Mobile communication network malicious traffic identification method, system, device and medium
By embedding data identification in the terminal and combining grayscale map transformation and deep learning models, the efficiency and accuracy of malicious traffic recognition on the access network side are solved, efficient and accurate malicious traffic detection is achieved, and network security and reliability are improved.
Patent Information
- Application Number
- CN202510595498.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-09
- Publication Date
- 2025-08-15
AI Technical Summary
Existing malicious traffic identification technology in mobile communication networks, especially on the access network side, is difficult to efficiently and accurately identify malicious traffic hidden in encrypted traffic, resulting in insufficient network security and reliability.
By embedding data identification on the terminal, legality verification and grayscale image conversion are performed on the access network side, combined with the deep learning model to identify malicious traffic, which is divided into one-time verification and second-time recognition stages to achieve efficient and accurate malicious traffic detection.
It improves the security and reliability of the mobile communication network, effectively reduces and even avoids malicious traffic entering the core network, and improves the identification efficiency and accuracy.
Smart Images
Figure CN120499666A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communication security technology, and specifically to a method, system, device and medium for identifying malicious traffic in a mobile communication network. Background Art
[0002] With 5G mobile communication networks deeply integrated into industrial manufacturing and playing a key role in infrastructure development, the industrial manufacturing industry has already adopted 5G networks for smart manufacturing, making 5G a crucial component of the new infrastructure sector. However, with the advancement of network technology, attack methods targeting 5G networks have become increasingly sophisticated and diverse, posing a serious threat to data security and production safety in industrial manufacturing. Furthermore, with the widespread use of encryption technology, attackers can encrypt malicious traffic and hide it within legitimate encrypted traffic, thereby evading traditional network traffic detection methods and posing a greater challenge to network traffic identification. Furthermore, the rapid development of new technologies provides attackers with more exploitable attack methods. For example, smallcell technology, used to cover blind spots in 5G networks, is vulnerable to attack access points and potential air interface penetration paths due to its extensive industry chain, lack of high-level security measures, and lack of unified operator management.
[0003] To ensure the smooth operation of industrial production, communication network traffic must be monitored in real time to identify and detect malicious traffic, preventing it from infiltrating industrial production networks and potentially damaging production equipment and leaking important data. However, existing technologies for identifying malicious encrypted traffic primarily focus on the core network, collecting data through switch mirror ports. Little attention has been paid to mobile communication networks, particularly malicious traffic on the air interface side. As the key link in carrying communications between end users and the core network, the access network is crucial for early detection of traffic. By identifying and detecting malicious traffic hidden within encrypted traffic on the access network side, control measures can be implemented early to effectively prevent malicious traffic from entering the core network, mitigate the damage caused by network attacks, and enhance the security of mobile communication networks.
[0004] Existing malicious traffic identification methods fall into two main categories: port-based detection and deep packet inspection (DPI)-based methods. Port-based detection methods identify specific applications by identifying specific ports, but with the emergence of dynamic ports, the effectiveness of these methods has gradually diminished. DPI methods identify malicious traffic by extracting key fields from data packets, but with the prevalence of encryption technology, traditional plaintext-based malicious traffic detection methods, including DPI, are no longer suitable for current network security situations. Furthermore, the rapid growth of network traffic has made it urgent to identify malicious traffic efficiently and accurately from massive amounts of data. Summary of the Invention
[0005] In view of the above-mentioned defects or deficiencies in the prior art, it is desired to provide a method, system, device and medium for identifying malicious traffic in a mobile communication network, which has the advantages of high malicious traffic identification efficiency, strong real-time performance and high identification accuracy, thereby effectively reducing or even preventing malicious traffic data packets from entering the core network, thereby improving the security and reliability of the network.
[0006] In a first aspect, an embodiment of the present application provides a method for identifying malicious traffic in a mobile communication network, which is applied to an access network side. The method includes:
[0007] Obtaining a data packet sent by a terminal and uploaded by a base station, wherein the data packet is pre-embedded with a data identifier by the terminal;
[0008] Performing legitimacy verification on the data packet according to the data identifier;
[0009] After the legitimacy of the data packet is verified, the data packet is converted into a grayscale image, and whether the data packet is malicious traffic is identified based on the grayscale image.
