Network function interaction anomaly detection method and system facing core network

Abstract

The application discloses a kind of network function interaction abnormality detection methods and systems for core network, belong to mobile communication network security technical field, method is converted into time sequence interaction sequence by calling tree data through logic abnormality detection, after numerical coding and embedding mapping, input LSTM-AE: first layer LSTM encoder extracts preliminary hidden state, second layer generates high-order feature and compresses into global latent representation;Double-layer LSTM decoder reconstructs sequence based on latent representation through fully connected layer, to reconstruct error exceeds error threshold to determine missing call, redundant or illegal call and other logic abnormalities.Frequency abnormality detection analyzes core network control plane pcap traffic data, extracts frame / IP / TCP multi-level feature vector, after data cleaning, feature selection and standardization preprocessing, input LSTM model to obtain predicted traffic normal probability, when traffic normal probability is lower than traffic threshold, identify low-frequency attack such as slow DoS;It can effectively detect the first missing in core network logic abnormality and low-frequency anomaly.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of mobile communication network security, and relates to a network function interaction anomaly detection method and system for a core network. BACKGROUND

[0002] With the wide deployment of 5G (5th Generation Mobile Communication Technology) and its evolution technology B5G (Beyond 5th Generation Mobile Communication Technology), mobile communication networks are accelerating evolution towards high bandwidth, low latency and massive connections. The core network adopts a service-based architecture (SBA), relies on modular network functions and standardized API (Application Programming Interface) interactions, and significantly improves system flexibility and scalability. However, high virtualization, service-based architecture and complex business processes also make network function interactions unprecedentedly frequent, expand potential attack surfaces, and significantly increase the risk of encountering diversified security threats. At the network function interaction level, there are mainly two types of anomalies that affect the stability and security of the core network: logical anomalies (such as missing calls, redundant calls or illegal calls, which violate the expected business process and arrangement order) and frequency anomalies, such as slow DoS (Denial-of-Service) attacks, which long-term occupy resources through low-frequency requests to cause service degradation.

[0003] To address these challenges, current research on anomaly detection in 5G / B5G core networks primarily focuses on three main directions: Traffic analysis-based methods monitor overall traffic patterns and use statistical or pattern matching techniques to identify abnormal data flow characteristics, excelling at detecting large-scale malicious traffic injection or high-frequency DoS attacks; methods based on observable data (such as logs and performance metrics) analyze operational fluctuations to identify potential anomalies and assist in problem localization; and methods based on network function interaction modeling delve into the logical sequence and topology of function calls, aiming to detect abnormal interaction processes, such as unauthorized calls and abnormal API access. However, existing methods still have significant limitations. Traffic analysis primarily focuses on high-frequency scenarios for detecting frequency anomalies, and since logical anomalies usually do not significantly alter overall traffic characteristics, its detection accuracy is insufficient. While observable data analysis can reflect the overall state of the core network, it does not pay enough attention to the fine-grained interaction logic at the network function level and lacks in-depth modeling, resulting in the missed detection of some key anomalies. Although network function interaction modeling can characterize call relationships, its detection capability is still lacking when facing complex logical anomalies such as missing calls at the beginning of the interaction sequence. Therefore, exploring more accurate and efficient detection methods to address the shortcomings in detecting low-frequency anomalies and complex logic anomalies in core network interactions has become a key research topic for ensuring the safe and stable operation of 5G / B5G networks. Summary of the Invention

[0004] The purpose of this invention is to solve the technical problems in the prior art that it is impossible to effectively detect complex logical anomalies such as missing first digits in core network logic anomalies, and that it lacks detection of low-frequency anomalies in the core network. The invention provides a method and system for detecting network function interaction anomalies in the core network.

[0005] To achieve the above objectives, the present invention employs the following technical solution:

[0006] The first aspect of the present invention provides a method for detecting network function interaction anomalies in a core network, including logic anomaly detection and frequency anomaly detection; when the logic anomaly detection result is abnormal or the frequency anomaly detection result is abnormal, the network function interaction is abnormal.

[0007] The logic anomaly detection specifically refers to:

[0008] The call tree data describing network function interactions in the core network is transformed into a time-series interaction sequence; each call in the time-series interaction sequence is numerically encoded and embedded in a mapping process to generate an embedded interaction sequence.

[0009] The embedded interactive sequence is input into the LSTM-AE model to generate a reconstructed sequence and calculate the reconstruction error; the LSTM-AE model includes an LSTM encoder and an LSTM decoder, both of which are two-layer LSTM structures.

[0010] determining that the time-series interaction sequence is an abnormal interaction sequence when the reconstruction error is greater than an error threshold value;

[0011] The frequency anomaly detection is specifically:

[0012] Feature extraction is performed on the collected network traffic data of the core network control plane to generate a feature vector;

[0013] The feature vector is preprocessed, and the preprocessed feature vector is input into an LSTM model to output a traffic normal probability;

[0014] When the traffic normal probability is lower than a traffic threshold value, the network traffic data is marked as abnormal.

[0015] Further, the embedded interaction sequence is input into an LSTM-AE model to generate a reconstruction sequence and calculate a reconstruction error, specifically:

[0016] The embedded interaction sequence is input into an LSTM-AE model to generate a reconstruction sequence;

[0017] The mean square error of the embedded interaction sequence and the reconstruction sequence is calculated to obtain the reconstruction error.

[0018] Further, the time-series interaction sequence is described as:

[0019]

[0020] wherein, is a time-series interaction sequence; is the i-th call in the call tree data; is the total number of calls. Further, the time-series interaction sequence is described as:

[0021] Further, the time-series interaction sequence is described as:

[0022] Each call in the time-series interaction sequence is assigned a numerical identifier and mapped to a numerical space to generate a numerical interaction sequence;

[0023] The numerical interaction sequence is embedded and mapped to generate an embedded interaction sequence.

[0024] Further, the embedded interaction sequence is represented as:

[0025]

[0026] wherein, is an embedded interaction sequence; respectively represent the i-th Location data; the embedded interaction sequence number The expression for the location data is: , In the formula, For embedded functions; Numericalized interaction sequence The numeric identifier for the location call; Indicates the first step of the embedded interaction sequence. Location data; Represents the numerical space; express 3D real vector; This indicates the total number of calls.

[0027] Furthermore, the expression for the error threshold is:

[0028]

[0029] in, Indicates the error threshold; This represents the reconstruction error sequence generated when training an LSTM-AE model using call tree data from normal network function interactions as the training set. It is the offset; It is a maximum value function.

