Mobile network signaling abnormal behavior identification and protection method under federated learning framework

Abstract

The invention discloses a mobile network signaling abnormal behavior identification and protection method under a federated learning framework, and relates to the technical field of communication, the federated learning framework allows each operator to locally train an abnormal detection model, only shares model update instead of original signaling data, not only guarantees user privacy and compliance, but also improves user experience. Fusion analysis of cross-network signaling features is realized, and the early recognition capability of cross-network spreading of signaling storms is improved; in combination with the graph attention network, the model can dynamically capture the topological relation of the cross-operator signaling flow, for example, an interaction mode between a node importance weight analysis interface and slices is used, the prediction accuracy of the abnormal propagation path is enhanced, and the missing report caused by insufficient local data is reduced.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method for identifying and protecting abnormal signaling behavior in mobile networks under a federated learning framework. Background Technology

[0002] The rapid development of mobile communication networks has made multi-operator environments the norm, with operators using interconnection interfaces to enable user roaming and service interoperability. In this context, abnormal behaviors such as signaling storms can be triggered from one operator's network and spread rapidly to other networks through interconnection interfaces. For example, when a malicious user device initiates a high-frequency location update request, a local anomaly in a single operator may evolve into cross-network signaling congestion, leading to a decline in service quality or the risk of network-wide interruption. This cross-network spread problem is particularly prominent in 5G roaming scenarios, where the blurred network boundaries and complex propagation paths increase the overall network instability.

[0003] To address signaling anomalies, some existing technologies employ deep learning-based detection methods, such as using graph neural networks and long short-term memory networks to analyze core network signaling traffic, or deploying traffic scrubbing strategies in 5G networks. While these methods can identify localized signaling storms or interface attacks within a single operator, they face data isolation issues in cross-operator scenarios. Due to privacy regulations and commercial competition, operators cannot share raw signaling data, causing detection models to rely only on local information and making it difficult to capture cross-network propagation characteristics. Furthermore, centralized processing models may infringe on user privacy during data aggregation, limiting the feasibility of real-time collaborative responses.

[0004] Some existing solutions mitigate cross-network issues by adjusting local thresholds or introducing local collaborative mechanisms, such as setting signaling filtering rules at interconnection interfaces. However, these methods lack global data support and cannot dynamically adapt to changes in multi-carrier environments. When signaling storms spread across networks, local responses are often delayed and may misjudge normal service peaks due to incomplete information. Although some solutions introduce lightweight data exchange, the requirement that data does not leave the domain means that cross-network anomaly detection is still mainly reactive and difficult to prevent. Summary of the Invention

[0005] In view of the aforementioned existing problems, the present invention is proposed.

[0006] This invention provides a method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework. This addresses the problem that existing solutions, due to data isolation and privacy restrictions, cannot achieve real-time collaborative detection and protection of cross-operator signaling anomalies, leading to an exacerbation of cross-network propagation issues.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] This invention provides a method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework, comprising:

[0009] Step S1: Deploy data collection nodes at key core network elements and RAN-side network elements or their interfaces in each operator's network to collect signaling traffic characteristics that have been anonymized / de-identified.

[0010] Step S2: Each operator trains anomaly detection models locally based on features and generates local model updates;

[0011] Step S3: Securely aggregate the local model updates reported by each operator using a federated learning framework to obtain a global anomaly detection model.

[0012] Step S4: Use the global anomaly detection model to infer the cross-carrier signaling sequence and output anomaly score and category;

[0013] Step S5: Trigger collaborative protection based on the inference results, including distributing threat fingerprints across operators and issuing rate limiting / filtering policies on the interface side;

[0014] This step does not aggregate the original signaling data outside the domain throughout the entire process.

[0015] As a preferred embodiment of the mobile network signaling abnormal behavior identification and protection method under the federated learning framework described in this invention, the data acquisition node is deployed at least at AMF, SMF, UPF and gNB-CU / DU or their interconnection interface;

[0016] The features collected include at least: signaling message type, direction, interface identifier, timestamp, frequency and rate of change within the window, session / slice / PLMN identifier, and peer network identifier.

[0017] As a preferred embodiment of the mobile network signaling abnormal behavior identification and protection method under the federated learning framework described in this invention, the local anomaly detection model is a temporal neural network, which uses at least one of LSTM, GRU or temporal convolutional network to encode the signaling sequence organized by a sliding window and output the local anomaly score.

