User traffic screening method and device, electronic equipment and storage medium

Abstract

The invention discloses a user traffic screening method and device, electronic equipment and a storage medium, and relates to the technical field of LTE core networks. The method comprises the steps of obtaining a target user identifier of a target user in response to a screening instruction of user traffic of the target user; determining a target control tunnel associated with the target user and bearing identifiers belonging to the target control tunnel; the bearing identifier comprises a default bearing identifier and a special bearing identifier; creating a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel and the target traffic data quintuple; and in response to the screening instruction of the target user traffic, forwarding the target user traffic to the target analysis system under the condition of determining that the target user traffic is matched with the target database. According to the scheme provided by the invention, the flow data generated by the LTE core network can be screened, and a basis is provided for improving the efficiency and accuracy of subsequent data analysis work.

Description

Technical Field

[0001] The present invention relates to the technical field of LTE core network, and in particular to a method, device, electronic device and storage medium for screening user traffic. Background Art

[0002] The main interfaces of the LTE (Long Term Evolution) core network are S11, S1-U, S58-C, and S58-U, of which S11 and S58-C are control plane interfaces, and S1-U and S58-U are user plane interfaces. At present, the log retention system will access the traffic of S11, S1-U, S58-C, and S58-U at the same time, parse the traffic of all users and generate logs for retention; at the same time, these data will be connected to the subsequent analysis system (the analysis system is only interested in the traffic data generated by certain users, for example, the Internet traffic of the target user), which will cause the analysis system to receive too much data, increasing the difficulty of analysis by the analysis system.

[0003] How to filter these traffic data and send them to matching analysis systems is a key research issue in the industry. Summary of the invention

[0004] The present invention provides a method, device, electronic device and storage medium for screening user traffic, so as to screen the traffic data generated by the LTE core network and provide a basis for improving the efficiency and accuracy of subsequent data analysis work.

[0005] According to one aspect of the present invention, a method for screening user traffic is provided, the method comprising:

[0006] In response to a filter instruction for user traffic of a target user, obtaining a target user identifier of the target user;

[0007] Determine a target control tunnel associated with the target user, and each bearer identifier belonging to the target control tunnel; the bearer identifier includes a default bearer identifier and a dedicated bearer identifier;

[0008] Creating a target database based on the target control tunnel, a bearer identifier belonging to the target control tunnel, and a target traffic data quintuple;

[0009] In response to the screening instruction of the target user traffic, when it is determined that the target user traffic matches the target database, the target user traffic is forwarded to the target analysis system.

[0010] According to another aspect of the present invention, there is provided a user traffic screening device, the device comprising:

[0011] A user identification acquisition module, configured to acquire a target user identification of a target user in response to a filter instruction of a user flow of a target user;

[0012] A determination module, used to determine a target control tunnel associated with the target user, and each bearer identifier belonging to the target control tunnel; the bearer identifier includes a default bearer identifier and a dedicated bearer identifier;

[0013] A database creation module, used to create a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple;

[0014] The user traffic screening module is used to respond to the screening instruction of the target user traffic and forward the target user traffic to the target analysis system when it is determined that the target user traffic matches the target database.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the user traffic screening method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the user traffic screening method described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for screening user traffic according to any embodiment of the present invention is implemented.

[0021] The technical solution of the embodiment of the present invention obtains the target user identifier of the target user by responding to the screening instruction of the user traffic of the target user; determines the target control tunnel associated with the target user, and each bearer identifier belonging to the target control tunnel; the bearer identifier includes a default bearer identifier and a dedicated bearer identifier; creates a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple; responds to the screening instruction of the target user traffic, and forwards the target user traffic to the target analysis system when it is determined that the target user traffic matches the target database, so as to screen the traffic data generated by the LTE core network and provide a basis for improving the efficiency and accuracy of subsequent data analysis work.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a flow chart of a method for screening user traffic provided according to Embodiment 1 of the present invention;

[0025] Figure 2 This is a schematic diagram of the relationship between a control tunnel, a default bearer, and a dedicated bearer provided according to Embodiment 1 of the present invention;

[0026] Figure 3 is a flow chart of a method for screening user traffic provided according to Embodiment 2 of the present invention;

[0027] Figure 4 is a structural schematic diagram of a user traffic screening device provided according to Embodiment 3 of the present invention;

[0028] Figure 5 It is a structural schematic diagram of an electronic device for implementing the method for screening user traffic according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 This is a flowchart of a method for filtering user traffic provided by Embodiment 1 of the present invention. This embodiment is applicable to filtering traffic data generated by an LTE core network. The method can be performed by a user traffic filtering device, which can be implemented in the form of hardware and / or software. The user traffic filtering device can be configured in electronic devices such as computers, servers, or tablet computers. Figure 1 As shown, the method includes:

[0033] Step 110: In response to a filter instruction for user traffic of a target user, a target user identifier of the target user is obtained.

