NWDAF assisted discovery of network applications

Abstract

A network node 1000 in a wireless communication network 100 receives, from a consumer network function NF, a request for an analysis service provided by a network data analysis function NWDAF 130 executed on the network node 1000. The request includes one or more filter criteria. A network node 1000 collects data from one or more NFs within a wireless communication network 100. The network node (1000) generates packet flow description (PFD) information from the collected data on the basis of a filter criterion, and transmits the PFD information to the consumer NF (115). The consumer NF 115 allocates an application identifier to the PFD information, and transmits a PFD including the application identifier and the PFD information to the SMF 180.

Description

[0001] Related Applications

[0002] This application claims priority to EP patent application 22382787.4 filed on August 17, 2022, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure generally relates to the field of wireless communication network technology, and more particularly to network management technology utilizing an analysis platform. Background Art

[0004] In the field of wireless communication networks, the network data analysis function (NWDAF) is traditionally an operator-managed network analysis logic function that is executed on a network node within the fifth generation (5G) core (5GC) reference architecture. NWDAF traditionally interacts with various other entities within the 5G system for various purposes. For example, NWDAF can perform data collection based on event subscriptions provided by access and mobility function (AMF), session management function (SMF), policy control function (PCF), unified data management (UDM), application function (AF) (directly or via network open function (NEF)) and / or operation, management and maintenance (OAM) nodes. NWDAF can also retrieve information from one or more data repositories (e.g., retrieve subscriber related information from the unified data repository (UDR) via UDM). NWDAF can also retrieve information about network functions (NFs), for example, retrieve NF related information from the network repository function (NRF) and / or retrieve network slice related information from the network slice selection function (NSSF). In addition, NWDAF is able to supply analysis to consumers of analysis data on demand.

[0005] The Packet Flow Description Function (PFDF) has the ability to create, update or remove Packet Flow Descriptions (PFDs) in the NEF, and distribute the information from the NEF to the SMF and ultimately to the User Plane Function (UPF). For example, when the UPF is configured to detect a specific application provided by an Application Service Provider (ASP), the PFDF can be used in this way. Traditionally, the PFDF is a logical function within the NEF.

[0006] NEF is traditionally able to send a PFD to SMF for a specific application identifier or set of application identifiers (e.g., using PFDF). This can be achieved where NEF (or PFDF) and SMF are able to create, update and remove individual PFDs or entire PFD sets from each other. Summary of the invention

[0007] Embodiments of the present disclosure provide analysis of application services. Certain embodiments provide new PFDs for unknown applications and / or updated PFDs for known applications by identifying signatures of specific network services (e.g., browsing, video streaming) and inferring the identities of the corresponding applications. Embodiments additionally or alternatively provide a mechanism by which consumers of analysis data notify NFs in the network of how new applications provided as output of the NWDAF's analysis will be named.

[0008] Certain embodiments of the present disclosure include a method implemented by a network node in a wireless communication network. The method includes receiving a request for an analysis service provided by a network data analysis function (NWDAF) executed on the network node from a consumer network function (NF). The request includes one or more filter criteria. The method also includes collecting data from one or more NFs within the wireless communication network. The method also includes generating packet flow description (PFD) information from the collected data based on the filter criteria. The method also includes sending the PFD information to the consumer NF.

[0009] In some embodiments, the consumer network function is a Network Open Function (NEF) and / or a Packet Flow Description Function (PFDF).

[0010] In some embodiments, the method further comprises obtaining a PFD from the NEF or the PFDF. Generating the PFD is in response to the collected data including session data that does not match any of the obtained PFDs.

[0011] In some embodiments, collecting data from one or more NFs includes collecting historical data from an analytical data repository function (ADRF).

[0012] In some embodiments, collecting data from one or more NFs includes collecting quality of service (QoS) data from a session management function (SMF).

[0013] In some embodiments, the method further comprises identifying a business pattern from the collected data that matches the filter criteria. Generating the PFD information comprises generating the PFD information for an application responsible for generating the business pattern.