[0010] In some examples, before obtaining the data packet sent by the terminal uploaded by the base station, the method further includes:
[0011] The terminal constructs a data identification fingerprint based on the service type extracted from the original IP data packet generated by the application client and the uniformly allocated identification factor;
[0012] The data identification fingerprint is embedded into the corresponding field of the original IP data packet to obtain the data packet, and the data packet is sent to the base station.
[0013] In some examples, verifying the legitimacy of the data packet according to the data identifier includes:
[0014] Performing destination address translation on the data packet, and importing the data packet into the virtual network card according to the destination address translation result;
[0015] In the virtual network card, determining whether the data packet carries a data identifier;
[0016] If the data packet carries a data identifier, further determining whether the data identifier is legal; otherwise, discarding the data packet;
[0017] If the data identifier is legal, further verify whether the data identifier is abnormal; otherwise, discard the data packet;
[0018] If the data identification verification is abnormal, the data packet is discarded; otherwise, it is confirmed that the legitimacy verification of the data packet has passed.
[0019] In some examples, determining whether the data identifier is legal includes:
[0020] Extracting the serial number of the data identifier;
[0021] The data identification factor synchronization mechanism is used to determine whether the serial number of the data identification is legal.
[0022] In some examples, verifying whether the data identification is abnormal includes:
[0023] Execute the identification verification algorithm to perform deobfuscation, i.e. data identification verification, to determine whether there are any anomalies in the data identification verification.
[0024] In some examples, after the legitimacy of the data packet is verified, converting the data packet into a grayscale image, and identifying whether the data packet is malicious traffic based on the grayscale image includes:
[0025] Converting the data packet into a grayscale image;
[0026] The grayscale image is input into a pre-trained classification model to obtain a classification result of the data packet, wherein the classification result of the classification model includes a normal traffic classification result and a malicious traffic classification result.
[0027] In some examples, after identifying whether the data packet is malicious traffic based on the grayscale image, the method further includes:
[0028] If the data packet is identified as malicious traffic, the data packet is discarded; otherwise, the data packet is forwarded to the core network requested by the terminal.
[0029] In a second aspect, an embodiment of the present application provides a mobile communication network malicious traffic identification system, which is applied to an access network side. The system includes:
[0030] an acquisition module, configured to obtain a data packet sent by a terminal and uploaded by a base station, wherein the data packet is pre-embedded with a data identifier by the terminal;
[0031] A verification module, configured to verify the legitimacy of the data packet according to the data identifier;
[0032] The identification module is used to convert the data packet into a grayscale image after the legitimacy of the data packet is verified, and identify whether the data packet is malicious traffic based on the grayscale image.
[0033] In a third aspect, an embodiment of the present application provides a computing device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the method for identifying malicious traffic in a mobile communication network described in the embodiment of the first aspect of the present application is implemented.
[0034] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for identifying malicious traffic in a mobile communication network described in the embodiment of the first aspect of the present application is implemented.
[0035] The method, system, device and medium for identifying malicious traffic in a mobile communication network proposed in the embodiments of the present application obtain data packets sent by terminals uploaded by base stations through the access network side, and perform a legitimacy verification on the data packets based on the data identifiers pre-embedded in the data packets. After the legitimacy verification is passed, the data packets are converted into grayscale images, and the data packets are secondarily identified based on the grayscale images, and finally malicious traffic data packets are identified from a large number of data packets. Malicious traffic detection can be divided into a primary verification phase and a secondary identification phase for the massive amount of data in the mobile network, thereby achieving efficient and accurate identification of malicious traffic on the access network side. The system has the advantages of high malicious traffic identification efficiency, strong real-time performance and high identification accuracy, thereby effectively reducing or even preventing malicious traffic data packets from entering the core network, thereby improving the security and reliability of the network.
