Signaling attack detection method and device, equipment and storage medium

Abstract

The invention discloses a signaling attack detection method and device, equipment and a storage medium, and relates to the technical field of communication security, and the method comprises the steps: obtaining original signaling data; preprocessing the original signaling data to obtain a low-dimensional feature vector; the low-dimensional feature vector is input into a target attack scoring model, an attack score for the original signaling data is obtained, and the target attack scoring model comprises a space-time capsule network model, a federal learning model and a quantum collaborative optimization model; and determining a defense strategy according to the attack score, and blocking an attack behavior according to the defense strategy. According to the method and the device, the omission ratio and the false alarm rate of signaling attack detection can be effectively reduced, so that the 5G network security is improved.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular to a signaling attack detection method, apparatus, device, and storage medium. Background Art

[0002] With the large-scale deployment of 5G network slicing and ultra-reliable low-latency communication technologies, current signaling attack detection technologies face multiple challenges. For example, while existing solutions based on spatiotemporal graph neural networks can capture the interaction characteristics between base stations and user devices, their cascaded model architecture results in a fragmentation of signaling spatiotemporal features, which leads to a surge in missed detection rates. Furthermore, while existing federated learning frameworks improve detection coverage through cross-parameter sharing, the misalignment of feature spaces caused by heterogeneous encoding formats also leads to a surge in false positives. Furthermore, to meet the latency requirements of URLLC scenarios, existing lightweight detection models must be compressed to one-fifth of their original accuracy, significantly reducing their sensitivity for detecting minor signaling anomalies like quantum injection attacks, resulting in missed detection rates exceeding 35%. Therefore, existing signaling attack detection methods generally suffer from high false positive and missed detection rates, which impact 5G network security.

[0003] The above content is only used to assist in understanding the technical solution of this application and does not constitute an admission that the above content is prior art. Summary of the Invention

[0004] The main purpose of this application is to provide a signaling attack detection method, device, equipment and storage medium, aiming to reduce the missed detection rate and false alarm rate of signaling attack detection and improve 5G network security.

[0005] To achieve the above objectives, the present application proposes a signaling attack detection method, which includes:

[0006] Get original signaling data;

[0007] Preprocessing the original signaling data to obtain a low-dimensional feature vector;

[0008] Inputting the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model;

[0009] A defense strategy is determined according to the attack score to block the attack behavior according to the defense strategy.

[0010] In one embodiment, the step of preprocessing the original signaling data to obtain a low-dimensional feature vector includes:

[0011] Determining data point distance information of the original signaling data;

[0012] Based on the quantum radial basis function, determining the kernel matrix elements according to the data point distance information;

[0013] Mapping the original signaling data to a high-dimensional space based on the kernel matrix elements to obtain high-dimensional signaling data;

[0014] Performing quantum principal component analysis on the high-dimensional signaling data to obtain target signaling data;

[0015] Perform feature alignment on the target signaling data to obtain a low-dimensional feature vector.

[0016] In one embodiment, the step of performing feature alignment on the target signaling data to obtain a low-dimensional feature vector includes:

[0017] Determining a preset interface for the original signaling data;

[0018] Determining the interface protocol type of the preset interface;

[0019] Integrating the target signaling data into a high-order tensor structure based on the interface protocol type, timestamp, and geographic grid;

[0020] The high-order tensor structure is decomposed to obtain a core tensor, and the core tensor is used as a low-dimensional feature vector.

[0021] In one embodiment, the step of inputting the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data includes:

[0022] Inputting the low-dimensional feature vector into the target attack scoring model, processing the low-dimensional feature vector through the spatiotemporal capsule network model to obtain a spatiotemporal feature representation;

[0023] Processing the spatiotemporal feature representation through the federated learning model to obtain a classification result;

[0024] The spatiotemporal feature representation and the classification result are processed by the quantum collaborative optimization model to obtain an attack score for the original signaling data.

[0025] In one embodiment, the space-time capsule network model includes an input capsule, an output capsule, a coupling coefficient layer, and a causal convolution layer; wherein, before the step of processing the low-dimensional feature vector using the space-time capsule network model to obtain a space-time feature representation, the step further includes:

[0026] Input the low-dimensional feature vector into the initial spatiotemporal capsule network model to obtain a prediction vector from any input capsule to the output capsule, and determine the output vector of the output capsule based on all the prediction vectors;

[0027] Determining a target coupling coefficient based on the prediction vector, the output vector, and the initial coupling coefficient, and adjusting the coupling coefficient layer of the initial space-time capsule network model according to the target coupling coefficient to obtain a space-time capsule network model;

[0028] The low-dimensional feature vector is processed by the space-time capsule network model to obtain a space-time feature representation.

[0029] In one embodiment, before the step of processing the spatiotemporal feature representation using the federated learning model to obtain a classification result, the step further includes:

[0030] Receive encrypted gradient parameters uploaded by edge devices;

[0031] After securely aggregating the encrypted gradient parameters, an aggregated gradient parameter is obtained;

[0032] The initial federated learning model is updated according to the aggregated gradient parameters to obtain a federated learning model.

