Suspicious behavior reporting

Abstract

Aspects of the disclosure relate to a method, apparatus and system for supporting suspicious behavior reporting. For example, implementations provide techniques for aggregating data related to suspicious behaviors in wireless communications and for propagating data to different entities in a wireless system. By utilizing the techniques, device and information security in wireless communications can be enhanced.

Description

[0001] Related Applications

[0002] This application claims priority to U.S. Provisional Application Serial No. 63 / 411,926, filed on September 30, 2022, entitled “SUSPICIOUS BEHAVIOR REPORTING,” the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates to wireless communications, and more particularly to security in wireless communications. Background Art

[0004] A wireless communication system may include one or more network communication devices (such as a base station), which may be referred to as an eNodeB (eNB), a next generation NodeB (gNB), or other suitable terms. Each network communication device (such as a base station) may support wireless communication for one or more user communication devices, which may also be referred to as user equipment (UE) or other suitable terms. A wireless communication system may support wireless communication with one or more user communication devices by utilizing resources of a wireless communication system (e.g., time resources (e.g., symbols, time slots, subframes, frames, etc.) or frequency resources (e.g., subcarriers, carriers)). Additionally, a wireless communication system may support wireless communication across various radio access technologies, including third generation (3G) radio access technology, fourth generation (4G) radio access technology, fifth generation (5G) radio access technology, and other suitable radio access technologies beyond 5G (e.g., sixth generation (6G)).

[0005] Some wireless communication systems provide methods for attempting to identify malicious behavior in wireless communications. However, such systems may be limited in their ability to collect certain types of data related to potential malicious behavior. Summary of the invention

[0006] The present disclosure relates to methods, apparatuses, and systems for supporting suspicious behavior reporting. For example, implementations provide techniques for aggregating data related to suspicious behavior in wireless communications and for propagating the data to different entities in the wireless system. By utilizing the techniques, device and information security in wireless communications can be enhanced.

[0007] Some implementations of the methods and devices described herein may also include: generating, by the first device, suspicious behavior data based on detected suspicious behavior related to direct communication between the second device and the first device, the suspicious behavior data including an event identifier, a timestamp, and one or more of the following items: an event identifier, an identifier for the second device, an application identifier, a service type, service function information, an identifier for the first device, a destination relay identifier, or business telemetry data; generating a suspicious behavior report including at least some of the suspicious behavior data; and sending the suspicious behavior report.

[0008] Some implementations of the methods and devices described herein may also include: wherein the suspicious behavior includes one or more of the following items: improper behavior related to direct communication, malicious behavior related to direct communication, or suspected malicious behavior related to direct communication; also includes collecting business telemetry data from the second device, the business telemetry data including one or more of the following items: suspicious data or suspicious messages; the first device includes a first user equipment (UE), and the second device includes one or more of the following items: a second UE, a UE-network relay, or a relay node; also includes detecting suspicious behavior based on at least one of the following items: the second device causes multiple direct communication links to fail; the message exchange related to direct communication includes one or more of the following items: business or data that deviates from at least one of the standard message exchange protocol or the standard message exchange format; the second device performs an operation that cannot be recognized by the first device; the second device sends data exceeding a threshold; an error detected during the implementation of the direct communication establishment process with the second device; or an error detected in the direct communication link established with the second device; the threshold is related to one or more of the following items: configured limitations or processing capabilities.

[0009] Some implementations of the methods and devices described herein may also include: wherein the identifier for the second device includes one or more of the following items: a destination ProSe relay UE identifier, a destination layer-2 identifier, or a ProSe layer-2 group identifier; the identifier for the first device includes one or more of the following items: a source ProSe relay UE identifier, a source layer-2 identifier, or a ProSe group identifier; the service type includes at least one of the following items: ProSe, U2X, or V2X; also includes sending information about at least one service function in a suspicious behavior report, and wherein at least one service function includes one or more of the following items: a ProSe service function, a U2X service function, or a V2X service function; also includes: determining to use a control plane to send a suspicious behavior report; and sending a suspicious behavior report to an access and mobility management function (AMF) via a non-access stratum (NAS); also includes: determining to use a user plane to send a suspicious behavior report; and sending a suspicious behavior report to an application function (AF); determining to use a user plane to send a suspicious behavior report includes determining to use an application-level connection to send a suspicious behavior report.

[0010] Some implementations of the methods and devices described herein may also include: receiving a suspicious behavior report by a first device, the suspicious behavior report including suspicious behavior data based on detected suspicious behavior related to direct communication between a second device and a third device, the suspicious behavior data including an event identifier, a timestamp, and one or more of the following: an event identifier, a source identifier for the second device, an application identifier, a service type, service function information, an identifier for the first device, a destination relay identifier, or business telemetry data; and sending the suspicious behavior report to a fourth device.

[0011] Some implementations of the methods and devices described herein may also include: wherein the first device includes an AF, the second device includes a first user equipment (UE) that generates a suspicious behavior report, and the third device includes one or more of the following items: a second UE, a UE-network relay, or a relay node that causes the behavior described by at least some of the suspicious behavior data; the fourth device includes at least one of the following items: a network data analysis function (NWDAF) or a network open function (NEF); and also includes receiving a confirmation message from the fourth device based at least in part on the suspicious behavior report.

[0012] Some implementations of the methods and devices described herein may also include: at the first device, receiving a suspicious behavior report from the second device, the suspicious behavior report including suspicious behavior data based on detected suspicious behavior related to direct communication between the third device and the fourth device; and sending a confirmation message to the second device based at least in part on the suspicious behavior report.

[0013] Some implementations of the methods and apparatus described herein may also include: wherein the first device includes an NWDAF, the second device includes at least one of the following items: an AF or an NEF, the third device includes a first user equipment (UE) that generates at least some of the suspicious behavior data, and the fourth device includes one or more of the following items: a second UE, a UE-network relay, or a relay node that causes the behavior described by at least some of the suspicious behavior data; the suspicious behavior data includes an event identifier, a timestamp, and one or more of the following items: an event identifier, a source identifier for the fourth device, an application identifier, a service type, service function information, an identifier for the third device, a destination relay identifier, or an industry service telemetry data; the suspicious behavior data includes an event identifier, a timestamp, and one or more of the following items: an event identifier, an identifier for a second device, an application identifier, a service type, service function information, an identifier for a first device, a destination relay identifier, or service telemetry data; also includes output analysis data, which includes one or more of the following items: a list of observed anomalies, detected risks, a type of attack associated with the suspicious behavior data, an indication of the severity of the suspicious behavior, a list of one or more UE-related devices suspected of being the cause of the suspicious behavior, a list of one or more UE-related devices suspected of being affected by the suspicious behavior of other UEs, or an indication of a confidence value related to the suspicious behavior.

[0014] Some implementations of the methods and devices described herein may also include: at a first device, receiving a suspicious behavior report from a second device via a non-access stratum (NAS) transmission, the suspicious behavior report including suspicious behavior data based on detected suspicious behavior related to direct communication between the second device and a third device; and sending the suspicious behavior report to a fourth device.

[0015] Some implementations of the methods and devices described herein may also include: wherein the first device includes an access and mobility management function (AMF), the second device includes a first user equipment (UE) that generates at least some of the suspicious behavior data, the third device includes one or more of the following items: a second UE, a UE-network relay, or a relay node that causes the behavior described by at least some of the suspicious behavior data, and the fourth device includes an NWDAF; also including: receiving one or more of the following items related to the suspicious behavior report from the second device: a freshness parameter, a subscription permanent identifier (SUPI), or a message authentication code (MAC); and sending one or more of the following items to the fourth device: a freshness parameter, a SUPI, or a MAC. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1An example of a wireless communication system that supports suspicious behavior reporting according to aspects of the present disclosure is illustrated.

[0017] Figure 2 The diagram illustrates a process for data collection from a UE.

[0018] Figure 3 A process for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated.

[0019] Figure 4 A process for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated.

[0020] Figure 5 A process for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated.

[0021] Figure 6 A process for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated.

[0022] Figure 7 and Figure 8 An example of a block diagram of a device that supports suspicious behavior reporting according to aspects of the present disclosure is illustrated.

[0023] Figures 9 to 12 A flow chart of a method for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated. DETAILED DESCRIPTION

[0024] In a wireless communication system, support may be provided for AF-based UE data collection for UE-related data analysis. However, some existing procedures do not specify what information the UE uses to determine to provide data related to suspicious behavior to the AF, such as to identify (multiple) network attacks. In addition, some existing data collection procedures for UEs (e.g., using AF) do not specify which data is collected for different scenarios related to direct communication, such as direct communication involving a relay that exhibits suspicious behavior, direct communication involving (multiple) relays in which the UE exhibits suspicious behavior, V2X scenarios in which the UE exhibits suspicious behavior, etc. The lack of sufficient data about such behavior may result in the analysis function (e.g., NWDAF) being unable to identify security risks (e.g., network attacks), as well as the identity of the entity causing such security risks and the extent of such security risks.

[0025] Therefore, the present disclosure provides a technology to support suspicious behavior reporting. For example, the implementation provides a technology for aggregating data related to suspicious behavior in wireless communications and for propagating the data to different entities in the wireless system. By utilizing the technology, the security of devices and information in wireless communications can be enhanced.

[0026] Aspects of the disclosure are described in the context of a wireless communication system.Aspects of the disclosure are also illustrated and described with reference to device diagrams and flow diagrams.