[0036] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] Other features, objects and advantages of the present application will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings:
[0038] Figure 1 A flowchart of a method for identifying malicious traffic in a mobile communication network according to an embodiment of the present application is provided;
[0039] Figure 2 A schematic diagram of data identification in a method for identifying malicious traffic in a mobile communication network according to an embodiment of the present application;
[0040] Figure 3 A schematic diagram of a flow chart of malicious traffic detection in a method for identifying malicious traffic in a mobile communication network according to an embodiment of the present application;
[0041] Figure 4 This is a structural block diagram of a mobile communication network malicious traffic identification system according to an embodiment of the present application;
[0042] Figure 5 A schematic diagram of the structure of a computing device suitable for implementing the embodiments of the present application is shown. DETAILED DESCRIPTION
[0043] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are intended only to illustrate the relevant application and are not intended to limit the application. It should also be noted that, for ease of description, only portions relevant to the application are shown in the accompanying drawings.
[0044] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0045] The following describes a method, system, device, and medium for identifying malicious traffic in a mobile communication network according to embodiments of the present application in conjunction with the accompanying drawings.
[0046] Figure 1 This is a flow chart of a method for identifying malicious traffic in a mobile communication network according to an embodiment of the present application. Figure 1 As shown, according to an embodiment of the present application, a method for identifying malicious traffic in a mobile communication network is applied to an access network, and the method for identifying malicious traffic in a mobile communication network includes the following steps:
[0047] S101: Obtain a data packet sent by a terminal and uploaded by a base station, wherein the data packet is pre-embedded with a data identifier by the terminal.
[0048] It should be noted that before a terminal such as a user terminal UE sends a data packet to a base station, the terminal embeds a data identifier into the data packet. For example, the terminal extracts the service type from the original IP data packet generated by the application client, and constructs a data identifier fingerprint based on a uniformly assigned identification factor; embeds the data identifier fingerprint into the corresponding field of the original IP data packet to obtain the data packet, and sends the data packet to the base station.
[0049] like Figure 2 The figure shows the process of data identification embedding by the terminal. Specifically, the user terminal UE extracts the service type from the original IP data packet generated by the APP (application client) and constructs a data identification fingerprint based on a uniformly assigned identification factor CF, for example, using the HMAC-SM3 algorithm. The fingerprint is embedded in the relevant fields of the original IP packet. The terminal UE then sends the data packet with the data identification to the base station.
[0050] Taking 5G network data transmission as an example, in order to simplify the monitoring and identification control capabilities of 5G network transmission data and improve the security of access network information transmission, in the embodiment of this application, lightweight data identification technology is adopted, combined with Figure 2As shown in the figure, the relevant lightweight data identification process is performed, which embeds the lightweight data identifier (CM) into the reserved field or extension field of the original header without modifying the original payload part, thereby maintaining the original format of the data packet and ensuring the transparency, efficiency and detectability of the transmission of the identification data.
[0051] S102: Verify the validity of the data packet according to the data identifier.
[0052] In one embodiment of the present application, the legitimacy of the data packet is verified based on the data identifier, including: performing destination address conversion on the data packet, and importing the data packet into a virtual network card based on the destination address conversion result; in the virtual network card, determining whether the data packet carries a data identifier; if the data packet carries a data identifier, further determining whether the data identifier is legal, otherwise, discarding the data packet; if the data identifier is legal, further verifying whether the data identifier is abnormal, otherwise, discarding the data packet; if the data identifier verification is abnormal, discarding the data packet, otherwise confirming that the legitimacy verification of the data packet has passed.
[0053] In the above example, determining whether the data identifier is legitimate includes: extracting the serial number of the data identifier; and determining whether the serial number of the data identifier is legitimate through a data identifier factor synchronization mechanism. Verifying whether the data identifier is abnormal includes: executing an identifier verification algorithm to perform deobfuscation, i.e., data identifier verification, to determine whether there is any abnormality in the data identifier verification.
