5G core network element behavior trust evaluation method and system

Abstract

The invention discloses a 5G core network element behavior trust evaluation method and system, and belongs to the field of network communication security. The method comprises the following steps: collecting communication data from each network element of a 5G core network and analyzing the communication data to determine whether an interaction relationship meeting a standard exists between the network elements; calculating a reference trust value of the network element meeting the standard interaction relationship; dynamically adjusting the reference trust value according to the interaction behavior of the network element, and calculating a reward and punishment score; performing comprehensive calculation on the reference trust value and the reward and punishment score to obtain the comprehensive trust degree of the network element; aggregating the comprehensive credibility of all service production network elements to a certain service consumption network element to obtain an aggregated credibility; and trust grading is carried out based on the aggregation trust degree, a corresponding access control strategy is made according to trust grading, and the operation authority and the resource access level of the network element are determined. According to the system and the method, a framework combining distributed trust evaluation modules and centralized trust evaluation modules is realized, and dynamic and accurate trust evaluation is carried out on the 5G core network element.

Description

Technical Field

[0001] The present invention belongs to the field of network communication security, and specifically relates to a 5G core network element behavior trust assessment method and system. Background Art

[0002] The 5G network can be divided into three parts as a whole, including access network, bearer network and core network. The core network is the command center of the 5G network, responsible for handling key functions such as data routing, user authentication, and session management. The 5G core network is software-based, flexible, and open based on the SBA architecture, but it faces new security risks and challenges that are becoming increasingly complex and diverse. Traditional network security models often focus on external threats and ignore the potential risks of internal threats. With the emergence of internal threat attacks such as IP forgery and malicious hijacking, coupled with the decoupling of the core network and the gradual blurring of boundaries, traditional network security protection can no longer meet the current 5G network security needs.

[0003] As a security concept, Zero Trust (ZT) has attracted widespread attention in the industry with its security protection concept of "default distrust". Its core content is to no longer use physical boundaries as network trust boundaries, but to protect network information data security through continuous trust assessment and detection of all users, devices, and services inside and outside the network, dynamic access control, and minimized active authorization based on identity authentication.

[0004] As a core component of the zero-trust network architecture, trust assessment performs real-time risk analysis and assessment on all network requests and activities, including identity authentication, behavior analysis, and recording and monitoring of historical activities of the request source. By integrating these data, the trust assessment mechanism can generate a quantitative trust score. The access control engine dynamically makes authorization decisions based on the trust score and trust classification provided by the trust assessment engine.

[0005] In the trust assessment model, the trust assessment algorithm plays a vital role. It determines whether to allow its request to pass by evaluating the security of entities in the network. Although the importance of trust assessment is widely recognized, there is a lack of effective mechanisms in the 5G core network to measure the trustworthiness of network functions and to judge the reliability of the behavior of service-consuming network elements. The current method mainly relies on the network element authentication method specified in the 3GPP standard, that is, by using the OAuth 2.0 method for authentication to ensure that the identity of each network element is trustworthy. Each network element must be authenticated when accessing and accessing the network to prevent forged or untrusted network elements from accessing the network. By using the relationship comparison table between NF service functions and URLs to determine whether network elements have permission to access resources, this simple, static mapping relationship often cannot accurately reflect the security of communication entities, which makes the core network vulnerable to attacks from internal malicious network elements, thereby threatening the security of the entire network.

[0006] In the existing 5G core network trust assessment, static authentication is usually relied on, mainly based on the network element authentication method specified in the 3GPP standard. In this authentication method, network element authentication mainly relies on static public key infrastructure (PKI) and digital certificates. Once the initial authentication is passed, subsequent dynamic changes and behaviors cannot be monitored and responded to in a timely manner. Once an attacker obtains a network element certificate, he can carry out malicious activities if the authentication is passed.

[0007] In addition, anomaly detection based on core network element access data can also provide basic support for trust assessment and improve the dynamic nature of network element trust to a certain extent. However, only behavioral pattern analysis and anomaly detection may generate a large number of false positives and missed positives. When attackers disguise themselves as normal behaviors, it is even more difficult to conduct effective analysis and detection. Summary of the invention

[0008] In order to solve the above technical problems, the present invention proposes a 5G core network element behavior trust evaluation method and system, which realizes an architecture combining distributed and centralized trust evaluation modules, and performs dynamic and accurate trust evaluation on 5G core network elements.

