A method and apparatus for detecting semantic attacks on the PFCP protocol based on a large language model.

Abstract

This invention provides a method and apparatus for detecting semantic attacks on the PFCP protocol based on a large language model. Utilizing the BERT (Bidirectional Encoder Representations from Transformers) model, it performs contextual association on the diverse information cells of the PFCP protocol, capturing dependencies over longer distances to identify PFCP protocol attack events. Deployed between the UPF and SMF, this invention collects and parses PFCP signaling data between the UPF and SMF, uses the BERT model to identify and predict semantic attacks on PFCP protocol information cell compliance, and analyzes PFCP protocol security events. This invention addresses the problems of numerous information cells in each type of PFCP signaling, the long hiding time of security events, and their difficulty in detection, offering a more targeted approach and facilitating the identification of PFCP protocol attack behaviors.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing technology, specifically to a method and apparatus for detecting semantic attacks on the PFCP protocol based on a large language model. Background Technology

[0002] User Plane Function (UPF) deployment in a private network refers to placing the UPF close to the user side within a 5G network. This enables local data processing and offloading, reducing network latency and improving data security and service experience. This deployment method can meet the diverse network needs of industry customers for data not leaving the network, uninterrupted service, and high-security isolation. By deploying the UPF, a local data loop can be achieved, meaning that 5G users' media plane data is offloaded within the campus, avoiding data detours through the public bearer network, shortening the transmission path, improving user experience, and saving operators' transmission resources.

[0003] However, after the UPF is deployed, it faces management risks such as the lack of access control for the data center, free entry and exit of external personnel, and continuous construction of new projects. This leads to the UPF being vulnerable to arbitrary tampering with network configurations. Furthermore, it can use the Packet Forwarding Control Protocol (PFCP) to launch man-in-the-middle attacks, signaling logic attacks such as cell duplication / missing, topology sniffing, and signaling storms against the 5G core network's Session Management Function (SMF), resulting in failures of critical 5G core network infrastructure.

[0004] The most influential pre-trained language model currently is BERT, a bidirectional deep language model based on Transformers. BERT consists of multiple layers of bidirectional Transformer decoders, primarily including two versions of different sizes: the basic version has 12 Transformer layers, each with 12 multi-head attention layers and a hidden layer size of 768; the enhanced version has 24 Transformer layers, each with 24 multi-head attention layers and a hidden layer size of 1024. It is evident that the deep and narrower model performs better than the shallower and wider model. Currently, BERT demonstrates excellent performance in multiple tasks, including machine translation, text classification, text similarity, and reading comprehension.

[0005] Developing a security monitoring system for semantic attacks on the PFCP protocol using large language models and strengthening the security of critical infrastructure are of great significance for enhancing the security of 5G networks for operators. Summary of the Invention

[0006] This invention addresses the problem that current 5G core network protection measures are only effective against traditional network security issues such as HTTP security and cannot handle PFCP protocol security events. It provides a PFCP protocol semantic attack detection method and device based on a large language model. Deployed between the UPF and SMF, the device collects and parses PFCP signaling data between the UPF and SMF, uses the BERT model to identify and predict semantic attacks on PFCP protocol cell compliance, and analyzes PFCP protocol security events.

[0007] This invention provides a method for detecting semantic attacks on the PFCP protocol based on a large language model, comprising the following steps:

[0008] S1. The PFCP signaling parser receives forwarded data from UPF or SMF, identifies the source IP address / port number, destination IP address / port number, and protocol type of the forwarded data through L2 to L7 layer protocols, then filters and identifies the PFCP signaling flow, classifies it according to the PFCP signaling flow to obtain the PFCP raw bitstream file, names it, and outputs it.

[0009] S2. The data preprocessor reads the PFCP raw code stream file, loads the response PFCP parsing rules according to the PFCP signaling process number in the PFCP raw code stream file name, performs L2 to L7 layer parsing on the PFCP signaling, and outputs the PFCP parsing log after parsing by naming. The PFCP parsing log is readable text.

[0010] The S3 and BERT models read the PFCP parsing logs and filter out the PFCP risk signaling texts. They then perform location encoding and risk classification on the filtered PFCP risk signaling texts and output embedded labels to represent them.

[0011] S4. The risk identifier reads the label embedding representation, uses a Bi-LSTM network for forward propagation, backward propagation, feature merging and sequence feature extraction to obtain the feature sequence, and then uses at least two classifiers to predict the feature sequence and output their respective prediction results. Finally, a comprehensive risk voting mechanism is used to vote on the prediction results and fuse the results to obtain the PFCP signaling risk type classification and risk probability. A PFCP protocol semantic attack detection method based on a large language model is completed.

[0012] The PFCP protocol semantic attack detection method based on a large language model described in this invention, as a preferred embodiment, in step S1, the filtering method is as follows: the PFCP signaling parser is configured with an IP whitelist, allowing only source IP addresses and destination IP addresses in the IP whitelist to continue parsing, and discarding forwarded data not in the IP whitelist; the PFCP signaling parser can also be configured with a protocol whitelist, allowing only PFCP protocol parsing, and discarding forwarded data that is not PFCP protocol.