[0054] like Figure 3 As shown, the process of malicious traffic detection is shown, combined with Figure 2 As shown, the checksum identification process on the access network side is as follows: the access network side performs data identification verification on the received data packets, including data packet identification determination, data identification factor legitimacy determination and identification data legitimacy determination. Data packets that pass all verifications are considered legal and sent to the subsequent malicious traffic classification and identification processing process. Otherwise, the data packet will be discarded.
[0055] like Figure 3 As shown, the legitimacy of the data packet is verified according to the data identifier, including:
[0056] After acquiring the UE's internet data uploaded by the base station, the data packets are translated into their destination addresses at the pre-routing hook point using the configured Iptables, and then directed to the virtual network card for processing. By building a virtualized environment, network traffic is isolated and processed within the virtual environment, including data identification verification and deep learning model classification, to avoid impacting other normal traffic.
[0057] Data identification verification is the first line of defense for malicious traffic detection. Only packets that pass the legitimacy verification will enter the subsequent malicious traffic classification process. The verification process includes:
[0058] Determine whether it is a data identification data packet. If it is non-identification data, it is considered to be a data packet forged by an illegal terminal and is discarded directly.
[0059] If it is a data identification data packet, the identification information and the data identification factor sequence number are extracted. The data identification factor synchronization mechanism is used to determine whether the data identification factor sequence number is legal. If it is illegal, the data identification illegal data packet is discarded.
[0060] The data identification factor determines the legality of the data packet, executes the verification identification algorithm, deobfuscates and verifies the data identification data. If the verification fails, it is judged as a data identification verification anomaly and discarded.
[0061] S103: After the data packet passes the validity verification, the data packet is converted into a grayscale image, and whether the data packet is malicious traffic is identified based on the grayscale image.
[0062] In one embodiment of the present application, after the legitimacy of the data packet is verified, the data packet is converted into a grayscale image, and whether the data packet is malicious traffic is identified based on the grayscale image, including: converting the data packet into a grayscale image; inputting the grayscale image into a pre-trained classification model to obtain a classification result of the data packet, wherein the classification result of the classification model includes a normal traffic classification result and a malicious traffic classification result.
[0063] Furthermore, after identifying whether the data packet is malicious traffic according to the grayscale image, the method further includes: if the data packet is identified as malicious traffic, discarding the data packet; otherwise, forwarding the data packet to the core network requested by the terminal.
[0064] Specifically, combined Figure 3 As shown, after the data packet is verified in step S102, it enters the malicious traffic detection model (i.e., classification model) based on the convolutional neural network CNN for classification. Each data packet is taken as a classification object, and the original data packet is converted into a grayscale image, and the data packet classification task is performed using 1D-CNN and 2D-CNN. Ultimately, the classification model is able to identify malicious traffic mixed in the traffic on the access network side. Among them, the CNN-based malicious traffic classification model takes the data packet as the classification object, represents the original bytes of the data packet in the form of a grayscale image, and adopts the convolutional neural network CNN-based learning to finally achieve accurate classification of malicious traffic.
[0065] According to the method for identifying malicious traffic in a mobile communication network according to an embodiment of the present application, a data packet sent by a terminal uploaded by a base station is obtained through the access network side, and the data packet is verified for legitimacy based on the data identifier pre-embedded in the data packet. After the legitimacy verification is passed, the data packet is converted into a grayscale image, and the data packet is secondarily identified based on the grayscale image, and finally malicious traffic data packets are identified from a large number of data packets. Malicious traffic detection can be divided into a primary verification phase and a secondary identification phase for the massive amount of data in the mobile network, thereby achieving efficient and accurate identification of malicious traffic on the access network side. The method has the advantages of high malicious traffic identification efficiency, strong real-time performance, and high identification accuracy, thereby effectively reducing or even preventing malicious traffic data packets from entering the core network, thereby improving the security and reliability of the network.