[0018] As a preferred embodiment of the mobile network signaling abnormal behavior identification and protection method under the federated learning framework described in this invention, the federated learning framework adopts federated averaging with security aggregation;

[0019] Each operator uploads the local model update obtained through gradient pruning. The aggregator performs a weighted average based on sample size and quality weights, and then distributes the updated global model after aggregation.

[0020] The weighting coefficients for the federal average are calculated as follows:

[0021] Each operator obtains the effective sample size after noise reduction and deduplication locally;

[0022] Locally, confidence scores are generated by combining validation returns and directional consistency, and differential privacy noise is added. These scores are then cropped to an interval for reporting. The following formula is used when calculating the local confidence score:

[0023] ,

[0024] in, Indicates the first Data quality confidence level of each operator This indicates the carrier index. This represents the weighting coefficients for the two quality signals. This represents the relative rate of decrease in validation loss. Indicates the first Fang in the round The loss of local verification Indicates the round index of the federated training. This indicates a small constant that avoids a denominator of zero. This represents the consistency score with the globally updated basis vectors. Indicates the first Local update vector after gradient clipping Indicates round Global update of basis vectors, This represents zero-mean Gaussian noise. This represents the noise intensity that satisfies the differential privacy budget. express of Sensitivity Indicates privacy budget, This indicates the lower confidence level. Indicates the upper and lower bound truncation operator. Represents cosine similarity. Represents the natural logarithm;

[0025] Unnormalized weights are formed by multiplicatively combining the effective sample size and confidence level, then normalized and smoothed to obtain the coefficients used for the federated average; the following formula is used when weighting:

[0026] ,

[0027] in, Indicates the first Unnormalized weights Indicates the first Effective sample size The exponential coefficient representing the sample size. Indicates the first Square quality confidence level The index coefficient representing the confidence level. This represents the normalized weights. This represents the summation index variable. This indicates the number of operators participating in the aggregation. This represents the final weighting coefficients after smoothing. Indicates the smoothness intensity.

[0028] As a preferred embodiment of the mobile network signaling abnormal behavior identification and protection method under the federated learning framework described in this invention, differential privacy processing is performed before local model update reporting, including:

[0029] Random noise is added to the cropped update to meet the preset (ε,δ) privacy budget, and privacy budget accounting management is performed.

[0030] As a preferred embodiment of the mobile network signaling anomaly behavior identification and protection method under the federated learning framework described in this invention, the global anomaly detection model integrates a graph attention network to model the topological relationship of cross-carrier signaling flows:

[0031] Construct a signaling flow graph with operators / interfaces / slices / UE groups as nodes and cross-network signaling interactions as edges. Calculate the importance weights of nodes / edges using the graph attention layer, and output anomaly scores after fusing them with the time-series coding results.

[0032] As a preferred embodiment of the mobile network signaling anomaly behavior identification and protection method under the federated learning framework described in this invention, wherein: an adaptive threshold is used to determine the global anomaly score:

[0033] Within the rolling time window, the threshold is updated based on the score distribution and the target false alarm rate / recall rate constraints, and the stability of cross-network anomaly identification is improved by combining the temporal consistency and correlation of scores among multiple operators.

[0034] The adaptive update method for the threshold is as follows:

[0035] Update the statistics on each operator's side by window number, and extract the outlier score quantiles, mean and standard deviation for the current window;

[0036] Calculate threshold candidates and apply false positive constraints:

[0037] ,

[0038] in, Indicates the first One operator at the window Threshold candidates, This indicates the carrier index. Indicates the sliding window index. This represents the combined weight of quantiles and mean-variance candidates. This indicates the score calculated based on the current window's rating sample. Quantiles This represents the average score for that window. This indicates the standard deviation of the rating for this window. This represents the quantile mapping coefficients corresponding to the mean-variance method. The gain coefficient representing the false alarm bias. This represents the empirical false alarm rate estimate from the previous window. Indicates the upper limit of the target false alarm rate. Represents the natural exponential function;

[0039] In the formula:

[0040] ,

[0041] in, This represents the smoothing coefficient for the false alarm rate estimate. Indicates in window The real-time false alarm rate obtained from post-event verification / business backtracking;

[0042] When performing threshold recursion and combining it with gating:

[0043] ,

[0044] in, Indicates the first One operator at the window The effective threshold, This indicates the threshold at which the previous window takes effect. This indicates the update step size for the index-weighted index. Represents a gated variable;

[0045] In the formula:

