Network function interaction anomaly detection method and system for core network

Abstract

The invention discloses a core network-oriented network function interaction anomaly detection method and system, and belongs to the technical field of mobile communication network security, and the method comprises the steps: converting call tree data into a time sequence interaction sequence through logic anomaly detection, and inputting the time sequence interaction sequence into LSTM-AE after numerical coding and embedded mapping; the second layer generates high-order features and compresses the high-order features into global potential representation; the dual-layer LSTM decoder reconstructs a sequence through a fully connected layer based on the potential representation to determine logical anomalies such as call missing, redundancy, or illegal calls with a reconstruction error exceeding an error threshold. The method comprises the steps of analyzing pcap flow data of a core network control plane through frequency anomaly detection, extracting frame / IP / TCP multi-level feature vectors, inputting the frame / IP / TCP multi-level feature vectors into an LSTM model to obtain a predicted flow normal probability after data cleaning, feature selection and standardized preprocessing, and identifying low-frequency attacks such as low-speed DoS when the flow normal probability is lower than a flow threshold value; and first bit missing and low-frequency anomalies in core network logic anomalies can be effectively detected.

Description

Technical Field

[0001] The present invention belongs to the technical field of mobile communication network security, and relates to a method and system for detecting network function interaction anomalies oriented to a core network. Background Art

[0002] With the widespread deployment of 5G (5th Generation Mobile Communication Technology) and its evolutionary technology, B5G (Beyond 5th Generation Mobile Communication Technology), mobile communication networks are rapidly evolving towards high bandwidth, low latency, and massive connections. The core network adopts a service-based architecture (SBA), leveraging modular network functions and standardized API (Application Programming Interface) interactions, significantly improving system flexibility and scalability. However, the high degree of virtualization, service-based nature, and complex business processes also lead to unprecedentedly frequent network function interactions, expanding the potential attack surface and significantly increasing the risk of diverse security threats. At the network function interaction level, two main types of anomalies affect the stability and security of the core network: logical anomalies (such as missing, redundant, or illegal calls that violate expected business processes and orchestration sequences) and frequency anomalies, such as slow DoS (Denial-of-Service) attacks, which cause service degradation by consuming resources through low-frequency requests.

[0003] To address these challenges, current research on anomaly detection in 5G / B5G core networks focuses on three main areas: Traffic analysis-based approaches monitor overall traffic patterns and apply statistical or pattern matching techniques to identify anomalous data flow characteristics. These approaches excel at detecting large-scale malicious traffic injections or high-frequency DoS attacks. Methods based on observability data (such as logs and performance metrics) analyze operational status fluctuations to identify potential anomalies and assist in problem location. Methods based on network function interaction modeling deeply analyze the logical sequence and topological structure of inter-function calls, aiming to detect abnormal interaction processes such as unauthorized calls and anomalous API access. However, existing methods still have significant limitations. Traffic analysis primarily focuses on detecting frequency anomalies in high-frequency scenarios. Because logical anomalies typically do not significantly alter overall traffic characteristics, their detection accuracy is insufficient. While observability data analysis can reflect the overall state of the core network, it lacks sufficient attention to the fine-grained interaction logic at the network function level and lacks in-depth modeling, resulting in missed detection of some critical anomalies. While network function interaction modeling can characterize call relationships, it still lacks the ability to detect complex logical anomalies, such as missing the first call in the interaction sequence. Therefore, in order to address the shortcomings in detecting low-frequency anomalies and complex logical anomalies in core network interactions, exploring more accurate and efficient detection methods has become a key research topic to ensure the safe and stable operation of 5G / B5G networks. Summary of the Invention

[0004] The purpose of the present invention is to solve the technical problems in the existing technology that it is impossible to effectively detect complex logical anomalies such as the first bit missing in the core network logical anomaly and lacks detection of low-frequency anomalies in the core network, and to provide a network function interaction anomaly detection method and system for the core network.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions: A first aspect of the present invention provides a core network-oriented network function interaction anomaly detection method, comprising logic anomaly detection and frequency anomaly detection; when the logic anomaly detection result is abnormal or the frequency anomaly detection result is abnormal, the network function interaction is abnormal; The logic anomaly detection is specifically as follows: Convert the call tree data describing the network function interaction in the core network into a time-series interaction sequence; perform numerical encoding and embedding mapping on each call in the time-series interaction sequence in turn to generate an embedded interaction sequence; The embedded interaction sequence is input into the LSTM-AE model to generate a reconstructed sequence and calculate the reconstruction error; the LSTM-AE model includes an LSTM encoder and an LSTM decoder, and both the LSTM encoder and the LSTM decoder have a two-layer LSTM structure; When the reconstruction error is greater than the error threshold, the time series interaction sequence is determined to be an abnormal interaction sequence; The frequency anomaly detection is specifically as follows: Extract features from the collected network traffic data of the core network control plane and generate feature vectors; Perform data preprocessing on the feature vector; input the preprocessed feature vector into the LSTM model and output the probability of normal traffic; When the probability of normal traffic is lower than the traffic threshold, the network traffic data is marked as abnormal.

[0006] Furthermore, the embedded interaction sequence is input into the LSTM-AE model to generate a reconstructed sequence and calculate the reconstruction error, specifically: The embedded interaction sequence is input into the LSTM-AE model to generate a reconstructed sequence; The mean square error between the embedded interaction sequence and the reconstructed sequence is calculated to obtain the reconstruction error.

[0007] Furthermore, the temporal interaction sequence is described as follows:

[0008] in, Represented as a temporal interaction sequence; Represented as the first calls; Indicates the total number of calls.

[0009] Furthermore, each call in the temporal interaction sequence is numerically encoded and embedded in turn to generate an embedded interaction sequence, specifically: Assign a numerical identifier to each call in the temporal interaction sequence and map it to the numerical space to generate a numerical interaction sequence; Embedding mapping is performed on the digitized interaction sequence to generate an embedded interaction sequence.

[0010] Furthermore, the embedded interaction sequence is expressed as:

[0011] in, represents the interaction sequence after embedding; Represent the interaction sequence after embedding Position data; the embedded interaction sequence The expression for the position data is: , Where, is the embedded function; A numerical interaction sequence The numeric identifier of the location call; Represents the interaction sequence after embedding Location data; Represents a numerical space; express -dimensional real vector; Indicates the total number of calls.