[0066] Figure 4 This is a structural block diagram of a mobile communication network malicious traffic identification system according to an embodiment of the present application. Figure 4 As shown, according to an embodiment of the present application, a malicious traffic identification system for a mobile communication network is applied on the access network side. The malicious traffic identification system for a mobile communication network includes: an acquisition module 410, a verification module 420, and an identification module 430, wherein:
[0067] An acquisition module 410 is configured to obtain a data packet sent by a terminal and uploaded by a base station, wherein the data packet is pre-embedded with a data identifier by the terminal;
[0068] Verification module 420, configured to verify the legitimacy of the data packet according to the data identifier;
[0069] The identification module 430 is configured to convert the data packet into a grayscale image after the data packet passes the validity verification, and identify whether the data packet is malicious traffic based on the grayscale image.
[0070] According to the mobile communication network malicious traffic identification system of the embodiment of the present application, the data packet sent by the terminal uploaded by the base station is obtained through the access network side, and the data packet is verified for legitimacy based on the data identifier pre-embedded in the data packet. After the legitimacy verification is passed, the data packet is converted into a grayscale image, and the data packet is secondarily identified based on the grayscale image, and finally malicious traffic data packets are confirmed from the massive data packets. For the massive data in the mobile network, the malicious traffic detection can be divided into a primary verification stage and a secondary identification stage, thereby realizing efficient and accurate identification of malicious traffic on the access network side, with the advantages of high malicious traffic identification efficiency, strong real-time performance and high identification accuracy, thereby effectively reducing or even preventing malicious traffic data packets from entering the core network, and improving the security and reliability of the network.
[0071] It should be noted that the specific implementation method of the mobile communication network malicious traffic identification system of the embodiment of the present application is similar to the specific implementation method of the mobile communication network malicious traffic identification method of the embodiment of the present application. Please refer to the description of the method part for details, and no further details will be given here.
[0072] Reference below Figure 5 , Figure 5 A schematic diagram of the structure of a computing device suitable for implementing the embodiments of the present application is shown.
[0073] like Figure 5 As shown, the computing device includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1008 into a random access memory (RAM) 1003. Various programs and data required for the operation instructions of the system are also stored in the RAM 1003. The CPU 1001, ROM 1002, and RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.
[0074] The following components are connected to the I / O interface 1005: an input section 1006 including a keyboard, a mouse, and the like; an output section 1007 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 1008 including a hard disk; and a communication section 1009 including a network interface card such as a LAN card or a modem. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 1010 as needed, so that computer programs read therefrom can be installed into the storage section 1008 as needed.
[0075] In particular, according to the embodiment of the present application, the above reference flow chart Figure 1 The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1009, and / or installed from a removable medium 1011. When the computer program is executed by the central processing unit (CPU) 1001, the above-mentioned functions defined in the system of the present application are executed.
[0076] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical cable, RF, or any suitable combination thereof.
[0077] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operating instructions of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the aforementioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than the order marked in the accompanying drawings. For example, the boxes represented by two connections can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operating instruction, or can be implemented using a combination of dedicated hardware and computer instructions.
[0078] The units or modules involved in the embodiments described in this application may be implemented in software or hardware. The units or modules described may also be provided in a processor. The names of these units or modules do not, in certain circumstances, constitute limitations on the units or modules themselves.
[0079] As another aspect, the present application also provides a computer-readable storage medium, which may be included in the computing device described in the above embodiment, or may exist independently without being assembled into the computing device. The above computer-readable storage medium stores one or more programs, and when the above programs are used by one or more processors to execute the method for identifying malicious traffic in a mobile communication network described in the present application. For example, the following steps are performed: obtaining a data packet sent by a terminal uploaded by a base station, wherein the data packet is pre-embedded with a data identifier by the terminal;
[0080] Performing legitimacy verification on the data packet according to the data identifier;
[0081] After the legitimacy of the data packet is verified, the data packet is converted into a grayscale image, and whether the data packet is malicious traffic is identified based on the grayscale image.