[0046] ,

[0047] in, Indicates an indicator function, Indicates a delayed half-width, Indicates the hysteresis coefficient. This indicates the window index where the threshold was actually updated last time. This indicates the number of cooling steps, used to limit excessively frequent updates;

[0048] When performing correlation correction to inject cross-network consistency:

[0049] ,

[0050] in, This represents the threshold after correlation correction. Indicates the correlation coefficient. Indicates the first Fang and the other participating parties at the window The consistency coefficient, where:

[0051] ,

[0052] in, Indicates the number of participating operators. Indicates and Different carrier indexes, This represents the Pearson correlation coefficient between the two score sequences within the window; the decision is based on the current score and... In comparison, high-consistency scenarios are triggered more sensitively, while low-consistency scenarios are suppressed more robustly.

[0053] As a preferred embodiment of the mobile network signaling abnormal behavior identification and protection method under the federated learning framework described in this invention, the collaborative protection includes generating and distributing encrypted threat fingerprints;

[0054] The threat fingerprint includes at least: anomaly type encoding, occurrence time, involved interface / slice / peer network identifier, hash characteristics of representative signaling subsequences, validity period and signature verification; distribution is completed through the consortium message bus or inter-carrier secure channel.

[0055] As a preferred embodiment of the mobile network signaling abnormal behavior identification and protection method under the federated learning framework described in this invention, each operator dynamically issues rate limiting / filtering / blacklist / whitelist policies at the interconnection interface and key network elements after receiving the threat fingerprint, and implements policy activation, rollback and canary release based on real-time business indicators and abnormal scores.

[0056] As a preferred embodiment of the mobile network signaling abnormal behavior identification and protection method under the federated learning framework described in this invention, wherein: federated training and model distribution are performed online according to a preset cycle or triggering conditions;

[0057] When cross-domain communication is restricted, each operator degenerates into local model inference and performs model alignment and drift detection after communication is restored.

[0058] The beneficial effects of this invention are as follows: This invention, through the mobile network signaling abnormal behavior identification and protection method under the federated learning framework, realizes collaborative detection and response of data without leaving the domain in a multi-operator environment, effectively overcoming the limitations of data silos and privacy leaks in existing technologies.

[0059] The federated learning framework of this invention allows operators to train anomaly detection models locally, sharing only model updates rather than raw signaling data. This ensures user privacy and compliance while enabling the fusion analysis of cross-network signaling features, improving the early identification capability of signaling storms spreading across networks. Combined with graph attention networks, the model can dynamically capture the topological relationships of cross-operator signaling flows. For example, by analyzing the interaction patterns between interfaces and slices through node importance weight analysis, it enhances the prediction accuracy of anomaly propagation paths and reduces missed detections due to insufficient local data. The adaptive threshold mechanism dynamically adjusts the judgment criteria based on the scoring distribution and false alarm constraints of a rolling time window. Through consistency correction of cross-operator scores, the threshold becomes more sensitive in highly correlated scenarios and more robust in isolated anomalies, thus balancing detection accuracy and stability and avoiding misjudgments of normal business peaks. The collaborative protection link achieves rapid information sharing and coordinated response across operators through the distribution of encrypted threat fingerprints and the issuance of interface policies. For example, it automatically limits or filters traffic when signaling anomalies are detected, shortening the delay from identification to protection.

[0060] This invention eliminates the need to aggregate raw data, reducing communication and storage overhead. Furthermore, through the periodic model updates and degradation mechanisms of federated learning, it ensures that local detection capabilities are maintained even when network communication is limited, thus improving the system's robustness and applicability. This enhances the overall resilience of mobile networks in complex multi-operator scenarios, providing a sustainable protection foundation for signaling security in 5G and future networks. Attached Figure Description

[0061] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation on the scope of this application.

[0062] Figure 1 This is a flowchart illustrating the mobile network signaling abnormal behavior identification and protection method under the federated learning framework in the embodiment. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0064] All terms used in this application (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0065] For example, the terms “first” and “second” used in this application are only used to distinguish and describe similar objects, to differentiate the first object from another object, and are not used to describe a specific order or sequence, nor should they be interpreted as indicating or implying relative importance.

[0066] This application proposes a method for identifying and protecting against abnormal mobile network signaling behavior within a federated learning framework, combining... Figure 1 As shown, the method includes:

[0067] Step S1: Deploy data collection nodes at key core network elements and RAN-side network elements or their interfaces in each operator's network to collect signaling traffic characteristics that have been anonymized / de-identified.