[0012] Furthermore, the expression of the error threshold is:

[0013] in, represents the error threshold; It represents the reconstruction error sequence generated by training the LSTM-AE model using the call tree data of normal network function interaction as the training set. is the offset; is the maximum function.

[0014] Furthermore, the feature extraction of the collected network traffic data of the core network control plane to generate a feature vector is specifically as follows: The collected network traffic data of the core network control plane is stored as a pcap file in pcap format; Extract features from the pcap file, store the extracted features in vector form, and generate a feature vector; the features include frame information, IP layer information, and TCP layer information.

[0015] Furthermore, the loss function of the LSTM model is:

[0016] in, It is The probability that the actual traffic of network traffic data is normal, It is The predicted normal traffic probability corresponding to the network traffic data, Indicates the total number of network traffic data; represents the loss function; is a logarithmic function.

[0017] Furthermore, the LSTM model uses the Adam optimizer to update the LSTM model parameters during training, specifically:

[0018] in, for The parameters of the LSTM model at the moment, is the learning rate, is the mean of the gradient, is the variance of the gradient, is the smoothing term; for Parameters of the LSTM model at this moment.

[0019] A second aspect of the present invention provides a core network-oriented network function interaction anomaly detection system, comprising: Logical anomaly detection module: used to convert call tree data describing network function interactions in the core network into a time-series interaction sequence; perform numerical encoding and embedding mapping on each call in the time-series interaction sequence in sequence to generate an embedded interaction sequence; input the embedded interaction sequence into the LSTM-AE model to generate a reconstructed sequence and calculate the reconstruction error; the LSTM-AE model includes an LSTM encoder and an LSTM decoder, both of which have a two-layer LSTM structure; when the reconstruction error is greater than the error threshold, the time-series interaction sequence is determined to be an abnormal interaction sequence; Frequency anomaly detection module: Extracts features from the collected network traffic data of the core network control plane to generate feature vectors; preprocesses the feature vectors; inputs the preprocessed feature vectors into the LSTM model and outputs the probability of normal traffic; and marks the network traffic data as abnormal when the probability of normal traffic falls below the traffic threshold.

[0020] Compared with the prior art, the present invention has the following beneficial effects: This invention discloses a core network-oriented network function interaction anomaly detection method. Using the LSTM-AE (Long Short-Term Memory Autoencoder) model, this method deeply models the network function interaction logic, achieving high-precision identification of complex logical anomalies. During the data processing phase, the call tree structure is converted into a temporal interaction sequence and an embedding mapping operation is introduced. This effectively preserves the semantic relevance of the call events while significantly reducing the complexity of the original data. The model employs a two-layer LSTM (Long Short-Term Memory) encoder architecture. The first LSTM layer captures the local temporal features of the call sequence, while the second LSTM layer further extracts higher-level abstract features. The resulting global latent representation comprehensively compresses the causal dependencies of the interaction sequence, laying the foundation for accurate reconstruction. The LSTM decoder gradually reconstructs the sequence based on the latent representation through fully connected layers. Its symmetrical structure forms a closed loop with the encoder, ensuring a strong fit for normal interaction patterns.

[0021] In the anomaly detection mechanism, by calculating the error between the input sequence and the reconstructed sequence and dynamically setting the threshold, logical anomalies such as missing calls, redundant calls, and illegal calls can be effectively identified. This solution overcomes the shortcomings of traditional methods in insufficiently modeling complex logical patterns, and is particularly good at detecting deep anomaly scenarios such as the missing first call in the interaction sequence. The model only needs normal sample training to establish a baseline model, greatly reducing the dependence on anomaly annotated data, and significantly improving the practicality and scalability of the detection system. In actual deployment, this technology can monitor the network function interaction chain under the core network service-oriented architecture in real time, and promptly block business failures and security threats caused by logical anomalies, providing key guarantees for the stable operation of the 5G / B5G core network.

[0022] Furthermore, the frequency anomaly detection method of the present invention achieves highly sensitive identification of low-frequency security threats in the core network by integrating multi-level traffic feature analysis with LSTM time series modeling technology. During the data collection phase, raw traffic data in pcap (packet capture) format is deeply analyzed to extract frame information, IP (Internet Protocol) layer features, and TCP (Transmission Control Protocol) layer dynamic indicators (such as time intervals and flag bit combinations). This constructs a feature vector system that comprehensively characterizes the interactive behavior of network functions. The preprocessing phase uses linear interpolation to fill missing values, the interquartile range method to eliminate non-offensive outliers, and the Pearson correlation coefficient to screen key features. This significantly improves data quality while preserving subtle traces of slow DoS attacks. The LSTM model captures the long-term dependency patterns of features such as time intervals and request frequency in normal traffic to establish a high-precision baseline behavior. When encountering a slow DoS attack, the low-frequency request patterns unique to the attack traffic deviate significantly from the normal baseline. The LSTM model outputs probability values ​​that quantify the degree of deviation in real time, effectively identifying long-term resource-hogging attacks. This solution overcomes the limitations of existing technologies in detecting high-frequency anomalies and is particularly adept at detecting low-frequency, slow-moving attack strategies carefully designed by attackers. This invention monitors the core network control plane service flow in real time, proactively intercepting abnormal traffic before service quality degrades. This, combined with the logical anomaly detection module, forms a dual protection system, fully guaranteeing the security and service continuity of the 5G / B5G core network in a highly virtualized environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 This is a flowchart of logical anomaly detection based on LSTM-AE; Figure 2 This is the LSTM-AE model structure diagram; Figure 3 This is a flowchart of frequency anomaly detection based on LSTM; Figure 4 This is a comparison chart of the effects of different algorithms in detecting illegal calls; Figure 5 This is a comparison chart of the effects of different algorithms in detecting call redundancy; Figure 6 This is a comparison chart of the effects of different algorithms in detecting missing calls; Figure 7 This is a comparison chart of the effects of different algorithms in detecting Slow Headers; Figure 8 This is a comparison chart of the effects of different algorithms in detecting Slow Post; Figure 9 This is a comparison chart of the effects of different algorithms in detecting Slow Read; Figure 10 This is a flow chart of the core network-oriented network function interaction anomaly detection method of the present invention; Figure 11 It is a block diagram of the network function interaction anomaly detection system for the core network of the present invention.