[0033] In one embodiment, before the step of processing the spatiotemporal feature representation and the classification result by the quantum collaborative optimization model to obtain an attack score for the original signaling data, the step further includes:

[0034] Encoding the initial parameters of the quantum cooperative optimization model as Ising model spins;

[0035] Constructing an energy function according to the Ising model spin, and finding the minimum value of the energy function using a quantum annealing algorithm;

[0036] The parameter combination corresponding to the minimum value is used as the optimal parameter, and the initial parameters of the quantum collaborative optimization model are adjusted according to the optimal parameter to obtain a trained quantum collaborative optimization model.

[0037] In one embodiment, the step of determining a defense strategy based on the attack score to block the attack behavior according to the defense strategy includes:

[0038] Obtain slice load status and cross-domain traceability confidence;

[0039] Constructing a state space based on the attack score, the slice load, and the cross-domain traceability confidence;

[0040] Selecting an optimal action in the state space according to a policy gradient reinforcement learning algorithm, and determining a defense strategy based on the optimal action;

[0041] The SDN controller issues defense instructions corresponding to the defense strategy to block attack behaviors.

[0042] In one embodiment, the method further comprises:

[0043] Obtaining system operation status information, wherein the system operation status information includes signaling traffic prediction results, clock frequency, and voltage distribution, wherein the signaling traffic prediction results are obtained by predicting future signaling traffic based on an autoregressive integrated moving average model and a long short-term memory network;

[0044] Based on the signaling traffic prediction result and the preset traffic value, the clock frequency is adjusted, and the voltage distribution is adjusted according to a preset power supply strategy to control the idle power consumption to be less than or equal to a preset power consumption threshold.

[0045] In addition, to achieve the above-mentioned purpose, the present application also proposes a signaling attack detection device, which includes:

[0046] An acquisition module is used to obtain original signaling data;

[0047] A processing module, configured to pre-process the original signaling data to obtain a low-dimensional feature vector;

[0048] An input module, configured to input the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model;

[0049] A determination module is configured to determine a defense strategy according to the attack score, so as to block the attack behavior according to the defense strategy.

[0050] In addition, to achieve the above-mentioned purpose, the present application also proposes a signaling attack detection device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is configured to implement the steps of the signaling attack detection method described above.

[0051] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium and stores a computer program. When the computer program is executed by a processor, the steps of the signaling attack detection method described above are implemented.

[0052] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the signaling attack detection method described above.

[0053] One or more technical solutions proposed in this application have at least the following technical effects:

[0054] The signaling attack detection method, apparatus, device and storage medium proposed in the present application obtain original signaling data; pre-process the original signaling data to obtain a low-dimensional feature vector; input the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model and a quantum collaborative optimization model; determine a defense strategy based on the attack score to block the attack behavior based on the defense strategy, thereby solving the technical problem that the existing signaling attack detection methods generally have a high missed detection rate and a high false alarm rate, which affect the security of 5G network. Compared with the existing technology, the present application The space-time capsule model, federated learning model and quantum collaborative optimization model are combined to jointly detect attacks on the original signaling data. The space-time capsule network can capture the spatiotemporal coupling relationship between NAS layer authentication failure events and RRC layer connection anomalies, thereby reducing the false alarm rate of slice hijacking attacks. It can also deploy a federated learning model to achieve lossless alignment and privacy protection of cross-operator signaling chains through secure multi-party computing. Finally, the quantum optimization model is used to map the SVM kernel function parameter optimization problem to the Ising model of the quantum annealing machine to improve the detection accuracy of AI adversarial signaling, and block it through defense strategies when attack behavior is detected, thereby ensuring 5G network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0056] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0057] Figure 1 A flowchart of the first embodiment of the signaling attack detection method of this application is provided;

[0058] Figure 2 This is a schematic diagram of the overall process provided in Example 1 of the signaling attack detection method of this application;

[0059] Figure 3 A flowchart of the second embodiment of the signaling attack detection method provided in this application;

[0060] Figure 4This is a schematic diagram of the module structure of the signaling attack detection device according to an embodiment of the present application;

[0061] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the signaling attack detection method in the embodiment of the present application.

[0062] The purpose, features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0063] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0064] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0065] The main solution of the embodiment of the present application is: obtaining original signaling data; preprocessing the original signaling data to obtain a low-dimensional feature vector; inputting the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model; determining a defense strategy based on the attack score to block the attack behavior according to the defense strategy.

[0066] It can be seen from the above embodiments that the present application obtains original signaling data; pre-processes the original signaling data to obtain a low-dimensional feature vector; inputs the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model; determines a defense strategy based on the attack score to block the attack behavior based on the defense strategy, thereby solving the technical problem that the existing signaling attack detection method generally has a high missed detection rate and a high false alarm rate, which affects the security of the 5G network. Compared with the existing technology, the present application combines the space-time capsule network model with the space-time capsule network model. The model, federated learning model and quantum collaborative optimization model are used to jointly detect attacks on the original signaling data. The space-time capsule network can be used to capture the spatiotemporal coupling relationship between NAS layer authentication failure events and RRC layer connection anomalies, thereby reducing the false alarm rate of slice hijacking attacks. The federated learning model can also be deployed to achieve lossless alignment and privacy protection of cross-operator signaling chains through secure multi-party computing. Finally, the quantum optimization model is used to map the SVM kernel function parameter optimization problem to the Ising model of the quantum annealing machine to improve the detection accuracy of AI adversarial signaling, and when attack behavior is detected, it is blocked through defense strategies, thereby ensuring 5G network security.