[0068] Step S2: Each operator trains anomaly detection models locally based on features and generates local model updates;

[0069] Step S3: Securely aggregate the local model updates reported by each operator using a federated learning framework to obtain a global anomaly detection model.

[0070] Step S4: Use the global anomaly detection model to reason about the cross-carrier signaling sequence and output the anomaly score and category;

[0071] Step S5: Trigger collaborative protection based on the inference results, including distributing threat fingerprints across operators and issuing rate limiting / filtering policies on the interface side;

[0072] This step does not aggregate the original signaling data outside the domain throughout the entire process;

[0073] In this embodiment, to avoid cross-domain leakage, anonymization / de-identification processing can be understood as using irreversible hashing or prefix aggregation to de-identify user and address identifiers at the collection end, and only outputting statistics or embedding vectors after feature extraction within the domain; by default, features are aggregated at the sampling end with a 1-second sampling period and a 60-second sliding window (10-second step). The window length can be adjusted within the range of 30-180 seconds according to the characteristics of service jitter, based on the common burst duration and scheduling cycle of core network signaling; the acquisition of cross-operator signaling sequences is based on the cross-network interface logs visible in this domain, and the sequence is formed by matching the timestamp with the peer network identifier, with time alignment allowing jitter of no more than 100 milliseconds; optionally, when there is a lack of high-precision time synchronization within the domain, an arrival order preservation strategy is used instead of strict alignment to maintain availability; when the sampling buffer overflows or some fields are missing, it is backfilled with the most recent valid value and null value mask, and the batch is marked as low confidence to avoid false triggering.

[0074] In one embodiment, the data acquisition node is deployed at least at the AMF, SMF, UPF, and gNB-CU / DU or their interconnection interface;

[0075] The features used include, but are not limited to: signaling message type, direction, interface identifier, timestamp, frequency and rate of change within the window, session / slice / PLMN identifier (de-sensitized), and peer network identifier. Specifically, the signaling message type and direction are obtained by mapping the message name parsed from the protocol stack to the send / receive direction. The interface identifier corresponds to the logical name or endpoint identifier of the interconnection port. The session and slice identifiers are de-sensitized context keys. The PLMN and peer network identifiers use irreversible hashing. By default, the frequency is counted within each window, and the rate of change is represented by the difference ratio between two adjacent windows. The stability threshold for the rate of change can be set to 5% to 7% to suppress statistical noise. The threshold is determined based on the steady-state fluctuation distribution of the offline playback set. For example, if there are fewer than 20 samples in a window, the window is only used for trend reference and does not participate in threshold learning. Optionally, in scenarios where the interface identifier is unstable or multiple links are aggregated, the data is first summarized by the peer network identifier and then subdivided to the interface layer to maintain consistent input. When the protocol field parsing fails, the entry is counted as an unknown type and represented by a separate embedding on the model side. Similarly, feature standardization is performed within the domain. Categorical fields use a fixed vocabulary and unknown placeholder encoding, while continuous fields employ robust scaling (based on quantiles rather than extreme values). The default vocabulary is updated weekly, and a vocabulary refresh is triggered when the proportion of unknown placeholders exceeds 10%, with an update cycle of no less than 24 hours. Optionally, message types are truncated in the offline phase, retaining only high-frequency types with a cumulative coverage of 95% to reduce model complexity. When peer network identifiers are missing, unidentified peer placeholders are used and their weights are reduced when participating in downstream scoring.

[0076] In one embodiment, the local anomaly detection model is a temporal neural network, employing at least one of LSTM, GRU, or temporal convolutional networks to encode signaling sequences organized in a sliding window and output local anomaly scores. In this embodiment, the sliding window length is 60 seconds by default, the window step size is 10 seconds, and the sequence length is 6 to 12 windows, determined based on typical network congestion growth and mitigation latency. The temporal network input includes standardized statistical features and mask labels, and the output is an anomaly score in the range of 0 to 1. Optionally, hard sample mining is used during the training phase to improve sensitivity to short-term spikes, but a fixed threshold is maintained during the inference phase to ensure federated consistency. When all fields within a window are missing, the window is skipped and the sequence is extended by one bit to maintain an effective length.