[0013] The PFCP protocol semantic attack detection method based on a large language model described in this invention, as a preferred embodiment, includes the following categories in step S1: PFCP session establishment, PFCP session modification, PFCP session cancellation, PFCP session reporting, PFCP heartbeat request, PFCP PFD management, PFCP association establishment, PFCP association update, and PFCP association release.

[0014] The PFCP signaling flow is categorized and numbered. The name of the PFCP raw bitstream file includes, in order: timestamp, mask, and PFCP signaling flow number. The PFCP raw bitstream file is a pcap file.

[0015] In the PFCP protocol semantic attack detection method based on a large language model described in this invention, as a preferred embodiment, in step S2, the data preprocessor performs PFCP signaling parsing according to the PFCP parsing rules;

[0016] For L2 to L4 layer information, the PFCP resolution rule is: filter out the source / destination MAC address, and complete the resolution of the source / destination IP address and source / destination port number;

[0017] For L7 layer information, the PFCP parsing rule is: parsing is performed according to the full PFCP signaling cell parsing rules defined in the Third Generation Partner Program;

[0018] The PFCP parsing log is named sequentially with the timestamp, mask, and FCP signaling flow number, and is a txt file.

[0019] The PFCP protocol semantic attack detection method based on a large language model described in this invention, as a preferred embodiment, in step S3, the data preprocessor is a BERT model that is trained using a BERT-Base-Uncased pre-trained BERT model.

[0020] The training method includes the following steps:

[0021] SⅠ. Construct a PFCP attack event sample library. The samples in the PFCP attack event sample library include PFCP attack threat intelligence, research results, and simulated PFCP attack event samples. The simulated PFCP attack event samples are constructed using simulation instruments, and then the attack events are labeled using a semi-automated annotation tool.

[0022] Model training data is generated using a PFCP attack event sample library and divided into training and test sets.

[0023] SⅡ. Using the Transformers library, fine-tuning experiments were conducted on pre-trained BERT models and Transformer variant models based on the training set to identify PFCP attack event risk types. PFCP risk signaling texts were selected and their location encoded and risk-classified labels were output as embedded representations. During training, the Adam optimizer was used, with each model trained for at least 5 epochs and a learning rate set to 1e. -4 ~1e -5 between;

[0024] SⅢ, evaluate the performance of BERT model parameters using accuracy, precision, recall, and F1 score. Once the target is achieved, the BERT model training is complete, and the selection in step S3 is performed.

[0025] In the PFCP protocol semantic attack detection method based on a large language model described in this invention, as a preferred embodiment, the ratio of the training set to the test set in step SⅠ is 8:2.

[0026] In step SⅡ, the risk types of PFCP attack events include: PFCP signaling format attack, PFCP signaling protocol attack, PFCP signaling content attack, PFCP signaling logic attack, PFCP signaling storm attack, UPF man-in-the-middle attack, UPF memory leak, SMF memory leak, and fake UPF access;

[0027] PFCP signaling format attacks include: attacks that exploit duplicate / missing numbers, duplicate / missing types, or disordered order of necessary PFCP information elements, leading to abnormal processing logic; and attacks that exploit data types or value ranges of necessary PFCP information elements that exceed the requirements of network services, leading to abnormal processing logic.

[0028] PFCP signaling protocol attacks include malicious network element attacks caused by the mismatch between the source representation (IP, SUPI, PDU session ID) and address field of PFCP signaling and the actual characteristics of the network element; topology sniffing attacks caused by abnormal response signaling that cannot be associated with PFCP request signaling; malicious network element attacks caused by the use of non-3GPP standard ports of the PFCP protocol; unauthorized attacks caused by the mismatch between PFCP protocol interface permissions and network element permissions; and malicious network element attacks caused by the use of PFCP protocol signaling types that exceed the scope of network element services.

[0029] PFCP signaling content attack is a brute-force attack that exploits the fact that the content of PFCP protocol cell exceeds the scope of network element services.

[0030] PFCP signaling logic attacks include malicious network element attacks caused by abnormal signaling that cannot pass the private network-main network access authentication mechanism, botnet attacks caused by abnormal interruption of private network signaling, malicious terminal attacks caused by fixed-location devices frequently changing access locations through location update signaling, and fake base station attacks caused by dedicated devices attempting to access the 4G network through 5G to 4G switching signaling.

[0031] PFCP signaling storm attack is a signaling storm attack that uses the PFCP protocol to attack the core network.

[0032] A UPF man-in-the-middle attack is a man-in-the-middle attack that uses the N4 interface of the UPF to create an N9 tunnel.

[0033] UPF memory leaks are attacks that exploit the UPF N4_Association_Setup_Request message to continuously change the source port number, resulting in the inability to release the message body and thus causing a memory leak.

[0034] The SMF memory leak is an attack that exploits the SMF N4_Association_Setup_Request message to continuously change the source port number, resulting in the inability to release the message body and causing a memory leak.

[0035] The fake UPF access attack is a fake UPF access attack that uses N4_Association_Setup_Request to continuously probe the network.