[0027] Figure 1 An example of a wireless communication system 100 that supports suspicious behavior reporting according to aspects of the present disclosure is illustrated. The wireless communication system 100 may include one or more network entities 102, one or more UEs 104, a core network 106, and a packet data network 108. The wireless communication system 100 may support various radio access technologies. In some implementations, the wireless communication system 100 may be a 4G network, such as an LTE network or an advanced LTE (LTE-A) network. In some other implementations, the wireless communication system 100 may be a 5G network, such as an NR network. In other implementations, the wireless communication system 100 may be a combination of a 4G network and a 5G network, or other suitable radio access technologies, including the Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20. The wireless communication system 100 may support radio access technologies other than 5G. Additionally, the wireless communication system 100 may support technologies such as time division multiple access (TDMA), frequency division multiple access (FDMA), or code division multiple access (CDMA).

[0028] One or more network entities 102 may be dispersed throughout a geographic area to form a wireless communication system 100. One or more of the network entities 102 described herein may be or include or may be referred to as a network node, a base station, a network element, a RAN, a base transceiver station, an access point, a NodeB, an eNodeB (eNB), a next generation NodeB (gNB), or other suitable terms. The network entity 102 and the UE 104 may communicate via a communication link 110, which may be a wireless or wired connection. For example, the network entity 102 and the UE 104 may perform wireless communication (e.g., receive signaling, send signaling) via a Uu interface.

[0029] The network entity 102 may provide a geographic coverage area 112 for which the network entity 102 may support services (e.g., voice, video, packet data, messaging, broadcast, etc.) for one or more UEs 104 within the geographic coverage area 112. For example, the network entity 102 and the UE 104 may support wireless communications of signals associated with services (e.g., voice, video, packet data, messaging, broadcast, etc.) according to one or more radio access technologies. In some implementations, the network entity 102 may be mobile, for example, a satellite associated with a non-terrestrial network. In some implementations, different geographic coverage areas 112 associated with the same or different radio access technologies may overlap, but different geographic coverage areas 112 may be associated with different network entities 102. The information and signals described herein may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the description may be represented by voltage, current, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0030] One or more UEs 104 may be dispersed throughout the geographic area of ​​the wireless communication system 100. UE 104 may include or may be referred to as a mobile device, a wireless device, a remote device, a remote unit, a handheld device, or a subscriber device, or some other suitable term. In some implementations, UE 104 may be referred to as a unit, a station, a terminal, or a client, etc. Additionally or alternatively, UE 104 may be referred to as an Internet of Things (IoT) device, an Internet of Everything (IoE) device, or a machine type communication (MTC) device, etc. In some implementations, UE 104 may be stationary in the wireless communication system 100. In some other implementations, UE 104 may be mobile in the wireless communication system 100.

[0031] One or more UEs 104 may be devices of different forms or with different capabilities. Figure 1 Some examples of UE 104 are illustrated in FIG. Figure 1 As shown, UE 104 can communicate with various types of devices, such as network entity 102, other UE 104, or network equipment (e.g., core network 106, packet data network 108, relay device, integrated access and backhaul (IAB) node, or another network device). Additionally or alternatively, UE 104 can support communication with other network entities 102 or UE 104 that can act as relays in wireless communication system 100.

[0032] The UE 104 may also be capable of supporting wireless communications directly with other UEs 104 via a communication link 114. For example, the UE 104 may support wireless communications directly with another UE 104 via a device-to-device (D2D) communication link. In some implementations, such as vehicle-to-vehicle (V2V) deployments, V2X deployments, or cellular V2X deployments, the communication link 114 may be referred to as a sidelink. For example, the UE 104 may support wireless communications directly with another UE 104 via a PC5 interface.

[0033] The network entity 102 may support communication with the core network 106 or with another network entity 102 or both. For example, the network entity 102 may be connected to the core network 106 via one or more backhaul links 116 (e.g., via S1, N2, N2 or another network interface). The network entities 102 may communicate with each other via the backhaul links 116 (e.g., via X2, Xn or another network interface). In some implementations, the network entities 102 may communicate directly with each other (e.g., between the network entities 102). In some other implementations, the network entities 102 may communicate with each other or indirectly (e.g., via the core network 106). In some implementations, one or more network entities 102 may include subcomponents, such as access network entities, which may be examples of access node controllers (ANCs). The ANC may communicate with one or more UEs 104 via one or more other access network transport entities (which may be referred to as radio heads, smart radio heads, or transport reception points (TRPs)).

[0034] In some implementations, the network entity 102 may be configured in a decomposed architecture that may be configured to utilize a protocol stack that is physically or logically distributed between two or more network entities 102, such as an integrated access backhaul (IAB) network, an open RAN (O-RAN) (e.g., a network configuration sponsored by the O-RAN Alliance), or a virtualized RAN (vRAN) (e.g., a cloud RAN (C-RAN)). For example, the network entity 102 may include one or more of the following: a central unit (CU), a distributed unit (DU), a radio unit (RU), a RAN intelligent controller (RIC) (e.g., a near real-time RIC (near real-time (RT) RIC), a non-real-time RIC (non-RT RIC)), a service management and orchestration (SMO) system, or any combination thereof.

[0035] The RU may also be referred to as a radio head, a smart radio head, a remote radio head (RRH), a remote radio unit (RRU), or a transmission reception point (TRP). In a decomposed RAN architecture, one or more components of the network entity 102 may be co-located, or one or more components of the network entity 102 may be located at distributed locations (e.g., separate physical locations). In some implementations, one or more network entities 102 of the decomposed RAN architecture may be implemented as virtual units (e.g., virtual CU (VCU), virtual DU (VDU), virtual RU (VRU)).

[0036] The functional split between CU, DU and RU can be flexible, and different functions can be supported according to the functions performed at the CU, DU or RU (e.g., network layer functions, protocol layer functions, baseband functions, radio frequency functions and any combination thereof). For example, a functional split of the protocol stack can be adopted between the CU and the DU, so that the CU can support one or more layers of the protocol stack and the DU can support one or more different layers of the protocol stack. In some implementations, the CU can host upper protocol layer (e.g., Layer 3 (L3), Layer 2 (L2)) functions and signaling (e.g., Radio Resource Control (RRC), Service Data Adaptation Protocol (SDAP), Packet Data Convergence Protocol (PDCP)). The CU can be connected to one or more DUs or RUs, and one or more DUs or RUs can host lower protocol layers, such as Layer 1 (L1) (e.g., physical (PHY) layer) or L2 (e.g., radio link control (RLC) layer, MAC layer) functions and signaling, and each DU or RU can be at least partially controlled by the CU.

[0037] Additionally or alternatively, a functional split of the protocol stack may be employed between the DU and the RU such that the DU may support one or more layers of the protocol stack and the RU may support one or more different layers of the protocol stack. The DU may support one or more different cells (e.g., via one or more RUs). In some implementations, the functional split between the CU and the DU or between the DU and the RU may be within the protocol layer (e.g., some functions for the protocol layer may be performed by one of the CU, DU, or RU, while other functions of the protocol layer may be performed by different items of the CU, DU, or RU).

[0038] The CU may be further functionally split into CU control plane (CU-CP) and CU user plane (CU-UP) functions. The CU may be connected to one or more DUs via a medium-range communication link (e.g., F1, F1-c, F1-u), and the DU may be connected to one or more RUs via a fronthaul communication link (e.g., an open fronthaul (FH) interface). In some implementations, the medium-range communication link or the fronthaul communication link may be implemented according to an interface (e.g., a channel) between layers of a protocol stack supported by a corresponding network entity 102 communicating via such a communication link.

[0039] The core network 106 may support user authentication, access authorization, tracking, connectivity, and other access, routing, or mobility functions. The core network 106 may be an evolved packet core (EPC) or a 5G core (5GC), which may include control plane entities that manage access and mobility (e.g., mobility management entity (MME), access and mobility management function (AMF)), and user plane entities that route packets or interconnections to external networks (e.g., serving gateway (S-GW), packet data network (PDN) gateway (P-GW), or user plane function (UPF)). In some implementations, the control plane entity may manage non-access stratum (NAS) functions, such as mobility, authentication, and bearer management (e.g., data bearers, signal bearers, etc.) for one or more UEs 104 served by one or more network entities 102 associated with the core network 106.

[0040] The core network 106 may communicate with the packet data network 108 via one or more backhaul links 116 (e.g., via S1, N2, N3, or another network interface). The packet data network 108 may include an application server 118. In some implementations, one or more UEs 104 may communicate with the application server 118. The UE 104 may establish a session (e.g., a PDU session, etc.) with the core network 106 via the network entity 102. The core network 106 may route traffic (e.g., control information, data, etc.) between the UE 104 and the application server 118 using the established session (e.g., the established PDU session). The PDU session may be an example of a logical connection between the UE 104 and the core network 106 (e.g., one or more network functions of the core network 106).

[0041] In the wireless communication system 100, the network entity 102 and the UE 104 may use the resources of the wireless communication system 100 (e.g., time resources (e.g., symbols, time slots, subframes, frames, etc.) or frequency resources (e.g., subcarriers, carriers)) to perform various operations (e.g., wireless communication). In some implementations, the network entity 102 and the UE 104 may support different resource structures. For example, the network entity 102 and the UE 104 may support different frame structures. In some implementations, such as in 4G, the network entity 102 and the UE 104 may support a single frame structure. In some other implementations, such as in 5G and other suitable radio access technologies, the network entity 102 and the UE 104 may support various frame structures (e.g., multiple frame structures). The network entity 102 and the UE 104 may support various frame structures based on one or more digital technologies.