[0030] Furthermore, the feature extraction of the collected network traffic data from the core network control plane to generate feature vectors is specifically as follows:

[0031] The collected network traffic data from the core network control plane is stored as a pcap file in pcap format.

[0032] Feature extraction is performed on the pcap file, and the extracted features are stored as vectors to generate feature vectors; the features include frame information, IP layer information, and TCP layer information.

[0033] Furthermore, the loss function of the LSTM model is:

[0034]

[0035] in, It is the first The actual probability of normal network traffic data. It is the first The predicted normal probability of traffic corresponding to each network traffic data point. This indicates the total number of network traffic data items; Represents the loss function; It is a logarithmic function.

[0036] Further, the LSTM model updates the LSTM model parameters using an Adam optimizer during training, specifically:

[0037] wherein, is the parameter of the LSTM model at the moment, is a learning rate, is the mean of the gradient, is the variance of the gradient, is a smoothing term; is the parameter of the LSTM model at the moment.

[0038] The second aspect of the application provides a network function interaction anomaly detection system for a core network, comprising:

[0039] a logical anomaly detection module: for converting call tree data describing network function interaction in the core network into a time sequence interaction sequence; sequentially performing numerical coding and embedding mapping on each call in the time sequence interaction sequence to generate an embedded interaction sequence; inputting the embedded interaction sequence into an LSTM-AE model to generate a reconstruction sequence and calculate a reconstruction error; the LSTM-AE model comprises an LSTM encoder and an LSTM decoder, and both the LSTM encoder and the LSTM decoder are two-layer LSTM structures; when the reconstruction error is greater than an error threshold, it is determined that the time sequence interaction sequence is an abnormal interaction sequence;

[0040] a frequency anomaly detection module: performing feature extraction on the collected network traffic data of the core network control plane to generate a feature vector; performing data preprocessing on the feature vector; inputting the preprocessed feature vector into an LSTM model to output a traffic normal probability; when the traffic normal probability is lower than a traffic threshold, the network traffic data is marked as abnormal.

[0041] Compared with the prior art, the application has the following beneficial effects:

[0042] The application discloses a network function interaction abnormality detection method for a core network. The method uses an LSTM-AE (Long Short-Term Memory Autoencoder) model to deeply model the network function interaction logic, thereby achieving high-precision identification of complex logic abnormalities. In the data processing stage, the calling tree structure is converted into a time sequence interaction sequence and an embedding mapping operation is introduced, thereby effectively preserving the semantic correlation of the calling events and significantly reducing the complexity of the original data. The model uses a double-layer LSTM (Long Short-Term Memory) encoder architecture. The first layer of LSTM captures the local time sequence features of the calling sequence, and the second layer of LSTM further extracts high-order abstract features. The finally generated global latent representation comprehensively compresses the causal dependence relationship of the interaction sequence, thereby laying a foundation for accurate reconstruction. The LSTM decoder gradually reconstructs the sequence through a fully connected layer based on the latent representation. The symmetric structure of the decoder and the encoder forms a closed loop, thereby ensuring strong fitting capability for normal interaction patterns.

[0043] In the abnormality detection mechanism, the error between the input sequence and the reconstructed sequence is calculated, and a threshold is dynamically set, thereby effectively identifying logic abnormalities such as missing calls, redundant calls and illegal calls. The scheme overcomes the defects of the traditional method in modeling complex logic patterns, and is particularly good at detecting deep abnormal scenarios such as missing first calls in the interaction sequence. The model only needs to be trained with normal samples to establish a benchmark pattern, thereby greatly reducing the dependence on abnormal labeled data and significantly improving the practicality and scalability of the detection system. In actual deployment, the technology can monitor the network function interaction chain under the service-oriented architecture of the core network in real time, timely block business failures and security threats caused by logic abnormalities, and provide a key guarantee for the stable operation of the 5G / B5G core network.

[0044] Further, the frequency anomaly detection method of the present application realizes high-sensitivity identification of low-frequency security threats in the core network by fusing multi-level traffic feature analysis and LSTM time series modeling technology. In the data collection stage, by deeply analyzing the original traffic data in the pcap (Packet Capture) format, frame information, IP (Internet Protocol) layer features and TCP (Transmission Control Protocol) layer dynamic indicators (such as time interval, flag combination) are extracted, and a feature vector system that comprehensively describes network function interaction behavior is constructed. In the preprocessing stage, linear interpolation is used to complete the missing values, and quartile range method is used to remove non-attack abnormal points, and based on the Pearson correlation coefficient, key features are selected, which significantly improves the data quality while retaining the subtle traces of slow DoS attacks. The LSTM model captures the long-term dependence patterns of time interval, request frequency and other features in normal traffic, and establishes a high-precision baseline of normal behavior. When encountering slow DoS attacks, the low-frequency request pattern unique to attack traffic deviates significantly from the normal baseline, and the LSTM model quantifies the deviation degree in real time through the output probability value, effectively identifying long-term resource occupation attacks. This scheme breaks through the detection limitations of existing technologies on high-frequency anomalies, and is particularly good at discovering low-frequency slow attack strategies carefully designed by attackers. The present application can monitor the core network control plane traffic in real time, actively intercept abnormal traffic before the quality of service decreases, and form a double protection system with the logical anomaly detection module to comprehensively guarantee the security and service continuity of the 5G / B5G core network in a high-virtualization environment. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0046] Figure 1 is a logical anomaly detection flowchart based on LSTM-AE;

[0047] Figure 2 is an LSTM-AE model structure diagram;

[0048] Figure 3 is a frequency anomaly detection flowchart based on LSTM;

[0049] Figure 4 is a comparison diagram of the effects of different algorithms on illegal calls;

[0050] Figure 5is the effect comparison chart of different algorithms detecting redundant call;

[0051] Figure 6 is the effect comparison chart of different algorithms detecting missing call;

[0052] Figure 7 is the effect comparison chart of different algorithms detecting Slow Headers;

[0053] Figure 8 is the effect comparison chart of different algorithms detecting Slow Post;

[0054] Figure 9 is the effect comparison chart of different algorithms detecting Slow Read;

[0055] Figure 10 is the flow chart of the network function interaction anomaly detection method for the core network of the present application;

[0056] Figure 11 is the block diagram of the network function interaction anomaly detection system for the core network of the present application.

