User traffic screening method and device, electronic equipment and storage medium

Abstract

The invention discloses a user traffic screening method and device, electronic equipment and a storage medium, and relates to the technical field of LTE core networks. Comprising the following steps: in response to a screening instruction of signaling traffic of a target user, obtaining a target user identifier of the target user; determining a target control tunnel associated with the target user and at least one default bearer identifier belonging to the target control tunnel; creating a target database based on the target control tunnel and a default bearer identifier belonging to the target control tunnel; and in response to a screening instruction of a target signaling traffic request packet, forwarding the target signaling traffic request packet to a target analysis system under the condition of determining that a target uplink tunnel of the target signaling traffic request packet is matched with each target control tunnel in the target database. According to the scheme provided by the invention, the flow data generated by the LTE core network can be screened, and a basis is provided for improving the efficiency and accuracy of subsequent data analysis work.

Description

Technical Field

[0001] The present invention relates to the technical field of LTE core network, and in particular to a method, device, electronic device and storage medium for screening user traffic. Background Art

[0002] The main interfaces of the LTE (Long Term Evolution) core network are S11, S1-U, S58-C, and S58-U, of which S11 and S58-C are control plane interfaces, and S1-U and S58-U are user plane interfaces. At present, the log retention system will access the traffic of S11, S1-U, S58-C, and S58-U at the same time, parse the traffic of all users and generate logs for retention; at the same time, these data will be connected to the subsequent analysis system (the analysis system is only interested in the traffic data generated by certain users, such as the location information of the target user), which will cause the analysis system to receive too much data, increasing the difficulty of analysis of the analysis system.

[0003] How to filter these traffic data and send them to matching analysis systems is a key research issue in the industry. Summary of the invention

[0004] The present invention provides a method, device, electronic device and storage medium for screening user traffic, so as to screen the traffic data generated by the LTE core network and provide a basis for improving the efficiency and accuracy of subsequent data analysis work.

[0005] According to one aspect of the present invention, a method for screening user traffic is provided, the method comprising:

[0006] In response to a filter instruction of the signaling traffic of the target user, obtaining a target user identifier of the target user;

[0007] Determining a target control tunnel associated with the target user and at least one default bearer identifier belonging to the target control tunnel;

[0008] Creating a target database based on the target control tunnel and a default bearer identifier belonging to the target control tunnel;

[0009] In response to a screening instruction of a target signaling traffic request packet, when it is determined that a target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database, the target signaling traffic request packet is forwarded to a target analysis system.

[0010] According to another aspect of the present invention, there is provided a user traffic screening device, the device comprising:

[0011] A target user identification acquisition module, used to obtain a target user identification of the target user in response to a screening instruction of the signaling traffic of the target user;

[0012] A target control tunnel determination module, used to determine a target control tunnel associated with the target user, and at least one default bearer identifier belonging to the target control tunnel;

[0013] A target database creation module, used to create a target database based on the target control tunnel and a default bearer identifier belonging to the target control tunnel;

[0014] The signaling traffic forwarding module is used to respond to the screening instruction of the target signaling traffic request packet, and forward the target signaling traffic request packet to the target analysis system when it is determined that the target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database.

[0015] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the user traffic screening method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the user traffic screening method described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for screening user traffic according to any embodiment of the present invention is implemented.

[0021] The technical solution of the embodiment of the present invention obtains the target user identifier of the target user by responding to the screening instruction of the signaling traffic of the target user; determines the target control tunnel associated with the target user, and at least one default bearer identifier belonging to the target control tunnel; creates a target database based on the target control tunnel and the default bearer identifier belonging to the target control tunnel; responds to the screening instruction of the target signaling traffic request packet, and forwards the target signaling traffic request packet to the target analysis system when it is determined that the target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database; the traffic data generated by the LTE core network can be screened, providing a basis for improving the efficiency and accuracy of subsequent data analysis work.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a flow chart of a method for screening user traffic provided according to Embodiment 1 of the present invention;

[0025] Figure 2 is a flow chart of a method for screening user traffic provided according to Embodiment 2 of the present invention;

[0026] Figure 3 is a schematic diagram of a relationship between a control tunnel and a default bearer provided according to Embodiment 2 of the present invention;

[0027] Figure 4 is a structural schematic diagram of a user traffic screening device provided according to Embodiment 3 of the present invention;

[0028] Figure 5 It is a structural schematic diagram of an electronic device for implementing the method for screening user traffic according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 This is a flowchart of a method for filtering user traffic provided by Embodiment 1 of the present invention. This embodiment is applicable to filtering traffic data generated by an LTE core network. The method can be performed by a user traffic filtering device, which can be implemented in the form of hardware and / or software. The user traffic filtering device can be configured in electronic devices such as computers, servers, or tablet computers. Figure 1 As shown, the method includes:

[0033] Step 110: In response to a filter instruction for signaling traffic of a target user, obtain a target user identifier of the target user.

