Interference monitoring method and system based on channel measurement data

Abstract

The invention discloses an interference monitoring method based on channel measurement data. The interference monitoring method comprises the following steps: firstly, acquiring the channel measurement data, carrying out interference attack detection based on the acquired channel measurement data, if interference exists, identifying the interference type, and finally, carrying out disposal and analysis based on the identified interference. According to the scheme, channel measurement data are deeply analyzed, researched and judged, interference attacks possibly occurring in the air interface are monitored, a normal signal channel measurement data mode is learned through the LSTM auto-encoder method, the excellent fitting capacity for normal signal channel measurement data and the mobile communication air interface interference recognition performance are achieved, and the method is suitable for being applied to the mobile communication air interface. Compared with a traditional interference attack identification scheme, the method can automatically and quickly identify interference, the identified interference attack types are multiple, the influence degree of the interference on a mobile communication network can be evaluated, meanwhile, the method has the functions of alarming and handling behaviors threatening network security, and the method is suitable for popularization and application. And the requirement on interference attack identification in a current mobile communication network air interface scene can be well met.

Description

Technical Field

[0001] The present invention belongs to the field of information security, and in particular relates to an interference monitoring method and system based on channel measurement data. Background Art

[0002] The popularity of mobile communications has enabled people to experience more possibilities in life and greatly improved the convenience of life and learning. The popularity of wireless devices such as mobile phones and tablets has injected colorful elements into people's daily lives. With the rapid arrival of 5G communication technology, the number of wireless communication devices has exploded. The rapid expansion of communication networks and the surge in wireless devices have stimulated a huge demand for spectrum resources, while making the electromagnetic environment increasingly complex, increasing the risk of mobile communication wireless air interface attacks. Attack behaviors are diverse and complex, including fake base station attacks, radio frequency interference, and spectrum resource abuse.

[0003] The above interference or attacks have a great impact on the normal operation of radio services, and have brought severe threats and complex challenges to their development and growth. This requires interference identification technology to deal with interference problems to ensure the stability and reliability of communication networks. Traditional radio anomaly detection methods rely on the support of historical spectrum databases and a large amount of prior knowledge. In the initial radio anomaly monitoring process, it is necessary to rely on personal prior knowledge and experience to determine whether the authorized signal is abnormal. This method of relying on personal subjective judgment is somewhat subjective. Therefore, monitoring personnel not only need extensive and in-depth professional knowledge, but also a lot of practical experience, and the knowledge level and skills of monitoring personnel are extremely high. At the same time, the use of manual monitoring requires a lot of time and energy, resulting in a waste of resources, and the monitoring efficiency is difficult to be satisfactory. Summary of the invention

[0004] In view of the above problems, an object of the present invention is to provide an interference monitoring method and system based on channel measurement data.

[0005] The specific technical solution for achieving the purpose of the present invention is:

[0006] An interference monitoring method based on channel measurement data comprises the following steps:

[0007] Step 1: Obtain channel measurement data;

[0008] Step 2: Perform interference attack detection based on the acquired channel measurement data;

[0009] Step 3: If interference exists, identify the type of interference;

[0010] Step 4: Perform processing and analysis based on the identified interference.

[0011] The present invention also provides an interference monitoring system based on channel measurement data, comprising the following modules:

[0012] Data acquisition module: obtain channel measurement data;

[0013] Interference attack detection module: used to perform interference attack detection based on the acquired channel measurement data;

[0014] Interference type identification module: used to identify the interference type;

[0015] Disposal and analysis module: used for handling and analysis based on identified interference.

[0016] Compared with the prior art, the present invention has the following beneficial effects:

[0017] (1) The solution of the present invention monitors possible interference attacks on the air interface by deeply analyzing and judging the channel measurement data. Compared with the traditional interference attack identification solution, this method can automatically and quickly identify interference, and can identify more types of interference attacks, and can evaluate the impact of interference on the mobile communication network. At the same time, it has the function of warning and handling behaviors that threaten network security, and can well meet the needs of interference attack identification in the current mobile communication network air interface scenario;

[0018] (2) The solution of the present invention utilizes the LSTM autoencoder method to learn the normal signal channel measurement data pattern, and has excellent fitting ability for normal signal channel measurement data and mobile communication air interface interference identification performance. The interference identification result has high accuracy, strong objectivity, and low probability of missed detection.