[0067] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or an electronic device capable of implementing the above functions, signaling attack detection equipment, etc. The following uses signaling attack detection as an example to illustrate this embodiment and the following embodiments.

[0068] Based on this, the embodiment of the present application provides a signaling attack detection method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the signaling attack detection method of this application.

[0069] In this embodiment, the signaling attack detection method includes steps S10 to S40:

[0070] Step S10, obtaining original signaling data;

[0071] It should be noted that raw signaling data can be obtained through preset interfaces, such as the 25Gbps fronthaul interface (eCPRI) for real-time access to signaling streams. The raw signaling stream contains 128-dimensional metadata that comprehensively reflects various information about 5G network signaling interactions. Preset interfaces include the N2 interface (AMF-gNB), the N4 interface (SMF-UPF), and the N11 interface (AMF-SMF). These interfaces perform different key functions in 5G networks. The N2 interface is used for communication between the access and mobility management function (AMF) and the base station (gNB). This interface contains important information such as NAS layer authentication messages. The accuracy of authentication messages is directly related to the security of user access to the network. The N4 interface is used for interaction between the session management function (SMF) and the user plane function (UPF). This interface involves content such as PDU session parameters, which determine the transmission path and quality of user data. The N11 interface is responsible for communication between the AMF and SMF. This interface contains NGAP handover instructions, etc. The correct execution of handover instructions is critical to ensuring communication continuity for users during mobility.

[0072] It is understandable that after capturing the signaling stream from the preset interface, it is necessary to parse these signaling streams based on the interface protocol to obtain the original signaling data. Specifically, the interface protocol can be the HTTP / 2 over QUIC protocol (that is, using QUIC as the transport layer protocol to implement the HTTP / 2 protocol, thereby utilizing the characteristics of QUIC to enhance the performance and security of HTTP / 2). In particular, the HTTP / 2 protocol has greatly improved in performance, supporting features such as multiplexing and header compression, which can improve the efficiency of data transmission, while the QUIC protocol provides better security and reliability at the transport layer and reduces handshake delay. This combined protocol can support a high throughput of 25Gbps, ensuring that a large amount of signaling data can flow into the preprocessing module quickly and stably.

[0073] In its implementation, the signaling attack detection device utilizes a distributed edge-cloud collaborative design. Its hardware layer consists of a pre-processing unit cluster, quantum accelerator cards, programmable switching chips, and blockchain evidence storage nodes. Deployed between the distributed unit (DU) and centralized unit (CU) defined by the O-RAN standard, it enables real-time access to signaling streams via a 25Gbps fronthaul interface (eCPRI). Each functional module is interconnected via a high-speed deterministic network (TSN bus), keeping latency jitter within ±50ns, meeting the 5ms end-to-end processing requirement for URLLC scenarios.

[0074] Step S20, preprocessing the original signaling data to obtain a low-dimensional feature vector;

[0075] It should be noted that preprocessing can include dimensionality reduction and feature alignment operations. By performing dimensionality reduction and feature alignment on the original signaling data, redundant information can be removed and key features can be extracted. This can provide concise and effective input for the subsequent detection engine, thereby improving the efficiency and accuracy of signaling attack detection.

[0076] In a feasible embodiment, the step of preprocessing the original signaling data to obtain a low-dimensional feature vector includes: determining the data point distance information of the original signaling data; determining the kernel matrix elements according to the data point distance information based on the quantum radial basis function; mapping the original signaling data to a high-dimensional space based on the kernel matrix elements to obtain high-dimensional signaling data; performing quantum principal component analysis on the high-dimensional signaling data to obtain target signaling data; and performing feature alignment on the target signaling data to obtain a low-dimensional feature vector.

[0077] In the specific implementation, the D-Wave Advantage2 quantum computer can be used to perform quantum PCA dimensionality reduction on the original signaling data. Specifically, QRBF (quantum radial basis function) kernel matrix calculation can be performed to map the original signaling data to a high-dimensional space, and finally quantum PCA dimensionality reduction is performed on the data in the high-dimensional space (because the distance relationship between data points becomes clearer in high-dimensional space, this will help identify more representative feature dimensions), so that key features can be extracted more effectively.

[0078] It should be noted that it is also possible to Decoherent noise of λ=0.05 is inserted into the superposition phase to counter adversarial sample attacks such as FGSM (Fast Gradient Sign Method) perturbations. FGSM attacks deceive the model by adding tiny perturbations to the original data, while noise injection can increase the robustness of quantum computer systems.

[0079] In the specific implementation, the specific calculation formula of the kernel matrix elements is as follows:

[0080]

[0081] Where x i represents the i-th data point in the original signaling data, x j represents the jth data point in the original signaling data, σ represents the kernel width (preferably, the kernel width can be set to 0.15), ||x i -x j || represents the Euclidean distance between the i-th data point and the j-th data point (i.e., data point distance information).