[0034] The target user may be any user accessing the LTE core network, which is not limited in this embodiment.

[0035] Among them, the target user identifier of the target user can be the mobile phone number of the target user, or other parameters that can uniquely identify the target user, such as the user name or registration identifier in the registration information of the target user, etc., which is not limited in this embodiment.

[0036] It can be understood that in the LTE core network, what is transmitted in the user plane interface is the user's Internet traffic; therefore, after receiving the target user's Internet traffic screening instruction, the Internet traffic data transmitted by the LTE core network through the user plane interfaces S1-U and S58-U can be obtained, and further the Internet traffic data can be screened or diverted.

[0037] In an optional implementation of this embodiment, after receiving the instruction to filter the Internet traffic of the target user, the received filtering instruction may be further parsed to obtain the target user identifier of the target user.

[0038] Optionally, in this embodiment, obtaining the target user identifier of the target user may include: obtaining an attachment request and / or a PDN (Packet Data Network, creating a specific packet data network) connection request of the target user; and determining the target user identifier of the target user based on the attachment request and / or the PDN connection request.

[0039] In this embodiment, a user device, such as a mobile phone, triggers a create session (CreateSession) process of the S11 and S58-C interfaces in the LTE core network during processes such as attachment and creation of a PDN connection; the CreateSession process may carry information such as a mobile phone number, an initial location, and a default bearer identifier.

[0040] In an optional implementation of this embodiment, after receiving a filtering instruction for the target user's Internet traffic, the attachment request related to the target user and the session creation process in the PDN connection request can be further obtained, and the request for creating the session process can be parsed to obtain the target user's mobile phone number; further, the target user's mobile phone number can be determined as the target user identifier of the target user.

[0041] Step 120: Determine a target control tunnel associated with the target user and each bearer identifier belonging to the target control tunnel.

[0042] The bearer identifier includes a default bearer identifier and a dedicated bearer identifier.

[0043] Optionally, in an optional implementation of the present embodiment, after receiving a filtering instruction for the target user's Internet traffic, the target control tunnel associated with the target user and the bearer identifiers matching each target control tunnel can be further determined; it can be understood that a control tunnel can be associated with multiple default bearers, and a default bearer can be associated with multiple dedicated bearers, that is, there can be multiple default bearers belonging to the target control tunnel and multiple dedicated bearers belonging to the default bearer at the same time, for example, 2, 3 or 10, etc., which are not limited in the present embodiment.

[0044] For example, Figure 2 is a schematic diagram of the relationship between a control tunnel, a default bearer and a dedicated bearer provided according to the first embodiment of the present invention; Figure 2 As shown, the target control tunnel may include control tunnel 1, control tunnel 2 and control tunnel 3; wherein, control tunnel 1 is associated with two default bearers, namely default bearer id=5 and default bearer id=6; default bearer id=5 is associated with two dedicated bearers, namely dedicated bearer id=8 and dedicated bearer id=9; default bearer id=6 is associated with dedicated bearer id=11; control tunnel 2 is associated with one default bearer, namely default bearer id=5; default bearer id=5 is associated with dedicated bearer id=13; control tunnel 3 is associated with one default bearer, namely default bearer id=5.

[0045] In an optional implementation of this embodiment, after receiving the filtering instruction of the target user's Internet traffic, the attachment request related to the target user and the creation session process in the PDN connection request can be further obtained, and the response to the creation session process can be parsed to obtain the information of the target user's GW side tunnel and the default bearer identifier.

[0046] Optionally, in this embodiment, determining the target control tunnel associated with the target user and each bearer identifier belonging to the target control tunnel may include: obtaining a first creation session process matching the attachment request, and determining the first uplink and downlink tunnels created in the first creation session process, and the first bearer identifier; determining the first uplink and downlink tunnels as the target control tunnel, and determining the first bearer identifier as the default bearer identifier belonging to the target control tunnel; or, obtaining a second creation session process matching the PDN connection request, and determining the second uplink and downlink tunnels created in the second creation session process, and the second bearer identifier; determining the second uplink and downlink tunnels as the target control tunnel, and determining the second bearer identifier as the default bearer identifier belonging to the target control tunnel; obtaining a dedicated bearer activation process, and obtaining a dedicated bearer identifier associated with the default bearer identifier in the dedicated bearer activation process.