[0042] One or more digital technologies may be supported in the wireless communication system 100, and the digital technologies may include subcarrier spacing and cyclic prefixes. A first digital technology (e.g., μ = 0) may be associated with a first subcarrier spacing (e.g., 15kHz) and a conventional cyclic prefix. A first digital technology (e.g., μ = 0) associated with a first subcarrier spacing (e.g., 15kHz) may utilize one slot per subframe. A second digital technology (e.g., μ = 1) may be associated with a second subcarrier spacing (e.g., 30kHz) and a conventional cyclic prefix. A third digital technology (e.g., μ = 2) may be associated with a third subcarrier spacing (e.g., 60kHz) and a conventional cyclic prefix or an extended cyclic prefix. A fourth digital technology (e.g., μ = 3) may be associated with a fourth subcarrier spacing (e.g., 120kHz) and a conventional cyclic prefix. A fifth digital technology (e.g., μ = 4) may be associated with a fifth subcarrier spacing (e.g., 240kHz) and a conventional cyclic prefix.

[0043] The time intervals of resources (e.g., communication resources) can be organized according to frames (also referred to as radio frames). Each frame can have a duration, for example, a duration of 10 milliseconds (ms). In some implementations, each frame can include multiple subframes. For example, each frame can include 10 subframes, and each subframe can have a duration, for example, a duration of 1 ms. In some implementations, each frame can have the same duration. In some implementations, each subframe of a frame can have the same duration.

[0044] Additionally or alternatively, the time intervals of resources (e.g., communication resources) can be organized according to time slots. For example, a subframe may include a certain number (e.g., quantity) of time slots. Each time slot may include a certain number (e.g., quantity) of symbols (e.g., orthogonal frequency division multiplexing (OFDM) symbols). In some implementations, the number (e.g., quantity) of time slots for a subframe may depend on the digital technology. For a conventional cyclic prefix, a time slot may include 14 symbols. For an extended cyclic prefix (e.g., applicable to a 60kHz subcarrier spacing), a time slot may include 12 symbols. For a conventional cyclic prefix and an extended cyclic prefix, the relationship between the number of symbols per time slot, the number of time slots per subframe, and the number of time slots per frame may depend on the digital technology. It should be understood that references to a first digital technology (e.g., μ=0) associated with a first subcarrier spacing (e.g., 15kHz) may be used interchangeably between subframes and time slots.

[0045] In the wireless communication system 100, the electromagnetic (EM) spectrum can be divided into various categories, frequency bands, frequency channels, etc. based on frequency or wavelength. For example, the wireless communication system 100 can support one or more operating frequency bands, such as frequency range names FR1 (410 MHz to 7.125 GHz), FR2 (24.25 GHz to 52.6 GHz), FR3 (7.125 GHz to 24.25 GHz), FR4 (52.6 GHz to 114.25 GHz), FR4a or FR4-1 (52.6 GHz to 71 GHz), and FR5 (114.25 GHz to 300 GHz). In some implementations, the network entity 102 and the UE 104 can perform wireless communications on the one or more operating frequency bands. In some implementations, FR1 can be used by the network entity 102 and the UE 104 and other devices or apparatuses for cellular communication services (e.g., control information, data). In some implementations, FR2 can be used by the network entity 102 and the UE 104 and other devices or apparatuses for short-range, high data rate capabilities.

[0046] FR1 may be associated with one or more digital technologies (e.g., at least three digital technologies). For example, FR1 may be associated with a first digital technology (e.g., μ=0) including a subcarrier spacing of 15 kHz; a second digital technology (e.g., μ=1) including a subcarrier spacing of 30 kHz; and a third digital technology (e.g., μ=2) including a subcarrier spacing of 60 kHz. FR2 may be associated with one or more digital technologies (e.g., at least 2 digital technologies). For example, FR2 may be associated with a third digital technology (e.g., μ=2) including a subcarrier spacing of 60 kHz; and a fourth digital technology (e.g., μ=3) including a subcarrier spacing of 120 kHz.

[0047] In accordance with an implementation for suspicious behavior reporting, UE 104(1) may be in direct wireless communication with UE-related device 104(2). Direct wireless communication may be implemented in various ways, such as ProSe transmission, sidelink transmission, etc. In conjunction with the direct wireless communication, UE 104(1) may detect suspicious behavior 120. For example, suspicious behavior 120 represents behavior exhibited by UE 104(2) as part of direct wireless communication that exhibits attributes of malicious behavior, such as behavior that may cause a security risk. Therefore, UE 104(1) aggregates data describing various attributes of suspicious behavior 120 and transmits a behavior report 122 describing suspicious behavior 120 to network entity 102. In an implementation, network entity 102 may perform actions to mitigate risks caused by suspicious behavior 120, such as marking UE 104(2) as a security risk, blocking UE 104(2) from connecting to an associated network, etc.

[0048] In some wireless communication systems, the concept of NWDAF detecting network attacks by monitoring events and data packets in UE and network has been discussed, such as with the support of machine learning algorithms. To achieve network attack detection, NWDAF can cooperate with UE and any other NF to collect relevant data as input, and provide abnormal event alerts to OAM and other NFs that have subscribed to abnormal events as output so that they can take appropriate actions.

[0049] In addition, the following key issues related to network attack detection are described:

[0050] Key issues regarding network attack detection

[0051] This key question describes what kind of cyber attacks can be detected. In order to mitigate the identified cyber attacks, the data / parameters collected by NWDAF or any other Network Function (NF) need to be studied.

[0052] The analysis function can provide detection support for specific network attacks, including but not limited to the following examples:

[0053] (1) MitM attack on the radio interface: MitM attacks or rogue relay nodes can modify or change messages between the UE and the RAN, causing failure of higher-level protocols such as NAS or primary authentication.

[0054] (2) DoS attacks: 5G has very high performance requirements for system capacity and data rate. The increased capacity and higher data rate may result in higher processing power costs for network entities, which may cause some network entities (e.g., RAN, core network entities) to suffer DDoS attacks. NF can also implement DDoS attack detection.

[0055] Security threats

[0056] Cyber ​​attacks may not be detected by 5G networks; therefore, further attacks can be carried out. Abnormal events may not be detected by 5G networks; therefore, further attacks can be carried out.

[0057] Potential security requirements

[0058] The 3GPP system supports the detection of network attacks by providing relevant inputs or collecting output analysis using analysis functions (e.g., NWDAF).

[0059] Regarding data collection from UE applications, the NWDAF can interact with the AF to collect data from (multiple) UE applications, which serves as input for analysis generation and machine learning (ML) model training. The AF can be in the mobile network operator (MNO) domain or in an AF outside the MNO domain. A data collection request from the NWDAF can trigger the AF to collect data from UE applications. The UE application establishes a connection to the AF in the MNO domain or outside the MNO domain on the user plane via a PDU session. The AF communicates with the UE application and collects data from the UE application. For both the AF in the trusted domain and the AF in the untrusted domain (which supports data collection from UE applications), the service level agreement (SLA) between the operator and the application service provider (e.g., ASP) determines each application identifier (ID) used by the ASP:

[0060] - The AF to which the UE application is to connect (e.g. based on the Fully Qualified Domain Name (FQDN)).

[0061] - Information shared by the UE application with the AF with the user's consent.

[0062] - Possible data anonymization, aggregation or normalization algorithms (if used).

[0063] - Authentication information enabling the AF to verify the authenticity of the UE application providing the data.

[0064] The AF (which supports data collection) may be configured based on the above SLA. In addition, the data anonymization, aggregation or normalization algorithms within the SLA are defined for individual UEs.

[0065] The ASP may utilize the application ID to configure the UE application (which may support providing data to the AF) for use in communications with the AF, and then for each application ID, the UE application is configured with the following information:

[0066] - The address of the AF to be contacted.

[0067] -Parameters that the UE application is authorized to provide to the AF.

[0068] -Authentication information that enables the UE application to verify the authenticity of the AF requesting data. The event reporting target in the Naf_EventExposure request can be set to:

[0069] - In case the AF is located in an untrusted domain, the external UE ID (e.g.

[0070] Shared Subscription Identifier (GPSI) or External Group ID;

[0071] - SUPI or Internal Group ID in case the AF is located within a trusted domain.

[0072] The GPSI may be an external identifier for an individual UE including a domain name. The domain name and the application ID configured in the UE application are different from each other.

[0073] Regarding the process of data collection from UE applications, the AF may retrieve and store the UE's Internet Protocol (IP) address (e.g., in the PDU session used) to request data collection from the UE application. The UE IP address is used by the AF to identify the user plane connection. In addition, the UE application may provide the AF with an application ID configured in the UE application, as described in Technical Specification (TS) 26.531 [4].

[0074] Regarding AF registration and discovery, the AF can register its available NF profiles with the Network Repository Function (NRF). AFs in the trusted domain can register with the NRF by using the Nnrf_NFManagement service. AFs in the untrusted domain can register available NF profiles with the NRF via NEF.

[0075] Figure 2 A process 200 for data collection from a UE is illustrated. The process 200 involves a UE 104, a NF 202, a NWDAF 204, a NEF 206, and an AF 208. At 210, the NF 202 subscribes to an analysis from the NWDAF 204, the analysis including an analysis ID, analysis filter information including, for example, an AoI, (multiple) internal application IDs, and a target for the analysis report. The NWDAF 204 may also initiate data collection prior to the subscription. In some cases, the subscription to the analysis may be triggered directly toward the NWDAF 204 or may be performed via a data collection coordination function (DCCF). At 212, the NWDAF 204 discovers an AF 208 providing data collection, for example based on an AF profile registered in the NRF.

[0076] Step 214 is used for AF 208 in the trusted domain, while step 216 is used for AF in the untrusted domain. At 214, NWDAF 204 subscribes to AF 208 in the trusted domain for UE data collection (e.g., input data from UE for analysis) by using Naf_EventExposure_Subscribe. The NWDAF request contains the application ID known in the core network, and the UE application provides the application ID configured in the UE application. AF 208 binds the NWDAF request for the application ID and the UE data collection for the application ID configured in UE 104.