[0082] In a feasible implementation, the step of performing feature alignment on the target signaling data to obtain a low-dimensional feature vector includes: determining the preset interface of the original signaling data; determining the interface protocol type of the preset interface; integrating the target signaling data into a high-order tensor structure based on the interface protocol type, timestamp and geographic grid; decomposing the high-order tensor structure to obtain a core tensor, and using the core tensor as a low-dimensional feature vector.

[0083] It should be noted that the target signaling data can be integrated into a 3rd-order tensor according to the interface protocol type (N2 / N4 / N11), timestamp (accuracy of 1μs), and geographic grid (100m×100m). This construction method can integrate signaling data from different protocols, at different times, and in different geographic locations into a unified tensor structure, facilitating subsequent analysis and processing. For example, different types of attack behaviors may occur in different geographic grids, and this tensor construction method can be used to correlate this information.

[0084] In the specific implementation, the core tensor G∈R can be extracted from the high-order tensor structure by Tucker decomposition method. 5 ×100×5 , where Tucker decomposition is a multilinear decomposition method that can decompose a high-order tensor structure into a core tensor and multiple factor matrices. Specifically, for a high-order tensor structure T, Tucker decomposition can be expressed as: G×1 A ×2 B ×3 C , where G is the core tensor, and A, B, and C are factor matrices corresponding to different modes.

[0085] It should be noted that Tucker decomposition can reveal the spatiotemporal-protocol coupling patterns of cross-slice attacks, such as the sudden aggregation of malicious switching instructions in a specific geographic grid. This pattern is of great significance for identifying and preventing attacks.

[0086] It can be understood that after quantum PCA dimensionality reduction and cross-protocol feature alignment, a compressed and aligned 16-dimensional feature vector is generated and output to the detection engine. This feature vector retains the key information in the original signaling stream while removing a large amount of redundant data, greatly improving the efficiency of the subsequent detection process.

[0087] Step S30: inputting the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model;

[0088] It should be noted that the attack score can intuitively reflect the likelihood of an attack in the original signaling data. The space-time capsule network overcomes the bottleneck of traditional detection models in parsing cross-protocol layer signaling associations. Through a dynamic routing algorithm, it simultaneously captures the spatiotemporal coupling between NAS layer authentication failures and RRC layer connection anomalies. The federated learning model uses the MobileNetV4-Tiny edge model, which has only 2MB of parameters. Specifically, this model is lightweight, suitable for running on edge devices, and supports ONNX-RT real-time inference, enabling rapid processing and analysis of input feature vectors. The quantum collaborative optimization model maps the SVM kernel function parameter optimization problem to the Ising model of a quantum annealer, leveraging the quantum tunneling effect to overcome the local optimality trap of traditional gradient descent. Under the 5ms end-to-end latency constraint, the detection accuracy of AI-generated adversarial signaling (such as RRC connection storms that mimic legitimate user behavior) is increased to 96.5%, an 8.3x speedup compared to traditional optimization algorithms, providing real-time protection for URLLC scenarios.

[0089] It's important to note that space-time capsule networks and federated learning agent technology can be used to conduct in-depth analysis of signaling data and detect attacks. By learning the characteristics and patterns of signaling data, it can accurately determine whether attacks are occurring and assign corresponding attack scores, providing a basis for subsequent parameter optimization and defense decision-making. Specifically, the input is the compressed and aligned 16-dimensional feature vectors output by the preprocessing module. These feature vectors are initially processed and refined signaling feature data, containing key information for identifying attack behaviors.

[0090] Step S40: determining a defense strategy according to the attack score, so as to block the attack behavior according to the defense strategy.

[0091] In the specific implementation, the defense action can be triggered according to the attack score, for example, when the attack score P attack When the value is ≥0.93, a series of proactive defense actions are triggered, including signaling obfuscation (forging 30% RRC Release) and slice QoS degradation (GBR→Non-GBR). In particular, signaling obfuscation can interfere with attackers' attack behavior, making it difficult for them to accurately obtain network information; slice QoS degradation can reduce resource consumption of the attacked slice and protect the operation of other normal slices.

[0092] In a feasible implementation, the step of determining a defense strategy based on the attack score to block the attack behavior according to the defense strategy includes: obtaining the slice load situation and the cross-domain traceability confidence; constructing a state space based on the attack score, the slice load situation and the cross-domain traceability confidence; selecting the optimal action in the state space according to the policy gradient reinforcement learning algorithm, and determining the defense strategy based on the optimal action; issuing the defense instructions corresponding to the defense strategy through the SDN controller to block the attack behavior.

[0093] It should be noted that cross-domain tracing confidence is a metric used in cyberattack tracing scenarios to measure the credibility of tracing the attack source from different network domains (which can be understood as different network management scopes, different network architecture components, or different trust zones, etc.). In a network environment, attacks may span multiple domains, such as entering an enterprise's internal network domain from an external public network domain and then infiltrating the core data network domain. This confidence level reflects the reliability of determining the attack source using cross-domain clues (such as log information, traffic data, and packet header information). Its value generally ranges from 0 to 1, or is expressed as a percentage. For example, an attack tracing result with a cross-domain tracing confidence level of 0.8 (or 80%) is relatively reliable, while a result with a confidence level of 0.3 (or 30%) is less reliable. Specifically, the confidence level of cross-domain tracing can be determined by collecting various log information from different network domains, including but not limited to system logs, network device logs, application logs, etc., and analyzing the correlation, consistency, and frequency of occurrence of these logs. It is also possible to perform feature modeling on known attack behavior patterns. When tracing attacks across domains, the collected cross-domain data can be matched with these known patterns. The higher the degree of matching, the higher the confidence level of cross-domain tracing.