[0047] In an optional implementation of this embodiment, a first session creation process matching the attachment request of the target user's mobile device may be obtained; specifically, when the request and response of the first session creation process are received, the user identifier may be extracted from the Create Session Request; the default bearer identifier (EBI (EPC Bearer Identify, user plane bearer identifier) ​​may be extracted from the Create Session Response; one EBI may correspond to one user plane downlink and downlink tunnel, exemplarily,

[0048] Ip1+teid1←←ip2+teid2; wherein, Ip2+teid2 is called the uplink tunnel identifier;), in this embodiment, the default bearer identifier is called the first bearer identifier; and GW side tunnel information (for example, TEID or creation time), in this embodiment, the GW side tunnel is called the first uplink tunnel, further, the acquired first uplink tunnel can be determined as the target control tunnel, and the first bearer identifier is determined as the default bearer identifier belonging to the target control tunnel.

[0049] It should be noted that in this embodiment, the user name interfaces S1U and S58-U are not distinguished, and the eNB on the AC side replaces the S1U and the SGW-U on the S58-U, and the SGW-U on the GW side replaces the S1U and the PGW-U on the S58-U; in this embodiment, only the GW side tunnel is taken as an example for illustration, which is not a limitation of this embodiment.

[0050] In another optional implementation of this embodiment, a second session creation process that matches the PDN connection request of the target user's mobile device can be obtained; specifically, when the request and response of the second session creation process are received, the user identifier can be extracted from the Create Session Request; the default bearer identifier (EBI) can be extracted from the Create Session Response, and the default bearer identifier is referred to as the second bearer identifier in this embodiment; and GW side tunnel information (for example, TEID or creation time), and the GW side tunnel is referred to as the second uplink and downlink tunnel in this embodiment. Further, the obtained second uplink and downlink tunnel can be determined as the target control tunnel, and the second bearer identifier can be determined as the default bearer identifier belonging to the target control tunnel.

[0051] Optionally, in this embodiment, after the first bearer identifier and the second bearer identifier are determined as default bearer identifiers based on the above steps, the dedicated bearer activation process can continue to be obtained; specifically, the default bearer identifier (for example, EBI=5) can be found in the Create BearerRequest message; further, the newly created dedicated bearer identifier (for example, EBI=7) can be extracted in the Create BearerResponse message; further, the default bearer identifier can be associated with the dedicated bearer identifier to form a mapping relationship, that is, the default bearer EBI=5 corresponds to the dedicated bearer EBI=7.

[0052] Step 130: Create a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple.

[0053] Among them, the target traffic data quintuple may include: source IP (Internet Protocol) address, which is the IP address of the data packet sender; destination IP address, which is the IP address of the data packet receiver; source port, which is the port number used by the sender's application; destination port, which is the port number used by the receiver's application; transport layer protocol, for example, TCP (Transmission Control Protocol) or UDP (User Datagram Protocol), etc.

[0054] Optionally, in this embodiment, after determining the five-tuple of the target control tunnel, the default bearer identifiers belonging to the target control tunnel, the dedicated bearer identifier associated with each default bearer identifier, and the target traffic data, a target database can be further created based on the five-tuple of the target control tunnel, the default bearer identifiers belonging to the target control tunnel, the dedicated bearer identifier associated with each default bearer identifier, and the target traffic data.

[0055] Exemplarily, the identifier of the target control tunnel, the default bearer identifiers belonging to the target control tunnel, and the dedicated bearer identifier associated with each default bearer identifier can be stored in the first data table; the tunnel identifier of the GW side user name tunnel created based on the default bearer identifier or the dedicated bearer identifier in the first data table is stored in the second data table; the Internet access process initiated by the target user under the user plane tunnel recorded in the second data table (represented based on a five-tuple) is added to the third data table; further, the first data table, the second data table and the third data table are combined to obtain the target database.

[0056] Step 140: In response to the target user traffic screening instruction, if it is determined that the target user traffic matches the target database, forward the target user traffic to a target analysis system.

[0057] Optionally, in this embodiment, after receiving the target user traffic through the user plane interfaces S1U and S58-U of the LTE core network, the target user traffic can be parsed to determine the quintuple of the target user traffic or the target user plane tunnel identifier; further, the quintuple of the target user traffic can be compared with the quintuple of the target traffic data stored in the target database, or the target user plane tunnel identifier can be compared with the default bearer identifier or dedicated bearer identifier stored in the target database, so as to determine whether to forward the target user traffic to the target analysis system based on the comparison results.