[0077] At 216, NWDAF 204 subscribes to AF 208 in the untrusted domain for UE data collection (eg, input data from UE for analysis), for example, by using steps 212 to 216. For steps 214, 216, DCCF may also be used to trigger data collection.

[0078] At 218, AF 208 collects UE data using direct or indirect data collection procedures. Prior to this, the establishment of the connection can be performed at any time. AF 208 links the data collection request from step 3 to the user plane connection. In implementation, direct data collection and indirect data collection procedures are described in TS26.531 [4].

[0079] Step 220 may be used for an AF 208 in a trusted domain, and step 222 may be used for an AF 208 in an untrusted domain. At 220, the AF 208 in the trusted domain receives input data from the UE 104 and processes the data (e.g., anonymizes, aggregates, and normalizes) according to the SLA configured in the AF and the event ID(s) and event filter(s) set during step 214. The trusted AF 208 then notifies the NWDAF 2-4 of the processed data according to the NWDAF subscription in step 214.

[0080] At 222, the AF 208 in the untrusted domain receives the input data from the UE 104 and processes the data (e.g., anonymizes, aggregates, and normalizes) according to the SLA configured in the AF 208 and the event ID(s) and event filter(s) set during step 216. The untrusted AF 208 notifies the NWDAF 204 of the processed data using step 222.

[0081] In implementation, if the NWDAF 204 requests the same data from multiple UEs (e.g., a determined list of UEs or “any UE” targeted for analysis reports), the AF 208 may process (e.g., anonymize, aggregate, and normalize) the data from the multiple UEs based on the (multiple) event IDs and (multiple) event filters received from the NWDAF 204 during steps 214 or 216 before notifying the NWDAF 204 of the processed data in step 220 (if the AF 208 is in a trusted domain) or step 222 (if the AF is in an untrusted domain).

[0082] At 224 , the NWDAF 204 generates analytics using the UE data received from the AF 208 , and at 226 , the NWDAQ 204 provides the analytics to the consumer NF 202 .

[0083] If the target of the analysis report received from the consumer at 210 includes an internal group ID, the NWDAF 204 includes such an internal group ID to the AF 208 in step 214 or step 216. In the case of step 216, the NEF 206 converts the internal group ID to an external group ID.

[0084] If the target of the analysis report received from the consumer in step 210 is "any UE", the NWDAF 204 may set the target of the event report to "any UE" to the AF 208 in steps 214 or 216, or may determine the SUPI list from the AMF and / or the session management function (SMF) based on the analysis filter information, and send the SUPI to the AF 208 for the determined UE list at steps 214 and 216. In implementation, it may be assumed that the AF 208 is provided with a list of UE IDs (GPSI or SUPI) belonging to an external or internal group ID.

[0085] Here are some relevant definitions:

[0086] Application ID: A globally unique identifier that identifies a specific application. This is an identifier used within the mobile operating system by applications within the mobile operating system. All mobile operating systems have a namespace that identifies applications within the mobile operating system.

[0087] Destination Layer-2 ID: A link layer identifier that identifies a device or a group of devices that are the recipients of the ProSe communication frame.

[0088] ProSe Application ID: The ProSe Application ID is an identifier used for open ProSe direct discovery to identify application-related information for a ProSe-enabled UE. Each ProSe Application ID may be globally unique.

[0089] ProSe direct communication: Communication between two or more ProSe-enabled UEs in proximity via a path that does not traverse any network nodes, through user plane transmission using the Evolved Universal Terrestrial Radio Access (E-UTRA) technology.

[0090] ProSe Direct Discovery: A procedure employed by a ProSe-enabled UE to discover other ProSe-enabled UEs in its vicinity by using only the capabilities of both UEs. ProSe Discovery: A procedure to identify that a ProSe-enabled UE is in proximity to another UE using E-UTRA (with or without E-UTRAN), EPC, or 5GS.

[0091] ProSe Discovery UE ID: A temporary identifier assigned by the ProSe function in the Home Public Land Mobile Network (HPLMN) to the UE for restricted direct discovery service. It includes the PLMN ID and a temporary identifier that uniquely identifies the UE in the HPLMN. ProSe Function ID: An FQDN that identifies the ProSe function.

[0092] ProSe layer-2 group ID: A layer-2 group identifier that can be used to address a group of users in the 3GPP lower layer. This ID needs to be configured in the UE before enabling one-to-many ProSe direct communication.

[0093] ProSe-enabled non-public safety UE: A UE that supports ProSe procedures but does not support public safety-specific functions.

[0094] ProSe-enabled public safety UE: The HPLMN has been configured as a UE authorized for public safety use, which is ProSe-enabled and supports ProSe procedures and functions specific to public safety. The UE may, but need not, have a Universal Subscriber Identity Module (USIM) with one of the special access categories.

[0095] ProSe-enabled UE: A UE that supports ProSe requirements and associated procedures. Unless explicitly stated otherwise, ProSe-enabled UE refers to both non-public safety UE and public safety UE.

[0096] ProSe UE-to-Network Relay: A UE that provides functionality supporting connectivity for remote UE(s) to the network.

[0097] Relay Service Code: The Relay Service Code is used to identify the connectivity service provided by the ProSe UE to Network Relay and the authorized users to whom the ProSe UE to Network Relay will provide services, and may select related security policies or information, such as the information required for authentication and authorization between the remote UE and the ProSe UE to Network Relay.

[0098] The definition of the value of the Relay Service Code is outside the scope of this specification.

[0099] Remote UE: A ProSe-enabled public safety UE that communicates with the PDN via the ProSe UE-to-Network Relay.

[0100] Restricted ProSe Application User ID: An identifier associated with the application layer user ID in the ProSe application server to hide / protect the application layer user identity from the 3GPP layer. It unambiguously identifies the user within a given application. The format of this identifier is outside the scope of 3GPP.

[0101] Source Layer-2 ID: a link layer identifier that identifies the device that initiates the ProSe communication frame.

[0102] Therefore, the present disclosure provides a solution to support UE to provide comprehensive suspicious behavior-related data about other entities / functions (such as UE network relay, UE (e.g., UE involved in ProSe communication, V2XUE, unmanned aerial system (UAS), unmanned aerial vehicle (UAV), UAV-C, network function (NF), etc.), so as to enable NWDAF and / or any related analysis functions to detect (multiple) network attacks and other malicious and / or potentially malicious behaviors. As used herein, "suspicious behavior" may refer to behavior that exhibits characteristics of improper behavior, malicious behavior, and / or potential improper behavior, and / or potential malicious behavior.

[0103] The implementation presented in the present disclosure describes a method for a UE to collect malicious activity or misconduct data associated with an entity, such as another UE or a relay involved in direct communication with the UE (e.g., via a PC5 interface), and report to the network using a control plane or user plane method based on an operator implementation.

[0104] (i) Example Case 1: UE and UE-Network Relay Involved in Direct Communication, where

[0105] The UE-network relay behavior is suspicious and the UE performs reporting of the suspicious behavior.

[0106] (ii) Example Case 2: UE and UE-Network Relay Involved in Direct Communication, where

[0107] The UE behavior is suspicious and the UE-network relay performs reporting of the suspicious behavior.

[0108] (iii) Example 3: Two UEs UE-1 and UE-2 are involved in direct communication (e.g., prose, V2X, U2X scenarios), where UE-1 behaves suspiciously and UE-2 performs reporting of the suspicious behavior. The opposite is also conceivable.

[0109] Figure 3 A process 300 for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated. For example, the process 300 represents a malicious behavior related data collection process and / or a data collection process for network attack detection. The process 300 includes a UE 104, a UE-related device 302, an AMF 304, an analysis consumer 305, a NWDAF 306, a NEF 308, and an AF 310. The UE-related device 302 represents an apparatus that can communicate with the UE 104, such as a UE-network relay, a UE (e.g., a UE involved in ProSe communication with the UE 104, a V2X UE, a UAS, a UAV, a UAV-C, etc.), etc. The analysis consumer 305 represents an apparatus associated with an entity that can utilize data and analysis related to detected suspicious behavior, such as operations, administration, and scheduling / maintenance (OAM) and / or other network functions.

[0110] In implementation, the UE 104 may be authenticated and registered with a network (e.g., a 5G system). The UE 104 may be involved in a direct communication establishment related message exchange, or may have established a direct communication link (e.g., via PC5) with a UE-related device 302 (e.g., related to D2D (such as V2X or U2X scenarios) or "UE-network relay" (e.g., proximity-based services (ProSe)). A "UE-to-network relay" may be a UE that provides functionality to support connectivity to a network for (multiple) remote UEs.

[0111] At 312, the UE 104 determines that a UE-related device 302 involved in direct communication with the UE 104 exhibits suspicious behavior. The UE 104 may detect suspicious behavior in various ways, such as if the UE-related device violates normal behavior and / or expected behavior, as listed below:

[0112] - If the UE-related device 302 involved in the direct communication repeatedly causes the direct communication chain

[0113] Road failure;

[0114] - If any message exchange associated with direct communication contains messages that deviate from the expected / configured

[0115] Services and / or data in information exchange protocols / formats;

[0116] - If the UE-related device 302 performs any unknown operation that cannot be identified by the UE 104;

[0118] - if the UE-related device 302 attempts to perform an operation that exceeds a threshold, such as data flooding that exceeds the configured limits and / or processing capabilities of the UE 104;

[0119] - If the UE 104 is in direct communication with the UE-related device 302,

[0120] Identify errors in the process;

[0121] - If the UE 104 identifies an error in the direct communication link established with the UE-related device 302.