[0034] The target user may be any user accessing the LTE core network, which is not limited in this embodiment.

[0035] Among them, the target user identifier of the target user can be the mobile phone number of the target user, or other parameters that can uniquely identify the target user, such as the user name or registration identifier in the registration information of the target user, etc., which is not limited in this embodiment.

[0036] It can be understood that in the LTE core network, the control plane interface transmits signaling traffic containing information such as user location; therefore, after receiving the filtering instruction of the target user's location information, the signaling traffic data transmitted by the LTE core network through the control plane interfaces S11 and S58-C can be obtained, and further, each signaling traffic data can be filtered or diverted.

[0037] In this embodiment, the signaling traffic of the target user may include the location information of the target user, or the user's mobile phone number and other information, which is not limited in this embodiment.

[0038] In an optional implementation of this embodiment, after receiving a filter instruction for the location information of the target user, the received filter instruction may be further parsed to obtain a target user identifier of the target user.

[0039] Optionally, in this embodiment, obtaining the target user identifier of the target user may include: obtaining an attachment request and / or a PDN (Packet Data Network, creating a specific packet data network) connection request of the target user; and determining the target user identifier of the target user based on the attachment request and / or the PDN connection request.

[0040] In this embodiment, a mobile device, such as a mobile phone, triggers the CreateSession process of the S11 and S58-C interfaces in the LTE core network during processes such as attachment and creation of a PDN connection; the CreateSession process may carry information such as a mobile phone number, an initial location, and a default bearer identifier.

[0041] In an optional implementation of this embodiment, after receiving the filtering instruction of the target user's signaling traffic, the attachment request related to the target user and the creation session process in the PDN connection request can be further obtained, and the request for creating the session process can be parsed to obtain the mobile phone number of the target user; further, the mobile phone number of the target user can be determined as the target user identifier of the target user.

[0042] Step 120: Determine a target control tunnel associated with the target user and at least one default bearer identifier belonging to the target control tunnel.

[0043] Optionally, in an optional implementation of the present embodiment, after receiving the filtering instruction of the signaling traffic of the target user, the target control tunnel associated with the target user and the default bearer identifiers matching each target control tunnel can be further determined; it can be understood that a control tunnel can be associated with multiple default bearer identifiers, that is, there can be multiple default bearer identifiers belonging to the target control tunnel at the same time, for example, 2, 3 or 10, etc., which is not limited in the present embodiment.

[0044] In an optional implementation of this embodiment, after receiving the filtering instruction of the target user's signaling traffic, the attachment request related to the target user and the creation session process in the PDN connection request can be further obtained, and the response to the creation session process can be parsed to obtain the target user's GW side tunnel information and the default bearer identifier.

[0045] Optionally, in this embodiment, determining the target control tunnel associated with the target user and at least one default bearer identifier matching the target control tunnel may include: obtaining a first creation session process matching the attachment request, and determining the first uplink and downlink tunnels created in the first creation session process, and the first bearer identifier; determining the first uplink and downlink tunnels as the target control tunnel, and determining the first bearer identifier as the default bearer identifier belonging to the target control tunnel; or, obtaining a second creation session process matching the PDN connection request, and determining the second uplink and downlink tunnels created in the second creation session process, and the second bearer identifier; determining the second uplink and downlink tunnels as the target control tunnel, and determining the second bearer identifier as the default bearer identifier belonging to the target control tunnel.

[0046] In an optional implementation of the present embodiment, a first create session process that matches the attachment request of the target user's mobile device can be obtained; specifically, when the request and response of the first create session process are received, the user identifier can be extracted from the Create Session Request; the default bearer identifier (EBI) can be extracted from the Create Session Response. In the present embodiment, the default bearer identifier is referred to as the first bearer identifier; and GW side tunnel information (for example, TEID or creation time). In the present embodiment, the GW side tunnel is referred to as the first uplink and downlink tunnel. Further, the obtained first uplink and downlink tunnel can be determined as the target control tunnel, and the first bearer identifier can be determined as the default bearer identifier belonging to the target control tunnel.