[0025] Among them, 1-Logical anomaly detection module; 2-Frequency anomaly detection module. DETAILED DESCRIPTION

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Generally, the components of the embodiments of the present invention described and marked in the drawings herein can be arranged and designed in various different configurations.

[0027] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are intended to fall within the scope of protection of the present invention.

[0028] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not require further definition or explanation in subsequent drawings.

[0029] The present invention is described in further detail below with reference to the accompanying drawings: See also Figure 10 The present invention provides a network function interaction anomaly detection method for the core network, including LSTM-AE-based logic anomaly detection and LSTM-based frequency anomaly detection, which are used to identify interaction sequence logic anomalies and low-frequency anomalies (such as slow denial of service attacks) in the core network control plane.

[0030] S1. Logical anomaly detection based on LSTM-AE: In order to effectively detect the interaction logic anomalies between network functions, this embodiment provides an anomaly detection method based on LSTM-AE. LSTM-AE can capture the temporal dependencies in the interaction of network functions, reconstruct the normal interaction sequence, and identify abnormal behaviors by calculating the reconstruction error. The anomaly detection method based on LSTM-AE has shown significant advantages in identifying logical anomalies in the interaction of network functions, such as missing calls, redundant calls, and illegal calls. The logical anomaly detection model based on LSTM-AE is as follows: Figure 1 The specific steps are as follows: S101. Data processing: S101-1, convert the call tree data describing the network function interaction in the core network into a time-series interaction sequence with consistent time order. The call tree consists of nodes and edges, where each node represents a call operation and each edge describes the causal relationship between calls. By traversing all the node sets in the call tree and edge sets , extract the information of each call in causal order, and Represents the caller and the callee A combination of:

[0031] According to the edge set , construct a temporal interaction sequence , whose expression is:

[0032] in, Indicates the total number of calls in the call tree; Respectively represent the first This process linearizes the complex call tree structure and maintains the time order of the calls, thereby generating a time-ordered sequential interaction sequence.

[0033] S101-2, numerically encode each call in the time-series interaction sequence, that is, assign a unique numerical identifier to each call, map each call to a numerical space, and form a numerical interaction sequence. This numerical encoding process not only preserves the semantic relationship between calls, but also effectively reduces the complexity of the original data. In addition, for subsequent use, the numerical encoding process also generates a complete mapping table that records the correspondence between call descriptions and their numerical representations. The specific steps are as follows: Sequential Interaction Sequence Each call in the encoding function Mapping to numerical space , each call Assigned a unique numeric identifier , the formed numerical interaction sequence can be expressed as:

[0034] in, Represents the numerical interaction sequence The value of the position; the numerical interaction sequence Numeric identifier of the location call ; The first time-series interaction sequence Location data; Represents the encoding function. The numerical encoding process not only effectively reduces the complexity of the original data, but also preserves the semantic relationship between calls, providing a richer feature representation for the learning of the LSTM-AE model. At the same time, a mapping table is generated to record the calls and its numerical identifier The correspondence between them provides explanatory support for subsequent model analysis.

[0035] S101-3, Logarithmic Interaction Sequence Perform embedding mapping. Specifically, by embedding function , call the discrete numerical Mapping to continuous vectors , ∈ The generated embedded interaction sequence is represented as:

[0036] in, Represent the interaction sequence after embedding Position data, the interaction sequence after embedding The expression for the position data is: , ; Represents the interaction sequence after embedding Location data; express -dimensional real vector; is the embedded function; A numerical interaction sequence The numeric identifier of the location call; Represents a numerical space; express -dimensional real vector; Represents the total number of calls. The embedding map not only preserves the semantic relationship of the calls but also makes its data representation more suitable for the calculation of the LSTM model.

[0037] S101-4, since the LSTM-AE model requires the input data to be of the same length, set the sliding window length Then, the embedded interaction sequence is analyzed using a sliding window. Perform length normalization. By filling a special vector at the end of the interaction sequence after embedding Expand it to length , for length Sequence, only retain the first elements. Therefore, the interaction sequence after length consistency processing is expressed as , this sequence is the input sequence of the LSTM-AE model; They represent the interaction sequence after length consistency processing and embedding. Location data; Represents the length of the interaction sequence after embedding after length consistency processing.

[0038] S102, Model Training: like Figure 2 As shown, the LSTM-AE model of this embodiment includes an LSTM encoder and an LSTM decoder; the LSTM encoder includes two layers of LSTM, and the LSTM encoder processes the input sequence through the two layers of LSTM. Processing time step by time, capturing the global temporal dependencies in the sequence. The first layer of LSTM extracts preliminary features of each time step and generates hidden states , hidden state After further processing by the second layer of LSTM, higher-level features are captured to generate hidden states Finally, the output of the LSTM encoder is processed by a repeated vector layer into a potential representation This potential representation compresses the global information of the input sequence and is the basis for subsequent sequence reconstruction. The LSTM decoder uses the same structure as the LSTM encoder to gradually generate the output sequence from the potential representation, that is, the reconstructed sequence At each time step, the LSTM unit in the LSTM decoder combines the hidden state to make a prediction and maps the hidden state to the original space of the input sequence through the fully connected layer. Ultimately, the decoder reconstructs a reconstructed sequence that is similar to the input sequence.

[0039] In this embodiment, only normal network function interaction sequences are used to train the LSTM-AE model. The normal network function interaction sequences are processed by step S101 to obtain the input sequence set , using this as the training data set; Indicates the total number of input sequences during training; Represents the first input sequence (i.e., the interaction sequence after length consistency processing and embedding). input sequence , by minimizing the input sequence The corresponding reconstruction sequence The mean square error between ; Indicates the length of the input sequence; Indicates the input sequence The value of the position; Reconstruction sequence The value of the position. This embodiment uses the input sequence set When training the LSTM-AE model, the final training data reconstruction error sequence is , The input sequence The corresponding reconstruction error.