[0057] Wherein, 1-logic anomaly detection module; 2-frequency anomaly detection module. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme of the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and indicated in the drawings can be arranged and designed in various different configurations.

[0059] Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without making creative efforts are within the scope of protection of the present application.

[0060] It should be noted that: similar labels and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0061] The present application will be described in further detail below in conjunction with the drawings:

[0062] Reference is made to Figure 10The application provides a network function interaction anomaly detection method for a core network, including LSTM-AE-based logical anomaly detection and LSTM-based frequency anomaly detection, which are respectively used for identifying logical anomaly and low-frequency anomaly (such as slow denial-of-service attack) of interaction sequences in a core network control plane.

[0063] S1, LSTM-AE-based logical anomaly detection:

[0064] In order to effectively detect the logical anomaly of network function interaction, the embodiment provides an anomaly detection method based on LSTM-AE. LSTM-AE can capture the time sequence dependence in network function interaction, reconstruct normal interaction sequences, and identify abnormal behaviors by calculating reconstruction error. The anomaly detection method based on LSTM-AE has significant advantages in identifying logical anomalies in network function interaction, such as missing calls, redundant calls, and illegal calls. The LSTM-AE-based logical anomaly detection model is as shown in FIG. 1. The specific steps are as follows: Figure 1

[0065] S101, data processing:

[0066] S101-1, convert the call tree data describing network function interaction in the core network into time-sequential interaction sequences consistent in time sequence. The call tree is composed of nodes and edges, wherein each node represents a call operation, and each edge describes the causal relationship between calls. By traversing all node sets and edge sets in the call tree, the information of each call is extracted in causal order, and each call is represented as a combination of the caller and the callee , that is:

[0067]

[0068] According to the edge set , the time-sequential interaction sequence is constructed, and its expression is:

[0069]

[0070] wherein, represents the total number of calls in the call tree; represents the call at the time in the time-sequential interaction sequence. This process linearizes the complex call tree structure and maintains the time sequence of the calls, thereby generating time-sequential interaction sequences in time sequence.

[0071] ​S101-2, Numerical encoding is performed on each call in the time-ordered interaction sequence, i.e., a unique numerical identifier is assigned to each call, and each call is mapped to a numerical space to form a numerical interaction sequence. This numerical encoding process not only preserves the semantic relationship between calls, but also effectively reduces the complexity of the original data. In addition, for subsequent use, the numerical encoding process also generates a complete mapping table to record the correspondence between call descriptions and their numerical representations. The specific steps are as follows:

[0072] Each call in the time-ordered interaction sequence is mapped to a numerical space by an encoding function , each call is assigned a unique numerical identifier , and the resulting numerical interaction sequence can be represented as:

[0073]

[0074] wherein, respectively represent the value of the numerical interaction sequence at position ; the numerical identifier of the call at position of the numerical interaction sequence ; is the data at position of the time-ordered interaction sequence; represents the encoding function. The numerical encoding process not only effectively reduces the complexity of the original data, but also preserves the semantic relationship between calls, providing a more rich feature representation for the learning of the LSTM-AE model. At the same time, a mapping table is generated to record the correspondence between the call and its numerical identifier , providing explanatory support for subsequent model analysis.

[0075] S101-3, Embedding mapping is performed on the numerical interaction sequence . Specifically, by using an embedding function , the discrete numerical call is mapped to a continuous vector , ∈ . The generated embedded interaction sequence is represented as:

[0076]

[0077] wherein, respectively represent the data at position of the embedded interaction sequence, and the expression of the data at position of the embedded interaction sequence is: , ; Indicates the first step of the embedded interaction sequence. Location data; express 3D real vector; For embedded functions; Numericalized interaction sequence The numeric identifier for the location call; Represents the numerical space; express 3D real vector; This indicates the total number of calls. Embedding mapping not only preserves the semantic relationships of the calls but also makes its data representation more suitable for the computation of LSTM models.

[0078] S101-4, Since the LSTM-AE model requires consistent input data length, set the sliding window length. Then, use a sliding window to process the embedded interaction sequence. Perform length normalization. For the length... The sequence is obtained by padding the end of the embedded interactive sequence with a special vector. Expand it to length For length The sequence, only the first part is retained. There are elements. Therefore, the embedded interaction sequence after length consistency processing is represented as: This sequence is the input sequence for the LSTM-AE model; These represent the first and second inter-sequences after length consistency processing and embedding. Location data; This indicates the length of the embedded interaction sequence after length consistency processing.

[0079] S102, Model Training:

[0080] like Figure 2 As shown, the LSTM-AE model in this embodiment includes an LSTM encoder and an LSTM decoder; the LSTM encoder includes two LSTM layers, and the LSTM encoder processes the input sequence through the two LSTM layers. Processing step-by-step captures global temporal dependencies in the sequence. The first LSTM layer extracts preliminary features at each time step and generates hidden states. Hidden state The second LSTM layer further processes the data to capture higher-level features and generate hidden states. Finally, the output of the LSTM encoder is processed by a repeating vector layer to form a latent representation. This latent representation compresses the global information of the input sequence and forms the basis for subsequent sequence reconstruction. The LSTM decoder uses the same structure as the LSTM encoder, progressively generating the output sequence, i.e., the reconstructed sequence, from the latent representation. At each time step, the LSTM units in the LSTM decoder combine the hidden state for prediction and map the hidden state back to the original space of the input sequence through a fully connected layer. Finally, the decoder reconstructs a sequence similar to the input sequence.

[0081] In this embodiment, only normal network function interaction sequences are used to train the LSTM-AE model. The normal network function interaction sequences are processed through step S101 to obtain the input sequence set. This will be used as the training dataset; This represents the total number of input sequences during training; They represent the first and second sequences in the input sequence set, respectively. The nth input sequence (i.e., the embedded interactive sequence after length consistency processing). For the nth input sequence set input sequences By minimizing the input sequence With the corresponding reconstruction sequence The mean square error between them is the reconstruction error. ; Indicates the length of the input sequence; Indicates the input sequence number 1 The value of the position; Indicates the reconstructed sequence number The value of the position. This embodiment utilizes the input sequence set. Training the LSTM-AE model yields the final training data reconstruction error sequence as follows: , The input sequences are respectively The corresponding reconstruction error.