[0058] The technical solution of this embodiment obtains the target user identifier of the target user by responding to the filtering instruction of the user traffic of the target user; determines the target control tunnel associated with the target user, and each bearer identifier belonging to the target control tunnel; the bearer identifier includes a default bearer identifier and a dedicated bearer identifier; creates a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple; responds to the filtering instruction of the target user traffic, and forwards the target user traffic to the target analysis system when it is determined that the target user traffic matches the target database, so as to filter the traffic data generated by the LTE core network, and provide a basis for improving the efficiency and accuracy of subsequent data analysis work.

[0059] Embodiment 2

[0060] Figure 3 1 is a flowchart of a method for screening user traffic according to Embodiment 2 of the present invention. This embodiment is a further refinement of the above technical solution. The technical solution in this embodiment can be combined with each optional solution in one or more of the above embodiments. Figure 3 As shown, the method includes:

[0061] Step 310: In response to a filter instruction for user traffic of a target user, obtain a target user identifier of the target user.

[0062] Step 320: Determine a target control tunnel associated with the target user and each bearer identifier belonging to the target control tunnel.

[0063] Optionally, in this embodiment, while obtaining the first session creation process matching the attachment request and determining the first uplink and downlink tunnels created in the first session creation process and the first bearer identifier, and obtaining the second session creation process matching the PDN connection request and determining the second uplink and downlink tunnels created in the second session creation process and the second bearer identifier, or after obtaining the first session creation process matching the attachment request and determining the first uplink and downlink tunnels created in the first session creation process and the first bearer identifier, and obtaining the second session creation process matching the PDN connection request and determining the second uplink and downlink tunnels created in the second session creation process and the second bearer identifier, it is also possible to obtain the first session deletion process matching the attachment request, or obtain the second session deletion process matching the PDN connection request; obtain attribute information of the first session creation process, the first session deletion process, the second session creation process and the first session deletion process respectively; and determine the creation time and deletion time of each target control tunnel according to each attribute information.

[0064] Among them, the attribute information may include the user identifier, tunnel identifier, default bearer identifier, creation time or deletion time of each session process, etc.; exemplarily, the first session creation process may include: user identifier, tunnel identifier, at least one default bearer identifier and the creation time of the first session creation process; the first session deletion process may include: user identifier, tunnel identifier, at least one default bearer identifier and the deletion time of the first session deletion process.

[0065] In an optional implementation of this embodiment, in the process of determining the target control tunnel associated with the target user and the default bearer identifiers matching the target control tunnel, attribute information of each creation session or deletion session can also be obtained. Furthermore, the creation time and deletion time of the target control tunnel can be determined based on the acquired attribute information.

[0066] It should be noted that in the process of creating a session, during the attachment request of the target user's mobile phone, the LTE core network will create uplink and downlink tunnels for the mobile phone on the control plane interface S11 and S58-C, and allocate a default bearer and id; for example: id=5. When the target user's mobile phone creates a PDN connection request, the uplink and downlink tunnels of S11 and S58-C will be created for the mobile phone (in this process, the attachment process may be reused) and the default bearer id will be allocated; for example: id=6; it is understandable that the same mobile phone of the target user may create multiple PDN connections; therefore, under one control tunnel of S11 / S58-C, multiple default bearers may be attached.

[0067] It should also be noted that in the process of deleting a session, if the default bearer identifier is not carried, it means deleting all default bearers under the control tunnel and deleting the control tunnel; if the default bearer identifier is carried, it means deleting the default bearer of the default bearer identifier. When multiple deletion sessions carrying the default bearer identifier cause all default bearers to be deleted, the control tunnel needs to be automatically deleted.

[0068] It is understandable that the mobile phone number carries the control plane tunnel assigned in CreateSession. The target user can be filtered and the control plane tunnel of the target user can be learned. At the same time, the default bearer is assigned in CreateSession. The default bearer of the target user can be learned. In the control tunnel, a dedicated bearer is created through CreateBear. The dedicated bearer of the target user can be learned. The user's Internet traffic is transmitted in the default bearer or the dedicated bearer. Therefore, the Internet traffic of the target user can be filtered out in the end.

[0069] Step 330: Create a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple.

[0070] Optionally, in this embodiment, creating a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple can include: storing the target control tunnel, the default bearer identifier belonging to the target control tunnel, the dedicated bearer identifier corresponding to the default bearer identifier, the creation time and deletion time of the target control tunnel, and the target traffic data quintuple to be screened in the target area to obtain a target database; wherein the target traffic data quintuple includes: original address, destination address, source port, destination port and transmission protocol.