[0009] The technical solutions specifically adopted in the present invention are as follows:

[0010] A 5G core network element behavior trust evaluation method comprises the following steps:

[0011] 1) Collect communication data from each network element of the 5G core network;

[0012] 2) Analyze the collected communication data to determine whether there is an interaction relationship that meets the standards between network elements. If there is no communication relationship between network elements, the baseline trust value is set to zero;

[0013] 3) For network elements that meet the standard interaction relationship, calculate their baseline trust value;

[0014] 4) Dynamically adjust the baseline trust value based on the interactive behavior of the network element and calculate the reward and punishment score;

[0015] 5) Comprehensively calculate the baseline trust value and the reward and punishment score to obtain the comprehensive trust of the network element;

[0016] 6) Aggregate the comprehensive trust of all service production network elements to a service consumption network element to obtain the aggregated trust;

[0017] 7) Trust classification is performed based on aggregated trust, and corresponding access control policies are formulated according to the trust classification to determine the operation permissions and resource access levels of network elements.

[0018] Furthermore, the communication data includes interaction information, interaction frequency and interaction success rate between network elements.

[0019] Furthermore, the step of calculating the baseline trust value includes:

[0020] Use the Bayesian trust evaluation method to calculate the interaction success rate between network elements;

[0021] Count the number of interactions within the observation time window and calculate the interaction frequency between network elements;

[0022] The interaction success rate and interaction frequency between network elements are comprehensively considered, different weights are assigned, and the baseline trust value is calculated;

[0023] The time decay factor is introduced to update the interaction success rate and interaction frequency between network elements, and then update the baseline trust value.

[0024] Furthermore, the calculated interaction frequency between network elements is the interaction frequency after normalization processing by introducing Sigmod function.

[0025] Furthermore, a reward and punishment mechanism module is constructed based on an autoencoder and a machine learning algorithm. The autoencoder includes an encoder and a decoder. The reward and punishment mechanism module dynamically adjusts the baseline trust value according to the interactive behavior of the network element and calculates the reward and punishment score.

[0026] Furthermore, the steps of calculating the reward and punishment scores in the reward and punishment mechanism module include:

[0027] Perform truncation and padding preprocessing on data packets;

[0028] The encoder converts the preprocessed data packets into encoded data in a matrix format suitable for processing by the autoencoder;

[0029] The decoder reconstructs the encoded data into a data length matrix;

[0030] Use normal data to train the reward and punishment mechanism module, use reconstruction loss to update the weights and biases in the encoder and decoder, and adjust the hyperparameters;

[0031] Set a reward and punishment score threshold, compare the reconstruction loss with the threshold, and use the Sigmoid function to map the reconstruction loss to a reward and punishment score.

[0032] Furthermore, when training the reward and punishment mechanism module, the Adam optimizer is used for parameter optimization, and the reconstruction loss is the mean square error (MSE).

[0033] Furthermore, the baseline trust value and the reward and punishment score are weighted and summed to obtain the comprehensive trust.

[0034] Furthermore, the method for calculating the aggregated trust is: averaging the comprehensive trusts of all current service production network elements, and performing a weighted summation with the historical aggregated trusts to obtain the current aggregated trust.

[0035] Furthermore, the following trust classification is performed based on the aggregated trust:

[0036] When the aggregate trust is ≥ 0.9, it is a high trust level;

[0037] When 0.6≤aggregate trust < 0.9, it is a medium trust level;

[0038] When the aggregate trust is less than 0.6, it is a low trust level.

[0039] Furthermore, corresponding access control policies are formulated according to the trust classification, including:

[0040] For network elements with a high trust level, access to all resources and services is allowed;

[0041] For network elements with medium trust level, only non-sensitive resources and services are allowed to be accessed;

[0042] Implement strict access control for network elements with low trust levels.

[0043] Furthermore, trust classification and access control policies are dynamically adjusted according to changes in the network environment and real-time security intelligence.