[0040] S103, detection stage: Use the LSTM-AE model trained in step S102 to reconstruct each time series interaction sequence in the test set, and the reconstruction error It is used as the basis for judging abnormalities. By analyzing the reconstruction error distribution of normal interaction sequences, the error threshold is set. :

[0041] in, represents the reconstruction error sequence, is the offset; is the maximum function. When the reconstruction error of the input sequence Greater than the error threshold , the temporal interaction sequence is determined to be an abnormal interaction sequence.

[0042] S2. Frequency anomaly detection based on LSTM: When performing frequency anomaly detection, LSTM learns the timing patterns of network traffic data of the normal core network control plane through training, and can then identify abnormal data that is significantly different from the normal core network control plane network traffic data. When there is a large deviation between the timing patterns of the network traffic data of the new core network control plane and the learned normal core network control plane network traffic data, LSTM can quickly identify these deviations and mark them as anomalies, thereby effectively detecting slow DoS attack traffic. This embodiment uses LSTM to detect frequency anomalies of network function interactions. The detection process is as follows: Figure 3 As shown, it can be divided into the following steps: S201. Data preparation: Raw HTTP / 2 (Hypertext Transfer Protocol Version 2) network traffic data from the 5G core network control plane is collected and stored in pcap format. Pcap files record detailed information about each packet in the network, including key fields such as timestamp, protocol type, packet length, and source and destination addresses. By further analyzing the core network control plane traffic data stored in pcap format and combining feature engineering methods to extract features, a feature vector is generated. This feature vector represents typical traffic patterns in the 5G / B5G core network.

[0043] Specifically, the core network control plane network traffic data stored in pcap format is further analyzed using the pyshark library to parse the pcap file packet by packet, extracting features that can reflect basic network communication information. The extracted features mainly include the following categories: (1) Frame information: such as the encapsulation type and total length of the data packet. This information reflects the basic structure of the data packet.

[0044] (2) IP layer information: such as IP header length, Time To Live (TTL), source IP address and destination IP address, etc. These characteristics describe the routing and transmission characteristics of data packets in the network.

[0045] (3) TCP layer information: such as source port, destination port, packet length, TCP flag, window size, time interval, etc. These features are particularly important for capturing the frequency of network function interaction and connection status.

[0046] By parsing the detailed fields of each packet using PyShark, these features are extracted and stored as a structured dataset. In the specific implementation, the packet features are converted into feature vectors, each of which corresponds to a packet. The construction of the feature vector follows the following process: (1) Traverse each data packet and extract frame information, IP layer information, TCP layer information and other related fields; (2) Store the extracted field values ​​into a feature vector; (3) Add the feature vector to the feature list to build a complete feature dataset.

[0047] Finally, all feature vectors are summarized and stored in a data file in CSV (Comma-Separated Values) format for subsequent processing.

[0048] S202, data preprocessing: The feature vector obtained in S201 is processed as follows: (1) Data cleaning: During the data cleaning phase, the primary goal is to improve the quality of the extracted raw data and address missing and outliers to ensure data integrity and consistency while avoiding loss of important features associated with slow DoS attacks. Data cleaning focuses on distinguishing noise data from normal traffic and traffic information with abnormal features associated with slow DoS attacks, thereby preserving the key characteristics of the attack behavior to the greatest extent possible.

[0049] Because network traffic may contain duplicate packets and incomplete packets (such as null values ​​or missing fields due to packet loss), the following three strategies are usually used to handle such outliers: Redundancy Removal: Removing redundant data is a critical step in data preprocessing, directly impacting the training efficiency and performance of the LSTM model. Redundant data not only increases the computational burden, leading to model overfitting, but also potentially reduces the model's generalization ability. Removing redundant data not only effectively reduces computing resource consumption and training time, but also increases the diversity and representativeness of training data, enabling the LSTM model to learn the core features of the data from different perspectives, thereby enhancing its predictive power for unknown data. Therefore, in this experiment, we removed redundant data packets from the dataset, especially those with severely missing feature information that cannot be repaired.

[0050] Filling in the gaps: Some missing features (such as time intervals or TCP window sizes) need to be filled in, because filling in the feature values ​​of training data is an important step to ensure the performance and stability of the LSTM model. Missing feature values ​​may damage the integrity of the input data, thereby affecting the LSTM model's ability to learn the data distribution, and thus reducing prediction accuracy. Filling in the feature values ​​helps to improve the availability and consistency of the data, thereby ensuring that the LSTM model can effectively capture the relationship between features. Through reasonable filling methods, such as mean filling, interpolation algorithms, or context-based prediction methods, the inherent structure of the data can be retained to the greatest extent and the introduction of noise can be reduced. In addition, filling in the feature values ​​can prevent the model from ignoring certain important features due to missing values, thereby improving the stability of training and the generalization ability of the model. This embodiment uses linear interpolation to fill in missing values ​​to ensure data integrity. The linear interpolation method is estimated based on the previous and next data points, and the interpolation formula is:

[0051] in, is a missing value, and are the adjacent data points before and after the missing value.

[0052] Remove disturbances: In order to enhance the robustness of the data, outliers in the traffic data are identified and processed. Outliers usually refer to data points that are far away from the normal distribution range, such as abnormally large time intervals, TCP flags that exceed the range specified by the protocol, etc. In the context of slow DoS attacks, time interval anomalies are often important features of the attack, so the handling of outliers requires special caution. Use statistical methods such as the upper and lower quartiles method to eliminate extreme values ​​of other features. The upper and lower quartiles method identifies outliers by calculating the interquartile range of the data. Outliers are defined as data points that are outside the following ranges, specifically:

[0053] in, is the first quartile, is the third quartile, is the interquartile range.

[0054] (2) Feature selection: Although a large amount of information is collected during the data collection phase to enrich the input dimensions of the LSTM model, some of these features may have limited contribution to the actual performance of the LSTM model and may even introduce interference or noise, resulting in reduced performance. Therefore, feature selection is an indispensable step in the data preprocessing process. Its main purpose is to screen out features that are highly relevant to the frequency anomaly detection task, while eliminating redundant or irrelevant features, thereby optimizing the input space of the LSTM model. During this process, statistical analysis methods, such as studying the distribution characteristics of features and calculating correlation matrices, can be used to quantify the effectiveness of each feature and identify features with minimal impact. In addition, feature selection not only reduces the dimensionality of the data, thereby reducing computational complexity, but also improves the training efficiency and generalization performance of the LSTM model, playing a significant role in the reliability and accuracy of the overall detection. This embodiment uses the Pearson correlation coefficient to evaluate the linear correlation between each feature and the target variable (whether it is a slow DoS attack). The correlation coefficient is calculated as follows:

[0055] in, and Respectively represent The characteristic values ​​and target values ​​of samples, and is the corresponding mean, is the total number of samples. By calculating the correlation coefficient, we can identify features that are highly correlated with the target variable.