[0047] In this embodiment, the control plane interfaces S11 and S58-C are not distinguished, and the AC side replaces the MME-C of S11 and the SGW-C of S58-C, and the GW side replaces the SGW-C of S11 and the PGW-C of S58-C; in this embodiment, only the GW side tunnel is taken as an example for illustration, which is not a limitation of this embodiment.

[0048] In another optional implementation of this embodiment, a second session creation process that matches the PDN connection request of the target user's mobile device can be obtained; specifically, when the request and response of the second session creation process are received, the user identifier can be extracted from the Create Session Request; the default bearer identifier (EBI) can be extracted from the Create Session Response. In this embodiment, the default bearer identifier is referred to as the second bearer identifier; and the GW side tunnel information (for example, TEID or creation time). In this embodiment, the GW side tunnel is referred to as the second uplink and downlink tunnel. Further, the obtained second uplink and downlink tunnel can be determined as the target control tunnel, and the second bearer identifier can be determined as the default bearer identifier belonging to the target control tunnel.

[0049] Step 130: Create a target database based on the target control tunnel and a default bearer identifier belonging to the target control tunnel.

[0050] In an optional implementation of this embodiment, after determining the target control tunnel and the default bearer identifiers matching the target control tunnel, a target database may be further created according to the target control tunnel and the default bearer identifiers matching the target control tunnel.

[0051] Optionally, in this embodiment, after determining the target control tunnel and the default bearer identifiers that match the target control tunnel, the target control tunnel and the default bearer identifiers that match the target control tunnel can be further stored in the target area, for example, in a folder with a set path, or in a cloud database, so as to obtain the target database.

[0052] Step 140: In response to the screening instruction of the target signaling traffic request packet, when it is determined that the target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database, forward the target signaling traffic request packet to the target analysis system.

[0053] Optionally, in this embodiment, after receiving the target signaling traffic request packet through the control plane interface S11 or S58-C of the LTE core network, the target signaling traffic request packet can be parsed to obtain the target uplink tunnel of the target signaling traffic; further, the target uplink tunnel can be compared with the target control tunnels stored in the target database to determine whether the target database contains the target uplink tunnel; when it is determined that the target uplink tunnel of the target signaling traffic request packet matches the target control tunnels in the target database, that is, when it is determined that the target uplink tunnel is included in the target database, it can be determined that the target signaling traffic request packet is signaling traffic related to the target user, and the target signaling traffic request packet can be forwarded to the target analysis system.

[0054] The technical solution of this embodiment obtains the target user identifier of the target user by responding to the screening instruction of the signaling traffic of the target user; determines the target control tunnel associated with the target user, and at least one default bearer identifier belonging to the target control tunnel; creates a target database based on the target control tunnel and the default bearer identifier belonging to the target control tunnel; responds to the screening instruction of the target signaling traffic request packet, and forwards the target signaling traffic request packet to the target analysis system when it is determined that the target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database; the traffic data generated by the LTE core network can be screened, providing a basis for improving the efficiency and accuracy of subsequent data analysis work.

[0055] Embodiment 2

[0056] Figure 2 1 is a flowchart of a method for screening user traffic according to Embodiment 2 of the present invention. This embodiment is a further refinement of the above technical solution. The technical solution in this embodiment can be combined with each optional solution in one or more of the above embodiments. Figure 2 As shown, the method includes:

[0057] Step 210: Receive a filter instruction for the signaling traffic of the target user.

[0058] Step 220: Obtain an attach request and / or a request to create a specific packet data network PDN connection of the target user; and determine a target user identifier of the target user based on the attach request and / or the PDN connection request.

[0059] Step 230: Determine a target control tunnel associated with the target user and at least one default bearer identifier matching the target control tunnel.