[0019] The present invention is further described below in conjunction with specific implementation modes. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flow chart of the interference monitoring method based on channel measurement data of the present invention.

[0021] Figure 2 Schematic diagram of the data detection model architecture based on the long short-term memory network in an embodiment of the present invention.

[0022] Figure 3 Schematic diagram of the interference monitoring system architecture based on channel measurement data in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] Example

[0024] In order to clearly describe the technical solution and the effects achieved by the present invention, the technical solution of the present invention is clearly explained below in combination with the accompanying drawings and specific embodiments of the present invention, so that technical personnel in the field can implement the invention without performing creative work. The structure shown in the accompanying drawings is not the entire actual structure but only a part of the actual structure. It should be noted that all other embodiments made by ordinary technical personnel in the field on the basis of the embodiments of the present invention without performing creative work should fall within the protection scope of the present invention.

[0025] The following examples are only for better explanation of the present invention, but the content of the present invention is not limited to the application in the examples. Therefore, those skilled in the art can make non-essential modifications to the implementation scheme based on the above invention content and apply it to other embodiments, which is still within the protection scope of the present invention. In addition, the experimental methods without specific conditions in the following examples should be carried out according to the conventional conditions or the conditions recommended by the manufacturer. If the expressions in the text are not specially explained, they are only used for distinction and have no other meanings.

[0026] Combination Figure 1 , an interference monitoring method based on channel measurement data, comprising the following steps:

[0027] Step 1: Obtain channel measurement data;

[0028] The channel measurement data includes uplink channel measurement information and downlink channel measurement information in the mobile communication network;

[0029] The uplink channel measurement information includes the mean and maximum uplink interference noise at the time-frequency resource block (RB) level, the cell information, frequency information (such as RB number) and time information of the measured time-frequency resource block, etc.;

[0030] The downlink channel measurement information includes measurement report (MeasurementReport, MR) and channel quality indication (ChannelQualityIndex, CQI) information, the measurement report includes reference signal strength (Reference SignalReceived Power, RSRP), reference signal quality (Reference SignalReceived Quality, RSRQ), signal interference and noise ratio (SignalInterferenceNoiseRatio, SINR) and cell information, as well as time information of measurement report and channel quality indication measurement.

[0031] The data acquisition sources of the channel measurement data are periodic feedback data and time-triggered feedback data.

[0032] Step 2: Perform interference attack detection based on the acquired channel measurement data. For example, in a 4G LTE system, first collect the channel measurement data when the terminal device can normally connect and communicate with the base station:

[0033] Step 2-1: Before inputting the measurement data into the LSTM network layer, the acquired channel measurement data needs to be preprocessed:

[0034] The base station side data has multiple features, and the scales of different features may be different. Standardization can eliminate the scale impact between different features, so that the model treats each feature more fairly. Therefore, the channel measurement data is first standardized to obtain the standardized data x:

[0035]

[0036] Where x′ is the original data, μ is the mean of the original data, and σ is the standard deviation of the original data;

[0037] Then the standardized data is windowed, with a window size of W and one step sliding each time;

[0038] The multivariate sequence can be expressed as [x(1), x(2), …, x(T)], where T is the number of samples. After windowing, we get N = T - W + 1 sequences x(n), where n = 1, 2, …, N:

[0039] X(1)=[x(1),...,x(W)]

[0040] X(2)=[x(2),...,x(W+1)] ...