[0122] At 314, the UE 104 generates a suspicious behavior report. In implementations where the UE-related device 302 involved in the direct communication is a UE-to-network relay, the UE 104 may generate a suspicious behavior report to include one or more of the following: an event ID (e.g., indicating a suspicious behavior or a specific suspicious behavior type), a source ID (e.g., a UE ID, which may be a SUPI / GPSI), a source application ID (e.g., announcer information, such as a prose application ID), a source layer-2 ID, a ProSe relay UE ID, a relay service code, a destination layer-2 ID, a ProSe layer-2 group ID, a UE ID related to the destination UE / UE-to-network relay (e.g., a restricted ProSe application user ID, a ProSe discovery UE ID), an EUTRAN cell global ID (ECGI) and / or any network-related cell global ID, traffic telemetry data, a serving Prose / V2X / U2X function ID, a serving Prose / V2X / U2X function address, and a timestamp (e.g., the time the report was created or the time the malicious behavior was detected).

[0123] Some general definitions related to ProSe include the following:

[0124] ProSe UE ID: A link layer identifier used for subsequent direct one-to-one and one-to-many communications.

[0125] Relay Service Code: The Relay Service Code associated with the message. The Relay Service Code is used to identify the security parameters required by the receiving UE to process the discovery message.

[0126] • ProSe Relay UE ID: a link layer identifier used for direct communication and associated with a relay service code.

[0127] ECGI or Cell Group ID: indicates the serving cell of the ProSe UE to the network relay.

[0128] In implementations where the UE-related devices 104 involved in the direct communication are different UEs, the UE 104 may generate a suspicious behavior report to include one or more of the following: an event ID (e.g., indicating inappropriate behavior or a specific type of inappropriate behavior), a source ID (e.g., a UE ID, which may be a SUPI / GPSI), a source application ID (e.g., related to a V2X service / U2X service or any other service), a source layer-2 ID, a destination layer-2 ID, a layer-2 group ID, a network-related cell global ID, a destination UE ID (e.g., a V2X ID or any UAV-ID / UAV-C ID), traffic telemetry data, a service Prose / V2X / U2X function ID, a service Prose / V2X / U2X function address, and a timestamp, such as the time when the report was created or the time when the malicious behavior was detected.

[0129] At 316, UE 104 may establish an application session with AF 310 based on local configuration associated with AF ID, AF address and / or FQDN (e.g., using an application session establishment request and response process based on Application Authentication and Key Management (AKMA) or Generic Bootstrapping Architecture (GBA). At 318, UE 104 sends a suspicious behavior report to AF 310 using the application session to perform a suspicious behavior report notification.

[0130] In this particular implementation, consider that AF 310 is within the trusted domain of the network operator for UE 104. Therefore, at 320, AF 310 sends a report notification (e.g., a Naf_Event_Exposure Notify message) to NWDAF 306, the report notification including a suspicious behavior report, such as a suspicious behavior report generated by UE 104. At 322, NWDAF 306 sends a report notification response (e.g., a Naf_Event_Exposure Notify response message) with a suspicious behavior report confirmation indication to AF 310. Additionally or alternatively, NWDAF 306 sends a Naf_Event_Exposure Notify confirmation message to AF 310.

[0131] Figure 4 A process 400 for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated. For example, process 400 represents a malicious behavior related data collection process and / or a data collection process for network attack detection, where AF 310 is outside of a trusted domain and / or AF 310 is within an untrusted domain. Process 400 combines various aspects of process 300 and can be implemented as an additional or alternative implementation of process 300.

[0132] In process 400, steps 312, 314, 316, 318 are implemented as described above. At 402, AF 310 sends a report notification (e.g., a Naf_Event_Exposure Notify message) to NEF 308, the report notification including the suspicious behavior report received from UE 104. At 404, NEF 308 sends a report notification, such as a suspicious behavior report in an Nnef_Event_ExposureNotify message, to NWDAF 306. At 406, NWDAF 306 sends a report response, such as an Nnef_Event_Exposure Notify response message with a suspicious behavior report confirmation indication to NEF 308. Additionally or alternatively, NWDAF 306 sends a Nnef_Event_Exposure Notify confirmation message to NEF 308.

[0133] At 408 , the NEF 308 sends a report response, such as a Naf_Event_Exposure Notify response message with a suspicious behavior report confirmation indication, to the AF 310 . Additionally or alternatively, the NEF 308 sends a Naf_Event_Exposure Notify confirmation message to the AF 310 .

[0134] Figure 5 A process 500 for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated. For example, the process 500 represents a malicious behavior related data collection process and / or a data collection process for network attack detection, where the UE 104 uses the control plane for reporting. The process 500 combines various aspects of the processes 300 and 400 and can be implemented as an additional or alternative implementation of the processes 300 and 400. In addition, the process 500 includes an authentication server function (AUSF) 502.

[0135] In process 500, steps 312 and 314 are implemented as described above. At 504, UE 104 determines to use a control plane in plain text (e.g., via NAS) to send a suspicious behavior report (e.g., the UE may also receive a suspicious behavior report request from NWDAF via a serving AMF, and then the UE determines to use the control plane to send the report). Additionally or alternatively, if UE 104 is configured to send a secure suspicious behavior report, UE 104 derives a report security key from Kausf and / or Kakma to protect the generated suspicious behavior report. UE 104 may derive a report security key in the following manner: Report security key: Key derivation function (KDF) (Kakma (or) Kausf, (multiple) input parameters: event ID (e.g., which indicates misbehavior or a specific type of misbehavior), UE ID (e.g., SUPI / GPSI), freshness parameter (e.g., random value / random number).

[0136] The UE 104 may encrypt the misbehavior report using the report security key or a key derived from the report key, or may only integrity protect the misbehavior report. If both confidentiality and integrity protection are to be implemented, the confidentiality and integrity protection keys may be generated from the report security key using additional parameters "code, e.g., 0x0000" specific to confidentiality and "code, e.g., 0x0001" specific to integrity protection.

[0137] At 506, the UE 104 sends the suspicious behavior report via a NAS message to the serving AMF 304. Additionally or alternatively, the UE 104 sends the suspicious behavior report (optionally in encrypted form if encrypted, and in plain text if not encrypted), freshness parameters, SUPI, message authentication code (MAC generated for integrity protection of the misbehavior report).

[0138] At 508, the AMF 304 forwards / sends (e.g., based on local configuration or based on an analytics event open subscription) the previously received suspicious behavior report, e.g., in a Namf_event_exposure_notify message, to the NWDAF 306. Additionally or alternatively, the AMF 304 forwards / sends the received suspicious behavior report (optionally in encrypted form if encrypted, or in plain text if not encrypted), freshness parameters, SUPI, MAC to the NWDAF 306 in a Namf_event_exposure_notify message.

[0139] In implementation, if the NWDAF 306 receives a suspicious behavior report with confidentiality and / or integrity protection (e.g., with a MAC and / or with an encrypted suspicious behavior report), the NWDAF may perform steps 510, 512. For example, at 510, the NWDAF 306 sends a key request (e.g., based on local configuration and / or operator implementation) to the AUSF 502, where the key request includes the SUPI, event ID, and freshness parameter. The AUSF 502 may use the received input parameters to derive a reporting security key, similar to the reporting security key generation performed by the UE in step 504.

[0140] At 512 , the AUSF provides the report security key (Rsk) in a key response message to the NWDAF 306 . At 514 , the NWDAF 306 performs analysis on the data from the suspicious behavior report and, at 516 , provides the analysis to the analysis consumer 305 .

[0141] According to various implementations, processes 300 , 400 , 500 may be implemented as additional and / or alternative approaches for implementing the various techniques described herein.

[0142] Table 1: Inputs provided by the UE and available in suspicious behavior reports

[0143]

[0144]

[0145] Table 2: Analysis / statistics of network attacks or UE malicious behaviors

[0146]

[0147] Figure 6 A process 600 for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated. For example, process 600 represents a malicious behavior related data collection process and / or a data collection process for network attack detection. Process 600 combines various aspects of processes 300 to 500 and can be implemented as an additional or alternative implementation of processes 300 to 500.

[0148] In at least one implementation, the UE 104 is registered with the network. The UE 104 may be involved in a direct communication setup related message exchange, or may have established a direct communication link with the UE related device 302 (eg, via the PC 5).

[0149] At 602, the analysis consumer 305 subscribes to UE malicious behavior (or improper behavior) related analysis information, such as by calling the Nnwdaf_Analytics_Subscription_Subscribe service operation message, which has an analysis ID (set to malicious UE behavior analysis / network attack detection analysis / attack detection analysis), a list of (multiple) event IDs (related to malicious UE behavior, UE suspicious behavior reports, network attacks, threats, DoS, DDoS, received messages that violate predefined service operation input or output formats (e.g., malformed messages), message requests that exceed configured limits, unexpected or unrecognized configuration changes / operation changes, any error notifications, repeated authentication failures, repeated communication failures, etc.), and an analysis target (indicating one or more UE IDs, such as SUPI / GPSI / relay IDs).

[0150] At 604, the NWDAF 306 opens a service to the AF 310 to subscribe to events based on local configuration (e.g., via the NEF if the AF is located externally) to be notified of data of events related to UE misbehavior reporting (an additional event ID may be indicated based on step 1) and includes as a target one or more UEs (identified using SUPI or GPSI) for reporting.