[0094] It should be noted that based on the PPO (Proximal Policy Optimization) reinforcement learning algorithm (i.e., the policy gradient reinforcement learning algorithm), the attack score P attack , slice CPU load rate (i.e., slice load status), and cross-domain traceability confidence construct a state space. Specifically, the PPO algorithm is a policy gradient-based reinforcement learning algorithm. By continuously optimizing the policy network, it enables the agent to select the optimal action under different states, ultimately generating a corresponding defense strategy and linking it with the SDN (Software Defined Network) controller to issue defense instructions. The SDN controller can flexibly control the network's traffic and topology. By issuing defense instructions, it can promptly block attack paths and protect network security.

[0095] In practice, a consortium chain architecture can be employed, with operators, regulators, and cloud service providers acting as PBFT (Practical Byzantine Fault Tolerance) consensus nodes. The PBFT consensus algorithm can ensure the consistency and security of the blockchain network even in the presence of a certain number of Byzantine nodes (malicious nodes). Specifically, the SHA3-512 hash of the original signaling data and the BeiDou timestamp (with an accuracy of 10ns) are written into the smart contract to reliably store attack evidence. The SHA3-512 hash algorithm is highly secure and unique, ensuring the integrity of the signaling data; the BeiDou timestamp provides precise time information, facilitating accurate tracing of attack events. This approach supports the ISO 27037 forensics standard, ensuring that the source of an attack can be accurately traced when necessary.

[0096] In a feasible embodiment, the method also includes: obtaining system operation status information, wherein the system operation status information includes signaling traffic prediction results, clock frequency and voltage distribution, and the signaling traffic prediction results are obtained after predicting future signaling traffic based on an autoregressive integral moving average model and a long short-term memory network; based on the signaling traffic prediction results and the preset traffic value, adjusting the clock frequency, and adjusting the voltage distribution according to a preset power supply strategy to control the idle power consumption to be less than or equal to a preset power consumption threshold.

[0097] It's important to note that the ARIMA (Autoregressive Integrated Moving Average) + LSTM (Long Short-Term Memory) model can be used to accurately predict signaling traffic for the next second, thereby obtaining signaling traffic forecast results. The ARIMA model is suitable for processing time series data with linear trends and seasonality, while the LSTM model excels at processing sequence data with long-term dependencies. Combining these two models can fully leverage their strengths and improve the accuracy of signaling traffic forecast results.

[0098] In a specific implementation, the FPGA clock frequency can be dynamically adjusted in real time according to the signaling traffic prediction result. Specifically, the frequency adjustment range is 200MHz to 1.2GHz. When the signaling traffic prediction result is greater than the first preset traffic value among the preset traffic values ​​(that is, when the signaling traffic is large), the clock frequency is increased to ensure the processing speed. When the signaling traffic prediction result is greater than the second preset traffic value among the preset traffic values ​​(that is, when the signaling traffic is small), the clock frequency can be reduced to reduce power consumption, wherein the first preset traffic value is greater than the second preset traffic value.

[0099] In a specific implementation, voltage islanding technology can be used to divide the FPGA into active and dormant areas. A preset power supply strategy can then be used to adjust the current voltage distribution. Specifically, the preset power supply strategy provides 1.0V power to the active area of ​​the FPGA to ensure normal operation, while reducing the voltage in the dormant area to 0.5V to reduce power consumption. This ensures that idle power consumption is ≤0.3W (the preset power consumption threshold), ultimately achieving efficient energy management for attack detection of signaling data.

[0100] In the specific implementation, Figure 2 As shown in the figure, this solution primarily consists of a preprocessing module, a detection engine module, a parameter optimization module, and an active defense module. The preprocessing module is the front end of the entire detection process, primarily responsible for preliminary processing and feature extraction of the raw signaling stream. The detection engine is the core component of the signaling attack detection device. Based on the feature vectors output by the preprocessing module, it utilizes space-time capsule networks and federated learning agent technology to conduct in-depth analysis of signaling data and detect attacks. The parameter optimization module optimizes and adjusts the parameters of the detection model based on the attack score output by the detection engine to improve the model's detection performance and adaptability. This module also manages balanced power consumption, ensuring efficient processing of signaling data while reducing energy consumption and improving the system's energy efficiency. The active defense module formulates and executes corresponding defense strategies based on the detection engine's attack score and the optimization module's decision hyperplane, responding to and blocking detected attacks in real time. Furthermore, through blockchain traceability technology, attack events are recorded and traced, providing strong support for subsequent security analysis.