[0014] Other embodiments include a method implemented by a network node in a wireless communication network, the method comprising sending a request for an analysis service to a NWDAF. The request comprises one or more filter criteria. The method further comprises receiving PFD information matching the filter criteria from the NWDAF 130. The method further comprises assigning an application identifier to the PFD information. The method further comprises sending a PFD comprising the application identifier and the PFD information to an SMF.

[0015] In some embodiments, the method further comprises receiving a PFD acquisition request from the NWDAF. The method further comprises sending a plurality of PFDs to the NWDAF in response to the PFD acquisition request. The PFD sent to the SMF is different from each of the PFDs sent to the NWDAF.

[0016] In some embodiments, sending the PFD to the SMF includes sending the PFD to a user plane function (UPF) via the SMF for inclusion of the PFD in enforcement of a user plane policy.

[0017] Certain features may be applied to any of the methods described herein. For example, in some embodiments, the filter criteria include an indicator of one or more user equipment identifiers. In some embodiments, the filter criteria include a primary traffic flow direction. In some embodiments, the filter criteria include a metric describing a packet size characteristic. In some embodiments, the filter criteria include a metric describing a traffic reception and / or transmission characteristic.

[0018] Still other embodiments include a network node comprising a processing circuit and a memory. The memory contains instructions executable by the processing circuit, whereby the network node is configured to receive a request for an analysis service provided by a NWDAF executed on the network node from a consumer NF. The request includes one or more filter criteria. The network node is further configured to collect data from one or more NFs within the wireless communication network. The network node is further configured to generate PFD information from the collected data based on the filter criteria. The network node is further configured to send the PFD information to the consumer NF.

[0019] In some embodiments, the network node is further configured to perform any of the above methods where the network node is performing NWDAF.

[0020] Still other embodiments include a network node comprising a processing circuit and a memory. The memory contains instructions executable by the processing circuit, whereby the network node is configured to send a request for an analysis service to the NWDAF. The request includes one or more filter criteria. The network node is further configured to receive PFD information matching the filter criteria from the NWDAF. The network node is further configured to assign an application identifier to the PFD information. The network node is further configured to send a PFD including the application identifier and the PFD information to the SMF.

[0021] In some embodiments, the network node is further configured to perform any of the above methods in which the network node sends a request for analysis services to the NWDAF.

[0022] Further embodiments comprise a computer program comprising instructions which, when executed on a processing circuit of a network node, cause the processing circuit to perform any of the methods described above.

[0023] Still further embodiments comprise a carrier embodying any of the computer programs discussed above. The carrier is one of an electronic signal, an optical signal, a radio signal or a computer-readable storage medium. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Aspects of the present disclosure are illustrated by way of example and not limited by the accompanying drawings.

[0025] Figure 1 is a schematic block diagram illustrating an example wireless communication network according to one or more embodiments of the present disclosure.

[0026] Figure 2 is a table illustrating an example definition of events opened by NWDAF according to one or more embodiments of the present disclosure.

[0027] Figure 3 is a table illustrating example input data collected by NWDAF for generating analytics in accordance with one or more embodiments of the present disclosure.

[0028] Figure 4 is a table illustrating example PDF information generated by NWDAF according to one or more embodiments of the present disclosure.

[0029] Figure 5 and Figure 6 is a signaling diagram illustrating an example of signaling between network functions according to different embodiments of the present disclosure.

[0030] Figure 7 is a flow chart illustrating an example method implemented by a network node executing NWDAF according to one or more embodiments of the present disclosure.

[0031] Figure 8 is a flow chart illustrating an example method implemented by a network node executing NEF according to one or more embodiments of the present disclosure.

[0032] Fig. 9 is a schematic block diagram illustrating an example network node according to one or more embodiments of the present disclosure. DETAILED DESCRIPTION

[0033] Figure 11 is a schematic block diagram illustrating an example network 100 including multiple NFs according to one or more embodiments of the present disclosure. The network 100 conforms to the 5G reference architecture and includes a UDR 110, a NEF 120, a NWDAF 130, an AF 140, a PCF 150, an NRF 155, a charging function (CHF) 160, an analysis data repository function (ADRF) 165, an AMF 170, an SMF 180, and a UPF 190, each of which can be executed alone on a network node or together with any one or more of the other functions. The NEF 120 may include a PFDF 125 in particular. Each of the nodes has its own interface through which the node can be contacted on the network. In addition to the interface between the UPF 190 and the SMF 180, the interface to each of the NFs is indicated by a prefix N added to the front of the name of the NF (e.g., the UDR 110 can be contacted on the network via the Nudr interface). The interface between the UPF 190 and the SMF 180 is referred to as an N4 interface.