[0036] The BERT model uses three positional encoding methods: word embedding, paragraph embedding, and positional embedding. The hidden layer size for word embedding is 768, and the dimension is (1, n, 768). In paragraph embedding, words from the previous sentence are represented by 0, and words from the next sentence are represented by 1, which helps BERT distinguish the vector representations of the two sentences in a sentence pair, and the dimension is (1, n, 768). Positional embedding enables the BERT model to learn the order attribute of the input, and the dimension is (1, n, 768).

[0037] The tag embedding is represented as a 768-dimensional embedding representation.

[0038] The PFCP protocol semantic attack detection method based on a large language model described in this invention, as a preferred embodiment, in step S4, the Bi-LSTM network is a model trained using label embedding representation; during the training of the Bi-LSTM network, the weights of the BERT model are frozen;

[0039] The Bi-LSTM network includes a pre-trained bidirectional LSTM network. The input size of the pre-trained bidirectional LSTM network is 768, and it includes a hidden layer of size 64. The pre-trained bidirectional LSTM network uses the maximum value of the output element of the LSTM network as a feature vector input to a single-layer fully connected network for classification.

[0040] During the training of the Bi-LSTM network, standard cross-entropy loss was used as the optimization criterion and the Adam optimizer, and the network was trained for more than 20 epochs. The learning rate could be set to 1e. -4 ~1e -5 between;

[0041] The classifier includes any one or more of the following: Support Vector Machine, KNN, Random Forest, and uses the scikit-learn library to implement a comprehensive risk voting mechanism with default parameter values;

[0042] During training using the integrated risk voting mechanism, standard cross-entropy loss was used as the optimization criterion and the Adam optimizer. Training lasted for more than 20 epochs with a learning rate set to 1e. -4 ~1e -5 between;

[0043] The performance of Bi-LSTM network model parameters is measured using accuracy, precision, recall, and F1 score.

[0044] The PFCP protocol semantic attack detection method based on a large language model described in this invention, as a preferred method, in step S4, the forward propagation is: the forward LSTM network processes the input 768-dimensional sequence from the first time step to the last time step, captures the past PFCP signaling flow context information to obtain the forward output;

[0045] Backpropagation is as follows: The backward LSTM processes the input 768-dimensional sequence from the last time step to the first time step, captures the future PFCP signaling flow context information, and obtains the backward output.

[0046] Feature merging: The forward and backward outputs of each time step are merged to obtain the complete PFCP signaling flow context features;

[0047] Sequence feature extraction is performed by applying an attention mechanism to the Bi-LSTM network to weight the contributions at different time steps, thereby completing feature extraction and obtaining the feature sequence.

[0048] In the PFCP protocol semantic attack detection method based on a large language model described in this invention, as a preferred method, in step S4, the comprehensive risk voting mechanism performs weighted voting based on confidence level.

[0049] This invention provides a PFCP protocol semantic attack detection device based on a large language model, comprising a PFCP signaling parser, a data preprocessor, a BERT model, and a risk identifier connected in sequence.

[0050] The PFCP signaling parser is located between the UPF and SMF, collects the forwarded data between the UPF and SMF, and performs filtering, identification, and classification to output the PFCP raw bitstream file;

[0051] The data preprocessor parses the PFCP signaling in the raw PFCP bitstream file and outputs the PFCP parsing log.

[0052] The BERT model performs semantic attack identification on the compliance of PFCP protocol information elements in the PFCP parsing log and outputs a label embedding representation.

[0053] The risk identifier makes predictions based on the embedded label representation and uses a comprehensive risk voting mechanism to assess the risk type classification and risk probability of PFCP signaling.

[0054] This technical solution utilizes the BERT (Bidirectional Encoder Representations from Transformers) model to perform contextual association on the diverse information cells of the PFCP protocol, capturing dependencies over longer distances and enabling the identification of PFCP protocol attack events.

[0055] The present invention has the following advantages:

[0056] (1) The present invention is a method and apparatus for detecting semantic attacks on the PFCP protocol using a large language model (hereinafter referred to as "PFCP protocol attack detection apparatus"). It is deployed between the UPF and the SMF, collects and parses PFCP signaling data between the UPF and the SMF, uses the BERT model to identify and predict semantic attacks on the compliance of PFCP protocol information cells, and analyzes PFCP protocol security events.

[0057] (2) The PFCP protocol includes signaling for PFCP session establishment, PFCP session modification, PFCP session cancellation, and PFCP reporting. Each signaling type contains numerous information elements, and security events are characterized by long periods of concealment and difficulty in detection. Currently available network risk identification databases cannot identify such risks. This invention is more targeted and facilitates the identification of PFCP protocol attack behaviors. Attached Figure Description

[0058] Figure 1 This is a flowchart of a semantic attack detection method for the PFCP protocol based on a large language model;

[0059] Figure 2 This is a schematic diagram of a semantic attack detection device based on a large language model and the PFCP protocol.