[0060] Optionally, in this embodiment, while obtaining the first session creation process matching the attachment request and determining the first uplink and downlink tunnels created in the first session creation process and the first bearer identifier, and obtaining the second session creation process matching the PDN connection request and determining the second uplink and downlink tunnels created in the second session creation process and the second bearer identifier, or after obtaining the first session creation process matching the attachment request and determining the first uplink and downlink tunnels created in the first session creation process and the first bearer identifier, and obtaining the second session creation process matching the PDN connection request and determining the second uplink and downlink tunnels created in the second session creation process and the second bearer identifier, it is also possible to obtain the first session deletion process matching the attachment request, or obtain the second session deletion process matching the PDN connection request; obtain attribute information of the first session creation process, the first session deletion process, the second session creation process and the first session deletion process respectively; and determine the creation time and deletion time of each target control tunnel according to each attribute information.

[0061] Among them, the attribute information may include the user identifier, tunnel identifier, default bearer identifier, creation time or deletion time of each session process, etc.; exemplarily, the first session creation process may include: user identifier, tunnel identifier, at least one default bearer identifier and the creation time of the first session creation process; the first session deletion process may include: user identifier, tunnel identifier, at least one default bearer identifier and the deletion time of the first session deletion process.

[0062] In an optional implementation of this embodiment, in the process of determining the target control tunnel associated with the target user and the default bearer identifiers matching the target control tunnel, attribute information of each creation session or deletion session can also be obtained. Furthermore, the creation time and deletion time of the target control tunnel can be determined based on the acquired attribute information.

[0063] For example, Figure 3 is a schematic diagram of a relationship between a control tunnel and a default bearer provided according to Embodiment 2 of the present invention, such as Figure 3 As shown, the target control tunnel may include control tunnel 1 and control tunnel 2; wherein control tunnel 1 includes two default bearer identifiers, namely, default bearer id=5 and default bearer id=6; control tunnel 2 includes one default bearer identifier, namely, default bearer id=5.

[0064] It should be noted that in the process of creating a session, during the attachment request of the target user's mobile phone, the LTE core network will create uplink and downlink tunnels for the mobile phone on the control plane interface S11 and S58-C, and allocate a default bearer and id; for example: id=5. When the target user's mobile phone creates a PDN connection request, the uplink and downlink tunnels of S11 and S58-C will be created for the mobile phone (in this process, the attachment process may be reused) and the default bearer id will be allocated; for example: id=6; it is understandable that the same mobile phone of the target user may create multiple PDN connections; therefore, under one control tunnel of S11 / S58-C, multiple default bearers may be attached.

[0065] It should also be noted that in the process of deleting a session, if the default bearer identifier is not carried, it means deleting all default bearers under the control tunnel and deleting the control tunnel; if the default bearer identifier is carried, it means deleting the default bearer of the default bearer identifier. When multiple deletion sessions carrying the default bearer identifier cause all default bearers to be deleted, the control tunnel needs to be automatically deleted.

[0066] It can be understood that the initial location of the mobile phone is in CreateSession; when the location of the mobile phone changes, it will be reflected in ModifyBear; from CreateSession controlling tunnel creation to DeleteSession controlling tunnel destruction, as well as ModifyBear in the middle, all signaling containing the location of the mobile phone is covered.

[0067] Step 240: Create a target database based on the target control tunnel and a default bearer identifier belonging to the target control tunnel.

[0068] In an optional implementation of the present embodiment, after obtaining each target control tunnel, the default bearer identifier matching each target control tunnel, the creation time and the deletion time of each target control tunnel, the target control tunnel (for example, the identifier of the target control tunnel), the default bearer identifier belonging to the target control tunnel, the creation time and the deletion time of the target control tunnel can be further stored in the target area to obtain the target database.

[0069] Step 250, parse the target signaling traffic request packet to obtain the identifier of the target uplink tunnel; determine whether the identifier of the target uplink tunnel matches the identifiers of each target control tunnel recorded in the target database; when it is determined that the identifier of the target uplink tunnel is consistent with the identifier of the target control tunnel, forward the target signaling traffic request packet to the target analysis system.

[0070] In an optional implementation of the present embodiment, after constructing a target database associated with the target user, if the control plane interface receives a target signaling traffic request packet, the target signaling traffic request packet can be further parsed to obtain the identifier of the target uplink tunnel in the target signaling traffic request packet; further, it can be determined whether the identifier of the target uplink tunnel matches the identifiers of each target control tunnel recorded in the target database; if it is determined that the identifier of the target uplink tunnel is consistent with the identifier of the target control tunnel, it can be determined that the identifier of the target uplink tunnel matches the identifiers of each target control tunnel recorded in the target database, and further, the target signaling traffic request packet can be forwarded to the target analysis system.