[0044] A 5G core network element behavior trust evaluation system, comprising a trust evaluation center module deployed in a 5G core network NRF network element and a trust evaluation module deployed in other network elements of the 5G core network;

[0045] The trust evaluation module is used to collect communication data from each network element of the 5G core network; analyze the collected communication data to determine whether there is an interactive relationship that meets the standards between the network elements. If there is no communication relationship between the network elements, the baseline trust value is set to zero; for network elements with interactive relationships that meet the standards, their baseline trust values ​​are calculated; the baseline trust values ​​are dynamically adjusted according to the interactive behaviors of the network elements, and the reward and punishment scores are calculated; the baseline trust values ​​and reward and punishment scores are comprehensively calculated to obtain the comprehensive trust of the network elements;

[0046] The trust assessment center module is used to aggregate the comprehensive trust of all service production network elements in a service consumption network element to obtain the aggregated trust; trust classification is performed based on the aggregated trust, and corresponding access control policies are formulated according to the trust classification to determine the operation permissions and resource access levels of the network elements.

[0047] The present invention introduces the concept of zero trust into the 5G core network with the goal of enhancing the security of the 5G core network. By analyzing the interaction characteristics of 5G core network elements defined by the standard and combining the advantages of distributed and centralized trust assessment models, a trust assessment method suitable for application in the 5G core network is designed. The present invention calculates the baseline trust score by combining the network element interaction frequency and interaction success rate, and obtains the comprehensive trust by integrating the self-encoding reward and punishment mechanism. The NRF network element aggregates the trust assessment results to realize dynamic trust quantification of the network elements. The purpose is to ensure that the core network can effectively identify the security status of the network elements, reduce complexity and cost as much as possible, and enhance the core network's defense capabilities against internal and external threats.

[0048] The technical effects achieved by the present invention are:

[0049] 1) The focus of the present invention is to dynamically calculate the trust benchmark score by combining the interaction frequency and interaction success rate of the network element, and use the reward and punishment mechanism based on machine learning to increase or decrease the trust value according to real-time behavior. Compared with traditional trust evaluation methods, the present invention combines 5G core network element behavior with machine learning analysis, which can significantly improve the sensitivity and accuracy of trust evaluation and ensure that the dynamic trust evaluation of core network elements is more reliable.

[0050] 2) The present invention uses NRF network elements to aggregate the comprehensive trust of all service production network elements to a service consumption network element, collects the evaluation results of multiple network elements, provides a more comprehensive and accurate trust evaluation, and reduces the probability of false positives and false negatives. At the same time, security decisions are made in real time based on the aggregated trust, and security policies are adjusted dynamically to improve the overall security and efficiency of the 5G core network.

[0051] 3) The present invention designs a distributed trust evaluation module and a centralized trust evaluation center module according to the network topology of the 5G core network. The distributed trust evaluation module performs preliminary evaluation and real-time feedback on each network element node to ensure the timely update and accuracy of the trust data; the centralized trust evaluation center module aggregates global data on the central control node, calculates the comprehensive trust and makes global security decisions. This design not only improves the accuracy of trust evaluation and the robustness of the system, but also optimizes resource utilization, improves response speed and security decision-making capabilities, can flexibly respond to complex network environments, and provide comprehensive, stable and efficient security guarantees.

[0052] 4) The present invention makes little change to the original 5G core network architecture, and can directly add corresponding modules to the existing core network elements, which can save costs, facilitate implementation, have good scalability, can flexibly adapt to complex network environments and diverse communication needs, and support diversified changes in network topology and communication needs. It is not only applicable to the current 5G core network, but can also be smoothly expanded to future network architectures and technology evolutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is an overall architecture diagram of a 5G core network element behavior trust evaluation system of an embodiment.

[0054] Figure 2 It is a module deployment diagram of a 5G core network element behavior trust evaluation system of an embodiment. DETAILED DESCRIPTION

[0055] In order to make the various technical features and advantages or technical effects in the above technical solutions of the present invention more obvious and easy to understand, they are described in detail below with reference to the accompanying drawings.