[0077] In one embodiment, the federated learning framework employs a federated average with secure aggregation or a variant thereof;

[0078] Each operator uploads its local model update obtained through gradient pruning. The aggregator performs a weighted average based on sample size and quality weights, and then distributes the updated global model after aggregation. Specifically, within a communication round of federated training, local training is completed in a fixed number of steps or a fixed time slice, with a default of no more than 5 minutes or 1000 steps per round, whichever comes first. The aggregation cycle is 15 minutes by default, but can be adjusted within the range of 5 to 30 minutes, depending on the cross-domain link bandwidth and latency tolerance. The validation gain in the quality weight comes from the validation slice reserved in the local domain, and the directional consistency comes from the cosine similarity between the local update and the global direction of the previous round. The tradeoff coefficient between the two is 0.5 by default, with a recommended range of 0.3 to 0.7. Optionally, when the number of participants is less than 3, the directional consistency term is temporarily not used, and only the validation gain constitutes the quality confidence. If a participant fails to report on time in this round, its weight from the previous round is used, and its update is considered as absent.

[0079] The weighting factor for the federal average is calculated as follows:

[0080] Each operator obtains the effective sample size after noise reduction and deduplication locally, which is used for subsequent weight calculation;

[0081] Locally, confidence scores are generated by combining validation returns and directional consistency, and differential privacy noise is added. These scores are then cropped to an interval for reporting. The following formula is used when calculating the local confidence score:

[0082] ,

[0083] in, Indicates the first Data quality confidence level of each operator This indicates the carrier index. This represents the weighting coefficients for the two quality signals. This represents the relative rate of decrease in validation loss. Indicates the first Fang in the round The loss of local verification Indicates the round index of the federated training. This indicates a small constant that avoids a denominator of zero. This represents the consistency score with the globally updated basis vectors. Indicates the first Local update vector after gradient clipping Indicates round Global update of basis vectors, This represents zero-mean Gaussian noise. This represents the noise intensity that satisfies the differential privacy budget. express of Sensitivity Indicates privacy budget, This indicates the lower confidence level. Indicates the upper and lower bound truncation operator. Represents cosine similarity. Represents the natural logarithm;

[0084] Unnormalized weights are formed by multiplicatively combining the effective sample size and confidence level, then normalized and smoothed to obtain the coefficients used for the federated average; the following formula is used when weighting:

[0085] ,

[0086] in, Indicates the first Unnormalized weights Indicates the first Effective sample size The exponential coefficient representing the sample size. Indicates the first Square quality confidence level The index coefficient representing the confidence level. This represents the normalized weights. This represents the summation index variable. This indicates the number of operators participating in the aggregation. This represents the final weighting coefficients after smoothing. The smoothing strength is indicated; for example, the sample size index and quality index are set to 1 by default, with a recommended range of 0.5 to 2; the smoothing strength is 0.1 by default, with a range of 0 to 0.3; the minimum weight of a participant is determined by both the smoothing strength and the number of participants, ensuring basic representativeness even in extremely heterogeneous scenarios; optionally, for short-term noise, the quality confidence is first smoothed by a single exponential method before participating in the weighting, with a smoothing coefficient of 0.1 to 0.3; when the reported effective sample size is zero or invalid after verification, the participant retains only the minimum share introduced by the smoothing strength in this round of weighting.

[0087] aggregator with The global update is obtained by weighted summation of local updates; normalization and smoothing make... and To avoid excessive concentration of weights causing oscillations, Controlling the relative sensitivity of scale and quality, taking a moderate value is beneficial for maintaining stability in heterogeneous scenarios, and consistency terms Suppress updates that deviate from the correct direction. For zero-mean noise, its variance can be obtained through... Settings, in conjunction with cropping and lower limit It can limit fluctuations;

[0088] Specifically, the above steps focus on quality confidence and multiplicative weighted normalization: the quality side uses the verification loss decrease and direction consistency to form a dual signal, and performs noise injection and pruning locally, which reflects the training benefits and reduces the impact of abnormal updates. The scale side uses the effective sample size to enter the exponential weighting, and forms an adjustable contribution curve with the quality index; normalization ensures that the weights sum to one, smoothly distributes the minimum share among the parties, and reduces the jitter caused by extreme concentration.

[0089] In one embodiment, differential privacy processing is performed before local model update reporting, including:

[0090] Random noise is added to the pruned updates to meet a preset privacy budget of (ε,δ), and privacy budget accounting is performed. Furthermore, the privacy budget for differential privacy is cumulatively controlled at the communication round level, with the default setting for the main parameters being medium intensity. The recommended range is configured within a lenient to strict range based on compliance requirements. Noise is added after pruning, and the pruning threshold is set according to the historical distribution quantile of the update vector, with a high quantile used by default to limit extreme updates. Optionally, a basic failure probability cap control can be introduced locally. When the cumulative budget approaches the cap, the number of local training steps is reduced or the aggregation period is extended to delay consumption. When the accountant state is missing, a conservative strategy is adopted to reject reporting and only local inference is performed.