[0101] This embodiment obtains original signaling data; pre-processes the original signaling data to obtain a low-dimensional feature vector; inputs the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model; determines a defense strategy according to the attack score to block the attack behavior according to the defense strategy, thereby solving the technical problem that the existing signaling attack detection method generally has a high missed detection rate and a high false alarm rate, which affects the security of 5G network. Compared with the existing technology, this application combines the space-time capsule model, the federated learning model, and the quantum collaborative optimization model. The federated learning model and the quantum collaborative optimization model are used to jointly detect attacks on the original signaling data. The space-time capsule network can be used to capture the spatiotemporal coupling relationship between NAS layer authentication failure events and RRC layer connection anomalies, thereby reducing the false alarm rate of slice hijacking attacks. The federated learning model can also be deployed to achieve lossless alignment and privacy protection of cross-operator signaling chains through secure multi-party computing. Finally, the quantum optimization model is used to map the SVM kernel function parameter optimization problem to the Ising model of the quantum annealing machine to improve the detection accuracy of AI adversarial signaling, and when attack behavior is detected, it is blocked through defense strategies, thereby ensuring 5G network security.

[0102] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above embodiment 1 can be referred to the above introduction and will not be described in detail later. Figure 3 , step S30 further includes steps S301 to S302:

[0103] Step S301: input the low-dimensional feature vector into the target attack scoring model, and process the low-dimensional feature vector through the spatiotemporal capsule network model to obtain a spatiotemporal feature representation;

[0104] In a feasible embodiment, the space-time capsule network model includes an input capsule, an output capsule, a coupling coefficient layer and a causal convolution layer; wherein, before the step of processing the low-dimensional feature vector through the space-time capsule network model to obtain the space-time feature representation, it also includes: inputting the low-dimensional feature vector into the initial space-time capsule network model to obtain a prediction vector from any input capsule to the output capsule, and determining the output vector of the output capsule based on all the prediction vectors; based on the prediction vector, the output vector and the initial coupling coefficient, determining the target coupling coefficient, and adjusting the coupling coefficient layer of the initial space-time capsule network model according to the target coupling coefficient to obtain the space-time capsule network model; processing the low-dimensional feature vector through the space-time capsule network model to obtain the space-time feature representation.

[0105] It should be noted that for the space-time capsule network model, the coupling coefficient between capsules is calculated through three rounds of iterations. Specifically, for the i-th input capsule and the j-th output capsule, the coupling coefficient b ij The update formula is:

[0106] b ij ←b ij +u ij ×v j ,

[0107] Among them, u oj is the prediction vector from input capsule i to output capsule j, v j is the output vector of output capsule j.

[0108] It should be noted that through three rounds of iterations, the coupling coefficient is continuously adjusted so that the space-time capsule network model can better capture the characteristics and structure of the signaling data, and the final output modulus length || v j || can represent the attack probability. The larger the modulus, the higher the correlation between the feature corresponding to the output capsule and the attack behavior.

[0109] It should be noted that the causal convolution layer in the space-time capsule network model uses an expansion factor of d = 2 4 Causal convolution is a special convolution method that ensures that the output of the convolution operation depends only on the past and current input moments, meeting the requirements for processing time series data. The dilation factor d determines the sampling interval of the convolution kernel on the input sequence. By setting a larger dilation factor, the receptive field of the convolution layer can be expanded, thereby better extracting features such as signaling interval jitter (standard deviation > 50ms) and retransmission rate (> 3 times / second). These features are particularly critical for identifying attack behaviors. For example, abnormal signaling interval jitter may indicate malicious interference, and an excessively high retransmission rate may indicate an attack on data transmission.

[0110] Step S302: Processing the spatiotemporal feature representation through the federated learning model to obtain a classification result;

[0111] In a feasible implementation, before the step of processing the spatiotemporal feature representation through the federated learning model to obtain a classification result, it also includes: receiving encrypted gradient parameters uploaded by the edge device; securely aggregating the encrypted gradient parameters to obtain aggregated gradient parameters; updating the initial federated learning model according to the aggregated gradient parameters to obtain a federated learning model.

[0112] It should be noted that the federated learning model supports cross-domain collaborative detection and enhances the generalization ability of the model in multi-operator and multi-slice scenarios; secure aggregation uses Paillier homomorphic encryption (key length 2048 bits) to protect gradient parameters. Specifically, Paillier homomorphic encryption is an additive homomorphic encryption algorithm that allows specific calculations on encrypted data without decrypting the data first. That is, in federated learning, the edge device encrypts the gradient parameters calculated locally (i.e., encrypted gradient parameters) and uploads them to the central node. The central node can aggregate these gradients in an encrypted state, and then decrypt the aggregated gradients and update the global model. The central node updates the global model (i.e., the federated learning model) through the MAML (model-independent meta-learning) meta-learning algorithm. The update formula is:

[0113]

[0114] Among them, θ global is the parameter of the global model, η is the learning rate, f θi is the i-th marginal model, D val It is a validation dataset. The MAML algorithm can quickly adapt to different tasks and data distributions, improving the generalization ability of the model in cross-domain scenarios.

[0115] Step S303: Process the spatiotemporal feature representation and the classification result through the quantum collaborative optimization model to obtain an attack score for the original signaling data.