[0034] In order for the network 100 to provide differentiated application service processing, the network 100 distinguishes services generated by different applications. In a 5G network, applications can be distinguished by a packet header of a service data flow (SDF) and / or by an application identifier. The most common method for detecting services is to use a packet header, which typically includes a source address and a destination address. An application identifier can be used to refer to a specific application detection filter of a UPF, and the AF 140 can provide a PFD to update the application detection filter information associated with the application identifier.

[0035] The PFD may include a flow description (e.g., a service-side 3-tuple), a uniform resource locator (URL), and domain name / protocol information. When the AF 140 delivers the PFD to the NEF 120 (e.g., to the PFDF 125), the PFD may be distributed to the SMF 180 and the UPF 190 to enable flow detection. In particular, the SMF 180 may supply or remove a PFD associated with a specific application identifier. However, there may be a situation where the ASP fails to provide the initial PFD information, or the ASP provides the initial PFD information but fails to update it in a timely manner. In such a case, the UPF 190 will not be able to detect the corresponding application service.

[0036] In view of this problem, embodiments of the present disclosure provide analysis of application services. Specific embodiments provide new PFDs for unknown applications and / or updated PFDs for known applications by identifying signatures of specific network services (e.g., browsing, video streaming) and inferring the identities of the corresponding applications. To achieve this, one or more embodiments include collecting measurements of applications in order to extract statistical characteristics, and collecting packet payloads to extract payload characteristics (such as domain names contained in the payload). The captured application characteristics can then be stored as a PFD, which can be used by SMF 180 and / or UPF 190 to detect applications.

[0037] In particular, NWDAF 130 may collect current and historical PFD information (including application identifiers, historical IP 3-tuples, historical URLs, historical domain name information) from NRF via NEF 120 (PFDF 125) and ADRF 165, respectively. In general, ADRF 165 allows NF consumers to store, retrieve, and remove data or analysis. Based on the PFD information identified from ADRF 165, NRF, and the business information from UPF, new PFD information (including application identifiers, new IP 3-tuples, new URLs, new domain name information) for existing application identifiers may be derived by NWDAF 130. The new PFD information provided by NWDAF 130 may be used by NEF 120 for supply to SMF 180 and / or UPF 190.

[0038] SMF 180 may request the provisioning of a PFD associated with a given application identifier and convert Policy and Charging Control (PCC) rules associated with the application identifier into Packet Detection Rules (PDRs) for installation on UPF 190. For example, SMF 180 may receive PCC rules associated with Application ID 1. If Application ID 1 is not already stored in SMF 180, SMF 180 may request the PFD associated with Application ID 1 from NEF 120. SMF 180 may send the PFD for Application ID 1 to UPF 190 and then convert the PCC rules into PDRs referencing Application ID 1.

[0039] In order to do this, SMF 180 needs to know the application ID of the appropriate PFD so that the application ID can be assigned a PCC rule with the desired business policy. In addition, the consumer of the analysis (e.g., NEF 120) may only be interested in a subset of the applications found by NWDAF 130. Therefore, embodiments of the present disclosure propose a new analysis filter to enable NWDAF 130 to filter the applications supplied to the analysis consumer, as well as provide input to NWDAF 130 for naming the found applications.

[0040] In particular, embodiments of the present disclosure allow consumers to notify NWDAF 130 of target applications of interest via an "ApplicationCharacteristics" parameter. The "ApplicationCharacteristics" parameter is a well-known mechanism for identifying relevant key performance indicators (KPIs) related to business characteristics. According to an embodiment, the ApplicationCharacteristics parameter is used to describe relationships for identifying applications.