[0082] S103, Detection Stage:

[0083] The LSTM-AE model trained in step S102 is used to reconstruct each temporal interaction sequence in the test set, and the reconstruction error is... It is used as a basis for judging anomalies. By analyzing the reconstruction error distribution of normal interaction sequences, an error threshold is set. :

[0084]

[0085] in, Represents the reconstructed error sequence. It is the offset; It is a maximum value function. When the reconstruction error of the input sequence... greater than an error threshold In this case, the timing interaction sequence is determined as an abnormal interaction sequence.

[0086] S2, frequency anomaly detection based on LSTM:

[0087] In the frequency anomaly detection, the LSTM learns the timing pattern of the network traffic data of the normal core network control plane through training, and can identify those abnormal data that are significantly different from the network traffic data of the normal core network control plane. When the new core network control plane network traffic data deviates greatly from the learned timing pattern of the normal core network control plane network traffic data, the LSTM can quickly identify the deviation and mark it as abnormal, thereby effectively detecting slow DoS attack traffic. This embodiment uses LSTM to detect frequency anomalies of network function interactions, and the detection process is as shown in Figure 3 The detection process can be divided into the following steps:

[0088] S201, data preparation:

[0089] Raw HTTP / 2 (Hypertext Transfer Protocol Version 2) network traffic data of the 5G core network control plane is collected, and the network data is stored in a pcap format file. The pcap file records detailed information of each data packet in the network, including timestamp, protocol type, packet length, source and target address, and other important fields. Through further analysis of the core network control plane network traffic data stored in the pcap format, combined with feature engineering method for feature extraction, a feature vector is generated, which represents the typical traffic feature pattern in the 5G / B5G core network.

[0090] Specifically, further analysis of the core network control plane network traffic data stored in the pcap format uses the pyshark library to parse the pcap file packet by packet, and extracts features that can reflect the basic information of network communication. The extracted features mainly include the following categories:

[0091] (1) Frame information: such as the encapsulation type and total length of the data packet, which reflects the basic structure of the data packet.

[0092] (2) IP layer information: such as IP header length, time to live (TTL), source IP address and destination IP address, etc., which describes the routing and transmission characteristics of the data packet in the network.

[0093] (3) TCP layer information: such as source port, destination port, packet length, TCP flag, window size, time interval, etc. These features are particularly important for capturing network function interaction frequency and connection state.

[0094] The detailed fields of each packet are parsed by pyshark, and these features are extracted and stored as structured datasets. In specific implementation, the features of the packet are converted into the form of feature vectors, each of which corresponds to a packet. The construction of the feature vector follows the following process:

[0095] (1) Traverse each packet to extract frame information, IP layer information, TCP layer information and other related fields;

[0096] (2) Store the extracted field values in a feature vector;

[0097] (3) Add the feature vector to the feature list to build a complete feature dataset.

[0098] Finally, all feature vectors are aggregated and stored as a CSV (Comma-Separated Values) format data file for subsequent processing.

[0099] S202, data preprocessing:

[0100] The feature vectors obtained in S201 are processed as follows:

[0101] (1) Data cleaning:

[0102] In the data cleaning stage, the main purpose is to improve the quality of the extracted original data, handle missing values and outliers, and ensure the integrity and consistency of the data, while avoiding the loss of important features related to slow DoS attacks. The focus of data cleaning is to distinguish between noise data in normal traffic and traffic information carrying abnormal features in slow DoS attacks, so as to maximize the retention of key features of attack behavior.

[0103] Due to the possibility of duplicate packets and incomplete packets (such as null values or missing fields due to packet loss) in network traffic, the following three strategies are usually used to handle such outliers:

[0104] Deletion of redundancy: Removing redundant data is a key step in data preprocessing, which directly affects the training efficiency and performance of the LSTM model. Redundant data not only increases the computational burden, leading to model overfitting, but also may reduce the generalization ability of the model. By removing redundant data, not only can we effectively reduce the consumption of computing resources and training time, but also can improve the diversity and representativeness of training data, promote the LSTM model to learn the core features of data from different angles, and enhance its prediction ability for unknown data. Therefore, in this experiment, we will remove the redundant data packets from the data set when their feature information is severely missing and cannot be repaired.

[0105] Completing the missing: For the missing of some features (such as time interval or TCP window size), it needs to be completed, because completing the feature value of training data is an important step to ensure the performance and stability of LSTM model. Missing feature values may cause the integrity of input data to be damaged, which affects the learning ability of LSTM model on data distribution, and thus reduces the prediction accuracy. Completing the feature value can help to improve the availability and consistency of data, so as to ensure that LSTM model can effectively capture the relationship between features. Through reasonable completion methods such as mean filling, interpolation algorithm or context-based prediction method, the internal structure of data can be preserved to the greatest extent, and the introduction of noise can be reduced. In addition, completing the feature value can prevent the model from ignoring some important features due to missing values, thereby improving the stability of training and the generalization ability of the model. This embodiment uses linear interpolation method to complete the missing value, ensuring the integrity of data. Linear interpolation method estimates according to the data points before and after, and the interpolation formula is:

[0106]

[0107] wherein, is the missing value, and are the adjacent data points before and after the missing value, respectively.

[0108] Deletion of disturbance: In order to enhance the robustness of data, the abnormal values in the flow data are identified and processed. Abnormal values usually refer to data points far away from the normal distribution range, such as abnormally large time interval, TCP flag bit exceeding the protocol specified range, etc. In the context of slow DoS attack, the anomaly of time interval is often an important feature of attack, so the processing of abnormal values needs to be particularly careful. Statistical methods such as upper and lower quartile method are used to remove extreme values of other features. The upper and lower quartile method identifies abnormal values by calculating the quartile range of data. Abnormal values are defined as data points outside the following range, specifically:

[0109]

[0110] wherein, is the first quartile, It is the third quartile. It is the interquartile range.