[0056] (3) Standardization: Data normalization is a key step in improving the performance of LSTM models. By unifying the scale of training data, normalization ensures that different features have the same mean and variance, or converts them to zero mean and unit variance, effectively addressing issues caused by feature scale differences. Furthermore, normalization accelerates the convergence of gradient descent methods, avoiding training instability and performance degradation caused by inconsistent scales. Especially when using a gradient descent optimizer, differences in feature scale can cause certain features to dominate gradient updates, thereby affecting LSTM model training efficiency. Standardization aligns the scales of all features, ensuring smooth gradient updates and shortening training time.

[0057] Additionally, feature data normalization prevents certain features from dominating the training process, thereby optimizing the LSTM model's learning of all features. Data normalization is crucial for activation functions in deep neural networks. It prevents unnormalized data from operating within the activation function's saturation range, reducing the risk of vanishing or exploding gradients. Normalization makes input data more evenly distributed, keeping activation functions operating within their effective range, further improving LSTM model training. Therefore, normalization not only optimizes the training process and speeds up convergence, but also enhances the generalization and overall performance of LSTM models.

[0058] Since step S201 parses the complete data packet information as feature data, these feature data are at different levels of computer network data (such as link layer, network layer, transport layer and application layer, etc.). In addition, the dimensional differences between different features will also lead to uneven distribution of data values. Specifically, the value ranges of feature data vary greatly. For example, the length of a data packet may reach hundreds of bytes, while the time interval may be between 0 and several seconds. After the features that have not been standardized are input into the model, some features may have too much influence on the learning of the model. Therefore, the standardization process converts all features to the same scale. The specific standardization formula is:

[0059] in, is the original value of the feature, is the mean of the feature, is the standard deviation of the feature, is the standardized feature value. Through standardization, the feature data is converted to a distribution with a mean of 0 and a standard deviation of 1, thereby eliminating the numerical scale differences between different features and helping to improve the convergence speed and prediction accuracy of the LSTM model.

[0060] S203, model training: The collected normal network traffic data of the core network control plane is processed by S201 and S202 and divided into a training set and a validation set to train the LSTM model.

[0061] During the LSTM model training process, binary cross entropy is used as the loss function, which is expressed as:

[0062] in, It is The probability that the actual traffic of network traffic data is normal, It is The predicted normal traffic probability corresponding to the network traffic data, Represents the total number of network traffic data, that is, the total number of data in the training set; represents the loss function; is a logarithmic function. By minimizing the loss function, the LSTM model can fit the training data to the greatest extent and improve the accuracy of anomaly detection.

[0063] During the optimization process, the Adam optimizer is used to update the LSTM model parameters. The Adam optimizer combines first-order momentum (mean of the gradient) and second-order momentum (variance of the gradient), and has the advantages of fast convergence and strong robustness. The optimization formula of the Adam optimizer is:

[0064] in, For the current moment The corresponding LSTM model parameters, is the learning rate, is the mean of the gradient, is the variance of the gradient, is the smoothing term, are the parameters of the LSTM model corresponding to the previous training.

[0065] The LSTM model parameters are iteratively updated using the Adam optimizer on the training set. Performance is evaluated using a loss function on the validation set to prevent overfitting. To improve the model's generalization, an early stopping mechanism is introduced. Training is terminated when the validation set loss stops improving for several consecutive rounds.

[0066] S204, anomaly detection: After the LSTM model training is completed, it enters the anomaly detection phase, where the network traffic data of the validation set is inferred and classified. During the detection process, the network traffic data is sequentially input into the trained LSTM model, and the trained LSTM model outputs the normal probability of traffic in each time window through forward propagation. .

[0067] In order to convert the continuous probability value into a discrete classification result, this embodiment sets the threshold To determine whether the traffic is abnormal. When the trained LSTM model outputs the normal probability of traffic When the traffic flow rate is less than the traffic threshold, the network traffic data in the time window is marked as abnormal, otherwise it is marked as normal. The decision rule is:

[0068] This method uses LSTM-AE for logical anomaly detection and LSTM for frequency anomaly detection, effectively detecting logical anomalies (especially first-bit missing) and low-frequency anomalies (slow DoS attacks) in 5G / B5G core networks. This method is theoretically feasible and can overcome the limitations of existing anomaly detection methods, enabling accurate identification of anomalies in the core network control plane.

[0069] The LSTM-AE model has sequence reconstruction capabilities and detects interaction anomalies by learning the normal interaction patterns of core network function interaction sequences. In the present invention, the LSTM-AE model maps network function interaction sequences to low-dimensional hidden representations using an LSTM encoder and reconstructs the sequences using an LSTM decoder, thereby learning normal interaction patterns. During training, the LSTM-AE model only learns normal interaction patterns and can accurately reconstruct complete network function interaction sequences, ensuring high fidelity with normal data. When the input interaction sequence is missing the first call, because the LSTM-AE model relies on complete time series information, the hidden states generated by its LSTM encoder will be affected, resulting in the LSTM decoder being unable to correctly reconstruct the sequence, significantly increasing the reconstruction error. During the detection process, the LSTM-AE calculates the mean squared error between the input sequence and the reconstructed sequence. When the error exceeds a set error threshold, it determines that the interaction sequence is anomaly. Because the missing first call disrupts the overall pattern of network function interaction, the LSTM-AE model can accurately identify such logical anomalies by comparing the input sequence with the reconstructed sequence, effectively compensating for the limitation of existing methods that have difficulty detecting the missing first call in the interaction sequence. The LSTM model has the ability to predict time series and can learn the temporal patterns of network function access frequencies, thereby identifying low-frequency anomalies (slow DoS attacks). The present invention uses the LSTM model to predict the normal access frequency distribution of specific network functions by predicting the normal probability of normal traffic for network functions. During the training process, the LSTM uses a long-term dependency memory mechanism to model the access frequency variation patterns between various network functions in the core network control plane, and predicts future access frequencies based on historical time windows. When the actual access frequency of a network function is lower than the normal range predicted by the LSTM for a long time, but still maintains a continuous access state, it can be determined that the NF is in a slow DoS attack state. Through time series modeling, the LSTM can identify the long-term deviation trend of low-frequency anomalies, thereby achieving accurate detection of slow DoS attacks. In summary, the present invention performs logical anomaly detection based on LSTM-AE, which can identify the missing first call in the interaction sequence through reconstruction error, thereby improving the logical anomaly detection capability of the core network control plane; performs frequency anomaly detection based on LSTM, which can identify low-frequency anomalies through time series prediction, and effectively detect slow DoS attacks.