[0056] like Figure 1 As shown, the embodiment of the present invention specifically proposes a 5G core network element trust assessment method and system, and the overall architecture mainly includes five parts: baseline trust, reward and punishment scoring, comprehensive trust, aggregated trust and security decision-making. The trust assessment mechanism in this system architecture consists of a distributed trust assessment module and a centralized trust assessment center module, wherein the trust assessment module includes baseline trust, reward and punishment scoring and comprehensive trust, and the trust assessment center module includes aggregated trust (for trust grading) and security decisions. The execution process of this method is as follows:

[0057] 1) Network element communication data collection: Build a 5G zero-trust network architecture and collect communication data from each network element in the core network. The data includes interaction information, interaction frequency, interaction success rate, etc. between network elements, and mainly analyzes data packets based on the HTTP / 2 protocol.

[0058] 2) Interaction relationship evaluation: Analyze the collected communication data to determine whether there is an interaction relationship that meets the standards between network elements. If there is no communication relationship between network elements, the trust value is directly assigned to zero.

[0059] 3) Baseline trust: Calculate the base trust value of network elements that meet the standard interaction relationship. The base trust value is calculated based on the interaction frequency and interaction success rate between network elements, reflecting the basic trust value of network elements in normal communication.

[0060] 4) Reward and Penalty Scoring: Use the self-encoded reward and penalty mechanism to adjust the baseline trust value. Give reward or penalty scores based on the behavior of the network element, and dynamically update the trust level. When the network element performs well as expected and the communication is normal, the trust value increases. When the detection behavior does not meet expectations, the trust value will decrease accordingly.

[0061] 5) Comprehensive trust: The baseline trust value and the reward and punishment score are calculated comprehensively to obtain the comprehensive trust of the network element. The comprehensive trust reflects the trust status of the service production network element in the service consumption network element at the current time point.

[0062] 6) Aggregate trust: The NRF network element aggregates the comprehensive trust of all service production network elements to a service consumption network element. By aggregating the trust evaluation results of multiple network elements, an accurate and comprehensive trust evaluation of the trust consumption network element is obtained.

[0063] 7) Security decision: Trust classification is performed based on the aggregated trust level, and corresponding security decisions are made. Security decisions include whether to allow network elements to perform specific operations or access network resources of what security level.

[0064] The module deployment of a 5G core network element behavior trust evaluation system in this embodiment is as follows Figure 2 As shown. Based on the standard 5G core network architecture, on the one hand, a trust assessment module is deployed in the key network function network elements of the 5G core network. This module quantifies the trust value of the service consumption network element (the network element requesting the service) by the service production network element (the network element providing the service) by analyzing the interaction behavior and status with other network elements, including interaction frequency, success rate and other indicators, and calculates a comprehensive trust. In the trust assessment process, the trust assessment module is divided into two parts: baseline trust and reward and punishment scoring. A trust score is given to each network element according to the predetermined baseline trust score. This score is dynamic and is updated in real time according to the behavior changes of the network element. On the other hand, NRF is used as the trust assessment center module to centrally process the trust assessment data from each network element, summarize and analyze it, and make access control and security decisions in a timely manner. The dynamic trust assessment mechanism can enhance the security performance of the 5G core network, enabling the network to respond to changing security threats more flexibly.

[0065] Figure 2 The network elements shown in FIG. 1 are specifically:

[0066] NEF (Network Exposure Function): Network exposure function, used to provide an open interface for network capabilities.

[0067] NRF (Network Repository Function): Network storage function, centrally manages and stores registration information of various services and network elements in the 5G network.

[0068] PCF (Policy Control Function): Policy control function, responsible for policy management and control, ensuring that the network complies with business and user policies.

[0069] UDM (Unified Data Management): Unified data management function to manage user subscription data.

[0070] AMF (Access and Mobility Management Function): Access and mobility management function, responsible for processing functions related to access and mobility management.

[0071] NSSF (Network Slice Selection Function): Network slice selection function, responsible for the selection and management of network slices.

[0072] SMF (Session Management Function): Session management function, responsible for managing the user's session status.

[0073] AUSF (Authentication Server Function): Authentication server function, responsible for processing authentication requests for 5G networks.