[0111] (2) Feature selection:

[0112] Although a large amount of information is collected during the data acquisition phase to enrich the input dimensions of the LSTM model, some features may have limited contribution to the actual performance of the LSTM model, or even introduce interference or noise, leading to a decline in LSTM model performance. Therefore, feature selection is an indispensable step in data preprocessing. Its main purpose is to screen out features that are highly relevant to the frequency anomaly detection task, while removing redundant or irrelevant features, thereby optimizing the input space of the LSTM model. In this process, statistical analysis methods, such as studying the distribution characteristics of features and calculating the correlation matrix, can be used to quantify the effectiveness of each feature and identify features with weak influence. In addition, feature selection can not only reduce the dimensionality of the data, thereby reducing computational complexity, but also improve the training efficiency and generalization performance of the LSTM model, playing an important role in the overall reliability and accuracy of detection. This embodiment uses the Pearson correlation coefficient to evaluate the linear correlation between each feature and the target variable (whether it is a slow DoS attack). The formula for calculating the correlation coefficient is:

[0113]

[0114] in, and They represent the first The feature values ​​and target values ​​of each sample and The corresponding mean, This represents the total number of samples. By calculating the correlation coefficient, features highly correlated with the target variable can be identified.

[0115] (3) Standardization:

[0116] Data standardization is a crucial step in improving the performance of LSTM models. Standardization unifies the scale of training data, ensuring that different features have the same mean and variance, or are transformed into zero-mean, unit-variance forms, thus effectively addressing the problems caused by differences in feature scale. Furthermore, standardization accelerates the convergence of gradient descent, avoiding training instability and performance degradation due to scale inconsistencies. Especially when using the gradient descent optimizer, differences in feature scale can cause certain features to dominate gradient updates, thus affecting the training efficiency of the LSTM model. After standardization, the consistent scale of all features ensures smooth gradient updates and shortens training time.

[0117] In addition, feature data standardization can prevent some features from dominating the training process, thereby optimizing the learning of all features by the LSTM model. Data standardization is crucial for activation functions in deep neural networks, avoiding unstandardized data working in the saturation interval of the activation function and reducing the risk of gradient vanishing or explosion. Through standardization, the input data distribution is more uniform, and the activation function operates in the effective interval, further improving the LSTM model training. Therefore, standardization not only optimizes the training process and improves the convergence speed, but also enhances the generalization ability and overall performance of the LSTM model.

[0118] Since S201 resolves the complete packet information as feature data, these feature data are at different levels of computer network data (such as link layer, network layer, transport layer, and application layer, etc.). In addition, the dimensional differences between different features will also cause uneven distribution of data values. Specifically, the value range of feature data differs greatly, for example, the data packet length may reach several hundred bytes, while the time interval may be between 0 and several seconds. Without standardization, the feature input model may cause some features to have a greater impact on the model learning. Therefore, standardization converts all features to the same scale. The specific standardization formula is:

[0119]

[0120] wherein, is the original value of the feature, is the mean of the feature, is the standard deviation of the feature, is the standardized feature value. Through standardization, feature data is converted to a distribution with a mean of 0 and a standard deviation of 1, thereby eliminating the numerical scale difference between different features, which helps to improve the convergence speed and prediction accuracy of the LSTM model.

[0121] S203, model training:

[0122] After the collected normal core network control plane network traffic data is processed by S201 and S202, it is divided into a training set and a validation set, and the LSTM model is trained.

[0123] In the LSTM model training process, binary classification cross-entropy is used as the loss function, and the expression is:

[0124]

[0125] wherein, is the actual traffic normal probability of the th network traffic data, is the predicted traffic normal probability corresponding to the th network traffic data, This represents the total number of network traffic data points, which is the total number of data points in the training set. Represents the loss function; The loss function is logarithmic. By minimizing the loss function, the LSTM model can fit the training data to the maximum extent, improving the accuracy of anomaly detection.

[0126] During optimization, the Adam optimizer is used to update the LSTM model parameters. The Adam optimizer combines first-order momentum (the mean of the gradient) and second-order momentum (the variance of the gradient), offering advantages such as fast convergence and strong robustness. The optimization formula for the Adam optimizer is:

[0127]

[0128] in, For the current moment The corresponding LSTM model parameters, For learning rate, Let be the mean of the gradient. Let Variance be the gradient. For smoothing terms, These are the parameters of the LSTM model from the previous training iteration.

[0129] The LSTM model parameters are iteratively updated using the Adam optimizer on the training set, and performance is evaluated by calculating the loss function on the validation set to prevent overfitting. To improve the model's generalization ability, an early stopping mechanism is introduced: the training process is terminated when the loss value on the validation set no longer improves within a certain number of consecutive epochs.

[0130] S204, Anomaly Detection:

[0131] After the LSTM model is trained, it enters the anomaly detection phase, performing inference and classification on the network traffic data of the validation set. During detection, network traffic data is sequentially input into the trained LSTM model, which outputs the normal probability of traffic for each time window through forward propagation. .

[0132] To transform continuous probability values ​​into discrete classification results, this embodiment sets a threshold. To determine if the traffic is abnormal. When the traffic output by the trained LSTM model is normal... If the network traffic is below the traffic threshold, the network traffic data for that time window is marked as abnormal; otherwise, it is marked as normal. The decision rule is as follows:

[0133]

[0134] The application can effectively detect logical anomalies (especially first missing) and low-frequency anomalies (slow DoS attacks) in the 5G / B5G core network based on the LSTM-AE for logical anomaly detection and the LSTM for frequency anomaly detection. The method has theoretical feasibility, can overcome the limitations of existing anomaly detection methods, and realizes accurate identification of core network control plane anomalies.

[0135] The LSTM-AE model has sequence reconstruction capability, which can detect interaction anomalies by learning the normal interaction mode of core network network function interaction sequences. In the application, the LSTM-AE model maps the network function interaction sequence to a low-dimensional hidden representation through the LSTM encoder, and reconstructs the sequence through the LSTM decoder, thereby learning the normal interaction mode. During training, the LSTM-AE model only learns the normal interaction mode, can accurately reconstruct the complete network function interaction sequence, and ensures high fidelity to normal data. When the first call of the input interaction sequence is missing, the hidden state generated by the LSTM-AE model will be affected due to its dependence on complete time series information, which will cause the LSTM decoder to fail to correctly reconstruct the sequence, thereby significantly increasing the reconstruction error. The LSTM-AE calculates the mean square error between the input sequence and the reconstructed sequence during detection, and when the error exceeds the set error threshold, it can be determined that the interaction sequence is abnormal. Since the first call is missing, it will destroy the overall pattern of network function interaction, and the LSTM-AE model can accurately identify this kind of logical anomaly by comparing the input sequence with the reconstructed sequence, thereby effectively making up for the limitations of existing methods that cannot detect the first call of the interaction sequence.