[0116] In a feasible embodiment, before the step of processing the spatiotemporal feature representation and the classification result through the quantum collaborative optimization model to obtain an attack score for the original signaling data, it also includes: encoding the initial parameters of the quantum collaborative optimization model as Ising model spin; constructing an energy function based on the Ising model spin, and using a quantum annealing algorithm to find the minimum value of the energy function; using the parameter combination corresponding to the minimum value as the optimal parameter, and adjusting the initial parameters of the quantum collaborative optimization model according to the optimal parameter to obtain a trained quantum collaborative optimization model.

[0117] In the specific implementation, the initial parameters (C, γ) of SVM (support vector machine, i.e. quantum collaborative optimization model) are encoded as the Ising model spin σ i ∈{±1}, and construct the energy function H=-∑j according to the Ising model spin ij σ i σ j , where j ijis the interaction coefficient between spins, which is related to the optimization objective of the SVM parameters. Specifically, the Ising model is a classic statistical physics model. By mapping the SVM parameters to the spin states of the Ising model, a quantum annealing algorithm can be used to find the minimum value of the energy function, thereby obtaining the optimal SVM parameters.

[0118] It should be noted that the quantum annealing process, which lasted 20μs and was performed on a D-Wave 5000Q quantum device, had a quantum tunneling probability of P = 5%. Specifically, quantum annealing is an optimization algorithm based on the principles of quantum mechanics that exploits the quantum tunneling effect, enabling the system to escape local optimal solutions and find the global optimal solution. By setting an appropriate quantum tunneling probability, the probability of finding the optimal solution can be increased while maintaining the algorithm's convergence speed.

[0119] It should be noted that the SVM parameters are mapped to the spin states of the Ising model to construct an energy function, where the energy value reflects the classification performance of the SVM model under the current parameter configuration; a quantum annealing process is performed on the D-Wave 5000Q quantum device, using the quantum tunneling effect to escape the local optimal solution and find the global optimal solution; based on the optimized parameters, a new decision hyperplane is generated to distinguish normal signaling from attack signaling.

[0120] It is understandable that although quantum annealing optimization directly targets the SVM model, its optimization results can indirectly improve the performance of the federated learning model. (The optimized SVM model provides a more accurate classification basis, which enables the federated learning model to adjust parameters based on higher-quality feedback information). Similarly, although quantum annealing optimization directly acts on the SVM model, its optimization results can improve the performance of the space-time capsule network model through a system-level feedback mechanism. (The coupling coefficient between capsules in the space-time capsule network is adjusted through iterative calculation, and this adjustment process depends on the feedback information of the entire system. The optimized SVM model can provide more accurate classification results, thereby indirectly guiding the adjustment of the coupling coefficient; parameters such as the expansion factor of the causal convolution layer need to be dynamically adjusted according to the distribution characteristics of the signaling data. The optimized SVM model can more accurately identify key features (such as signaling interval jitter and retransmission rate), thereby indirectly improving the performance of the causal convolution layer).

[0121] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the signaling attack detection method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0122] This application also provides a signaling attack detection device, please refer to Figure 4 , the signaling attack detection device includes:

[0123] Acquisition module 10, used to obtain original signaling data;

[0124] The processing module 20 is used to pre-process the original signaling data to obtain a low-dimensional feature vector;

[0125] An input module 30 is configured to input the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model;

[0126] The determination module 40 is configured to determine a defense strategy according to the attack score, so as to block the attack behavior according to the defense strategy.

[0127] The signaling attack detection device provided in this application, which employs the signaling attack detection method of the above-mentioned embodiment, can address the technical issues of existing signaling attack detection methods, which generally suffer from high missed detection rates and high false alarm rates, thus affecting 5G network security. Compared with the prior art, the beneficial effects of the signaling attack detection device provided in this application are the same as those of the signaling attack detection method provided in the above-mentioned embodiment, and the other technical features of the signaling attack detection device are the same as those disclosed in the above-mentioned embodiment method, and are not further described here.

[0128] The present application provides a signaling attack detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the signaling attack detection method in the above-mentioned embodiment one.

[0129] Reference below Figure 5 , which shows a schematic diagram of the structure of a signaling attack detection device suitable for implementing the embodiments of the present application. The signaling attack detection device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The signaling attack detection device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0130] like Figure 5As shown, the signaling attack detection device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory 1002 or programs loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the signaling attack detection device. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: an input device 1007 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the signaling attack detection device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a signaling attack detection device with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems can be implemented or provided instead.

[0131] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a read-only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are performed.

[0132] The signaling attack detection device provided in this application, using the signaling attack detection method in the above-mentioned embodiment, can solve the technical problems of existing signaling attack detection methods, such as high missed detection rates and high false alarm rates, which affect the security of 5G networks. Compared with the existing technology, the beneficial effects of the signaling attack detection device provided in this application are the same as those of the signaling attack detection method provided in the above-mentioned embodiment, and the other technical features of the signaling attack detection device are the same as those disclosed in the method of the previous embodiment, and are not further described here.

[0133] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0134] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0135] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, a computer program) stored thereon, and the computer-readable program instructions are used to execute the signaling attack detection method in the above embodiment.