[0060] Figure 3This is a schematic diagram of information elements in the pcap file obtained after parsing the PDUSSession Modify Request in Embodiment 1 of a PFCP protocol semantic attack detection method and apparatus based on a large language model. Figure 1 ;

[0061] Figure 4 This is a schematic diagram of information elements in the pcap file obtained after parsing the PDUSSession Modify Request in Embodiment 1 of a PFCP protocol semantic attack detection method and apparatus based on a large language model. Figure 2 . Detailed Implementation

[0062] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0063] Example 1

[0064] like Figure 1 and Figure 2 As shown, a method and apparatus for detecting semantic attacks on the PFCP protocol based on a large language model are presented. The PFCP protocol attack detection apparatus consists of a PFCP signaling parser, a data preprocessor, a BERT model, and a risk identifier.

[0065] A method for detecting semantic attacks on the PFCP protocol based on a large language model includes the following steps:

[0066] S1. The PFCP signaling parser receives forwarded data from UPF or SMF, identifies the source IP address / port number, destination IP address / port number, and protocol type of the forwarded data through L2 to L7 layer protocols, then filters and identifies the PFCP signaling flow, classifies it according to the PFCP signaling flow to obtain the PFCP raw bitstream file, names it, and outputs it.

[0067] S2. The data preprocessor reads the PFCP raw code stream file, loads the response PFCP parsing rules according to the PFCP signaling process number in the PFCP raw code stream file name, performs L2 to L7 layer parsing on the PFCP signaling, and outputs the PFCP parsing log after parsing by naming. The PFCP parsing log is readable text.

[0068] The S3 and BERT models read the PFCP parsing logs and filter out the PFCP risk signaling texts. They then perform location encoding and risk classification on the filtered PFCP risk signaling texts and output embedded labels to represent them.

[0069] S4. The risk identifier reads the label embedding representation, uses a Bi-LSTM network for forward propagation, backward propagation, feature merging and sequence feature extraction to obtain the feature sequence, and then uses at least two classifiers to predict the feature sequence and output their respective prediction results. Finally, a comprehensive risk voting mechanism is used to vote on the prediction results and fuse the results to obtain the PFCP signaling risk type classification and risk probability. A PFCP protocol semantic attack detection method based on a large language model is completed.

[0070] The PFCP signaling parser works as follows:

[0071] The PFCP signaling parser receives forwarded data from UPF or SMF and identifies the source IP address and port number, destination IP address and port number, and protocol type of the forwarded data through L2 to L7 layer protocols. The PFCP signaling parser can be configured with an IP whitelist, allowing only whitelisted source and destination IP addresses to be resolved, while discarding data not in the whitelist. Similarly, the PFCP signaling parser can be configured with a protocol whitelist, allowing only PFCP protocol data to be resolved, while discarding data not using the PFCP protocol.

[0072] The PFCP signaling parser identifies and numbers different PFCP signaling flows using PFCP signaling identifiers. PFCP signaling flows include:

[0073] 0x1. PFCP Session Establishment Request / Response

[0074] 0x2. PFCP Session Modification Request / Response

[0075] 0x3. PFCP Session Deletion Request / Response (PFCP Session Cancellation Request / Response)

[0076] 0x4. PFCP Session Report Request / Response

[0077] 0x5. PFCP Heartbeat Request / Response

[0078] 0x6. PFCP PFD Management Request / Response

[0079] 0x7. PFCP Association Setup Request / Response

[0080] 0x8. PFCP Association Update Request / Response

[0081] 0x9. PFCPAssociation Release Request / Response

[0082] 0xA. PFCP Node Report Request / Response

[0083] The filtered traffic data is parsed into a raw PFCP bitstream file and output. The raw bitstream file is named according to the timestamp + three-bit mask + three-bit PFCP signaling process number, such as 202410201221220010xA.pcap

[0084] The data preprocessor works as follows:

[0085] The data preprocessor reads the original bitstream file, loads the response PFCP parsing rules according to the last three PFCP signaling process numbers, performs L2 to L7 layer parsing on the PFCP signaling, and outputs the parsing log.

[0086] For L2 to L4 layer information, PFCP resolution rules filter out source / destination MAC addresses and complete the resolution of source / destination IP addresses and source / destination port numbers.

[0087] For L7 layer information, the PFCP parsing rules follow the full PFCP signaling cell parsing rules defined in Section 7 of 3GPP TS29.244. For example, the PFCP Association Update response message (TS29.244 Section 7.4.4.4) requires parsing four cells: Node ID, Cause, User Plane Function Features, and Control Plane Function Features. The PFCP parsing rules load the original code stream of the response message with the number 0x9 and parse the four cells in the original code stream.

[0088] After the data preprocessor completes the parsing of PFCP signaling layers L2 to L7, it outputs the parsed data as readable text. The text is named according to the timestamp + three-digit mask + three-digit PFCP signaling process number, such as 202410201221220010xA.txt

[0089] The working principle of the tag processor is as follows:

[0090] The label processor utilizes a pre-trained version of BERT-Base-Uncased.

[0091] The BERT model receives filtered and classified readable PFCP signaling text from the data preprocessor, selects PFCP risk signaling text, and classifies the selected PFCP risk signaling text for risk classification.