[0091] In one embodiment, the global anomaly detection model integrates a graph attention network to model the topology of signaling flows across operators:

[0092] A signaling flow graph is constructed with operators / interfaces / slices / UE groups as nodes and cross-network signaling interactions as edges. The importance weights of nodes / edges are calculated using the graph attention layer, and the results are fused with the timing coding results to output an anomaly score. In this embodiment, the nodes of the topology model can be hierarchically abstracted according to operators, interfaces, slices, and terminal groups. A two-layer graph structure is adopted by default to balance computation and expression. The edge weights use the frequency or bandwidth proxy of cross-network interactions within the window, which are standardized and then participate in the graph attention calculation. The fusion method is to first obtain the topology attention score and the timing anomaly score independently, and then fuse them in the fully connected layer. The fusion weights are evenly distributed by default, and the range can be adjusted between 3:7 and 7:3. Optionally, when the size of the topology graph exceeds the preset upper limit, nodes are merged, and adjacent small-degree nodes are aggregated with the peer network identifier as the primary key. If a certain type of edge is completely missing within the window, it is occupied by a zero vector but no missing penalty is triggered.

[0093] In one embodiment, an adaptive threshold is used to determine the global anomaly score:

[0094] Within the rolling time window, the threshold is updated based on the score distribution and the target false alarm rate / recall rate constraints, and the stability of cross-network anomaly identification is improved by combining the temporal consistency and correlation of scores among multiple operators.

[0095] The adaptive update method for the threshold is as follows:

[0096] On each operator's side, the statistics are updated by window number, and the outlier score quantiles, mean and standard deviation of the current window are extracted and used as the statistical basis for threshold candidates.

[0097] Calculate threshold candidates and apply false positive constraints:

[0098] ,

[0099] in, Indicates the first One operator at the window Threshold candidates, This indicates the carrier index. Indicates the sliding window index. This represents the combined weight of quantiles and mean-variance candidates. This indicates the score calculated based on the current window's rating sample. Quantiles This represents the average score for that window. This indicates the standard deviation of the rating for this window. This represents the quantile mapping coefficients corresponding to the mean-variance method (which can be approximated by Gaussian values). (Matching standard normal quantiles) The gain coefficient representing the false alarm bias. This represents the empirical false alarm rate estimate from the previous window. Indicates the upper limit of the target false alarm rate. Represents the natural exponential function;

[0100] In the formula:

[0101] ,

[0102] in, This represents the smoothing coefficient for the false alarm rate estimate. Indicates in window The real-time false alarm rate obtained from post-event verification / business backtracking;

[0103] When performing threshold recursion and combining it with gating:

[0104] ,

[0105] in, Indicates the first One operator at the window The effective threshold, This indicates the threshold at which the previous window takes effect. This indicates the update step size for the index-weighted index. Represents a gated variable;

[0106] In the formula:

[0107] ,

[0108] in, Indicates an indicator function, Indicates a delayed half-width, Indicates the hysteresis coefficient. This indicates the window index where the threshold was actually updated last time. This indicates the number of cooling steps, used to limit excessively frequent updates;

[0109] When performing correlation correction to inject cross-network consistency:

[0110] ,

[0111] in, This represents the threshold after correlation correction. Indicates the correlation coefficient. Indicates the first Fang and the other participating parties at the window The consistency coefficient, where:

[0112] ,

[0113] in, Indicates the number of participating operators. Indicates and Different carrier indexes, This represents the Pearson correlation coefficient between the two score sequences within the window; the decision is based on the current score and... In comparison, high-consistency scenarios are triggered more sensitively, while low-consistency scenarios are suppressed more robustly. Specifically, the quantile and mean-variance mixed weights are set to 0.5 by default, with a recommended range of 0.3 to 0.7. The mean-variance mapping coefficient can be selected based on a normal approximation, corresponding to the standard quantile of the target false alarm upper limit, with commonly used values ​​corresponding to the upper tail of 5% or 1%. The false alarm bias gain is set to a moderate value by default to avoid drastic fluctuations, and the smoothing coefficient is used for single exponential smoothing of empirical false alarms, with a default value of 0.1 to 0.3. The update step size is set to 0.2 to 0.4 by default, and the gating hysteresis coefficient is set to 1.5 to 2.5 by default, with the corresponding hysteresis half-width linearly scaled according to the score fluctuation within the window. The cooling step size is set to 3 to 6 windows by default. The correlation influence coefficient is set to a small value by default and adjusted slowly. Optionally, correlation correction can be disabled in the early cold start phase and enabled after the number of participants reaches a stable level. When empirical false alarms cannot be estimated or the sample size is below the minimum threshold, the threshold update is paused and the previous valid value is maintained.