[0041] The content of the application characteristic parameters is created based on the business characteristics provided by the UPF 190 as input for relevant data collection and in combination with the application relationship function. Business characteristics may include, for example, data duration, quality of service (QoS) flow bit rate, packet transmission, packet size, data volume and / or uplink / downlink packet delay. Application relationship functions may include, for example, min(), application with minimum value; max(), application with maximum value. Several characteristics may be used for each filter use and / or each operator.

[0042] Figure 2 is a table illustrating example events exposed by NWDAF 130 to consumer NFs in network 100. In this example, the event is called "Assisted Application Detection". The event is associated with an event filter list. The event filter list allows the description of filters for each of a plurality of applications using application characteristic parameters. Figure 2 As shown, Application 1 is described as an application where the service has the maximum data duration and the minimum QoS flow bit rate. Application 2 is described as an application where the service has the minimum packet transmission and the maximum packet size. Any number of event filters can be defined for any number of applications in this way.

[0043] The name specified in the application characteristic parameter is used by NWDAF 130 to name the applications that match the listed characteristics. In response to receiving one or more application characteristic filters in an analytics subscription request, NWDAF 130 will provide analytics about the applications that match the filters. In at least some embodiments, in response to overlap between the PFD information provided by NWDAF 130 and by AF 140, the information provided by AF 140 takes precedence over the PFD information provided by NWDAF 130. Therefore, embodiments of the present disclosure provide a mechanism by which consumers of analytics data inform NWDAF 130 how to identify and name applications based on business analytics.

[0044] Figure 3is a table listing example data that NWDAF 130 may collect from various sources in network 100 for identifying applications having certain characteristics specified by the analytics consumer. Inputs may include QoS flow related data from SMF 180, such as for a particular Single Network Slice Selection Assistance Information (S-NSSAI), Domain Network Name (DNN), and / or UE.

[0045] Figure 4 is a table listing example output analysis generated by NWDAF 130 according to one or more embodiments of the present disclosure. The output can be used to provision new PFDs for known applications, or to define new PFDs for new applications that are not yet known to NEF 120. Upon receiving the analysis including new PFD information from NWDAF 130, NEF 120 can assign a PFD ID for the unknown application. In addition, the assigned PFD ID can be used to identify, audit, and report the unknown application.

[0046] In view of the above, Figure 5 is a signaling diagram illustrating example signaling for obtaining analysis from a network node of the network 100. Figure 5 , the consumer NF 115 subscribes to the NWDAF 130 to request analysis for application detection (step 310). The consumer NF 115 can be any NF of the network 100, and in particular can be the NEF 120 (or its PFDF 125). The subscription can be triggered, for example, by local configuration or operation, administration and maintenance (OAM). The subscription includes an indicator that a new service analysis is being requested, and can additionally include an analysis filter. The analysis filter can include UE ID, S-NSSAI and / or DNN.

[0047] NWDAF 130 obtains currently stored PFD information from NEF 120 (eg, via PFDF 125 of NEF 120) by sending a obtain request to NEF (step 320) and receiving a corresponding obtain response (step 330). Although not shown, NWDAF may also obtain historical data from ADRF.

[0048] The NWDAF 130 collects session related information about the URL, domain name portion, and Internet packet (IP) 3-tuple of packets from one or more SDFs that do not match the installed PDR from the UPF 190 (step 340). The NWDAF 130 derives the PFD analysis based on the collected UPF data and / or the analysis filter received from the NF consumer (step 350), for example. The NWDAF 130 notifies the analysis consumer NF 115 of the output consistent with the previous request of the consumer NF.

[0049] To support certain embodiments of the present disclosure, certain network functions will need to be adapted in certain ways from their traditional behavior. For example, in some embodiments, NWDAF 130 provides new analysis for application detection information. Additionally or alternatively, NWDAF 130 processes user plane data for extracting business characteristics. Additionally or alternatively, NWDAF 130 filters and names the detected applications based on an "application characteristics" filter.