[0071] In an optional implementation method of the present embodiment, after obtaining the target control tunnel, the default bearer identifier belonging to the target control tunnel, the dedicated bearer identifier of the dedicated bearer identifier corresponding to the default bearer identifier, the creation time and deletion time of the target control tunnel, and the target traffic data quintuple to be screened, the target control tunnel, the default bearer identifier belonging to the target control tunnel, the dedicated bearer identifier of the dedicated bearer identifier corresponding to the default bearer identifier, the creation time and deletion time of the target control tunnel, and the target traffic data quintuple to be screened can be further added to the database to obtain the target database.

[0072] Exemplarily, in this embodiment, after determining to obtain the above data, the tunnel identifier, creation time, deletion time, default bearer identifier belonging to the target control tunnel, and dedicated bearer identifier corresponding to the default bearer identifier of the target control tunnel can be further added to the first data table; the tunnel identifier of the user plane tunnel created based on the default bearer identifier or dedicated bearer identifier in the first data table is added to the second data table; the Internet access process initiated by the target user under the user plane tunnel recorded in the second data table (represented based on the five-tuple) is added to the third data table; the first data table, the second data table and the third data table are stored in the target area together to obtain a target database. Step 340, parse the target user traffic to obtain a target five-tuple matching the target user traffic; compare the target five-tuple with the target traffic data five-tuple stored in the target database to obtain a comparison result; if it is determined according to the comparison result that the target five-tuple is consistent with the target traffic data five-tuple stored in the target database, forward the target user traffic to the target analysis system.

[0073] In an optional implementation of the present embodiment, after constructing a target database associated with a target user, if the user plane interface receives a target user traffic data packet, the target user traffic data packet can be further parsed to obtain a target quintuple in the target user traffic data packet, that is, to obtain the source address, destination address, source port, destination port and transmission protocol of the target user traffic data; further, it can be determined whether the target quintuple matches the target traffic data quintuple recorded in the third data table in the target database; if it is determined that the target quintuple is consistent with the target traffic data quintuple recorded in the third data table in the target database, it can be determined that the target quintuple matches the target traffic data quintuple recorded in the third data table in the target database, and further, the target user traffic can be forwarded to a target analysis system.

[0074] Furthermore, the target analysis system can perform subsequent analysis and processing on the received traffic data packets of each target user; for example, if the traffic data packets of each target user contain the Internet access information of the target user, then the target analysis system can determine the Internet access habits of the target user by analyzing the Internet access information.

[0075] Step 350: When it is determined based on the comparison result that the target quintuple is inconsistent with the target traffic data quintuple stored in the target database, determine the target user plane tunnel identifier of the target user traffic; determine whether the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the target database; when it is determined that the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the target database, forward the target user traffic to the target analysis system and add the target quintuple to the target database.

[0076] The target user plane tunnel identifier includes: an access side (AC side) user plane tunnel identifier and a gateway side (GW side) user plane tunnel identifier.

[0077] It can be understood that, in this embodiment, the target control tunnel stored in the target database is an uplink tunnel; however, during the target user traffic screening process, the uplink and downlink tunnels of the target user traffic are matched with the tunnel identifiers stored in the database respectively.

[0078] In an optional implementation of the present embodiment, when it is determined based on the comparison result that the target quintuple is inconsistent with the target traffic data quintuple stored in the target database, that is, it is determined that the target quintuple is inconsistent with the target traffic data quintuple recorded in the third data table in the target database, then the target user plane tunnel identifier can be further determined based on the analysis result of the target user traffic; further, it can be determined whether the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the second data table of the target database; if it is determined that the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the second data table of the target database, the target user traffic can be further forwarded to the target analysis system; at the same time, the target quintuple can also be added to the third data table of the target database, and the target database can be updated; in this way, when user traffic consistent with the target quintuple is subsequently obtained, the user traffic can be directly forwarded to the target analysis system, thereby improving the efficiency of traffic screening.

[0079] According to the solution of this embodiment, after constructing a target database associated with a target user, if target user traffic is received, the target user traffic can be parsed to obtain a target five-tuple matching the target user traffic; the target five-tuple is compared with the target traffic data five-tuple stored in the target database to obtain a comparison result; if it is determined according to the comparison result that the target five-tuple is consistent with the target traffic data five-tuple stored in the target database, the target user traffic is forwarded to a target analysis system; if it is determined according to the comparison result that the target five-tuple is inconsistent with the target traffic data five-tuple stored in the target database, the target user plane tunnel identifier of the target user traffic is determined; it is determined whether the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the target database; if it is determined that the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the target database, the target user traffic is forwarded to the target analysis system, and the target five-tuple is added to the target database; each target user traffic can be screened based on the target database, and the target data used for analysis by the target analysis system can be obtained, providing a basis for obtaining the analysis results quickly and accurately in the future.