[0092] The BERT model requires prior training. Since there is currently no comprehensive and widely accepted PFCP attack event database, diverse and high-quality attack samples are obtained by synchronizing PFCP attack threat intelligence and research results from 3GPP, the GSMA, research from well-known domestic and international operators, and research from renowned domestic and international universities. A large number of PFCP attack event samples are constructed using simulation instruments, and a semi-automated annotation tool is developed to label the attack events, creating a more diverse PFCP attack event sample database. Using this PFCP attack event sample database, 10Gbps of model training data is generated, divided into training and test sets with a ratio of 8:2.

[0093] Using the Transformers library, fine-tuning experiments were conducted on pre-trained BERT models and variant models using training set data to improve the classification performance of BERT models and obtain the optimal BERT model with the best experimental results. The Adam optimizer was used during training, with each model trained for at least 5 epochs, and the learning rate could be set to 1e. -4 ~1e -5 All other hyperparameters use their default values.

[0094] The following is a list of PFCP attack events:

[0095]

[0096] Model parameter performance is measured using standard metrics, including accuracy, precision, recall, and F1 score.

[0097] The risk identifier works as follows:

[0098] The BERT model creates a 768-dimensional embedding for each label in the output and feeds the label embeddings as input to the Bi-LSTM network for training. During the Bi-LSTM network training, the weights of the BERT model are frozen.

[0099] In RNN networks, the Bi-LSTM network has a pre-trained bidirectional LSTM network with a unit input size of 768 and a hidden layer of size 64. The pre-trained model uses the maximum value of the LSTM network output as a feature vector and inputs it into a single-layer fully connected network for classification.

[0100] During the training of the Bi-LSTM network, standard cross-entropy loss was used as the optimization criterion and the Adam optimizer, and the network was trained for more than 20 epochs. The learning rate could be set to 1e. -4 ~1e -5 between.

[0101] A comprehensive risk voting mechanism consisting of Support Vector Machine (SVM), KNN, and Random Forest is implemented using the scikit-learn library with default parameter values.

[0102] During training using the integrated risk voting mechanism, standard cross-entropy loss was used as the optimization criterion and the Adam optimizer. Training was conducted for more than 20 epochs, and the learning rate could be set to 1e. -4 ~1e -5 between.

[0103] Model parameter performance is measured using standard metrics, including accuracy, precision, recall, and F1 score.

[0104] Ultimately, the comprehensive risk voting mechanism outputs the PFCP signaling risk type classification and probability.

[0105] Take the "UPF man-in-the-middle attack" as an example. This attack occurs during the PDU SessionModify Request signaling process for updating the PDR.

[0106] Table 7.5.4.2-1 of 3GPP TS29.244V16.3.0 (2020-03) states that the PDU SessionModify Request for updating the PDR must carry the information elements shown in the table below:

[0107]

[0108] Table 7.5.5.1-1 of 3GPP TS29.244V16.3.0 (2020-03) specifies that the PDU SessionModify Response when updating the PDR must carry the information elements shown in the table below:

[0109]

[0110]

[0111] After the PFCP signaling parser parses the PDU Session Modify Request, the resulting pcap file contains, for example: Figure 3 The cell shown.

[0112] After the PFCP signaling parser parses the PDU Session Modify Response, the obtained pcap file contains, for example: Figure 4 The cell shown.

[0113] The PDU SessionModify Request is parsed into a binary .txt file by the data preprocessor, with the binary data of each information cell between the two "|" symbols.

[0114] |0|fa|16|3e|28|a3|e6|50|e0|ef|16|38|14|81|00|02|0a|08|00|45|00|00|75|03|ee|00|00|3f|11|4a|04|0a|b1|14| 03|0a|b1|04|22|22|65|22|65|00|61|88|1c|21|34|00|55|00|00|00|00|00|03|91|00|00|00|05|00|00|01|00|45|00| 38|00|02|00|03|00|1d|00|04|00|00|00|01|00|02|00|26|00|14|00|01|00|00|a0|00|01|0f|00|15|00|02|0d|05|00| 16|00|04|03|6e|39|75|00|7c|00|01|01|00|5d|00|05|02|46|46|46|01|00|5f|00|01|00|00|6c|00|04|00|00|00|01|

[0115] The PDU SessionModify Response is parsed into a binary .txt file by the data preprocessor, with the binary data of each information cell between the two "|" symbols.

[0116] |0|50|e0|ef|16|38|14|fa|16|3e|28|a3|e6|81|00|0f|ac|08|00|45|e0|00|58|0c|3d|00|00 |fe|11|81|f1|0a|b1|04|22|0a|b1|14|03|22|65|22|65|00|44|a2|d5|21|35|00|38|00|00|0 0|00|00|00|27|11|00|00|05|00|00|13|00|01|01|00|08|00|23|00|38|00|02|00|03|00|15| 00|19|03|40|03|91|06|0a|b1|04|23|20|20|01|77|00|00|00|00|00|00|00|00|00|00|04|35|

[0117] The two .txt files above are used as samples for pre-training of the BERT model. The BERT model uses three location embedding methods to encode the location of each data point:

[0118] Token embeddings are vector representations of each token. Since a basic BERT pre-trained model is used, the hidden layer size is 768, and the dimensions are (1, n, 768).