[0050] UPF 190 may additionally or alternatively need to be adapted. In some embodiments, UPF 190 reports the URL, domain name portion, and IP 3-tuple of packets from unknown applications to NWDAF 130. Additionally or alternatively, UPF 190 provides requested session statistics, including data volume, data duration, QoS flow bit rate, and packet transmission.

[0051] The NEF 120 (eg, at the PFDF 125 ) may additionally or alternatively need to be adapted. In particular, the NEF 120 may need to support consumption of new PFD information from the NWDAF 130 .

[0052] Figure 6 FIG. 1 is a flow chart illustrating another example of signaling according to a specific embodiment of the present disclosure. Figure 6 As shown, the consumer NF 115 (e.g., NEF 120 or PFDF 125) subscribes to the auxiliary application detection provided by the NWDAF 130. To this end, the consumer 115 sends a subscription request to the NWDAF 130 (step 210), for example, as a Nnwdaf_AnalyticsSubscription_Subscribe request message. The subscription request may be a request to subscribe to the classification service provided by the NWDAF 130, and includes one or more parameters as input, such as an analytical-ID parameter, an analytical-input parameter, and / or an analytical-filter input.

[0053] exist Figure 6In the example of , the Analysis-ID parameter is set to a value indicating AssistedApplicationDetection, and the Analysis-Filter is set to the identifier of the UE 105 (i.e., UE-ID), the single network slice selection assistance information identifying the relevant network slice, and the data network name (DNN). The Analysis-Input parameter can be a data element or structure describing the relationship between clusters (referred to as "ClusterCharacteristics" in this example), which will allow the NWDAF 130 to identify and assign application names to each of the clusters.

[0054] For example, for a first application, the cluster characteristic parameters may describe clusters with higher than average packet sizes and traffic flowing primarily in the uplink direction, while for a second application, the cluster characteristic parameters may describe clusters with lower standard inter-arrival times and higher maximum retransmission packets. Thus, the cluster characteristic parameters may describe criteria by which a cluster may be identified from traffic data stored at the NWDAF 130.

[0055] The NWDAF 130 replies to the consumer 115 by providing a subscription response indicating that the operation was successful (step 220). Subsequently, a packet data unit (PDU) session is established for the UE 105 (step 230). For simplicity, in this example, it is assumed that there is a single UE 105, which is identified by the UE-ID indicated in the analysis-filter parameter of the subscription request.

[0056] NWDAF 130 collects session-related data including service data using, for example, SMF 180 or UPF 190 (step 240).

[0057] Based on the collected data and the cluster characteristics provided by the consumer 115 in the subscription request, the NWDAF 130 identifies the requested cluster and generates an analysis (step 250). To make the cluster identifiable, the NWDAF 130 uses the specified dynamic relationship to assign names to the found clusters, which can be referred to as applications with specific business types within the network.

[0058] The NWDAF 130 sends the analysis result to the consumer 115 in a notification message (step 260). In this example, the notification message is a Nnwdaf_AnalyticsSubscription_Notify request message, which includes the aforementioned analysis-ID and analysis result (AnalyticResult) parameters. The analysis result parameter includes the newly detected application of a given business type and includes its corresponding name.

[0059] The consumer 115 sends a notification response message indicating that the notification operation is successful to the NWDAF 130 (step 270). As a result, the consumer 115 can apply corresponding actions based on the analysis results. For example, the consumer 115 can store the new application and / or business type as application data in the NEF 120, PFDF 125, UDR 110 or elsewhere, and distribute the information to the UPF 190 for business classification. In this way, policies corresponding to the identified business can be applied in an automatic manner.

[0060] In view of the above, the embodiments of the present disclosure include: Figure 7 4. The method 400 is shown in the example of FIG. 4. The method is implemented by a network node in a communication network 100. The method 400 includes receiving a request for an analysis service provided by an NWDAF 130 executed on the network node from a consumer NF 115 (block 410). The request includes one or more filter criteria. The method 400 also includes collecting data from one or more NFs within the wireless communication network 100 (block 420). The method 400 also includes generating PFD information from the collected data based on the filter criteria (block 430). The method 400 also includes sending the PFD information to the consumer NF 115 (block 440).