[0042] X(N)=[x(N),...,x(T)]

[0043] Step 2-2: Build a data detection model based on the long short-term memory network and train the model using normal signals:

[0044] Combination Figure 2 , a data detection model is constructed based on the long short-term memory network, and the input long short-term memory network data is defined as a tensor of dimension S×W×D, where S is the batch size, W represents the time step, that is, the window size, and D is the number of features of the sequence, which are RSRP, RSRQ and SINR in this embodiment;

[0045] When training the model, normal signals are used as input. The model continuously reconstructs the input to minimize the error between the input and the reconstructed data, and finally learns the pattern of the normal signal data.

[0046] When testing the model, the input data is reconstructed through the autoencoder, and the reconstruction error between the input data and the reconstruction is calculated. When the reconstruction error is less than the set threshold, the model training is considered complete.

[0047] This embodiment uses mean square error as the loss function, that is, reconstruction error:

[0048]

[0049] Where N represents the number of samples, x i represents the i-th sample, is the predicted value of the i-th sample, that is, x i Reconstructed input after the autoencoder;

[0050] Step 2-3: Detect the pre-processed channel measurement data based on the trained data detection model to determine whether there is an interference attack;

[0051] The data detection model calculates the reconstruction error based on the preprocessed channel measurement data, and compares the reconstruction error with a set threshold. If the reconstruction error is greater than the threshold, it is considered that interference exists, and if the reconstruction error is less than the threshold, it is considered that no interference exists.

[0052] Step 3: If interference exists, identify the type of interference;

[0053] If it is determined that interference exists, interference identification is performed based on the channel measurement data;

[0054] If some mobile communication frequency points in the dynamic spectrum drawn based on the measured time-frequency resource blocks in the channel measurement data always maintain a high power state, it indicates that the interference type is radio frequency interference;

[0055] The BCCH (Broadcast Control Channel) configured by the fake base station is usually the same as the BCCH of a nearby cell, which causes the mobile phone to mistake the fake base station for a normal cell and force the mobile phone to reselect the cell through a higher signal strength, and then access the fake base station. Based on long-term monitoring of the signal strength of each cell, the change characteristics of the signal strength are summarized and obtained. If the signal strength in the channel measurement data is abnormal, it means that the interference type is fake base station interference;

[0056] If some large-scale frequency bands of mobile communications in the dynamic spectrum drawn based on the measured time-frequency resource blocks in the channel measurement data remain obviously occupied, it indicates that the interference type is spectrum abuse interference.

[0057] Step 4: Perform processing and analysis based on the identified interference.

[0058] Once a specific air interface interference threat is identified, the interference event can be evaluated and analyzed, and timely warnings and decision-making can be issued for behaviors that threaten network security.

[0059] Combination Figure 3 , is a schematic diagram of the deployment architecture of the interference monitoring system based on channel measurement data in this embodiment, wherein the network elements related to interference attack monitoring include electromagnetic monitoring equipment, wireless network management equipment and interference threat monitoring platform, and the specific functions and deployment methods are as follows:

[0060] Among them, the interference monitoring module of this solution is deployed in the core network, receives monitoring data from the wireless network management equipment, performs interference analysis, alarms and disposal, and comprehensively displays the security situation of the mobile communication air interface; each network element device completes data collection and reports it to the Trace Server according to the subscription task of the data flow. MAE-Access is a unified management platform for mobile networks, which completes data subscription control. The Trace Server is a northbound flow collection server. Its main function is to collect network element data, encapsulate the data in a common data flow format, and report it to the interference monitoring module.

[0061] The solution of the present invention monitors possible interference attacks on the air interface by deeply analyzing and judging the channel measurement data, and can automatically and quickly identify interference based on the acquired channel measurement data. The identification has high accuracy and fast speed, and can well meet the needs of interference attack identification in the air interface scenarios of current mobile communication networks.

[0062] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. An interference monitoring method based on channel measurement data, characterized in that: The following steps are involved: Step 1: Obtain channel measurement data; Step 2: Perform interference attack detection based on the acquired channel measurement data; Step 3: If interference exists, identify the type of interference; Step 4: Perform processing and analysis based on the identified interference.