[0070] To verify the effectiveness of the core network network function interaction anomaly detection method of the present invention, one embodiment of the present invention uses the open-source 5G Core Network (free5GC) project from 3GPP R15 (3rd Generation Partnership Project Release 15) and later versions for the core network. The open-source simulator Ueransim is used for the access network (Radio Access Network) and user equipment (UE) components. This simulator simulates the connection between the UE and the next-generation Node B (gNB), providing a complete end-to-end 5G communication process. A free5GC + UERANSIM environment was deployed based on Docker Compose to create a relatively complete 5G testbed, collecting core network control plane data consistent with real-world scenarios. Furthermore, to enable real-time monitoring and tracing of calls between NFs (Network Functions), SkyWalking was introduced as a distributed tracing tool in the experimental platform. This tool collects call trees of core network function interactions in real time and uses these trees to analyze the call logic between core network elements. Wireshark is also used as a network monitoring and data collection tool to capture traffic data in real-time network transmission and obtain the frequency of core network function interaction.

[0071] First, perform an attack simulation, specifically: Logical anomaly attack simulation: (1) Removal of malicious network functions: In the 5G core network, the Network Repository Function (NRF) primarily provides service registration and discovery capabilities. Attackers, posing as legitimate NFs, exploited a vulnerability in the NRF interface that lacks strict permission control and sent unauthorized Delete requests to delete critical NF configuration files. Because the NRF interface doesn't authenticate the requesting identity, attackers can abuse interface permissions to cause damage. If these operations are performed in bulk, they could cause large-scale deregistration of core network components, leading to severe consequences such as service interruptions.

[0072] (2) User information extraction: This type of attack exploits a vulnerability in free5GC versions prior to v3.0.7. A malicious NF requests authentication from the AUSF (Authentication Server Function). Due to this vulnerability, even if authentication fails, the AUSF will still return the UE's SUPI (Subscription Permanent Identifier) ​​to the malicious NF. Upon receiving the UE's SUPI, the malicious NF uses it to access private information about the UE. For example, it calls the / nudm-sdm / {supi} / am-data interface to retrieve UE access and mobility subscription data, and the / nudm-sdm / {supi} / nssai interface to retrieve the target UE's slice subscription information.

[0073] Low-frequency abnormal attack (slow DoS) simulation: (1) Slow Headers: The attack targets the API interface between AMF and AUSF in the core network. The attack script simulates an attacker occupying the server's connection and memory resources by slowly sending HTTP (Hypertext Transfer Protocol) request headers. By delaying the request headers and controlling the request rate, the target server is unable to process subsequent normal requests in a timely manner, paralyzing the service.

[0074] (2) Slow Post attack; The attack targets the API interface between AMF (Authentication Management Function) and AUSF in the core network. The attack script simulates an attacker sending a Post request with a large content-length, sending the request body data at an extremely low speed, forcing the server to occupy memory and computing resources while waiting for the complete data, making it impossible to process normal API requests in a timely manner.

[0075] (3) Slow Read Attack: The attack targets the API interface between AMF and AUSF in the core network. The attack script simulates an attacker sending a request to the server and then reads the response content at an extremely low speed. In this way, the attacker can continuously occupy the server's connection and memory resources, making the server unable to process new normal requests, and ultimately causing service interruption.

[0076] Through simulated attacks, the present invention was compared with existing anomaly detection solutions. In this embodiment, the logical anomaly detection solution used was ADSeq, a network function interaction anomaly detection solution, and was compared with an RNN-based anomaly detection solution. ADSeq is derived from the paper ADSeq-5GCN: Anomaly Detection Method Based on 5G Core Network Control Plane Traffic Sequences [C] / / 24th IEEE International Conference on High Performance Switching and Routing (HPSR 2023). Albuquerque, NM: IEEE Press, 2023: 75-82. ADSeq is a detection solution based on a bidirectional long short-term memory network. The detection effectiveness of different solutions against three logical anomaly attacks was compared.

[0077] For frequency anomaly detection, we selected RNN (Recurrent Neural Network), SVM (Support Vector Machine), Naive Bayes, and Logistic Regression as comparison models. We compared the detection performance of different algorithms for three types of slow denial-of-service attacks: Slow Header, Slow Post, and Slow Read. The specific comparison results are as follows: (1) Comparison results of logical anomaly detection: from Figure 4 As can be seen from the figure, LSTM-AE performs best in the illegal call detection task, as demonstrated in the following aspects: Both accuracy and precision are close to 100%, demonstrating that LSTM-AE can accurately identify illegal calls with an extremely low false positive rate. Recall and F1-score also remain high, demonstrating that the model possesses strong detection capabilities and overall performance in covering illegal call events. Compared to LSTM-AE, ADSeq achieves higher precision but lower recall, resulting in a slightly lower F1 score, indicating limitations in its overall ability to capture illegal calls. In contrast, the RNN model performs more modestly, with accuracy significantly lower than the other two models and insufficient performance in other metrics, indicating a high false negative rate in the illegal call detection task.

[0078] from Figure 5As can be seen from the figure, LSTM-AE performs best in the call redundancy detection task, with both accuracy and precision exceeding 98%. This demonstrates that the reconstruction error threshold is appropriately set and effectively captures the characteristics of redundant calls. The recall and F1 scores are also high, indicating that LSTM-AE has good coverage and accuracy in detecting call redundancy. In contrast, ADSeq performs close to LSTM-AE in terms of precision, but has lower recall and F1 scores, indicating that it misjudges some redundant calls. RNN, on the other hand, performs worst in the call redundancy task, with low performance across all metrics. This reflects its inability to model complex temporal dependencies, making it difficult to accurately detect redundant call events.