[0071] Exemplarily, the identifier of the target control tunnel may be the IP or TEID of each target control tunnel, which is not limited in this embodiment.

[0072] Furthermore, the target analysis system can perform subsequent analysis and processing on each received signaling traffic request packet; for example, if each target signaling traffic request packet contains the location information of the target user, then the target analysis system can determine the location change trajectory of the target user by analyzing this location information.

[0073] Step 260: When it is determined that the identifier of the target uplink tunnel is consistent with the identifier of the target control tunnel, determine the target signaling traffic response packet corresponding to the target signaling traffic request packet; and forward the target signaling traffic response packet to the target analysis system.

[0074] In an optional implementation of the present embodiment, when it is determined that the identifier of the target uplink tunnel is consistent with the identifier of the target control tunnel, that is, when it is determined that the identifier of the target uplink tunnel matches the identifiers of each target control tunnel recorded in the target database, the target signaling traffic response packet corresponding to the target signaling traffic request packet can be further determined, and the target signaling traffic response packet can be forwarded to the target analysis system, so that the target analysis system can process it according to the target signaling traffic request packet and the target signaling traffic response packet, thereby obtaining a more accurate processing result.

[0075] Optionally, in this embodiment, the target signaling traffic response packet may be determined from a plurality of signaling traffic response packets according to an identifier or a sequence number of the target signaling traffic request packet.

[0076] The solution of this embodiment, after constructing a target database matching the target user, can parse the target signaling traffic request packet to obtain the identifier of the target uplink tunnel; determine whether the identifier of the target uplink tunnel matches the identifier of each target control tunnel recorded in the target database; when it is determined that the identifier of the target uplink tunnel is consistent with the identifier of the target control tunnel, forward the target signaling traffic request packet to the target analysis system; when it is determined that the identifier of the target uplink tunnel is consistent with the identifier of the target control tunnel, determine the target signaling traffic response packet corresponding to the target signaling traffic request packet; forward the target signaling traffic response packet to the target analysis system, and each target signaling traffic request packet can be screened based on the target database, and the target data used for analysis by the target analysis system can be obtained, providing a basis for obtaining the analysis results quickly and accurately later.

[0077] In order to better understand the method for screening user traffic involved in this embodiment, a specific example is used below to describe the implementation of this solution:

[0078] 1) Database:

[0079] A database is established to store the target user's uplink GW-side tunnels. One control tunnel may correspond to multiple default bearers.

[0080] 2) Addition:

[0081] Specifically, in the process of creating a session, check whether the mobile phone number in CreateSessionReq is the target user; if so, learn the corresponding GW side tunnel and default bearer id in CreateSessionResp into the database, and forward CreateSessionReq / Resp to the directional analysis system; if not, no further processing.

[0082] 3) Modifications:

[0083] Specifically, the downlink control tunnel is modified in ModifyBear, so it can be ignored; it can be understood that the control tunnel is bidirectional, distinguishing between uplink and downlink, and the downlink is easy to be modified, so we store the uplink tunnel; therefore, the tunnels in the database only involve additions and deletions, not modifications.

[0084] 4) Delete:

[0085] Specifically, in the process of deleting a session, a single default bearer, all default bearers, and the control tunnel are deleted; if the default bearer identifier is not carried, it means deleting all default bearers under the control tunnel and deleting the control tunnel; if the default bearer identifier is carried, it means deleting the default bearer with the default bearer identifier. When multiple deletion sessions with different default bearer identifiers delete all default bearers, the control tunnel needs to be deleted.

[0086] 5) Traffic filtering:

[0087] Specifically, it is possible to check whether the uplink tunnel of the signaling traffic request packet hits the database. If so, the request packet is forwarded to the directional analysis system, and the corresponding response packet is associated with the ip-pair+seqnum of the request packet, and the response packet is also forwarded to the directional analysis system; if not, no further processing is performed.

[0088] The solution of this embodiment can filter the signaling traffic containing the location of certain 4G users through the S11 and S58-C control interfaces, and output it to a directional traffic analysis system, thereby reducing the traffic processing pressure of the directional traffic analysis system.