2. The interference monitoring method based on channel measurement data according to claim 1, characterized in that: The channel measurement data in step 1 includes uplink channel measurement information and downlink channel measurement information in the mobile communication network; The uplink channel measurement information includes the uplink interference noise mean and maximum value at the time-frequency resource block level, the cell information, frequency information and time information of the measured time-frequency resource block; The downlink channel measurement information includes measurement report and channel quality indication information, the measurement report includes reference signal strength, reference signal quality, signal to interference and noise ratio and cell information, and measurement time information of the measurement report and channel quality indication.

3. The interference monitoring method based on channel measurement data according to claim 2, characterized in that: The data acquisition sources of the channel measurement data are periodic feedback data and time-triggered feedback data.

4. The interference monitoring method based on channel measurement data according to claim 1, characterized in that: The interference attack detection based on the acquired channel measurement data in step 2 is specifically performed as follows: Step 2-1, preprocessing the acquired channel measurement data; Step 2-2, constructing a data detection model based on the long short-term memory network, and training the model using normal signals; Step 2-3: Detect the pre-processed channel measurement data based on the trained data detection model to determine whether there is an interference attack.

5. The interference monitoring method based on channel measurement data according to claim 4, characterized in that: The preprocessing of the channel measurement data in step 2-1 is specifically as follows: First, standardize the channel measurement data to obtain the standardized data x: Where x′ is the original data, μ is the mean of the original data, and σ is the standard deviation of the original data; Then the standardized data is windowed, with a window size of W and one step sliding each time; The multivariate sequence can be expressed as [x(1), x(2), …, x(T)], where T is the number of samples. After windowing, we get N = T - W + 1 sequences x(n), where n = 1, 2, …, N: X(1)=[x(1),...,x(W)] X(2)=[x(2),...,x(W+1)] ... X(N)=[x(N),...,x(T)].

6. The interference monitoring method based on channel measurement data according to claim 4, characterized in that: The step 2-2 of constructing a data detection model based on a long short-term memory network is specifically as follows: Build a data detection model based on the long short-term memory network, and define the input long short-term memory network data as a tensor of dimension S×W×D, where S is the batch size, W represents the time step, that is, the window size, and D is the number of features of the sequence; When training the model, normal signals are used as input. The model continuously reconstructs the input to minimize the error between the input and the reconstructed data, and finally learns the pattern of the normal signal data. When testing the model, the input data is reconstructed through the autoencoder, and the reconstruction error between the input data and the reconstruction is calculated. When the reconstruction error is less than the set threshold, the model training is considered complete.

7. The interference monitoring method based on channel measurement data according to claim 6, characterized in that: The data detection model uses mean square error as the loss function, that is, reconstruction error: Where N represents the number of samples, x i represents the i-th sample, is the predicted value of the i-th sample, that is, x i Reconstructed input after the autoencoder; The data detection model calculates the reconstruction error based on the preprocessed channel measurement data, and compares the reconstruction error with a set threshold. If the reconstruction error is greater than the threshold, it is considered that interference exists, and if the reconstruction error is less than the threshold, it is considered that no interference exists.

8. The interference monitoring method based on channel measurement data according to claim 2, characterized in that: The interference type identification in step 3 is specifically as follows: If it is determined that interference exists, interference identification is performed based on the channel measurement data; If some mobile communication frequency points in the dynamic spectrum drawn based on the measured time-frequency resource blocks in the channel measurement data always maintain a high power state, it indicates that the interference type is radio frequency interference; If the signal strength in the channel measurement data is abnormal, it means that the interference type is pseudo base station interference; If some large-scale frequency bands of mobile communications in the dynamic spectrum drawn based on the measured time-frequency resource blocks in the channel measurement data remain obviously occupied, it indicates that the interference type is spectrum abuse interference.

9. An interference monitoring system based on channel measurement data, characterized in that: Includes the following modules: Data acquisition module: obtain channel measurement data; Interference attack detection module: used to perform interference attack detection based on the acquired channel measurement data; Interference type identification module: used to identify the interference type; Disposal and analysis module: used for handling and analysis based on identified interference.

Images