[0079] from Figure 6 As can be seen, LSTM-AE also maintains a leading position across all metrics, with accuracy and precision approaching 100%, demonstrating the high reliability of LSTM-AE in detecting missed call events. Both recall and F1 scores exceed 95%, further verifying the model's high coverage and detection accuracy for missed call events. ADSeq's detection performance is second only to ADSeq. While its accuracy and precision are high, its recall is slightly lower, resulting in a suboptimal F1 score and a lack of sensitivity to missed calls. RNN performs the worst, with all metrics falling below 90%, particularly its low recall, indicating a tendency to miss detections when dealing with missed calls and weak detection performance.

[0080] (2) Frequency anomaly detection comparison results: from Figure 7 As can be seen, the LSTM-based model significantly outperforms other methods in the Slow Header scenario. In terms of accuracy and F1 score, the LSTM model approaches 100%, while the other methods perform relatively poorly. In contrast, the RNN model performs well, achieving accuracy above 90%, slightly lower than the model in this solution. The SVM performs reasonably well in terms of recall, but all metrics are significantly lower than the LSTM. This indicates that while the SVM is strong in reducing false positives, it lacks comprehensive detection capabilities for anomalous traffic. The naive Bayes model's recall is only approximately 20%, making it difficult to detect the complex characteristics of Slow Header attacks. The logistic regression model performs weaker than the LSTM in terms of precision, indicating its limited ability to capture anomalous patterns.

[0081] from Figure 8As can be seen from the figure, our proposed solution shows significant advantages in detecting Slow Post attacks, with all four indicators close to 99%. This shows that the present invention can accurately distinguish normal traffic from attack traffic with extremely low false alarm and omission rates, and is the best performing solution in this comparative experiment. In comparison, the performance of other comparison algorithms is significantly inferior. The recall rate of the RNN model is less than 90%. The SVM model performs well in terms of recall rate, but the precision rate is only 41%, the false alarm rate is high, and the F1 value is only 55%, which is difficult to meet the needs of practical applications. Although the Naive Bayes has a high precision rate, the recall rate is only 18.15%, the omission rate is serious, and the F1 value is as low as 30%, which is almost incapable of effectively detecting Slow Post attacks. Logistic regression achieves a certain balance between precision and recall rate, but the F1 value is 82%, and the overall performance is still far inferior to our solution.

[0082] like Figure 9 As shown, in slow read attack detection, the LSTM model maintains a leading position in all four metrics, all approaching 100%, demonstrating excellent detection capabilities. It can accurately distinguish between normal and attack traffic while significantly reducing the likelihood of false positives and false negatives. In comparison, the RNN's recall rate is only 80%. The SVM performs averagely, with an accuracy of 87%, precision of 90%, and recall of 85%. While this approach is acceptable in terms of false positives and false negatives, its overall detection capabilities are insufficient. While Naive Bayes achieves high precision, its recall rate is only 14.95%, with significant false negatives, resulting in an F1 score of only 26%, indicating extremely poor overall performance. Logistic regression achieves an accuracy of 80%, but its F1 score is 76%, significantly inferior to our solution.

[0083] An embodiment of the present invention provides a method for detecting network function interaction anomalies for a core network, specifically involving detecting the missing of the first call in an interaction sequence based on LSTM-AE.

[0084] This embodiment uses LSTM-AE to perform logical anomaly detection to detect the missing first call of the network function interaction sequence in the 5G / B5G core network.

[0085] First, a distributed tracing system (such as SkyWalking) is used to collect network function interaction data from the core network control plane, including information such as the call source, call target, timestamp, and call event. This data is then preprocessed, including sequence encoding, embedding, and sliding window truncation, to form fixed-length interaction sequences for model training.

[0086] Then, the LSTM-AE model is trained based on normal network function interaction sequences to learn the normal interaction patterns of the core network. The LSTM-AE model consists of an encoder and a decoder. The encoder extracts low-dimensional feature representations of the input interaction sequence, while the decoder reconstructs the low-dimensional features back to the original sequence and calculates the mean squared error between the input sequence and the reconstructed sequence.

[0087] During the testing process, the network function interaction sequence to be tested is input into the LSTM-AE for reconstruction, and the reconstruction error is calculated. If the reconstruction error exceeds a set threshold, the interaction sequence is considered to be an anomaly. If further analysis reveals that the interaction sequence is missing the first call of a key network function, it can be determined to be a missing first call anomaly.

[0088] For example, in the user authentication process, the normal interaction sequence is: AMF→AUSF; AUSF→NRF; AUSF→UDM (Unified Data Management); UDM→UDR (Unified Data Repository); UDM→UDR.

[0089] However, in the case of a malicious attack, the AUSF may abuse its authority and directly request the UE's private information from the UDM even without receiving the authentication request from the AMF, bypassing the normal authentication and authorization process. That is, the first call is missing. At this time, the interaction sequence becomes: AUSF→UDM;UDM→UDR;UDM→UDR.

[0090] By comparing the reconstructed sequence with the input sequence, LSTM-AE can detect logical anomalies such as missing first call. This example demonstrates that LSTM-AE can effectively learn the core network network function interaction pattern and accurately identify missing first call in the interaction sequence through reconstruction error, thereby improving the logical anomaly detection capabilities of the 5G / B5G core network.

[0091] An embodiment of the present invention provides a method for detecting network function interaction anomalies in a core network, specifically related to detecting slow DoS attacks in a core network based on LSTM.

[0092] This example uses LSTM to detect frequency anomalies and slow DoS attacks in the 5G / B5G core network. First, a core network test platform was built to simulate three types of slow DoS attacks. It can be seen that after the attack begins, server resources are gradually exhausted, and the service becomes unavailable. Wireshark is used to collect raw HTTP / 2 network traffic data from the 5G core network control plane. The collected data is preprocessed, including feature extraction, data cleaning, and standardization.