[0080] In order to better understand the method for screening user traffic involved in this embodiment, a specific example is used below to describe the implementation of this solution:

[0081] 1) Database:

[0082] The database may include: uplink control tunnel: at least one default bearer EBI; uplink data tunnel: default bearer, with a dedicated bearer under the default bearer; Internet traffic quintuple:

[0083] The database contains different data tables: the uplink control tunnel table, which stores the GW-side control tunnel of the target user (the control tunnel needs to record the default bearer ID and its dedicated bearer ID); the uplink data tunnel table, which stores the GW-side user plane tunnel created under the control tunnel in the uplink control tunnel table; and the Internet access traffic five-tuple table, which stores the Internet access process initiated by the target user under the user plane tunnel in the uplink data tunnel table. Each Internet access process is represented by a five-tuple.

[0084] It can be understood that in this embodiment, the uplink control tunnel table stores the uplink control tunnel of the target user, the identifiers of each user plane bearer of the target user, and the uplink tunnel of each user plane bearer identifier; the uplink data tunnel table stores the uplink tunnel of the user plane bearer identifier of the target user; and the Internet traffic quintuple table stores the Internet traffic quintuple of the target user.

[0085] 2) Addition:

[0086] Specifically, the default bearer can be learned in CreateSession; check whether the mobile phone number in CreateSession is the target user; if so, learn the GW-side control tunnel and insert it into the uplink control tunnel table (the control tunnel records its default bearer id); learn the GW-side user plane tunnel of the default bearer and insert it into the uplink data tunnel table; if not, no further processing; learn the dedicated bearer in Createbear (CreatBear / DeleteBear is initiated by the GW side), cache the request / response; CreateBearReq takes the downlink control tunnel from the GW side to the AC side and needs to be cached. Its corresponding CreateBearResp takes the uplink control tunnel from the AC side to the GW side, and checks whether the uplink control tunnel hits the uplink control tunnel table; if it hits, insert the carried dedicated bearer GW-side user plane tunnel into the uplink data tunnel table. And update the uplink control tunnel table (the default bearer id records its dedicated bearer id); if it does not hit, no further processing.

[0087] 3) Modifications:

[0088] Specifically, the downlink control / data tunnel is modified in ModifyBear, so it can be ignored; the AC side tunnel is easy to change, so we record the GW side tunnel. Therefore, the uplink control tunnel table and the uplink data tunnel table only involve addition and deletion, not modification.

[0089] 4) Delete:

[0090] Specifically, in the DeleteBear process, the dedicated bearer is deleted; DeleteBearReq goes through the downlink control tunnel from the GW side to the AC side, which needs to be cached. Its corresponding DeleteBearResp goes through the uplink control tunnel from the AC side to the GW side, and checks whether the uplink control tunnel hits the uplink control tunnel table; if it hits, the GW side user plane tunnel corresponding to the carried dedicated bearer id is deleted from the uplink data tunnel table. And update the uplink control tunnel table (the default bearer id deletes its dedicated bearer id); if it does not hit, no further processing.

[0091] In the process of deleting a session, DeleteSession deletes a single default bearer and its downstream dedicated bearers, and deletes all bearers; checks whether the control tunnel taken by DeletSession hits the uplink control tunnel table; if it hits, if it carries the default bearer id, delete the default bearer tunnel from the uplink data tunnel table, delete the dedicated bearer under the default bearer, and update the uplink control tunnel table (delete the default bearer id, and the dedicated bearer id under it); if it does not carry the default bearer id, delete the control tunnel from the uplink control tunnel table, and delete all bearers of the control tunnel from the uplink data tunnel table; if it does not hit, no further processing.

[0092] 5) Filter Internet traffic:

[0093] Specifically, the five-tuple of Internet traffic can be parsed to check whether it is in the five-tuple table of Internet traffic; if so, the traffic is forwarded to the directional analysis system; if not, the AC-side and GW-side user plane tunnels of Internet traffic are parsed. Check whether one of the tunnels on both sides is in the uplink data tunnel table; if so, the five-tuple is inserted into the five-tuple table of Internet traffic; if not, no further processing is performed.

[0094] The solution of this embodiment can filter the Internet traffic of certain 4G users from the S1U and S58-U user plane interfaces and output it to a directional traffic analysis system, thereby reducing the traffic processing pressure of the directional analysis system.

[0095] Embodiment 3

[0096] Figure 4 Schematic diagram of a user flow screening device according to Embodiment 3 of the present invention. Figure 4 As shown, the device includes: a user identification acquisition module 410, a determination module 420, a database creation module 430 and a user traffic screening module 440.