[0082] As another aspect, the present application also provides a computer program product, which may be included in the computing device described in the above embodiment, or may exist independently without being assembled into the computing device. The above computer program product stores one or more programs, and when the above program is used by one or more processors to execute the method for identifying malicious traffic in a mobile communication network described in the present application. For example, the execution includes: obtaining a data packet sent by a terminal uploaded by a base station, wherein the data packet is pre-embedded with a data identifier by the terminal;
[0083] Performing legitimacy verification on the data packet according to the data identifier;
[0084] After the legitimacy of the data packet is verified, the data packet is converted into a grayscale image, and whether the data packet is malicious traffic is identified based on the grayscale image.
[0085] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the aforementioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.
Claims
1. A method for identifying malicious traffic in a mobile communication network, characterized in that: Applied to the access network side, the method includes: Obtaining a data packet sent by a terminal and uploaded by a base station, wherein the data packet is pre-embedded with a data identifier by the terminal; Performing legitimacy verification on the data packet according to the data identifier; After the legitimacy of the data packet is verified, the data packet is converted into a grayscale image, and whether the data packet is malicious traffic is identified based on the grayscale image.
2. The method for identifying malicious traffic in a mobile communication network according to claim 1, wherein: Before obtaining the data packet sent by the terminal uploaded by the base station, it also includes: The terminal constructs a data identification fingerprint based on the service type extracted from the original IP data packet generated by the application client and the uniformly allocated identification factor; The data identification fingerprint is embedded into a corresponding field of the original IP data packet to obtain the data packet, and the data packet is sent to the base station.
3. The method for identifying malicious traffic in a mobile communication network according to claim 1 or 2, characterized in that: The verifying the legitimacy of the data packet according to the data identifier includes: Performing destination address translation on the data packet, and importing the data packet into the virtual network card according to the destination address translation result; In the virtual network card, determining whether the data packet carries a data identifier; If the data packet carries a data identifier, further determining whether the data identifier is legal; otherwise, discarding the data packet; If the data identifier is legal, further verify whether the data identifier is abnormal; otherwise, discard the data packet; If the data identification verification is abnormal, the data packet is discarded; otherwise, it is confirmed that the legitimacy verification of the data packet has passed.
4. The method for identifying malicious traffic in a mobile communication network according to claim 3, wherein: The determining whether the data identification is legal includes: Extracting the serial number of the data identifier; The data identification factor synchronization mechanism is used to determine whether the serial number of the data identification is legal.
5. The method for identifying malicious traffic in a mobile communication network according to claim 3, wherein: The verifying whether the data identifier is abnormal includes: Execute the identification verification algorithm to perform deobfuscation, i.e. data identification verification, to determine whether there are any anomalies in the data identification verification.
6. The method for identifying malicious traffic in a mobile communication network according to claim 1, wherein: After the legitimacy verification of the data packet is passed, converting the data packet into a grayscale image, and identifying whether the data packet is malicious traffic based on the grayscale image, includes: Converting the data packet into a grayscale image; The grayscale image is input into a pre-trained classification model to obtain a classification result of the data packet, wherein the classification result of the classification model includes a normal traffic classification result and a malicious traffic classification result.
7. The method for identifying malicious traffic in a mobile communication network according to claim 1, wherein: After identifying whether the data packet is malicious traffic according to the grayscale image, the method further includes: If the data packet is identified as malicious traffic, the data packet is discarded; otherwise, the data packet is forwarded to the core network requested by the terminal.
8. A mobile communication network malicious traffic identification system, characterized in that: Applied to the access network side, the system includes: An acquisition module, configured to obtain a data packet sent by a terminal and uploaded by a base station, wherein the data packet is pre-embedded with a data identifier by the terminal; A verification module, configured to verify the legitimacy of the data packet according to the data identifier; The identification module is used to convert the data packet into a grayscale image after the legitimacy of the data packet is verified, and identify whether the data packet is malicious traffic based on the grayscale image.
9. A computing device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for identifying malicious traffic in a mobile communication network according to any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying malicious traffic in a mobile communication network according to any one of claims 1 to 7 is implemented.