[0119] Segment embeddings use 0 to represent words in the previous sentence and 1 to represent words in the next sentence to assist BERT in distinguishing the vector representations of the two sentences in a sentence pair. The dimensions are (1, n, 768).

[0120] Position embeddings allow BERT to learn the order attributes of the input, with dimensions (1, n, 768).

[0121] The pseudocode for implementing BERT positional encoding using Python is as follows:

[0122] # Assuming vocab_size = 30522 # Vocabulary size type_vocab_size = 2 # Number of paragraph types, usually 2 (single sentences and sentence pairs) max_position_embeddings = 512 # Maximum sequence length embedding_size = 768 # Dimension of embedding vectors

[0123] #Word embedding matrix word_embeddings = np.random.normal(size = (vocab_size, embedding_size))

[0124] #Segment embedding matrix segment_embeddings = np.random.normal(size = (type_vocab_size, embedding_size))

[0125] # Position embedding matrix: position_embeddings = np.zeros((max_position_embeddings, embedding_size))

[0126] forposin range(max_position_embeddings):

[0127] for iin range(0,embedding_size,2):

[0128] position_embeddings[pos,i]=np.sin(pos / np.power(10000,i / embedding_size))

[0129] position_embeddings[pos,i+1]=np.cos(pos /

[0130] np.power(10000,(i+1) / embedding_size))

[0131] # Input data input_ids = [...] # Token ID sequence token_type_ids = [...] # Paragraph type ID sequence, used to distinguish between two sentences in a sentence pair

[0132] #Word embedding word_embeddings_input=word_embeddings[input_ids]

[0133] # Paragraph embedding: segment_embeddings_input = segment_embeddings[token_type_ids]

[0134] #Position embeddings_position_embeddings_input =

[0135] position_embeddings[range(len(input_ids))]

[0136] # Add token embeddings, paragraph embeddings, and position embeddings together: token_embeddings = word_embeddings_input +

[0137] segment_embeddings_input+position_embeddings_input

[0138] # Output returntoken_embeddings

[0139] in:

[0140] 1. word_embeddings is a matrix that is the size of the vocabulary multiplied by the dimension of the embedding vectors, used to store the embedding vector for each word.

[0141] 2. segment_embeddings is a matrix that is the number of segment types multiplied by the dimension of the embedding vector, used to store the embedding vector for each segment type.

[0142] 3. position_embeddings is a matrix consisting of the maximum sequence length multiplied by the dimension of the embedding vector, used to store the embedding vector at each position.

[0143] 4. input_ids is a sequence containing the token IDs of the input text.

[0144] 5. token_type_ids is a sequence used to distinguish the two sentences in a sentence pair. Typically, all token IDs of the first sentence correspond to one value, and all token IDs of the second sentence correspond to another value.

[0145] 6. word_embeddings_input is obtained by finding the corresponding embedding vector of input_ids in word_embeddings.

[0146] 7. segment_embeddings_input is obtained by finding the corresponding embedding vector of token_type_ids in segment_embeddings.

[0147] 8. The position_embeddings_input is obtained by finding the corresponding embedding vector in position_embeddings for the position index.

[0148] 9. Finally, add the three embedding vectors together to obtain the final embedding representation of each word.

[0149] After BERT completes positional encoding, Bi-LSTM uses positional encoding to extract features from the PFCP SessionModify Request / PFCP SessionModify Response.

[0150] Input sequence: Bi-LSTM receives the BERT-encoded sequence of PFCP SessionModify Request / PFCP SessionModifyResponse as input, with each time step containing a 768-dimensional vector.

[0151] Forward propagation: The forward LSTM processes the 768-dimensional sequence of input from the first time step to the last time step, capturing past PFCP SessionModify Request / PFCP SessionModify Response context information.

[0152] Backpropagation: Backpropagation LSTM processes the 768-dimensional sequence of input from the last time step to the first time step, capturing the context information of future PFCP SessionModify Request / PFCP SessionModify Response.

[0153] Feature merging: The forward and backward outputs of each time step are merged (usually concatenated) to form the complete PFCP Session Modify context features.

[0154] Sequence feature extraction: Bi-LSTM uses an attention mechanism to weight the contributions of different time steps to complete feature extraction.

[0155] The pseudocode for implementing feature extraction using a Bi-LSTM model in Python is as follows:

[0156]

[0157]

[0158] A comprehensive risk voting mechanism scores the features extracted from PFCP Session Modify Requests / PFCP Session Modify Responses and filters out signaling messages with a high probability of detection. In PFCP protocol semantic attack detection, this mechanism can reduce false positives and false negatives, improving the accuracy of attack detection.

[0159] Independent prediction: Each classifier (such as SVM, KNN, random forest) independently predicts the feature sequence and outputs its own risk score or class label.

[0160] Voting mechanism: Voting is based on the classifier's prediction results. Weighted voting is based on confidence levels.

[0161] Results fusion: Ultimately, features like network instance=n9u were identified as "man-in-the-middle attacks." A comprehensive risk voting mechanism was used to identify the risks.