[0097] The user identification acquisition module 410 is used to obtain the target user identification of the target user in response to the filter instruction of the user traffic of the target user;

[0098] The determination module 420 is used to determine the target control tunnel associated with the target user and each bearer identifier belonging to the target control tunnel; the bearer identifier includes a default bearer identifier and a dedicated bearer identifier;

[0099] A database creation module 430, configured to create a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple;

[0100] The user traffic screening module 440 is used to respond to the screening instruction of the target user traffic and forward the target user traffic to the target analysis system when it is determined that the target user traffic matches the target database.

[0101] The solution of this embodiment is to obtain the target user identifier of the target user by the user identifier acquisition module in response to the filtering instruction of the user traffic of the target user; to determine the target control tunnel associated with the target user and each bearer identifier belonging to the target control tunnel by the determination module 420; the bearer identifier includes a default bearer identifier and a dedicated bearer identifier; to create a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple by the database creation module; to respond to the filtering instruction of the target user traffic by the user traffic filtering module, and when it is determined that the target user traffic matches the target database, the target user traffic is forwarded to the target analysis system, so that the traffic data generated by the LTE core network can be filtered, providing a basis for improving the efficiency and accuracy of subsequent data analysis work.

[0102] In an optional implementation of this embodiment, the user identification acquisition module 410 is specifically used to obtain the target user's attachment request and / or create a specific packet data network PDN connection request;

[0103] A target user identifier of the target user is determined based on the attach request and / or the PDN connection request.

[0104] In an optional implementation of this embodiment, the determination module 420 is specifically configured to obtain a first session creation process matching the attachment request, and determine a first uplink and downlink tunnel created in the first session creation process, and a first bearer identifier;

[0105] Determine the first uplink and downlink tunnel as a target control tunnel, and determine the first bearer identifier as a default bearer identifier belonging to the target control tunnel;

[0106] or,

[0107] Acquire a second session creation process that matches the PDN connection request, and determine a second uplink and downlink tunnel created in the second session creation process, and a second bearer identifier;

[0108] Determine the second uplink and downlink tunnel as a target control tunnel, and determine the second bearer identifier as a default bearer identifier belonging to the target control tunnel;

[0109] A dedicated bearer activation process is obtained, and a dedicated bearer identifier associated with the default bearer identifier in the dedicated bearer activation process is obtained.

[0110] In an optional implementation of this embodiment, the user traffic screening device further includes: an attribute information determination module for

[0111] Acquire a first session deletion process that matches the attach request, or acquire a second session deletion process that matches the PDN connection request, or acquire a bearer deletion process;

[0112] Respectively obtain the attribute information of the first create session process, the first delete session process, the second create session process, the first delete session process, and the bearer delete process;

[0113] The creation time and deletion time of each target control tunnel are determined according to each attribute information.

[0114] In an optional implementation of this embodiment, the database creation module 430 is specifically used to store the target control tunnel, the default bearer identifier belonging to the target control tunnel, the dedicated bearer identifier corresponding to the default bearer identifier, the creation time and deletion time of the target control tunnel, and the target traffic data to be screened into the target area to obtain a target database;

[0115] The target traffic data quintuple includes: source address, destination address, source port, destination port and transmission protocol.

[0116] In an optional implementation of this embodiment, the user traffic screening module 440 is specifically used to parse the target user traffic to obtain a target five-tuple matching the target user traffic;

[0117] Compare the target quintuple with the target traffic data quintuple stored in the target database to obtain a comparison result;

[0118] When it is determined according to the comparison result that the target quintuple is consistent with the target traffic data quintuple stored in the target database, the target user traffic is forwarded to the target analysis system.

[0119] In an optional implementation of this embodiment, the user traffic screening module 440 is further specifically configured to determine the target user plane tunnel identifier of the target user traffic when it is determined according to the comparison result that the target quintuple is inconsistent with the target traffic data quintuple stored in the target database;

[0120] Determine whether the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the target database, and if it is determined that the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the target database, forward the target user traffic to the target analysis system, and add the target quintuple to the target database;

[0121] The target user plane tunnel identifier includes: an access side user plane tunnel identifier and a gateway side user plane tunnel identifier.

[0122] The user traffic screening device provided in the embodiment of the present invention can execute the user traffic screening method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0123] Embodiment 4

[0124] Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0125] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0126] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0127] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a method for screening user traffic, the method comprising: in response to a screening instruction of user traffic of a target user, obtaining a target user identifier of the target user; determining a target control tunnel associated with the target user, and each bearer identifier belonging to the target control tunnel; the bearer identifier includes a default bearer identifier and a dedicated bearer identifier; creating a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple; in response to a screening instruction of the target user traffic, forwarding the target user traffic to a target analysis system when it is determined that the target user traffic matches the target database.