[0136] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0137] The computer-readable storage medium may be included in the signaling attack detection device; or may exist independently without being assembled into the signaling attack detection device.

[0138] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the signaling attack detection device, the signaling attack detection and evaluation device: obtains original signaling data; preprocesses the original signaling data to obtain a low-dimensional feature vector; inputs the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model; determines a defense strategy according to the attack score to block the attack behavior according to the defense strategy.

[0139] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0140] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0141] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0142] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-mentioned signaling attack detection method. This computer-readable storage medium can solve the technical problem that existing signaling attack detection methods generally have high missed detection rates and high false alarm rates, which affect the security of 5G networks. Compared with the existing technology, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the signaling attack detection method provided in the above-mentioned embodiment, and will not be elaborated here.

[0143] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned signaling attack detection method when executed by a processor.

[0144] The computer program product provided in this application can address the technical issues with existing signaling attack detection methods, such as high missed detection rates and high false alarm rates, which affect 5G network security. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the signaling attack detection method provided in the above embodiments, and are not further elaborated here.

[0145] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A signaling attack detection method, characterized in that: The method comprises: Get original signaling data; Preprocessing the original signaling data to obtain a low-dimensional feature vector; Inputting the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model; A defense strategy is determined according to the attack score to block the attack behavior according to the defense strategy.

2. The method according to claim 1, wherein The step of preprocessing the original signaling data to obtain a low-dimensional feature vector includes: Determining data point distance information of the original signaling data; Based on the quantum radial basis function, determining the kernel matrix elements according to the data point distance information; Mapping the original signaling data to a high-dimensional space based on the kernel matrix elements to obtain high-dimensional signaling data; Performing quantum principal component analysis on the high-dimensional signaling data to obtain target signaling data; Perform feature alignment on the target signaling data to obtain a low-dimensional feature vector.

3. The method according to claim 2, wherein The step of performing feature alignment on the target signaling data to obtain a low-dimensional feature vector includes: Determining a preset interface for the original signaling data; Determining the interface protocol type of the preset interface; Integrating the target signaling data into a high-order tensor structure based on the interface protocol type, timestamp, and geographic grid; The high-order tensor structure is decomposed to obtain a core tensor, and the core tensor is used as a low-dimensional feature vector.

4. The method according to claim 1, wherein The step of inputting the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data includes: Inputting the low-dimensional feature vector into the target attack scoring model, processing the low-dimensional feature vector through the spatiotemporal capsule network model to obtain a spatiotemporal feature representation; Processing the spatiotemporal feature representation through the federated learning model to obtain a classification result; The spatiotemporal feature representation and the classification result are processed by the quantum collaborative optimization model to obtain an attack score for the original signaling data.

5. The method according to claim 4, wherein The space-time capsule network model includes an input capsule, an output capsule, a coupling coefficient layer, and a causal convolution layer; wherein, before the step of processing the low-dimensional feature vector by the space-time capsule network model to obtain the space-time feature representation, the step further includes: Input the low-dimensional feature vector into the initial spatiotemporal capsule network model to obtain a prediction vector from any input capsule to the output capsule, and determine the output vector of the output capsule based on all the prediction vectors; Determining a target coupling coefficient based on the prediction vector, the output vector, and the initial coupling coefficient, and adjusting the coupling coefficient layer of the initial space-time capsule network model according to the target coupling coefficient to obtain a space-time capsule network model; The low-dimensional feature vector is processed by the space-time capsule network model to obtain a space-time feature representation.

6. The method according to claim 4, wherein Before the step of processing the spatiotemporal feature representation and the classification result by the quantum collaborative optimization model to obtain an attack score for the original signaling data, the method further includes: Encoding the initial parameters of the quantum cooperative optimization model as Ising model spins; Constructing an energy function according to the Ising model spin, and finding the minimum value of the energy function using a quantum annealing algorithm; The parameter combination corresponding to the minimum value is used as the optimal parameter, and the initial parameters of the quantum collaborative optimization model are adjusted according to the optimal parameter to obtain a trained quantum collaborative optimization model.

7. The method according to claim 1, wherein The step of determining a defense strategy according to the attack score to block the attack behavior according to the defense strategy includes: Obtain slice load status and cross-domain traceability confidence; Constructing a state space based on the attack score, the slice load, and the cross-domain traceability confidence; Selecting an optimal action in the state space according to a policy gradient reinforcement learning algorithm, and determining a defense strategy based on the optimal action; The SDN controller issues defense instructions corresponding to the defense strategy to block attack behaviors.

8. A signaling attack detection device, characterized in that: The device comprises: An acquisition module is used to obtain original signaling data; A processing module, configured to pre-process the original signaling data to obtain a low-dimensional feature vector; An input module, configured to input the low-dimensional feature vector into a target attack scoring model to obtain an attack score for the original signaling data, wherein the target attack scoring model includes a space-time capsule network model, a federated learning model, and a quantum collaborative optimization model; The determination module is configured to determine a defense strategy according to the attack score, so as to block the attack behavior according to the defense strategy.

9. A signaling attack detection device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the signaling attack detection method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the signaling attack detection method according to any one of claims 1 to 7 are implemented.

Images