[0061] Correspondingly, the embodiments of the present disclosure include: Figure 8 5. The method 500 is implemented by a network node within the communication network 100. The method 500 includes sending a request for an analysis service to the NWDAF 130 (block 510). The request includes one or more filter criteria. The method 500 also includes receiving PFD information that matches the filter criteria from the NWDAF (block 520). The method 500 also includes assigning an application identifier to the PFD information (block 530). The method 500 also includes sending a PFD including the application identifier and the PFD information to the SMF 180 (block 540).

[0062] Other embodiments of the present disclosure include those implemented as Fig. 9 A network node 1000 is schematically illustrated in an example of FIG. Figure 4The example network node 1000 includes a processing circuit 1010, a memory circuit 1020, and an interface circuit 1030. The processing circuit 1010 is communicatively coupled to the memory circuit 1020 and the interface circuit 1030, for example, via a bus 1004. The processing circuit 1010 may include one or more microprocessors, microcontrollers, hardware circuits, discrete logic circuits, hardware registers, digital signal processors (DSPs), field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), or combinations thereof. For example, the processing circuit 1010 may be programmable hardware capable of executing software instructions stored in the memory circuit 1020, for example, as a machine-readable control program 1040. The memory circuit 1020 of various embodiments may include any non-transitory machine-readable medium known in the art or that can be developed, whether volatile or non-volatile, including but not limited to solid-state media (e.g., SRAM, DRAM, DDRAM, ROM, PROM, EPROM, flash memory, solid-state drives, etc.), removable storage devices (e.g., Secure Digital (SD) cards, miniSD cards, microSD cards, memory sticks, thumb drives, USB flash drives, ROM cartridges, universal media disks), fixed drives (e.g., magnetic hard drives), etc., all or in any combination.

[0063] The interface circuit 1030 may be a controller hub configured to control input and output (I / O) data paths of the network node 1000. Such I / O data paths may include data paths for exchanging signals through a network. The interface circuit 1030 may be implemented as a single physical component, or may be implemented as a plurality of physical components arranged in series or separately, any of which may be communicatively coupled to any other component or may communicate with any other component via the processing circuit 1010. For example, the interface circuit 1030 may include a transmitter 1032 configured to send wireless communication signals and a receiver 1034 configured to receive wireless communication signals.

[0064] According to a particular embodiment, the processing circuit 1010 is configured to receive a request for an analysis service provided by the NWDAF 130 executed on the network node 1000 from the consumer NF 115. The request includes one or more filter criteria. The processing circuit 1010 is also configured to collect data from one or more NFs within the wireless communication network 100. The processing circuit 1010 is also configured to generate PFD information from the collected data based on the filter criteria and send the PFD information to the consumer NF 115 (e.g., via the interface circuit 1030).

[0065] According to other embodiments, the processing circuit 1010 is configured to send a request for an analysis service to the NWDAF 130. The request includes one or more filter criteria. The processing circuit 1010 is also configured to receive PFD information matching the filter criteria from the NWDAF 130. The processing circuit 1010 is also configured to assign an application identifier to the PFD information and send a PFD including the application identifier and the PFD information to the SMF 180.

[0066] Still other embodiments include a system comprising a Figure 7 The first network node of the method 400 and the Figure 8 The method 500 is performed by a second network node.

[0067] Still other embodiments include a control program 1040 that includes instructions that, when executed on the processing circuit 1010 of the network node 1000, cause the network node 1000 to perform the method 400. Alternatively, the control program 1040 may include instructions that, when executed on the processing circuit 1010 of the network node 1000, cause the network node 1000 to perform the method 500.

[0068] Still other embodiments include a carrier containing the control program 1040. The carrier is one of an electronic signal, an optical signal, a radio signal, or a computer-readable storage medium.

[0069] Of course, without departing from the basic characteristics of the present invention, the present invention can be implemented in other ways beyond the mode specifically set forth herein. The present embodiment should be considered illustrative and non-restrictive in all aspects, and all changes falling within the meaning and equivalent scope of the appended claims are intended to be included herein.