[0114] Specifically, this paper presents threshold candidates based on sliding window statistics, and performs exponential correction using the deviation term of the target false alarm rate, enabling the threshold to adaptively converge around a set upper limit. The recursion employs exponential weighting and gating, triggered by both hysteresis and cooling: updates are only allowed when the difference between the candidate and the current value reaches a certain magnitude and several windows have passed since the last update, thus suppressing frequent jitter during periods of slight distribution drift or data sparsity. Cross-carrier correlation is incorporated into the threshold as an external consistency signal. By averaging the positively correlated components and applying a gentle exponential scaling, the trigger sensitivity in cross-network synchronization anomaly scenarios is improved, while maintaining more robust judgment under isolated peaks lacking consistency. Overall flow... The process does not rely on the immediate completeness of labels and can use backtracking or corroboration mechanisms to make smooth estimates of false alarm rates. At the same time, all coefficients are bounded and updates are gated, which facilitates obtaining a smooth running trajectory and reducing strategy oscillations in heterogeneous load and time-varying distribution environments. Similarly, the backtracking and corroboration sources of false alarms can include signals such as subsequent work orders, alarm clearance feedback and business indicator rebounds, and are aligned by default with feedback within 24 hours at the latest. When the feedback delay exceeds the default time limit, the empirical false alarm estimate is replaced by the historical average and the weight is reduced to reduce the excessive impact of lag on the threshold. Optionally, the base value of the threshold is pre-adjusted and the update step is reduced during known peak periods such as holidays or promotional events to suppress false triggers caused by normal peaks.

[0115] In one embodiment, collaborative protection includes generating and distributing cryptographic threat fingerprints;

[0116] Threat fingerprints include at least: anomaly type encoding, occurrence time, involved interface / slice / peer network identifier, hash characteristics of representative signaling subsequences, validity period, and signature verification. Distribution is completed through the consortium message bus or inter-carrier secure channel. In this embodiment, the default lifespan of threat fingerprints is set to 10-30 minutes, and fingerprints exceeding the lifespan will no longer trigger policy changes. Field serialization uses compact encoding, and the size of a single fingerprint is controlled to be in the hundreds of bytes to adapt to cross-domain bandwidth. Fingerprint signing is completed within the domain and verified with the public key index carried in the message. Optionally, when cross-domain channels are congested, a priority-based downgrading sending strategy is adopted, prioritizing the distribution of high-risk types and recent fingerprints. If signature verification fails or the timestamp is ahead / behind by more than the allowable deviation, the fingerprint is discarded and recorded in the audit log.

[0117] In one embodiment, after receiving threat fingerprints, operators dynamically issue rate limiting / filtering / blacklist / whitelist policies at interconnection interfaces and key network elements, and implement policy activation, rollback, and canary release based on real-time business indicators and anomaly scores. Furthermore, the activation and rollback of rate limiting and filtering policies are granular, with a default canary release step size of 10%–20% of interface bearers, and a single-step observation period of no less than two windows. The condition for triggering rollback is a deterioration of key business indicators or anomaly scores falling below a threshold for several windows. Optionally, in multi-interface parallel scenarios, canary releases are implemented in batches according to interface importance and historical stability, with priority given to piloting on secondary interfaces. When policy execution feedback is missing, the minimum rate limiting policy prioritizing protection is activated for an observation period, after which the policy is extended or rolled back based on scores and indicators.

[0118] In one embodiment, federated training and model distribution are performed online according to a preset cycle or triggering conditions;

[0119] When cross-domain communication is restricted, each operator degenerates to local model inference and performs model alignment and drift detection after communication is restored. For example, model alignment uses the most recent global model as the baseline and performs a fast synchronization on the lagging local model. Drift detection is based on the distribution difference of the sliding window, using robust two-sample statistics by default and giving a binary conclusion of whether drift has occurred at the window level. When continuous drift is detected, the federated aggregation cycle is shortened and the local verification frequency is increased until the regression is stable. Optionally, in the early stage of cross-domain communication recovery, a transition round is run in a way that only sends data and does not report data to reduce jitter. When local domain resources are insufficient to complete alignment, inference service is given priority and training and reporting are postponed until resources are restored.