[0128] In some embodiments, the method for screening user traffic may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for screening user traffic described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the method for screening user traffic in any other appropriate manner (e.g., by means of firmware).

[0129] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0130] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0131] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0132] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0133] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0134] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0135] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0136] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for screening user traffic, characterized in that: include: In response to a filter instruction for user traffic of a target user, obtaining a target user identifier of the target user; Determine a target control tunnel associated with the target user, and each bearer identifier belonging to the target control tunnel; the bearer identifier includes a default bearer identifier and a dedicated bearer identifier; Creating a target database based on the target control tunnel, a bearer identifier belonging to the target control tunnel, and a target traffic data quintuple; In response to the screening instruction of the target user traffic, when it is determined that the target user traffic matches the target database, the target user traffic is forwarded to the target analysis system.

2. The method for screening user traffic according to claim 1, characterized in that: The step of obtaining a target user identifier of the target user includes: Obtaining an attachment request of the target user and / or a request to create a specific packet data network PDN connection; A target user identifier of the target user is determined based on the attach request and / or the PDN connection request.

3. The method for screening user traffic according to claim 2, characterized in that: The determining of the target control tunnel associated with the target user and the bearer identifiers belonging to the target control tunnel includes: Acquire a first session creation process that matches the attachment request, and determine a first uplink and downlink tunnel created in the first session creation process, and a first bearer identifier; Determine the first uplink and downlink tunnel as a target control tunnel, and determine the first bearer identifier as a default bearer identifier belonging to the target control tunnel; or, Acquire a second session creation process that matches the PDN connection request, and determine a second uplink and downlink tunnel created in the second session creation process, and a second bearer identifier; Determine the second uplink and downlink tunnel as a target control tunnel, and determine the second bearer identifier as a default bearer identifier belonging to the target control tunnel; A dedicated bearer activation process is obtained, and a dedicated bearer identifier associated with the default bearer identifier in the dedicated bearer activation process is obtained.

4. The method for screening user traffic according to claim 3, characterized in that: The method further comprises: Acquire a first session deletion process that matches the attach request, or acquire a second session deletion process that matches the PDN connection request, or acquire a bearer deletion process; Respectively obtain the attribute information of the first create session process, the first delete session process, the second create session process, the first delete session process, and the bearer delete process; The creation time and deletion time of each target control tunnel are determined according to each attribute information.

5. The method for screening user traffic according to claim 4, characterized in that: The creating a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple includes: The target control tunnel, the default bearer identifier belonging to the target control tunnel, the dedicated bearer identifier corresponding to the default bearer identifier, the creation time and deletion time of the target control tunnel, and the target traffic data to be screened are stored in the target area to obtain a target database; The target traffic data quintuple includes: source address, destination address, source port, destination port and transmission protocol.

6. The method for screening user traffic according to claim 1, characterized in that: The method of responding to the target user traffic screening instruction and forwarding the target user traffic to the target analysis system when it is determined that the target user traffic matches the target database includes: Parsing the target user traffic to obtain a target five-tuple matching the target user traffic; Compare the target quintuple with the target traffic data quintuple stored in the target database to obtain a comparison result; When it is determined according to the comparison result that the target quintuple is consistent with the target traffic data quintuple stored in the target database, the target user traffic is forwarded to the target analysis system.

7. The method for screening user traffic according to claim 6, characterized in that: The method further comprises: In the case where it is determined according to the comparison result that the target quintuple is inconsistent with the target traffic data quintuple stored in the target database, determining a target user plane tunnel identifier for the target user traffic; Determine whether the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the target database, and if it is determined that the target user plane tunnel identifier is consistent with the user plane tunnel identifier stored in the target database, forward the target user traffic to the target analysis system, and add the target quintuple to the target database; The target user plane tunnel identifier includes: an access side user plane tunnel identifier and a gateway side user plane tunnel identifier.

8. A user traffic screening device, characterized in that: include: A user identification acquisition module, configured to acquire a target user identification of a target user in response to a filter instruction of a user flow of a target user; A determination module, used to determine a target control tunnel associated with the target user, and each bearer identifier belonging to the target control tunnel; the bearer identifier includes a default bearer identifier and a dedicated bearer identifier; A database creation module, used to create a target database based on the target control tunnel, the bearer identifier belonging to the target control tunnel, and the target traffic data quintuple; The user traffic screening module is used to respond to the screening instruction of the target user traffic and forward the target user traffic to the target analysis system when it is determined that the target user traffic matches the target database.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the user traffic screening method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the user traffic screening method according to any one of claims 1 to 7 when executed.

Images