Claims

1. A method 400 implemented by a network node 1000 in a wireless communication network 100, the method comprising: receiving 410 a request from a consumer network function NF 115 for an analysis service provided by a network data analysis function NWDAF 130 executing on the network node 1000, the request comprising one or more filter criteria; Collecting 420 data from one or more NFs within the wireless communication network 100; generating 430 packet flow description (PFD) information from the collected data based on the filter criteria; as well as The PFD information is sent 440 to the consumer NF 115 .

2. The method of claim 1, wherein: The consumer network function is the network exposure function NEF 120 and / or the packet flow description function PFDF 125 .

3. The method according to any one of claims 1 to 2, further comprising: A PFD is retrieved from NEF 120 or PFDF 125, wherein the PFD is generated in response to the collected data including session data that does not match any of the retrieved PFDs.

4. The method according to any one of claims 1 to 3, wherein: Collecting the data from the one or more NFs includes collecting historical data from an analytical data repository function ADRF 165 .

5. The method according to any one of claims 1 to 4, wherein: Collecting the data from the one or more NFs includes collecting quality of service QoS data from a session management function SMF 180.

6. The method according to any one of claims 1 to 5, further comprising: A business pattern matching the filter criteria is identified from the collected data, wherein generating the PFD information includes generating the PFD information for an application responsible for generating the business pattern.

7. A method 500 implemented by a network node 1000 in a wireless communication network 100, the method comprising: sending 510 a request for analysis services to the network data analysis function NWDAF 130, the request including one or more filter criteria; receiving 520 packet flow description (PFD) information matching the filter criteria from the NWDAF 130; assigning 530 an application identifier to the PFD information; and The PFD including the application identifier and the PFD information is sent 540 to the session management function SMF 180 .

8. The method of claim 7, further comprising: receiving a PFD acquisition request from the NWDAF 130; In response to the PFD acquisition request, sending a plurality of PFDs to the NWDAF 130; The PFD sent to the SMF 180 is different from each of the PFDs sent to the NWDAF 130.

9. The method according to any one of claims 7 to 8, wherein: Sending the PFD to the SMF includes sending the PFD to a user plane function UPF 190 via the SMF 180 for including the PFD in implementing a user plane policy.

10. The method according to any one of claims 1 to 9, wherein: The filter criteria include: one or more indicators of user equipment identities.

11. The method according to any one of claims 1 to 10, wherein: The filter criteria include: primary traffic flow direction.

12. The method according to any one of claims 1 to 11, wherein: The filter criteria include: a metric that describes characteristics of packet size.

13. The method according to any one of claims 1 to 12, wherein: The filter criteria include metrics describing reception and / or transmission characteristics of the service.

14. A network node 1000, comprising: The processing circuit 1010 and the memory 1020 contain instructions executable by the processing circuit 1010, whereby the network node 1000 is configured to: receiving, from a consumer network function NF 115, a request for an analysis service provided by a network data analysis function NWDAF 130 executing on the network node 1000, the request comprising one or more filter criteria; Collecting data from one or more NFs within the wireless communication network 100; generating packet flow description (PFD) information from the collected data based on the filter criteria; as well as The PFD information is sent to the consumer NF 115 .

15. The network node according to the preceding claim, further configured to perform the method 400 according to any one of claims 2-6.

16. A network node 1000, comprising: The processing circuit 1010 and the memory 1020 contain instructions executable by the processing circuit 1010, whereby the network node 1000 is configured to: sending a request for analysis services to the network data analysis function NWDAF 130, the request including one or more filter criteria; receiving packet flow description (PFD) information matching the filter criteria from the NWDAF 130; assigning an application identifier to the PFD information; and The PFD including the application identifier and the PFD information is sent to the session management function SMF 180.

17. The network node according to the preceding claim, further configured to perform the method 500 according to any one of claims 8-13.

18. A computer program comprising instructions which, when executed on a processing circuit 1010 of a network node 1000, cause the processing circuit 1010 to perform a method according to any one of claims 1-13.

19. A carrier comprising a computer program as claimed in any preceding claim, wherein: The carrier is one of an electronic signal, an optical signal, a radio signal or a computer-readable storage medium.

Images