[0151] At 606, the UE 104 determines that the UE-related device 302 involved in the direct communication is suspected of exhibiting suspicious behavior (e.g., violating normal behavior), as listed below:

[0152] - If the UE-related device 302 involved in the direct communication repeatedly causes the direct communication chain

[0153] Road failure;

[0154] - If any message exchange associated with direct communication contains messages that deviate from the expected / configured

[0155] Services and / or data in information exchange protocols / formats;

[0156] - If the UE-related device 302 performs any unknown operation that cannot be identified by the UE 104;

[0158] - if the UE-related device 302 attempts to perform an operation that exceeds a threshold, such as data flooding that exceeds the configured limits and / or processing capabilities of the UE 104;

[0159] - If the UE 104 is in direct communication with the UE-related device 302,

[0160] Errors were identified during the process:

[0161] - If the UE 104 identifies an error in the direct communication link established with the UE-related device 302.

[0162] At 606, the UE 104 generates a suspicious behavior report having one or more of the following: an event ID (associated with the UE misbehavior report), source identification(s) (e.g., SUPI / GPSI, source layer-2 ID, application layer ID), target identification(s) (e.g., destination layer-2 ID, application layer ID of the UE or relay UE ID of the UE-network relay (e.g., based on the type of destination device)), application ID, service telemetry data (e.g., data collected by the UE from other UEs / UE-network relays, including suspicious data / messages that violate normal behavior), service prose / v2x / u2x function ID, and timestamp. Additionally or alternatively, for the case where the UE-network relay experiences misbehavior from another UE, in the UE suspicious behavior report, the source identification may be associated with the relay UE and the destination identification may be the identification of the other misbehaving UE.

[0163] At 608, 610, UE 104 implements establishment of an application session with AF 310 based on local configuration (eg, using AF ID (eg, with FQDN)) and establishes a secure connection based on AKMA. UE 104 also provides a suspicious behavior report to AF through the established application session.

[0164] At 612, the AF 310 sends a report notification (e.g., a Naf_Event_Exposure Notify message) to the NWDAF 306, the report notification including the suspicious behavior report, e.g., the suspicious behavior report received from the UE at 610. In at least one implementation, if the AF 310 is located outside the network, the AF 310 notifies the NWDAF 306 of the suspicious behavior report via the NEF.

[0165] At 614, NWDAF 306 performs UE suspicious event specific analysis (e.g., network attack detection analysis), such as by using data collected and received in suspicious behavior reports. At 616, NWDAF 306 notifies analysis consumer 305 (e.g., using Nnwdaf_AnalyticsSubscription_Notify and / or Nnwdaf_Analytics_Info-Request response (e.g., based on request)) of analysis report parameters, which include event specific UE malicious behavior analysis and / or network attack detection analysis related statistics and prediction outputs, as shown in Tables 3 and 4 below, respectively.

[0166] Table 3: Statistics of UE improper / malicious behaviors

[0167]

[0168]

[0169] Table 4: UE misbehavior / malicious behavior prediction

[0170]

[0171] Figure 7 An example of a block diagram 700 of a device 702 (e.g., an apparatus) that supports suspicious behavior reporting according to aspects of the present disclosure is illustrated. The device 702 may be an example of a UE 104 as described herein. The device 702 may support wireless communications with one or more network entities 102, UEs 104, or any combination thereof. The device 702 may include components for bidirectional communications, including components for sending and receiving communications, such as a processor 704, a memory 706, a transceiver 708, and an I / O controller 710. These components may be in electronic communication or otherwise coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces (e.g., a bus).

[0172] The processor 704, the memory 706, the transceiver 708, or various combinations thereof, or various components thereof may be examples of means for performing various aspects of the present disclosure described herein. For example, the processor 704, the memory 706, the transceiver 708, or various combinations thereof, or components thereof may support methods for performing one or more of the operations described herein.

[0173] In some implementations, the processor 704, the memory 706, the transceiver 708, or various combinations or components thereof may be implemented in hardware (e.g., in a communication management circuit system). The hardware may include a processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination of components configured to or otherwise support the functions described in the present disclosure. In some implementations, the processor 704 and the memory 706 coupled to the processor 704 may be configured to perform one or more functions described herein (e.g., the processor 704 executes instructions stored in the memory 706. For example, in the context of the UE 104, the transceiver 708 and the processor 704 coupled to the transceiver 708 are configured to cause the UE 104 to perform various described operations and / or combinations thereof.

[0174] For example, according to examples disclosed herein, the processor 704 and / or the transceiver 708 can support wireless communication at the device 702. For example, the processor 704 and / or the transceiver 708 can be configured to or otherwise support components for: generating suspicious behavior data based on the detected suspicious behavior related to the direct communication of the second device with the first device, the suspicious behavior data including an event identifier, a timestamp, and one or more of the following: an event identifier, an identifier for the second device, an application identifier, a service type, service function information, an identifier for the first device, a destination relay identifier, or traffic telemetry data; generating a suspicious behavior report including at least some of the suspicious behavior data; and sending the suspicious behavior report.

[0175] In addition, in some implementations, the suspicious behavior includes one or more of the following items: inappropriate behavior related to direct communication, malicious behavior related to direct communication, or suspected malicious behavior related to direct communication; the processor is configured to cause the first device to collect business telemetry data from the second device, and the business telemetry data includes one or more of the following items: suspicious data or suspicious messages; the first device includes a first user equipment (UE), and the second device includes one or more of the following items: a second UE, a UE-network relay, or a relay node; the processor is configured to cause the device to detect suspicious behavior based on at least one of the following items: the second device causes multiple direct communication links to fail; the message exchange related to direct communication includes one or more of the following items: business or data that deviates from at least one of a standard message exchange protocol or a standard message exchange format; the second device performs an operation that cannot be recognized by the first device; the second device sends data exceeding a threshold; an error detected during the implementation of the direct communication establishment process with the second device; or an error detected in the direct communication link established with the second device; the threshold is related to one or more of the following items: a configured limit or processing capability.

[0176] In addition, in some implementations, the identifier for the second device includes one or more of the following items: a destination ProSe relay UE identifier, a destination layer-2 identifier, or a ProSe layer-2 group identifier; the identifier for the first device includes one or more of the following items: a source ProSe relay UE identifier, a source layer-2 identifier, or a ProSe group identifier; the service type includes at least one of the following items: ProSe, U2X, or V2X; the processor is configured to cause the first device to send information about at least one service function (e.g., an identifier or an address) in the suspicious behavior report, and at least A service function includes one or more of the following items: a ProSe service function, a U2X service function, or a V2X service function; the processor is configured to enable the first device to: determine to use the control plane to send a suspicious behavior report; and send the suspicious behavior report to an access and mobility management function (AMF) via a non-access stratum (NAS); the processor is configured to enable the first device to: determine to use the user plane to send the suspicious behavior report; and send the suspicious behavior report to the AF; in order to determine to use the user plane to send the suspicious behavior report, the processor is configured to enable the first device to determine to use an application-level connection to send the suspicious behavior report.

[0177] The processor 704 may include an intelligent hardware device (e.g., a general purpose processor, a DSP, a CPU, a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some implementations, the processor 704 may be configured to operate a memory array using a memory controller. In some other implementations, the memory controller may be integrated into the processor 704. The processor 704 may be configured to execute computer-readable instructions stored in a memory (e.g., a memory 706) to cause the device 702 to perform various functions of the present disclosure.

[0178] The memory 706 may include random access memory (RAM) and read-only memory (ROM). The memory 706 may store computer-readable, computer-executable code, which includes instructions that, when executed by the processor 704, cause the device 702 to perform various functions described herein. The code may be stored in a non-transient computer-readable medium such as a system memory or another type of memory. In some implementations, the code may not be directly executable by the processor 704, but may cause a computer (e.g., when compiled and executed) to perform the functions described herein. In addition, in some implementations, the memory 706 may include a basic I / O system (BIOS), which may control basic hardware or software operations, such as interaction with peripheral device components or devices.

[0179] I / O controller 710 can manage input and output signals for device 702. I / O controller 710 can also manage peripheral devices that are not integrated into device 2402. In some implementations, I / O controller 710 can represent a physical connection or port to an external peripheral device. In some implementations, I / O controller 710 can utilize an operating system, such as

[0180] Or another known operating system. In some implementations, I / O controller 710 can be implemented as part of a processor such as processor M08. In some implementations, a user can interact with device 702 via I / O controller 710 or via hardware components controlled by I / O controller 710.

[0181] In some implementations, the device 702 may include a single antenna 712. However, in some other implementations, the device 702 may have more than one antenna 712 (e.g., multiple antennas), including multiple antenna panels or antenna arrays, which are capable of concurrently sending or receiving multiple wireless transmissions. The transceiver 708 can communicate bidirectionally via one or more antennas 712, wired or wireless links, as described herein. For example, the transceiver 708 can represent a wireless transceiver and can communicate bidirectionally with another wireless transceiver. The transceiver 708 may also include a modem for modulating packets to provide modulated packets to one or more antennas 712 for transmission, and demodulating packets received from one or more antennas 712.

[0182] Figure 8 An example of a block diagram 800 of a device 802 (e.g., an apparatus) that supports suspicious behavior reporting according to aspects of the present disclosure is illustrated. The device 802 may be an example of a network entity 102 as described herein. The device 802 may support wireless communications with one or more network entities 102, UEs 104, or any combination thereof. The device 802 may include components for bidirectional communication including components for sending and receiving communications, such as a processor 804, a memory 806, a transceiver 808, and an I / O controller 810. These components may be in electronic communication or otherwise coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces (e.g., a bus).

[0183] The processor 804, the memory 806, the transceiver 808, or various combinations thereof, or various components thereof may be examples of means for performing various aspects of the present disclosure described herein. For example, the processor 804, the memory 806, the transceiver 808, or various combinations thereof, or components thereof may support methods for performing one or more of the operations described herein.