[0136] The LSTM model has time series prediction capability, which can learn the time series mode of network function access frequency, thereby identifying low-frequency anomalies (slow DoS attacks). The application uses the LSTM model to predict the normal access frequency distribution of a specific network function by predicting the normal probability of network function traffic. During training, the LSTM models the access frequency variation law between network functions in the core network control plane through a long-term dependent memory mechanism, and predicts the future access frequency based on a historical time window. When the actual access frequency of a network function is lower than the normal range predicted by the LSTM for a long time, but still maintains a continuous access state, it can be determined that the NF is in a slow DoS attack state. The LSTM can identify the long-term deviation trend of low-frequency anomalies through time series modeling, thereby realizing accurate detection of slow DoS attacks.

[0137] In summary, the present application performs logical anomaly detection based on LSTM-AE, which can identify the missing first call of the interaction sequence through reconstruction error, improve the logical anomaly detection capability of the core network control plane, and perform frequency anomaly detection based on LSTM, which can identify low-frequency anomalies through time series prediction, and effectively detect slow DoS attacks.

[0138] To verify the effectiveness of the core network-oriented network function interaction anomaly detection method of the present application, one embodiment of the present application uses the open source project (Free and Open-source 5G Core Network, free5GC) of 3GPP R15 (3rd Generation Partnership Project Release 15, third generation partnership project version 15) and subsequent versions for the core network part, and uses the open source simulator Ueransim for the access network (Radio Access Network, access network) and access device UE (User Equipment, user equipment) part, which is used to simulate the connection of user equipment and gNB (the next Generation Node B, the next generation base station), to provide complete end-to-end 5G communication process. At the same time, based on Docker Compose, the free5GC + UERANSIM environment is deployed to build a relatively complete 5G test bed, so as to collect core network control plane data conforming to the real scene. In addition, in order to realize real-time monitoring and tracking of the calling information between NFs (Network Function, network function), SkyWalking is introduced as a distributed tracking tool in the experimental platform to collect the calling tree of the core network network function interaction in real time, and the calling logic between the core network elements is sorted based on the calling tree. And Wireshark is used as a network monitoring and data collection tool to capture traffic data in real-time network transmission and obtain the frequency of core network network function interaction.

[0139] First, attack simulation is performed, specifically:

[0140] Logical anomaly attack simulation:

[0141] (1) Malicious network function deletion:

[0142] In the 5G core network, the NRF (Network Repository Function) mainly provides service registration and discovery functions. Attackers can disguise as legitimate NFs, take advantage of the vulnerability of the NRF interface lacking strict permission control, and send unauthorized Delete requests to delete critical NF configuration files. Since the NRF does not verify the identity of the request, attackers can abuse interface permissions to implement destruction, and if batch operations are performed, it can cause large-scale logout of core network components, and further cause service interruption and other serious consequences.

[0143] (2) User information extraction:

[0144] This type of attack takes advantage of a vulnerability in previous versions of free5GC v3.0.7. A malicious NF requests the authentication service of the AUSF (Authentication Server Function), and due to the vulnerability, the AUSF will return the SUPI (Subscription Permanent Identifier) of the UE to the malicious NF even if the authentication fails. Upon receiving the SUPI of the UE, the malicious NF will use the SUPI to access private information about the UE. For example, it calls the / nudm-sdm / {supi} / am-data interface to obtain UE access and mobile subscription data, and calls the / nudm-sdm / {supi} / nssai interface to obtain the slice subscription information of the target UE.

[0145] Low-frequency anomaly attack (slow DoS) simulation:

[0146] (1) Slow Headers:

[0147] The target of the attack is the API interface between AMF and AUSF in the core network. The attack script sends HTTP request headers slowly to simulate the attacker occupying the server's connection and memory resources. By delaying the sending of request headers and controlling the sending rate of requests, the target server cannot process subsequent normal requests in time, causing service paralysis.

[0148] (2) Slow Post attack:

[0149] The attack target is the API interface between AMF (Authentication Management Function) and AUSF in the core network. The attack script simulates an attacker sending a Post request and specifying a larger message body length (content-length), sending the request body data at an extremely low speed, forcing the server to occupy memory and computing resources in the process of waiting for complete data, so that normal API requests cannot be processed in time.

[0150] (3) Slow Read attack:

[0151] The attack target is the API interface between AMF and AUSF in the core network. After the attack script simulates an attacker sending a request to the server, it reads the response content at an extremely low speed. In this way, the attacker can continuously occupy the server's connection and memory resources, causing the server to be unable to process new normal requests, eventually causing service interruption.

[0152] By simulating attacks, the application is compared with existing anomaly detection schemes. In this embodiment, the comparison scheme of logical anomaly detection selects the network function interaction anomaly detection scheme ADSeq, and the anomaly detection scheme based on RNN as the comparison scheme. The scheme ADSeq comes from the paper ADSeq-5GCN: Anomaly Detection Method Based on 5G Core Network Control Plane Traffic Sequence [C] / / 24th IEEE International Conference on High Performance Switching and Routing (HPSR 2023). Albuquerque, New Mexico, USA: IEEE Press, 2023: 75-82. The scheme ADSeq is a detection scheme based on bidirectional long short-term memory network. The detection effects of different schemes on three types of logical anomaly attacks are compared.

[0153] The comparison model of frequency anomaly detection selects RNN (Recurrent Neural Network), SVM (Support Vector Machine), Naive Bayes and logistic regression. The detection effects of three types of slow denial of service attacks, Slow Headers, Slow Post and Slow Read, under different algorithms are compared. The specific comparison results are as follows:

[0154] (1) Comparison results of logical anomaly detection:

[0155] From Figure 4As can be seen from Table 6, LSTM-AE performs best in the illegal call detection task, which is reflected in the following aspects: the accuracy and precision are close to 100%, indicating that LSTM-AE can accurately identify illegal calls with extremely low false positive rate. The recall and F1 score are also maintained at a high level, indicating that the model has strong detection ability and comprehensive performance in covering illegal call events. Compared with LSTM-AE, ADSeq has higher precision, but the recall decreases, resulting in slightly lower F1 score, indicating that it has certain limitations in capturing illegal calls. In contrast, the performance of the RNN model is general, with significantly lower accuracy than the other two models, and the performance of other indicators is also insufficient, indicating that it has a high false negative rate in the illegal call detection task.