[0089] Embodiment 3

[0090] Figure 4 Schematic diagram of a user flow screening device according to Embodiment 3 of the present invention. Figure 4 As shown, the device includes: a target user identification acquisition module 410, a target control tunnel determination module 420, a target database creation module 430 and a signaling traffic forwarding module 440.

[0091] The target user identification acquisition module 410 is used to obtain the target user identification of the target user in response to the filter instruction of the signaling traffic of the target user;

[0092] A target control tunnel determining module 420, configured to determine a target control tunnel associated with the target user and at least one default bearer identifier belonging to the target control tunnel;

[0093] A target database creation module 430, configured to create a target database based on the target control tunnel and a default bearer identifier belonging to the target control tunnel;

[0094] The signaling traffic forwarding module 440 is used to respond to the screening instruction of the target signaling traffic request packet, and forward the target signaling traffic request packet to the target analysis system when it is determined that the target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database.

[0095] The solution of this embodiment is to obtain the target user identifier of the target user by a target user identifier acquisition module in response to the screening instruction of the signaling traffic of the target user; determine the target control tunnel associated with the target user and at least one default bearer identifier belonging to the target control tunnel by a target control tunnel determination module; create a target database based on the target control tunnel and the default bearer identifier belonging to the target control tunnel by a target database creation module; respond to the screening instruction of the target signaling traffic request packet by a signaling traffic forwarding module, and forward the target signaling traffic request packet to a target analysis system when it is determined that the target uplink tunnel of the target signaling traffic request packet matches the target control tunnels in the target database. This can screen the traffic data generated by the LTE core network and provide a basis for improving the efficiency and accuracy of subsequent data analysis work.

[0096] In an optional implementation of this embodiment, the target user identification acquisition module 410 is specifically used to obtain the target user's attachment request and / or create a specific packet data network PDN connection request;

[0097] A target user identifier of the target user is determined based on the attach request and / or the PDN connection request.

[0098] In an optional implementation of this embodiment, the target control tunnel determination module 420 is specifically used to obtain a first session creation process matching the attachment request, and determine a first uplink and downlink tunnel created in the first session creation process, and a first bearer identifier;

[0099] Determine the first uplink and downlink tunnel as a target control tunnel, and determine the first bearer identifier as a default bearer identifier belonging to the target control tunnel;

[0100] or,

[0101] Acquire a second session creation process that matches the PDN connection request, and determine a second uplink and downlink tunnel created in the second session creation process, and a second bearer identifier;

[0102] The second uplink and downlink tunnel is determined as a target control tunnel, and the second bearer identifier is determined as a default bearer identifier belonging to the target control tunnel.

[0103] In an optional implementation of this embodiment, the target control tunnel determination module 420 is further specifically configured to obtain a first session deletion process matching the attachment request, or obtain a second session deletion process matching the PDN connection request;

[0104] Respectively obtain the attribute information of the first create session process, the first delete session process, the second create session process and the first delete session process;

[0105] The creation time and deletion time of each target control tunnel are determined according to each attribute information.

[0106] In an optional implementation of this embodiment, the target database creation module 430 is specifically used to store the target control tunnel, the default bearer identifier belonging to the target control tunnel, the creation time and the deletion time of the target control tunnel in the target area to obtain the target database.

[0107] In an optional implementation of this embodiment, the signaling traffic forwarding module 440 is specifically used to parse the target signaling traffic request packet to obtain the identifier of the target uplink tunnel;

[0108] Determining whether the identifier of the target uplink tunnel matches the identifiers of each target control tunnel recorded in the target database;

[0109] When it is determined that the target uplink tunnel identifier is consistent with the target control tunnel identifier, the target signaling traffic request packet is forwarded to a target analysis system.

[0110] In an optional implementation of this embodiment, the signaling traffic forwarding module 440 is further specifically configured to determine a target signaling traffic response packet corresponding to the target signaling traffic request packet when it is determined that the identifier of the target uplink tunnel is consistent with the identifier of the target control tunnel;

[0111] The target signaling traffic response packet is forwarded to a target analysis system.