[0074] The specific technical contents of each part are described as follows:

[0075] 1. Trust Assessment Module

[0076] 1. Baseline Trust

[0077] Network element behavior is the main basis for judging the identity of the network element. In the 5G network, the business process of the core network involves the interaction of multiple network elements. According to the 3GPP standard, these interaction orders and interaction relationships are usually predefined, and the interaction frequency and interaction success rate of network elements should ideally be relatively fixed or within the expected range. Network element interaction frequency refers to the number of interactions between network elements within a specific time. Network element interaction success rate is the proportion of successful interaction requests between network elements. Successful interaction means that data or control information is correctly transmitted and received without errors or loss. Interaction failure may be due to authentication failure caused by incorrect credentials or invalid keys, or network elements accessing resources that they are not authorized to access and attempting to perform unauthorized operations. Frequent interaction failures are a sign of network security issues, indicating that there may be malicious attacks or system vulnerabilities. Therefore, network element interaction frequency and network element interaction success rate are two key metrics for trust benchmark evaluation.

[0078] 1) Network element interaction success rate. The Bayesian trust-based evaluation method is used to calculate the historical data of the interaction between the evaluation network element (service production network element) NFi and the evaluated network element (service consumption network element) NFj. ij and β ij To record the number of successful and failed interactions between two network elements, the statistical expectation of NFi's trust in NFj is:

[0079]

[0080] 2) Network element interaction frequency. Let NF be a set of network elements, and NFi,NFj∈NF be any two network elements. Define T as the total length of the observation time window, and Cij(t) as the number of interactions between network element NFi and network element NFj in time window t. Then the interaction frequency between network element NFi and network element NFj is:

[0081]

[0082] Introducing the Sigmod function The above interaction frequencies are normalized and mapped to the following interaction frequencies:

[0083]

[0084] 3) The trust benchmark is obtained by integrating the network element interaction frequency and the network element interaction success rate. The benchmark trust between network element NFi and network element NFj is:

[0085] BT(i,j)=k 1 ST(i,j)+k 2 FT(i,j)

[0086] where k 1 +k 2=1, which respectively represent the weights of network element interaction frequency and network element interaction success rate in the trust benchmark score.

[0087] 4) Time decay. In order to reflect the timeliness of trust in the trust evaluation model, a time decay factor is introduced, which can pay more attention to the recent behavior of the network element and reduce the impact of past behavior on the current trust evaluation. Assume that in the interaction history between NFi and NFj, successful interactions occur α times. ij times, failed β ij times. In a new cycle T, successful interactions occur r times and failed s times. These parameters are weighted according to the time when the interaction occurs to obtain the updated number of successful interactions:

[0088]

[0089] And the updated number of interaction failures:

[0090]

[0091] Where the time decay factor θ(t) = e -q(T-t) , q is the time decay factor parameter, which aims to make the time decay factor in the range of (0,1).

[0092] After updating, we get:

[0093]

[0094] Updated Baseline Trust:

[0095] BT n (i,j)=k 1 ST n (i,j)+k 2 FT n (i,j)

[0096] 2. Reward and Punishment Scoring

[0097] The reward and punishment scores are calculated by the reward and punishment mechanism module, which is implemented based on autoencoders and machine learning algorithms. Autoencoder (AE) is an unsupervised neural network that consists of two parts: encoder and decoder. The encoder converts the input data into a lower-dimensional representation, while the decoder attempts to reconstruct the original data from this representation. By comparing the input data and its reconstructed version, the autoencoder can be used for anomaly detection: if the reconstruction error exceeds the set threshold, the data may be abnormal; otherwise, it is considered normal.

[0098] The specific processing steps of the reward and punishment mechanism module are as follows:

[0099] 1) Data preprocessing: Data packet truncation and padding, such as truncating each data packet to 1024 bytes, or padding to 1024 bytes with 0.

[0100] 2) Encoder data reshaping. Encoder data reshaping can be performed in the following manner, but is not limited to: the encoder accepts a data packet of 1024 bytes in length and reshapes it into a 32x32x1 matrix, uses four Conv2D layers to compress the 32x32x1 matrix into an 8x8x1 tensor for convolution layer processing, and then uses a Dense layer to flatten the 8x8x1 tensor.

[0101] 3) Decoder data reconstruction: The decoder obtains the encoded data from the encoder and reconstructs it into a data length matrix corresponding to the truncation and padding of the data packet.

[0102] 4) Reward and Punishment Module Training: Use normal data to train the reward and punishment mechanism module, use reconstruction loss to update the weights and biases in the encoder and decoder, and adjust hyperparameters. If the Adam optimizer is used, the loss function is the mean square error (MSE).