[0156] From Figure 5 As can be seen from Table 7, LSTM-AE performs best in the call redundancy detection task, with accuracy and precision reaching more than 98%, indicating that the threshold of reconstruction error is reasonable and can effectively capture the characteristics of redundant calls. The recall and F1 score are also at a high level, indicating that LSTM-AE has good coverage and accuracy in detecting call redundancy. In contrast, ADSeq performs close to LSTM-AE in precision, but has lower recall and F1 score, indicating that it has false positives in detecting some redundant calls. RNN performs worst in the call redundancy task, with all indicators performing poorly, reflecting its shortcomings in modeling complex temporal dependencies and difficulty in accurately detecting redundant call events.

[0157] From Figure 6 As can be seen from Table 8, LSTM-AE also leads in all indicators, with accuracy and precision close to 100%, indicating that LSTM-AE has high reliability in detecting call missing events. The recall and F1 score are both above 95%, further verifying the high coverage and detection accuracy of the model for call missing events. ADSeq has the second best detection performance, although it has high accuracy and precision, but the recall is slightly lower, resulting in a F1 score that is not optimal, indicating that it lacks sensitivity to call missing. RNN performs worst, with all indicators not exceeding 90%, especially the recall is low, indicating that it is prone to missing detection when facing call missing, and has weak detection performance.

[0158] (2) Comparison results of frequency anomaly detection:

[0159] From Figure 7It can be seen that the LSTM-based model performs significantly better than other methods in the Slow Headers scenario. In terms of accuracy and F1 value, the LSTM model is close to 100%, while the performance of other methods is relatively low. In contrast, the detection effect of the RNN model is better, all above 90%, slightly inferior to the model of the present scheme. SVM performs well in recall rate, but all indicators are significantly lower than LSTM. This shows that SVM is strong in reducing false positives, but lacks comprehensive detection capability for abnormal traffic. The recall rate of the Naive Bayes model is only about 20%, and it is difficult to cope with the complex features of the Slow Headers attack; the performance of the logistic regression model in precision is weaker than LSTM, indicating that its ability to capture abnormal patterns is limited.

[0160] As can be seen from Figure 8 , the proposed scheme has a significant advantage in detecting Slow Post attacks, with all four indicators close to 99%, indicating that the present invention can accurately distinguish between normal traffic and attack traffic with extremely low false positive and false negative rates, and is the best performing scheme in this comparative experiment. In contrast, other comparative algorithms perform significantly worse. The recall rate of the RNN model is less than 90%. The SVM model performs well in recall rate, but the precision is only 41%, the false positive rate is high, and the F1 value is only 55%, which cannot meet the actual application requirements. Although the accuracy of Naive Bayes is high, the recall rate is only 18.15%, the false negative phenomenon is serious, and the F1 value is as low as 30%, which is almost impossible to effectively detect Slow Post attacks. Logistic regression achieves a certain balance between precision and recall rate, but the F1 value is 82%, and the overall performance is still far inferior to our scheme.

[0161] As Figure 9 shown, in Slow Read attack detection, the four indicators of the LSTM model remain in the lead, all close to 100%, showing excellent detection capability and the ability to accurately distinguish between normal traffic and attack traffic, while greatly reducing the possibility of false positives and false negatives. In contrast, the recall rate of RNN is only 80%. SVM performs generally, with an accuracy of 87%, a precision of 90%, and a recall rate of 85%, which is acceptable in terms of false positives and false negatives, but the overall detection capability is insufficient. Although Naive Bayes performs well in precision, its recall rate is only 14.95%, and the false negative phenomenon is extremely serious, resulting in an F1 value of only 26%, and the overall performance is extremely poor. The precision of logistic regression is 80%, but its F1 value is 76%, and the overall performance is far inferior to our scheme.

[0162] An embodiment of the present invention provides a network function interaction anomaly detection method for a core network, specifically relates to detecting the first call missing of an interaction sequence based on LSTM-AE.

[0163] The embodiment adopts LSTM-AE for logical anomaly detection to detect the missing first call of network function interaction sequences in a 5G / B5G core network.

[0164] First, a distributed tracing system (such as SkyWalking) is used to collect network function interaction data in the control plane of the core network, including calling source, calling target, timestamp, and calling event information, and network function interaction sequences are constructed in chronological order. Then, the collected interaction data is preprocessed, including sequence encoding, embedding, and sliding window truncation, to form fixed-length interaction sequences for model training.

[0165] Then, the LSTM-AE model is trained based on normal network function interaction sequences to learn the normal interaction patterns of the core network. The LSTM-AE consists of an encoder and a decoder, the encoder is used to extract low-dimensional feature representations of the input interaction sequences, and the decoder is used to reconstruct the low-dimensional features back to the original sequences and calculate the mean square error between the input sequences and the reconstructed sequences.

[0166] During detection, the network function interaction sequence to be detected is input into the LSTM-AE for reconstruction, and the reconstruction error is calculated. When the reconstruction error exceeds the set threshold, it is determined that the interaction sequence may have an anomaly. If further analysis finds that the interaction sequence is missing the first call of a certain key network function, it can be determined as a first call missing anomaly.

[0167] For example, in the user authentication process, the normal interaction sequence is:

[0168] AMF→AUSF; AUSF→NRF; AUSF→UDM (Unified Data Management); UDM→UDR (Unified Data Repository); UDM→UDR.

[0169] However, in the case of malicious attacks, AUSF may abuse its authority, i.e., without receiving an authentication request from AMF, it still directly requests UE's private information from UDM, bypassing the normal authentication and authorization process, i.e., the first call is missing, and the interaction sequence becomes:

[0170] AUSF→UDM; UDM→UDR; UDM→UDR.

[0171] LSTM-AE can detect this logical anomaly of missing first call by comparing the reconstructed sequence with the input sequence. This embodiment shows that LSTM-AE can effectively learn the network function interaction patterns of the core network and accurately identify the missing first call of the interaction sequence through reconstruction error, thereby improving the logical anomaly detection capability of the 5G / B5G core network.

[0172] One embodiment of the present application provides a network function interaction anomaly detection method for a core network, specifically relates to detecting slow DoS attacks in a core network based on LSTM.

[0173] This embodiment uses LSTM for frequency anomaly detection to detect slow DoS attacks in a 5G / B5G core network. First, a core network test platform is built to simulate three types of slow DoS attacks. It can be seen that after the attack starts, the server resources are gradually exhausted and the service becomes unavailable. The original 5G core control plane HTTP / 2 network traffic data is collected using wireshark, and the collected data is preprocessed, including feature extraction, data cleaning and standardization.

