram of a computer program product provided by an exemplary embodiment of the present disclosure. Figure 8 As shown, the computer program product 800 includes a computer program 801, wherein the computer program 801 implements the above method disclosed in the embodiment of the present disclosure when executed by a processor.

[0142] In embodiments of the present disclosure, computer program codes for performing the operations of the present disclosure may be written in one or more programming languages ​​or combinations thereof, including but not limited to object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer.

[0143] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0144] The modules, components or units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the names of the modules, components or units do not, in some cases, limit the modules, components or units themselves.

[0145] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0146] The above descriptions are only some embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, a technical solution formed by replacing the above features with the technical features with similar functions disclosed in the present disclosure (but not limited to).

[0147] Although some specific embodiments of the present disclosure have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present disclosure. It should be understood by those skilled in the art that the above embodiments may be modified without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A method for generating a surfing log, It is characterized in that include: In response to an Internet access request initiated by a user device, determine signaling data corresponding to the Internet access request, and obtain the signaling data through a first interface corresponding to a first target network element, wherein the first target network element is a network element in an Internet of Things core network of a province to which the user belongs; Acquire user plane data corresponding to the Internet access request through a second interface corresponding to a second target network element, wherein the user plane data includes address information of a target data network, and the second target network element is a network element in an Internet of Things core network of a province to which the user belongs; When the second target network element transmits the user plane data to the target data network according to the address information, obtaining network address translation data from a preset firewall; Generate an Internet access log corresponding to the user equipment according to the signaling data, the user plane data and the network address translation data.

2. The method according to claim 1, It is characterized in that The first target network element is a control plane network element, and the first interface is an S5 / S8-C interface and / or an N16 interface; The second target network element is a user plane network element, and the second interface is an S5 / S8-U interface and / or an N9 interface.

3. The method according to claim 1, It is characterized in that The generating the Internet surfing log corresponding to the user equipment according to the signaling data, the user plane data and the network address translation data includes: Parsing the signaling data to obtain a control plane call record; Parsing the user plane data to obtain a user plane call record; Parsing the network address translation data to obtain a network address translation log; Generate an Internet access log corresponding to the user equipment according to the control plane call record, the user plane call record and the network address translation log.

4. The method according to claim 3, It is characterized in that The generating the Internet access log corresponding to the user equipment according to the control plane call list, the user plane call list and the network address translation log includes: The control plane call record, the user plane call record and the network address translation log are merged by using a preset data synthesis device to generate an Internet access log corresponding to the user device.

5. The method according to claim 1, It is characterized in that The first interface and the second interface are both optical splitting interfaces.

6. The method according to claim 1, It is characterized in that The acquiring network address translation data from a preset firewall when the second target network element transmits the user plane data to the target data network according to the address information includes: When the firewall receives the user plane data, the firewall performs address translation on the address information to generate network address translation data; Network address translation data is obtained from the firewall.

7. A device for generating a surfing log, It is characterized in that include: A first acquisition module, configured to respond to an Internet access request initiated by a user device, determine signaling data corresponding to the Internet access request, and obtain the signaling data through a first interface corresponding to a first target network element, wherein the first target network element is a network element in an Internet of Things core network of a province to which the user belongs; A second acquisition module is used to obtain user plane data corresponding to the Internet access request through a second interface corresponding to a second target network element, wherein the user plane data includes address information of a target data network, and the second target network element is a network element in an Internet of Things core network of a province to which the user belongs; a third acquisition module, configured to obtain network address translation data from a preset firewall when the second target network element transmits the user plane data to the target data network according to the address information; A generation module is used to generate an Internet access log corresponding to the user equipment according to the signaling data, the user plane data and the network address translation data.

8. A computer device comprising a memory, a processor and a computer program stored in the memory, It is characterized in that The processor executes the computer program to implement the steps of the method according to claims 1 to 6.

9. A computer-readable storage medium having a computer program / instructions stored thereon, It is characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claims 1 to 6 are implemented.

10. A computer program product comprising a computer program / instructions, It is characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to claims 1 to 6 are implemented.

Images