[0103] 5) Reward and punishment score: Set the reward and punishment score threshold ɑ. When the MSE of the output and input is less than the threshold ɑ, it means that the autoencoder can accurately reconstruct the input data, indicating that the behavior of the network element is consistent with the normal behavior pattern learned from the training data. Therefore, it can be considered that the behavior of the network element is relatively normal, and a higher trust value should be given, and an incentive mechanism should be set for this. On the contrary, when the MSE is greater than the threshold ɑ, it indicates that the autoencoder encountered difficulties in reconstructing the input data, and there is a large difference between the reconstructed data and the original data. This means that the behavior of the network element does not match the normal behavior pattern in the training data, and shows abnormal or atypical characteristics. In this case, the trust value of the network element should be lowered and a penalty mechanism should be adopted. The Sigmod function is introduced to map the MSE to a reward and punishment score:

[0104]

[0105] Among them, τ 1 ,τ 2 Custom constants are set for reward and punishment scores to ensure that the reward and punishment scores are within appropriate values.

[0106] 3. Comprehensive trust

[0107] Trust benchmark scores based on network element interaction frequency and network element interaction success rate and reward and punishment trust based on machine learning each have certain limitations. For trust benchmark scores, the evaluating network element needs to have sufficient direct interaction with the evaluated network element to ensure the accuracy of the score; for reward and punishment trust, malicious recommendations from malicious network elements may cause the trust score to be disturbed. In order to overcome these limitations, combining the trust benchmark score and the reward and punishment trust score to comprehensively calculate the trust value can provide a more comprehensive and accurate trust score, thereby enhancing the effectiveness of the evaluation process. Specific method: At time t, the comprehensive trust of NFi to NFj is:

[0108] AT t (i,j)=λ 1 *BT n (i,j)+λ 2 *PRT(i,j)

[0109] where λ 1 +λ 2 =1, representing the trust base value and the weight of the reward and punishment trust. t When (i,j)<0, let AT t (i,j)=0; when AT t When (i,j)>1, let AT t (i,j)=1.

[0110] 2. Trust Assessment Center Module

[0111] As a centralized trust evaluation center, NRF can centrally manage and store the trust scores of all network functions, facilitating information sharing and updating. By weighting the average score reported by each network element and the historical aggregate trust, considering that the historical score can accumulate and integrate long-term trust information, rather than just based on the interaction during that period, it provides a robust way to calculate and update the trust score.

[0112] 1) Aggregate trust: At time t, to calculate the trust score of NFj, NRF first averages the comprehensive trust reported by the trust evaluation modules of all other service production network elements that interact with NFj, and then weights it with the aggregate trust at time t-1. The aggregate trust is:

[0113]

[0114] where γ 1 +γ 2 =1, representing the weights of the historical aggregate trust and the average of the comprehensive trust. t (j) represents the aggregated trust score of NRF on NFj network element at time t, Score t-1(j) represents the historical aggregated trust score of NRF for NFj network element at time t-1. N represents the number of network elements in the NF set that provide trust in this evaluation.

[0115] 2) Trust classification: NRF uses aggregated trust to perform trust classification to implement trust classification and dynamic access control strategy, as shown in Table 1.

[0116] Table 1 Trust rating

[0117]

[0118] 3) Security decision-making: Based on the trust classification, NRF implements different access control policies for network elements of different levels. Network elements with high trust levels can access all resources and services in the network. Network elements with medium trust levels can only access non-sensitive resources and services. Network elements with low trust levels are subject to strict access control. In addition, NRF can dynamically adjust the trust classification and access control policies based on changes in the network environment and real-time security intelligence. For example, if a security threat is detected in the network, NRF can temporarily increase the threshold of the trust classification and strengthen access control to prevent potential security risks.

[0119] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions of the technical solutions of the present invention made by ordinary technicians in the field should all be included in the protection scope of the present invention. The protection scope of the present invention shall be based on what is defined in the claims.