[0162] The pseudocode for implementing a comprehensive risk voting mechanism using Python is as follows:

[0163]

[0164]

[0165] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting semantic attacks on the PFCP protocol based on a large language model, characterized in that: Includes the following steps: S1. The PFCP signaling parser receives forwarded data from UPF or SMF, identifies the source IP address / port number, destination IP address / port number, and protocol type of the forwarded data through L2 to L7 layer protocols, then filters and identifies the PFCP signaling flow, classifies it according to the PFCP signaling flow to obtain the PFCP raw bitstream file, names it, and outputs it. S2. The data preprocessor reads the PFCP raw code stream file, loads the response PFCP parsing rule according to the PFCP signaling process number in the PFCP raw code stream file name, performs L2 to L7 layer parsing on the PFCP signaling, and outputs the PFCP parsing log after parsing by naming. The PFCP parsing log is readable text. S3, the BERT model reads the PFCP parsing log and filters out the PFCP risk signaling text, performs location encoding and risk classification on the filtered PFCP risk signaling text, and outputs a label embedding representation; S4. The risk identifier reads the label embedding representation, uses a Bi-LSTM network for forward propagation, backward propagation, feature merging and sequence feature extraction to obtain a feature sequence, then uses at least two classifiers to predict the feature sequence and output their respective prediction results, and then uses a comprehensive risk voting mechanism to vote on the prediction results and fuse the results to obtain the PFCP signaling risk type classification and risk probability.

2. The PFCP protocol semantic attack detection method based on a large language model according to claim 1, characterized in that: In step S1, the filtering method is as follows: the PFCP signaling resolver is configured with an IP whitelist, which only allows source IP addresses and destination IP addresses in the IP whitelist to continue to be resolved, and forwarded data not in the IP whitelist is discarded; The PFCP signaling parser can also be configured with a protocol whitelist, allowing only PFCP protocol data to be parsed and discarding forwarded data that is not PFCP protocol data.

3. The PFCP protocol semantic attack detection method based on a large language model according to claim 1, characterized in that: In step S1, the categories of the PFCP signaling process include: PFCP session establishment, PFCP session modification, PFCP session cancellation, PFCP session reporting, PFCP heartbeat request, PFCP PFD management, PFCP association establishment, PFCP association update, and PFCP association release; The PFCP signaling process is categorized and numbered. The name of the PFCP raw bitstream file includes, in sequence: timestamp, mask, and PFCP signaling process number. The PFCP raw bitstream file is a pcap file.

4. The PFCP protocol semantic attack detection method based on a large language model according to claim 1, characterized in that: In step S2, the data preprocessor performs PFCP signaling parsing according to the PFCP parsing rules; For L2 to L4 layer information, the PFCP resolution rule is: filter out the source / destination MAC address, and complete the resolution of the source / destination IP address and source / destination port number; For L7 layer information, the PFCP parsing rule is: to parse according to the full PFCP signaling cell parsing rules defined in the Third Generation Partner Program; The PFCP parsing log is named by sequentially concatenating the timestamp, mask, and FCP signaling process number, and the PFCP parsing log is a txt file.

5. The PFCP protocol semantic attack detection method based on a large language model according to claim 1, characterized in that: In step S3, the data preprocessor is a BERT model that is trained again using a BERT-Base-Uncased pre-trained BERT model; The training method includes the following steps: SⅠ. Construct a PFCP attack event sample library. The samples in the PFCP attack event sample library include PFCP attack threat intelligence, research results, and simulated PFCP attack event samples. The simulated PFCP attack event samples are constructed using simulation instruments, and then the attack events are labeled using a semi-automated annotation tool. The model training data is formed using the PFCP attack event sample library and divided into training set and test set; SⅡ. Using the Transformers library and the training set, fine-tuning experiments are conducted on the pre-trained BERT model and Transformer variant model to identify PFCP attack event risk types. The PFCP risk signaling texts are selected, and positional encoding and risk classification are performed to output the label embedding representation. During training, the Adam optimizer is used, with each model trained for at least 5 epochs and a learning rate set to 1e. -4 ~1e -5 between; SⅢ, evaluate the performance of BERT model parameters using accuracy, precision, recall, and F1 score. Once the target is achieved, the BERT model training is complete, and the selection in step S3 is performed.