[0174] Then, in the training phase of the LSTM model, the LSTM model learns the time series pattern of a large amount of normal data and gradually establishes the expected pattern of normal traffic. The LSTM model learns the time series features of normal interaction data by adjusting parameters and generates a time series model for identifying and predicting normal traffic. When new interaction data is input into the model, the LSTM model will make predictions based on the normal patterns it has learned and compare them with the current input data. If the input data deviates significantly from the normal pattern, the LSTM model will mark it as abnormal traffic, effectively detecting slow DoS attacks.

[0175] Referring to Figure 11 One embodiment of the present application provides a network function interaction anomaly detection system for a core network, comprising:

[0176] The logical anomaly detection module 1 is used to convert the call tree data describing network function interaction in the core network into a time series interaction sequence; each call in the time series interaction sequence is sequentially numerically encoded and embedded mapped to generate an embedded interaction sequence; the embedded interaction sequence is input into the LSTM-AE model to generate a reconstruction sequence and calculate a reconstruction error; the LSTM-AE model includes an LSTM encoder and an LSTM decoder, both of which are two-layer LSTM structures; when the reconstruction error is greater than an error threshold, the time series interaction sequence is determined to be an abnormal interaction sequence;

[0177] The frequency anomaly detection module 2 is used to extract features from the collected core network control plane network traffic data to generate a feature vector; the feature vector is preprocessed; the preprocessed feature vector is input into the LSTM model to output a traffic normal probability; when the traffic normal probability is lower than a traffic threshold, the network traffic data is marked as abnormal.

[0178] The above merely describes the preferred embodiments of the present application, and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting network function interaction anomalies in a core network, characterized in that, This includes logic anomaly detection and frequency anomaly detection; when the logic anomaly detection result or the frequency anomaly detection result is abnormal, the network function interaction is abnormal. The logic anomaly detection specifically refers to: The call tree data describing network function interactions in the core network is transformed into a time-series interaction sequence; each call in the time-series interaction sequence is sequentially numerically encoded and embedded to generate an embedded interaction sequence, specifically: Assign a numerical identifier to each call in the time-series interaction sequence and map it to a numerical space to generate a numerical interaction sequence; The numerical interaction sequence is embedded and mapped to generate an embedded interaction sequence. The embedded interactive sequence is input into the LSTM-AE model to generate a reconstructed sequence and calculate the reconstruction error; the LSTM-AE model includes an LSTM encoder and an LSTM decoder, both of which are two-layer LSTM structures. When the reconstruction error is greater than the error threshold, the time-series interaction sequence is determined to be an abnormal interaction sequence; The frequency anomaly detection specifically refers to: Feature extraction is performed on the collected network traffic data from the core network control plane to generate feature vectors; The feature vectors are preprocessed; the preprocessed feature vectors are input into the LSTM model, which outputs the normal probability of traffic flow; the loss function of the LSTM model is: in, It is the first The actual probability of normal network traffic data. It is the first The predicted normal probability of traffic corresponding to each network traffic data point. This indicates the total number of network traffic data items; Represents the loss function; It is a logarithmic function; When the probability of normal traffic is lower than the traffic threshold, the network traffic data is marked as abnormal.

2. The method for detecting network function interaction anomalies in the core network according to claim 1, characterized in that, The process of inputting the embedded interaction sequence into the LSTM-AE model to generate the reconstructed sequence and calculate the reconstruction error is as follows: The embedded interaction sequence is input into the LSTM-AE model to generate the reconstructed sequence; The mean square error of the embedded interaction sequence and the reconstructed sequence is calculated to obtain the reconstruction error.

3. The method for detecting network function interaction anomalies in the core network according to claim 1, characterized in that, The temporal interaction sequence is described as follows: in, Represented as a temporal interaction sequence; This indicates that the first element in the tree data is being called. One call; This indicates the total number of calls.

4. The method for detecting network function interaction anomalies in the core network according to claim 1, characterized in that, The embedded interaction sequence is represented as follows: in, This represents the embedded interaction sequence; These represent the first and second steps of the embedded interaction sequence. Location data; the embedded interaction sequence number The expression for the location data is: , In the formula, For embedded functions; Numericalized interaction sequence The numeric identifier for the location call; Indicates the first step of the embedded interaction sequence. Location data; Represents the numerical space; express 3D real vector; This indicates the total number of calls.

5. The method for detecting network function interaction anomalies in the core network according to claim 1, characterized in that, The expression for the error threshold is: in, Indicates the error threshold; This represents the reconstruction error sequence generated when training an LSTM-AE model using call tree data from normal network function interactions as the training set. It is the offset; It is a maximum value function.

6. The method for detecting network function interaction anomalies in the core network according to claim 1, characterized in that, The process of extracting features from the collected network traffic data of the core network control plane to generate feature vectors is as follows: The collected network traffic data from the core network control plane is stored as a pcap file in pcap format. Feature extraction is performed on the pcap file, and the extracted features are stored as vectors to generate feature vectors; The features include frame information, IP layer information, and TCP layer information.

7. The method for detecting network function interaction anomalies in the core network according to claim 1, characterized in that, The LSTM model uses the Adam optimizer to update its parameters during training, specifically: in, for The parameters of the LSTM model at time step [time]. For learning rate, Let be the mean of the gradient. Let Variance be the gradient. For smoothing terms; for The parameters of the LSTM model at time t.

8. A network function interaction anomaly detection system for core networks, based on the network function interaction anomaly detection method for core networks as described in claim 1, characterized in that, include: Logical anomaly detection module: used to convert the call tree data describing network function interactions in the core network into a time-series interaction sequence; Each call in the temporal interaction sequence is sequentially numerically encoded and embedded to generate an embedded interaction sequence. The embedded interaction sequence is then input into an LSTM-AE model to generate a reconstruction sequence and calculate the reconstruction error. The LSTM-AE model includes an LSTM encoder and an LSTM decoder, both of which are two-layer LSTM structures. When the reconstruction error exceeds an error threshold, the temporal interaction sequence is determined to be an abnormal interaction sequence. Frequency anomaly detection module: Extracts features from the collected network traffic data of the core network control plane and generates feature vectors; The feature vectors are preprocessed; the preprocessed feature vectors are input into the LSTM model, and the normal probability of traffic is output; when the normal probability of traffic is lower than the traffic threshold, the network traffic data is marked as abnormal.

Images