Claims

1. A 5G core network element behavior trust evaluation method, comprising the following steps: 1) Collect communication data from each network element of the 5G core network; 2) Analyze the collected communication data to determine whether there is an interaction relationship that meets the standards between network elements. If there is no communication relationship between network elements, the baseline trust value is set to zero; 3) For network elements that meet the standard interaction relationship, calculate their baseline trust value; 4) Dynamically adjust the baseline trust value based on the interactive behavior of the network element and calculate the reward and punishment score; 5) Comprehensively calculate the baseline trust value and the reward and punishment score to obtain the comprehensive trust of the network element; 6) Aggregate the comprehensive trust of all service production network elements to a service consumption network element to obtain the aggregated trust; 7) Trust classification is performed based on aggregated trust, and corresponding access control policies are formulated according to the trust classification to determine the operation permissions and resource access levels of network elements.

2. The method according to claim 1, characterized in that The communication data includes interaction information, interaction frequency and interaction success rate between network elements.

3. The method according to claim 1, characterized in that The steps to calculate the baseline trust value include: Use the Bayesian trust evaluation method to calculate the interaction success rate between network elements; Count the number of interactions within the observation time window and calculate the interaction frequency between network elements; The interaction success rate and interaction frequency between network elements are comprehensively considered, different weights are assigned, and the baseline trust value is calculated; The time decay factor is introduced to update the interaction success rate and interaction frequency between network elements, and then update the baseline trust value.

4. The method according to claim 1, characterized in that A reward and punishment mechanism module is constructed based on an autoencoder and a machine learning algorithm. The autoencoder includes an encoder and a decoder. The reward and punishment mechanism module dynamically adjusts the baseline trust value according to the interactive behavior of the network element and calculates the reward and punishment score. The steps for calculating reward and punishment scores in the reward and punishment mechanism module include: Perform truncation and padding preprocessing on data packets; The encoder converts the preprocessed data packets into encoded data in a matrix format suitable for processing by the autoencoder; The decoder reconstructs the encoded data into a data length matrix; Use normal data to train the reward and punishment mechanism module, use reconstruction loss to update the weights and biases in the encoder and decoder, and adjust the hyperparameters; Set a reward and punishment score threshold, compare the reconstruction loss with the threshold, and use the Sigmoid function to map the reconstruction loss to a reward and punishment score.

5. The method according to claim 1, characterized in that When training the reward and punishment mechanism module, the Adam optimizer is used for parameter optimization, and the reconstruction loss is the mean square error (MSE).

6. The method according to claim 1, characterized in that The benchmark trust value and reward and punishment scores are weighted and summed to obtain the comprehensive trust.

7. The method according to claim 1, characterized in that The method for calculating the aggregate trust is: averaging the comprehensive trust of all current service production network elements, and weighted summing it with the historical aggregate trust to obtain the current aggregate trust.

8. The method according to claim 1, characterized in that The following trust levels are made based on the aggregated trust: When the aggregate trust is ≥ 0.9, it is a high trust level; When 0.6≤aggregate trust < 0.9, it is a medium trust level; When the aggregate trust is less than 0.6, it is a low trust level.

9. The method according to claim 8, characterized in that Develop corresponding access control policies based on trust levels, including: For network elements with a high trust level, access to all resources and services is allowed; For network elements with medium trust level, only non-sensitive resources and services are allowed to be accessed; Implement strict access control for network elements with low trust levels.

10. A 5G core network element behavior trust evaluation system, used to implement the method according to any one of claims 1 to 9, characterized in that: Including the trust assessment center module deployed in the NRF network element of the 5G core network and the trust assessment module deployed in other network elements of the 5G core network; The trust evaluation module is used to collect communication data from each network element of the 5G core network; analyze the collected communication data to determine whether there is an interaction relationship that meets the standards between the network elements. If there is no communication relationship between the network elements, the baseline trust value is set to zero; for network elements with interaction relationships that meet the standards, their baseline trust values ​​are calculated; Dynamically adjust the baseline trust value based on the interactive behavior of network elements and calculate reward and punishment scores; The baseline trust value and the reward and punishment score are calculated comprehensively to obtain the comprehensive trust of the network element; The trust evaluation center module is used to aggregate the comprehensive trust of all service production network elements to a service consumption network element to obtain the aggregated trust; Trust classification is performed based on aggregated trust, and corresponding access control policies are formulated according to the trust classification to determine the operation permissions and resource access levels of network elements.

Images