6. The PFCP protocol semantic attack detection method based on a large language model according to claim 5, characterized in that: In step SⅠ, the ratio of the training set to the test set is 8:2; In step SⅡ, the PFCP attack event risk types include: PFCP signaling format attack, PFCP signaling protocol attack, PFCP signaling content attack, PFCP signaling logic attack, PFCP signaling storm attack, UPF man-in-the-middle attack, UPF memory leak, SMF memory leak, and fake UPF access; The PFCP signaling format attacks include: attacks that exploit the duplication / missing number, duplication / missing type, and disordered order of necessary PFCP information elements to cause abnormal processing logic, and attacks that exploit the fact that the data type and value range of necessary PFCP information elements exceed the requirements of the network's service scope to cause abnormal processing logic. The PFCP signaling protocol attacks include malicious network element attacks caused by the mismatch between the PFCP signaling source representation (IP, SUPI, PDU session ID) and address field and the actual characteristics of the network element; topology sniffing attacks caused by abnormal response signaling that cannot be associated with PFCP request signaling; malicious network element attacks caused by the use of non-3GPP standard ports of the PFCP protocol; privilege escalation attacks caused by the mismatch between PFCP protocol interface permissions and network element permissions; and malicious network element attacks caused by the use of PFCP protocol signaling types that exceed the scope of network element services. The PFCP signaling content attack is a brute-force attack that exploits the fact that the PFCP protocol cell content exceeds the scope of network element services. The PFCP signaling logic attacks include malicious network element attacks caused by abnormal signaling that cannot pass the private network-main network access authentication mechanism, botnet attacks caused by abnormal interruption of private network signaling, malicious terminal attacks caused by fixed-location devices frequently changing access locations through location update signaling, and fake base station attacks caused by dedicated devices attempting to access the 4G network through 5G to 4G switching signaling. The PFCP signaling storm attack refers to a signaling storm attack on the core network using the PFCP protocol. The aforementioned UPF man-in-the-middle attack is a man-in-the-middle attack that uses the N4 interface of the UPF to create an N9 tunnel. The UPF memory leak is an attack that exploits the UPF N4_Association_Setup_Request message to continuously change the source port number, resulting in the inability to release the message body and thus causing a memory leak. The SMF memory leak is an attack that exploits the SMF N4_Association_Setup_Request message to continuously change the source port number, resulting in the inability to release the message body, thus causing a memory leak. The fake UPF access is a fake UPF access attack that uses N4_Association_Setup_Request to continuously probe the network. The BERT model employs three positional encoding methods: word embedding, paragraph embedding, and positional embedding. The hidden layer size for word embedding is 768, with dimensions (1, n, 768). In paragraph embedding, words from the preceding sentence are represented by 0, and words from the following sentence are represented by 1, assisting BERT in distinguishing the vector representations of the two sentences in a sentence pair; the dimension is (1, n, 768). Positional embedding enables the BERT model to learn the order attributes of the input, with dimensions (1, n, 768). The label embedding representation is a 768-dimensional embedding representation.

7. The PFCP protocol semantic attack detection method based on a large language model according to claim 1, characterized in that: In step S4, the Bi-LSTM network is a model trained using the label embedding representation; during the training of the Bi-LSTM network, the weights of the BERT model are frozen; The Bi-LSTM network includes a pre-trained bidirectional LSTM network, the input size of which is 768, and includes a hidden layer of size 64. The pre-trained bidirectional LSTM network uses the maximum value of the output element of the LSTM network as a feature vector input to a single-layer fully connected network for classification. During training, the Bi-LSTM network was trained for more than 20 epochs using standard cross-entropy loss as the optimization criterion and Adam optimizer, with a learning rate set to 1e. -4 ~1e -5 between; The classifier includes any one or more of the following: support vector machine, KNN, random forest. The comprehensive risk voting mechanism is implemented using the scikit-learn library and uses default parameter values. During the training of the comprehensive risk voting mechanism, standard cross-entropy loss was used as the optimization criterion and Adam optimizer, and the mechanism was trained for more than 20 epochs with a learning rate set to 1e. -4 ~1e -5 between; The performance of the model parameters of the Bi-LSTM network is measured using accuracy, precision, recall, and F1 score.

8. The PFCP protocol semantic attack detection method based on a large language model according to claim 1, characterized in that: In step S4, the forward propagation is as follows: the forward LSTM network processes the input 768-dimensional sequence from the first time step to the last time step, captures the past PFCP signaling process context information, and obtains the forward output. The backpropagation is as follows: the backward LSTM processes the input 768-dimensional sequence from the last time step to the first time step, captures the future PFCP signaling flow context information, and obtains the backward output; The features are merged as follows: the forward output and the backward output of each time step are merged to obtain the complete PFCP signaling flow context features; The sequence feature extraction is performed by applying an attention mechanism to the Bi-LSTM network to weight the contributions at different time steps, thereby completing the feature extraction and obtaining the feature sequence.

9. The PFCP protocol semantic attack detection method based on a large language model according to claim 1, characterized in that: In step S4, the comprehensive risk voting mechanism uses weighted voting based on confidence level.

10. A PFCP protocol semantic attack detection device based on a large language model, used to execute the PFCP protocol semantic attack detection method based on a large language model as described in any one of claims 1 to 9, characterized in that: It includes the PFCP signaling parser, the data preprocessor, the BERT model, and the risk identifier, which are connected in sequence. The PFCP signaling parser is located between the UPF and SMF, collects the forwarding data between the UPF and SMF, and filters, identifies, and classifies it to output the PFCP raw bitstream file; The data preprocessor parses the PFCP signaling in the PFCP raw code stream file and outputs the PFCP parsing log. The BERT model performs semantic attack identification on the compliance of PFCP protocol information elements in the PFCP parsing log and outputs the tag embedding representation. The risk identifier makes predictions based on the embedded label representation and uses a comprehensive risk voting mechanism to determine the PFCP signaling risk type classification and risk probability.

Images