[0184] In some implementations, the processor 804, the memory 806, the transceiver 808, or various combinations or components thereof may be implemented in hardware (e.g., in a communication management circuit system). The hardware may include a processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination of components configured to or otherwise support the functions described in the present disclosure. In some implementations, the processor 804 and the memory 806 coupled to the processor 804 may be configured to perform one or more functions described herein (e.g., the processor 804 executes instructions stored in the memory 806). For example, in the context of the network entity 102, the transceiver 808 and the processor 804 coupled to the transceiver 808 are configured to cause the network entity 102 to perform various described operations and / or combinations thereof.

[0185] For example, according to examples as disclosed herein, the processor 804 and / or the transceiver 808 may support wireless communication at the device 802. For example, the processor 804 and / or the transceiver 808 may be configured to or otherwise support components for: receiving a suspicious behavior report including suspicious behavior data based on a detected suspicious behavior related to direct communication between the second device and the third device, the suspicious behavior data including an event identifier, a timestamp, and one or more of the following: an event identifier, a source identifier for the second device, an application identifier, a service type, service function information, an identifier for the first device, a destination relay identifier, or traffic telemetry data; and sending the suspicious behavior report to the fourth device.

[0186] In addition, in some implementations, the first device includes an AF, the second device includes a first user equipment (UE) that generates a suspicious behavior report, and the third device includes one or more of the following items: a second UE, a UE-network relay, or a relay node that causes the behavior described by at least some of the suspicious behavior data; the fourth device includes at least one of the following items: an NWDAF or an NEF; and the processor is configured to cause the first device to receive a confirmation message from the fourth device based at least in part on the suspicious behavior report.

[0187] In further examples, according to examples disclosed herein, the processor 804 and / or the transceiver 808 can support wireless communications at the device 802. For example, the processor 804 and / or the transceiver 808 can be configured as or otherwise used as a component of: receiving a suspicious behavior report from the second device, the suspicious behavior report including suspicious behavior data based on detected suspicious behavior related to direct communication between the third device and the fourth device; and sending a confirmation message to the second device based at least in part on the suspicious behavior report.

[0188] In addition, in some implementations, the first device includes a NWDAF, the second device includes at least one of the following: an AF or a NEF, the third device includes a first user equipment (UE) that generates at least some of the suspicious behavior data, and the fourth device includes one or more of the following: a second UE, a UE-network relay, or a relay node that causes the behavior described by at least some of the suspicious behavior data; the suspicious behavior data includes an event identifier, a timestamp, and one or more of the following: an event identifier, a source identifier for the fourth device, an application identifier, a service type, service function information, an identifier for the third device, a destination relay identifier, or business telemetry data; the suspicious behavior data Including an event identifier, a timestamp, and one or more of the following items: an event identifier, an identifier for a second device, an application identifier, a service type, service function information, an identifier for a first device, a destination relay identifier, or business telemetry data; the processor is configured to cause the first device to output analysis data, which includes one or more of the following items: a list of observed anomalies, detected risks, a type of attack associated with suspicious behavior data, an indication of the severity of the suspicious behavior, a list of one or more UE-related devices suspected of being the cause of the suspicious behavior, a list of one or more UE-related devices suspected of being affected by the suspicious behavior of other UEs, or an indication of a confidence value related to the suspicious behavior.

[0189] In further examples, according to examples disclosed herein, the processor 804 and / or the transceiver 808 may support wireless communications at the device 802. For example, the processor 804 and / or the transceiver 808 may be configured to or otherwise support components for: receiving a suspicious behavior report from a second device via a non-access stratum (NAS) transmission, the suspicious behavior report including suspicious behavior data based on detected suspicious behavior related to direct communication between the second device and a third device; and sending the suspicious behavior report to a fourth device.

[0190] In addition, in some implementations, the first device includes an access and mobility management function (AMF), the second device includes a first user equipment (UE) that generates at least some of the suspicious behavior data, the third device includes one or more of the following items: a second UE, a UE-network relay, or a relay node that causes the behavior described by at least some of the suspicious behavior data, and the fourth device includes an NWDAF; the processor is configured to cause the first device to: receive one or more of the following items related to the suspicious behavior report from the second device: a freshness parameter, a SUPI, or a MAC; and send one or more of the following items to the fourth device: a freshness parameter, a SUPI, or a MAC.

[0191] The processor 804 may include an intelligent hardware device (e.g., a general purpose processor, a DSP, a CPU, a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some implementations, the processor 804 may be configured to operate a memory array using a memory controller. In some other implementations, the memory controller may be integrated into the processor 804. The processor 804 may be configured to execute computer-readable instructions stored in a memory (e.g., a memory 806) to cause the device 802 to perform various functions of the present disclosure.

[0192] The memory 806 may include random access memory (RAM) and read-only memory (ROM). The memory 806 may store computer-readable, computer-executable code, which includes instructions that, when executed by the processor 804, cause the device 802 to perform various functions described herein. The code may be stored in a non-transient computer-readable medium such as a system memory or another type of memory. In some implementations, the code may not be directly executable by the processor 804, but may cause a computer (e.g., when compiled and executed) to perform the functions described herein. In addition, in some implementations, the memory 806 may include a basic I / O system (BIOS), which may control basic hardware or software operations, such as interaction with peripheral device components or devices.

[0193] I / O controller 810 can manage input and output signals for device 802. I / O controller 810 can also manage peripheral devices that are not integrated into device 2402. In some implementations, I / O controller 810 can represent a physical connection or port to an external peripheral device. In some implementations, I / O controller 810 can utilize an operating system, such as

[0194] Or another known operating system. In some implementations, I / O controller 810 can be implemented as part of a processor such as processor M06. In some implementations, a user can interact with device 802 via I / O controller 810 or via hardware components controlled by I / O controller 810.

[0195] In some implementations, the device 802 may include a single antenna 812. However, in some other implementations, the device 802 may have more than one antenna 812 (e.g., multiple antennas), including multiple antenna panels or antenna arrays, which are capable of concurrently sending or receiving multiple wireless transmissions. The transceiver 808 can communicate bidirectionally via one or more antennas 812, wired or wireless links, as described herein. For example, the transceiver 808 can represent a wireless transceiver and can communicate bidirectionally with another wireless transceiver. The transceiver 808 may also include a modem for modulating packets to provide modulated packets to one or more antennas 812 for transmission, and demodulating packets received from one or more antennas 812.

[0196] Fig. 9 1 is a flowchart of a method 900 for supporting suspicious behavior reporting according to aspects of the present disclosure. The operations of the method 900 may be implemented by a device or components thereof as described herein. For example, the operations of the method 900 may be implemented by a device or components thereof as described herein. Figures 1 to 8 The UE 104 described above may be used to perform the functions described. In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the described functions.

[0197] At 902, the method may include: generating, by the first device, suspicious behavior data based on the detected suspicious behavior related to the direct communication between the second device and the first device, the suspicious behavior data including an event identifier, a timestamp, and one or more of the following: an event identifier, an identifier for the second device, an application identifier, a service type, service function information, an identifier for the first device, a destination relay identifier, or business telemetry data. The operation of 902 may be performed according to the examples described herein. In some implementations, aspects of the operation of 902 may be performed as described in reference to Figure 1 The device is used to perform the above.

[0198] At 904, the method may include generating a suspicious behavior report including at least some of the suspicious behavior data. The operations of 904 may be performed according to examples as described herein. In some implementations, aspects of the operations of 904 may be performed as described in reference to Figure 1 The device is used to perform the above.

[0199] At 906, the method may include sending a suspicious behavior report. The operations of 906 may be performed according to examples as described herein. In some implementations, aspects of the operations of 906 may be performed as described in reference to Figure 1 The device is used to perform the above.

[0200] Fig.10 1000 is a flowchart of a method 1000 for supporting suspicious behavior reporting according to aspects of the present disclosure. The operations of the method 1000 may be implemented by a device or components thereof as described herein. For example, the operations of the method 1000 may be implemented by a device or components thereof as described herein. Figures 1 to 8 The network entity 102 is used to perform the described functions. In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the described functions.

[0201] At 1002, the method may include: receiving, by the first device, a suspicious behavior report, the suspicious behavior report including suspicious behavior data based on a detected suspicious behavior related to direct communication between the second device and the third device, the suspicious behavior data including an event identifier, a timestamp, and one or more of the following: an event identifier, a source identifier for the second device, an application identifier, a service type, service function information, an identifier for the first device, a destination relay identifier, or business telemetry data. The operations of 1002 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1002 may be performed as described in reference to Figure 1 The device is used to perform the above.

[0202] At 1004, the method may include: sending the suspicious behavior report to a fourth device. The operations of 1004 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1004 may be performed as described in reference to Figure 1 The device is used to perform the above.

[0203] Fig.11 100 is a flowchart of a method 1100 for supporting suspicious behavior reporting according to aspects of the present disclosure. The operations of the method 1100 may be implemented by a device or components thereof as described herein. For example, the operations of the method 1100 may be implemented by a device or components thereof as described herein. Figures 1 to 8 The network entity 102 is used to perform the described functions. In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the described functions.

[0204] At 1102, the method may include: at the first device, receiving a suspicious behavior report from the second device, the suspicious behavior report including suspicious behavior data based on a detected suspicious behavior related to direct communication between the third device and the fourth device. The operations of 1102 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1102 may be performed as described in reference to Figure 1 The device is used to perform the above.

[0205] At 1104, the method may include sending a confirmation message to the second device based at least in part on the suspicious behavior report. The operations of 1104 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1104 may be performed as described in reference to Figure 1 The device is used to perform the above.

[0206] Fig.12 A flow chart of a method 1200 for supporting suspicious behavior reporting according to aspects of the present disclosure is illustrated. The operations of the method 1200 may be implemented by a device or components thereof as described herein. For example, the operations of the method 1200 may be implemented by a device or components thereof as described herein. Figures 1 to 8 The network entity 102 is used to perform the described functions. In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the described functions.