[0093] Then, during the LSTM model's training phase, the model gradually establishes an expected pattern for normal traffic by learning the time series patterns of a large amount of normal data. By adjusting its parameters, the LSTM model learns the time series characteristics of normal interaction data and generates a time series model for identifying and predicting normal traffic. When new interaction data is input into the model, the LSTM model makes predictions based on the learned normal patterns and compares them with the current input data. If the input data deviates significantly from the normal pattern, the LSTM model marks it as anomalous traffic, effectively detecting slow DoS attacks.

[0094] See also Figure 11 One embodiment of the present invention provides a core network-oriented network function interaction anomaly detection system, including: Logical anomaly detection module 1: used to convert call tree data describing network function interactions in the core network into a time-series interaction sequence; perform numerical encoding and embedding mapping on each call in the time-series interaction sequence in sequence to generate an embedded interaction sequence; input the embedded interaction sequence into the LSTM-AE model to generate a reconstructed sequence and calculate the reconstruction error; the LSTM-AE model includes an LSTM encoder and an LSTM decoder, both of which have a two-layer LSTM structure; when the reconstruction error is greater than the error threshold, the time-series interaction sequence is determined to be an abnormal interaction sequence; Frequency anomaly detection module 2: Extract features from the collected network traffic data of the core network control plane to generate feature vectors; perform data preprocessing on the feature vectors; input the preprocessed feature vectors into the LSTM model and output the probability of normal traffic; when the normal traffic probability is lower than the traffic threshold, the network traffic data is marked as abnormal.

[0095] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A method for detecting anomaly in network function interaction of a core network, characterized in that: It includes logic anomaly detection and frequency anomaly detection; when the logic anomaly detection result or the frequency anomaly detection result is abnormal, the network function interaction is abnormal; The logic anomaly detection is specifically as follows: Convert the call tree data describing the network function interaction in the core network into a time-series interaction sequence; perform numerical encoding and embedding mapping on each call in the time-series interaction sequence in turn to generate an embedded interaction sequence; The embedded interaction sequence is input into the LSTM-AE model to generate a reconstructed sequence and calculate the reconstruction error; the LSTM-AE model includes an LSTM encoder and an LSTM decoder, and both the LSTM encoder and the LSTM decoder have a two-layer LSTM structure; When the reconstruction error is greater than the error threshold, the time series interaction sequence is determined to be an abnormal interaction sequence; The frequency anomaly detection is specifically as follows: Extract features from the collected network traffic data of the core network control plane and generate feature vectors; Perform data preprocessing on the feature vector; input the preprocessed feature vector into the LSTM model and output the probability of normal traffic; When the probability of normal traffic is lower than the traffic threshold, the network traffic data is marked as abnormal.

2. The method for detecting anomalies in network function interaction in a core network according to claim 1, wherein: The embedded interaction sequence is input into the LSTM-AE model to generate a reconstructed sequence and calculate the reconstruction error, specifically: The embedded interaction sequence is input into the LSTM-AE model to generate a reconstructed sequence; The mean square error between the embedded interaction sequence and the reconstructed sequence is calculated to obtain the reconstruction error.

3. The method for detecting anomalies in network function interaction in a core network according to claim 1, wherein: The temporal interaction sequence is described as: in, Represented as a temporal interaction sequence; Represented as the first calls; Indicates the total number of calls.

4. The method for detecting anomalies in network function interaction in a core network according to claim 1, wherein: The numerical encoding and embedding mapping are performed on each call in the time-series interaction sequence to generate an embedded interaction sequence, specifically: Assign a numerical identifier to each call in the temporal interaction sequence and map it to the numerical space to generate a numerical interaction sequence; Embedding mapping is performed on the digitized interaction sequence to generate an embedded interaction sequence.

5. The method for detecting anomalies in network function interaction in a core network according to claim 4, wherein: The embedded interaction sequence is expressed as: in, represents the interaction sequence after embedding; Represent the interaction sequence after embedding Position data; the embedded interaction sequence The expression for the position data is: , Where, is the embedded function; A numerical interaction sequence The numeric identifier of the location call; Represents the interaction sequence after embedding Location data; Represents a numerical space; express -dimensional real vector; Indicates the total number of calls.

6. The method for detecting anomalies in network function interaction in a core network according to claim 1, wherein: The expression of the error threshold is: in, represents the error threshold; It represents the reconstruction error sequence generated by training the LSTM-AE model using the call tree data of normal network function interaction as the training set. is the offset; is the maximum function.

7. The method for detecting anomalies in network function interaction in a core network according to claim 1, wherein: The feature extraction of the collected network traffic data of the core network control plane to generate a feature vector is specifically as follows: The collected network traffic data of the core network control plane is stored as a pcap file in pcap format; Extract features from the pcap file, store the extracted features in vectors, and generate feature vectors; The features include frame information, IP layer information and TCP layer information.

8. The method for detecting anomalies in network function interaction in a core network according to claim 1, wherein: The loss function of the LSTM model is: in, It is The probability that the actual traffic of network traffic data is normal, It is The predicted normal traffic probability corresponding to the network traffic data, Indicates the total number of network traffic data; represents the loss function; is a logarithmic function.

9. The method for detecting anomalies in network function interaction in a core network according to claim 1, wherein: The LSTM model uses the Adam optimizer to update the LSTM model parameters during training, specifically: in, for The parameters of the LSTM model at the moment, is the learning rate, is the mean of the gradient, is the variance of the gradient, is the smoothing term; for Parameters of the LSTM model at this moment.

10. A core network-oriented network function interaction anomaly detection system, characterized in that: include: Logical anomaly detection module: used to convert call tree data describing network function interactions in the core network into time-series interaction sequences; Each call in the time series interaction sequence is numerically encoded and embedded in turn to generate an embedded interaction sequence; the embedded interaction sequence is input into the LSTM-AE model to generate a reconstruction sequence and calculate the reconstruction error; the LSTM-AE model includes an LSTM encoder and an LSTM decoder, both of which have a two-layer LSTM structure; when the reconstruction error is greater than an error threshold, the time series interaction sequence is determined to be an abnormal interaction sequence; Frequency anomaly detection module: extracts features from the collected network traffic data of the core network control plane and generates feature vectors; The feature vector is preprocessed; the preprocessed feature vector is input into the LSTM model, and the normal traffic probability is output; when the normal traffic probability is lower than the traffic threshold, the network traffic data is marked as abnormal.

Images