[0112] The user traffic screening device provided in the embodiment of the present invention can execute the user traffic screening method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0113] Embodiment 4

[0114] Figure 5A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0115] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0116] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0117] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a method for screening user traffic, the method comprising: in response to a screening instruction of a target user's signaling traffic, obtaining a target user identifier of the target user; determining a target control tunnel associated with the target user, and at least one default bearer identifier belonging to the target control tunnel; creating a target database based on the target control tunnel and the default bearer identifier belonging to the target control tunnel; in response to a screening instruction of a target signaling traffic request packet, when it is determined that the target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database, forwarding the target signaling traffic request packet to a target analysis system.

[0118] In some embodiments, the method for screening user traffic may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for screening user traffic described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the method for screening user traffic in any other appropriate manner (e.g., by means of firmware).

[0119] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0120] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0121] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0122] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0123] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0124] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0125] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0126] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for screening user traffic, characterized in that: include: In response to a filter instruction of the signaling traffic of the target user, obtaining a target user identifier of the target user; Determining a target control tunnel associated with the target user and at least one default bearer identifier belonging to the target control tunnel; Creating a target database based on the target control tunnel and a default bearer identifier belonging to the target control tunnel; In response to a screening instruction of a target signaling traffic request packet, when it is determined that a target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database, the target signaling traffic request packet is forwarded to a target analysis system.

2. The method for screening user traffic according to claim 1, characterized in that: The step of obtaining a target user identifier of the target user includes: Obtaining an attachment request of the target user and / or a request to create a specific packet data network PDN connection; A target user identifier of the target user is determined based on the attach request and / or the PDN connection request.

3. The method for screening user traffic according to claim 2, characterized in that: The determining of a target control tunnel associated with the target user and at least one default bearer identifier belonging to the target control tunnel includes: Acquire a first session creation process that matches the attachment request, and determine a first uplink and downlink tunnel created in the first session creation process, and a first bearer identifier; Determine the first uplink and downlink tunnel as a target control tunnel, and determine the first bearer identifier as a default bearer identifier belonging to the target control tunnel; or, Acquire a second session creation process that matches the PDN connection request, and determine a second uplink and downlink tunnel created in the second session creation process, and a second bearer identifier; The second uplink and downlink tunnel is determined as a target control tunnel, and the second bearer identifier is determined as a default bearer identifier belonging to the target control tunnel.

4. The method for screening user traffic according to claim 3, characterized in that: The method further comprises: Acquire a first session deletion process that matches the attach request, or acquire a second session deletion process that matches the PDN connection request; Respectively obtain the attribute information of the first create session process, the first delete session process, the second create session process and the first delete session process; The creation time and deletion time of each target control tunnel are determined according to each attribute information.

5. The method for screening user traffic according to claim 4, characterized in that: The creating a target database based on the target control tunnel and a default bearer identifier belonging to the target control tunnel includes: The target control tunnel, the default bearer identifier belonging to the target control tunnel, the creation time and the deletion time of the target control tunnel are stored in the target area to obtain the target database.

6. The method for screening user traffic according to claim 5, characterized in that: The method of responding to the screening instruction of the target signaling traffic request packet and forwarding the target signaling traffic request packet to the target analysis system when it is determined that the target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database includes: Parse the target signaling traffic request packet to obtain the identifier of the target uplink tunnel; Determining whether the identifier of the target uplink tunnel matches the identifiers of each target control tunnel recorded in the target database; When it is determined that the target uplink tunnel identifier is consistent with the target control tunnel identifier, the target signaling traffic request packet is forwarded to a target analysis system.

7. The method for screening user traffic according to claim 6, characterized in that: The method further comprises: In the case where it is determined that the identifier of the target uplink tunnel is consistent with the identifier of the target control tunnel, determining a target signaling flow response packet corresponding to the target signaling flow request packet; The target signaling traffic response packet is forwarded to a target analysis system.

8. A user traffic screening device, characterized in that: include: A target user identification acquisition module, used to obtain a target user identification of the target user in response to a screening instruction of the signaling traffic of the target user; A target control tunnel determination module, used to determine a target control tunnel associated with the target user, and at least one default bearer identifier belonging to the target control tunnel; A target database creation module, used to create a target database based on the target control tunnel and a default bearer identifier belonging to the target control tunnel; The signaling traffic forwarding module is used to respond to the screening instruction of the target signaling traffic request packet, and forward the target signaling traffic request packet to the target analysis system when it is determined that the target uplink tunnel of the target signaling traffic request packet matches each target control tunnel in the target database.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the user traffic screening method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the user traffic screening method according to any one of claims 1 to 7 when executed.

Images