[0207] At 1202, the method may include: at a first device, receiving a suspicious behavior report from a second device via a non-access stratum (NAS) transmission, the suspicious behavior report including suspicious behavior data based on a detected suspicious behavior related to direct communication between the second device and a third device. The operations of 1202 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1202 may be performed as described in reference to Figure 1 The device is used to perform the above.

[0208] At 1204, the method may include sending the suspicious behavior report to a fourth device. The operations of 1204 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1204 may be performed as described in reference to Figure 1 The device is used to perform the above.

[0209] It should be noted that the methods described herein describe possible implementations, and that the operations and steps may be rearranged or otherwise modified, and other implementations are possible. Furthermore, aspects from two or more methods may be combined.

[0210] The various illustrative blocks and components described in conjunction with the disclosure herein may be implemented or performed using a general purpose processor, a DSP, an ASIC, a CPU, an FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in an alternative, the processor may be any processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices (e.g., a DSP and a microprocessor, a plurality of microprocessors, a combination of one or more microprocessors in conjunction with a DSP core, or any other such configuration).

[0211] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored on or sent via a computer-readable medium as one or more instructions or codes. Other examples and implementations are within the scope of this disclosure and the appended claims. For example, due to the nature of software, the functions described herein may be implemented using software executed by a processor, hardware, firmware, hard wiring, or any combination of these. Features that implement the functions may also be physically located in various locations, including being distributed so that parts of the functions are implemented in different physical locations.

[0212] Computer readable medium includes both non-transient computer storage medium and communication medium, and communication medium includes any medium that promotes to transmit computer program from one place to another place.Non-transient storage medium can be any available medium that can be accessed by general or special-purpose computer.As an example and not limitation, non-transient computer readable medium can include RAM, ROM, electrically erasable programmable ROM (EEPROM), flash memory, compact disc (CD) ROM or other optical disc storage, disk storage or other magnetic storage device, or can be used to carry or store desired program code parts in the form of instruction or data structure and can be accessed by general or special-purpose computer, or any other non-transient medium of general or special-purpose processor.

[0213] Any connection may be appropriately referred to as a computer-readable medium. For example, if the software is sent from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technology (such as infrared, radio, and microwave), the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology (such as infrared, radio, and microwave) is included in the definition of computer-readable medium. Disks and optical disks as used herein include CDs, laser disks, optical disks, digital versatile disks (DVDs), floppy disks, and blue-ray disks, wherein disks typically reproduce data magnetically, and optical disks reproduce data optically using lasers. Combinations of the above are also included within the scope of computer-readable media.

[0214] As used herein (including in the claims), "or" as used in a list of items (e.g., a list of items beginning with a phrase such as "at least one of..." or "one or more of..." or "one or both of...") indicates an inclusive list, so that, for example, a list of at least one of A, B, or C means A or B or C or AB or AC or BC or ABC (e.g., A and B and C). In addition, as used herein, the phrase "based on" should not be interpreted as a reference to a closed set of conditions. For example, an example step described as "based on condition A" can be based on both condition A and condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase "based on" should be interpreted in the same manner as the phrase "based at least in part on." In addition, as used herein (including in the claims), a "set" may include one or more elements.

[0215] When referring to a network entity, the terms "send," "receive," or "transmit" may refer to any part of a network entity of a RAN (e.g., base station, CU, DU, RU) that communicates with another device (e.g., directly or via one or more other network entities).

[0216] The descriptions described herein in conjunction with the accompanying drawings describe example configurations and do not represent all examples that may be implemented or within the scope of the claims. The term "example" as used herein means "used as an example, instance, or illustration," rather than "preferred" or "better than other examples." The detailed description includes specific details to provide an understanding of the described techniques. However, these techniques may be practiced without these specific details. In some cases, known structures and devices are shown in block diagram form to avoid confusing the concepts of the described examples.

[0217] The description herein is provided to enable one of ordinary skill in the art to make or use the present disclosure. Various modifications to the present disclosure will be clear to one of ordinary skill in the art, and the general principles defined herein may be applied to other variations without departing from the scope of the present disclosure. Therefore, the present disclosure is not limited to the examples and designs described herein, but should conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A user equipment (UE) for wireless communication, comprising: at least one memory; as well as at least one processor, coupled to the at least one memory, and configured to cause the UE to: generating suspicious behavior data based on the detected suspicious behavior related to direct communication between the second device and the UE, the suspicious behavior data comprising an event identifier, a timestamp, and one or more of the following: an event identifier, an identifier for the second device, an application identifier, a service type, service function information, an identifier for the UE, a destination relay identifier, or traffic telemetry data; generating a suspicious behavior report including at least some of the suspicious behavior data; as well as Sending a suspicious behavior report.

2. The UE according to claim 1, wherein the suspicious behavior comprises one or more of the following items: improper behavior related to the direct communication, malicious behavior related to the direct communication, or suspected malicious behavior related to the direct communication.

3. The UE according to claim 1, wherein the at least one processor is configured to enable the UE to: collect the business telemetry data from the second device, and the business telemetry data includes one or more of the following items: suspicious data or suspicious messages. 4 . The UE of claim 1 , wherein the second device comprises one or more of the following: a second UE, a UE-network relay, or a relay node.

5. The UE of claim 1, wherein the at least one processor is configured to cause the UE to detect the suspicious behavior based on at least one of the following: The second device causes a plurality of direct communication links to fail; The message exchange associated with the direct communication includes one or more of the following: services or data that deviate from at least one of a standard message exchange protocol or a standard message exchange format; The second device performs an operation that is unrecognizable by the UE; The second device sends data exceeding a threshold; an error detected during the established direct communication with the second device; or An error detected in a direct communication link established with the second device.

6. The UE of claim 5, wherein the threshold is related to one or more of: a configured limit or a processing capability. 7 . The UE of claim 1 , wherein the identifier for the second device comprises one or more of: a destination ProSe relay UE identifier, a destination layer-2 identifier, or a ProSe layer-2 group identifier. 8 . The UE of claim 1 , wherein the identifier for the UE comprises one or more of: a source ProSe relay UE identifier, a source layer-2 identifier, or a ProSe group identifier.

9. The UE according to claim 1, wherein the service type comprises at least one of the following items: ProSe, U2X, or V2X.

10. A UE according to claim 1, wherein the at least one processor is configured to enable the UE to: send information about at least one service function (e.g., an identifier or address) in the suspicious behavior report, and wherein the at least one service function includes one or more of the following items: a ProSe service function, a U2X service function, or a V2X service function.

11. The UE according to claim 1, wherein the at least one processor is configured to cause the UE to: Determining to use a control plane to send the suspicious behavior report; and The suspicious behavior report is sent to an access and mobility management function (AMF) via a non-access stratum (NAS) transport.

12. The UE according to claim 1, wherein the at least one processor is configured to cause the UE to: Determining to use a user plane to send the suspicious behavior report; and The suspicious behavior report is sent to an application function (AF).

13. The UE according to claim 12, wherein in order to determine to use a user plane to send the suspicious behavior report, the at least one processor is configured to cause the UE to: determine to use an application level connection to send the suspicious behavior report.

14. A processor for wireless communication, comprising: at least one controller coupled to at least one memory and configured to cause the processor to: generating suspicious behavior data based on the detected suspicious behavior related to direct communication between the second device and the processor, the suspicious behavior data comprising an event identifier, a timestamp, and one or more of: an event identifier, an identifier for the second device, an application identifier, a service type, service function information, an identifier for the first device, a destination relay identifier, or traffic telemetry data; generating a suspicious behavior report including at least some of the suspicious behavior data; as well as Sending a suspicious behavior report.

15. The processor of claim 14, wherein the suspicious behavior comprises one or more of: inappropriate behavior related to the direct communication, malicious behavior related to the direct communication, or suspected malicious behavior related to the direct communication.

16. The processor of claim 14, wherein the at least one controller is configured to cause the processor to: collect the business telemetry data from the second device, and the business telemetry data includes one or more of the following items: suspicious data or suspicious messages.

17. The processor of claim 14, wherein the second device comprises one or more of: a second UE, a UE-network relay, or a relay node.

18. The processor of claim 14, wherein the at least one controller is configured to cause the processor to detect the suspicious behavior based on at least one of: The second device causes a plurality of direct communication links to fail; The message exchange associated with the direct communication includes one or more of the following: services or data that deviate from at least one of a standard message exchange protocol or a standard message exchange format; The second device performs an operation that is not recognizable by the first device; The second device sends data exceeding a threshold; an error detected during the established direct communication with the second device; or An error detected in a direct communication link established with the second device.

19. A method performed by a user equipment (UE), the method comprising: generating suspicious behavior data based on the detected suspicious behavior related to direct communication between the second device and the UE, the suspicious behavior data comprising an event identifier, a timestamp, and one or more of the following: an event identifier, an identifier for the second device, an application identifier, a service type, service function information, an identifier for the UE, a destination relay identifier, or traffic telemetry data; generating a suspicious behavior report including at least some of the suspicious behavior data; as well as Sending a suspicious behavior report.

20. A network entity for wireless communication, comprising: processor; as well as a memory coupled to the processor, the processor being configured to cause the network entity to: receiving a suspicious behavior report, the suspicious behavior report comprising suspicious behavior data based on detected suspicious behavior related to direct communication between the second device and the third device, the suspicious behavior data comprising an event identifier, a timestamp, and one or more of: an event identifier, a source identifier for the second device, an application identifier, a service type, service capability information, an identifier for the network entity, a destination relay identifier, or traffic telemetry data; as well as The suspicious behavior report is sent to a fourth device.

Images