[0120] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0121] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of this application and form different embodiments. For example, all the embodiments above can be used in any combination. The information disclosed in this background section is intended only to enhance the understanding of the general background of this application and should not be construed as an admission or in any way implying that such information constitutes prior art known to those skilled in the art.

Claims

1. A method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework, characterized in that, include: Step S1: Deploy data collection nodes at key core network elements and RAN-side network elements or their interfaces in each operator's network to collect signaling traffic characteristics that have been anonymized / de-identified. Step S2: Each operator trains anomaly detection models locally based on features and generates local model updates; Step S3: Securely aggregate the local model updates reported by each operator using a federated learning framework to obtain a global anomaly detection model. Step S4: Use the global anomaly detection model to infer the cross-carrier signaling sequence and output anomaly score and category; Step S5: Trigger collaborative protection based on the inference results, including distributing threat fingerprints across operators and issuing rate limiting / filtering policies on the interface side; This step does not aggregate the original signaling data outside the domain throughout the entire process.

2. The method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework as described in claim 1, characterized in that, The data acquisition nodes are deployed at least at AMF, SMF, UPF, and gNB-CU / DU or their interconnection interfaces; The features collected include at least: signaling message type, direction, interface identifier, timestamp, frequency and rate of change within the window, session / slice / PLMN identifier, and peer network identifier.

3. The method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework as described in claim 1, characterized in that, The local anomaly detection model is a temporal neural network that uses at least one of LSTM, GRU, or temporal convolutional networks to encode signaling sequences organized in a sliding window and output local anomaly scores.

4. The method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework as described in claim 1, characterized in that, The federated learning framework employs federated averaging with secure aggregation; Each operator uploads the local model update obtained through gradient pruning. The aggregator performs a weighted average based on sample size and quality weights, and then distributes the updated global model after aggregation. The weighting coefficients for the federal average are calculated as follows: Each operator obtains the effective sample size after noise reduction and deduplication locally; Locally, confidence scores are generated by combining validation returns and directional consistency, and differential privacy noise is added. These scores are then cropped to an interval for reporting. The following formula is used when calculating the local confidence score: ， in, Indicates the first Data quality confidence level of each operator This indicates the carrier index. This represents the weighting coefficients for the two quality signals. This represents the relative rate of decrease in validation loss. Indicates the first Fang in the round The loss of local verification Indicates the round index of the federated training. This indicates a small constant that avoids a denominator of zero. This represents the consistency score with the globally updated basis vectors. Indicates the first Local update vector after gradient clipping Indicates round Global update of basis vectors, This represents zero-mean Gaussian noise. This represents the noise intensity that satisfies the differential privacy budget. express of Sensitivity Indicates privacy budget, This indicates the lower confidence level. Indicates the upper and lower bound truncation operator. Represents cosine similarity. Represents the natural logarithm; Unnormalized weights are formed by multiplicatively combining the effective sample size and confidence level, then normalized and smoothed to obtain the coefficients used for the federated average; the following formula is used when weighting: ， in, Indicates the first Unnormalized weights Indicates the first Effective sample size The exponential coefficient representing the sample size. Indicates the first Square quality confidence level The index coefficient representing the confidence level. This represents the normalized weights. This represents the summation index variable. This indicates the number of operators participating in the aggregation. This represents the final weighting coefficients after smoothing. Indicates the smoothness intensity.

5. The method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework as described in claim 4, characterized in that, Differential privacy processing is performed before local model updates are reported, including: Add random noise to the cropped update to meet the preset requirements. Implement a privacy budget and manage its accounting.

6. The method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework as described in claim 1, characterized in that, The global anomaly detection model integrates a graph attention network to model the topological relationships of cross-carrier signaling flows: Construct a signaling flow graph with operators / interfaces / slices / UE groups as nodes and cross-network signaling interactions as edges. Calculate the importance weights of nodes / edges using the graph attention layer, and output anomaly scores after fusing them with the time-series coding results.

7. The method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework as described in claim 1, characterized in that, An adaptive threshold is used for global anomaly scoring: Within the rolling time window, the threshold is updated based on the score distribution and the target false alarm rate / recall rate constraints, and the stability of cross-network anomaly identification is improved by combining the temporal consistency and correlation of scores among multiple operators. The adaptive update method for the threshold is as follows: Update the statistics on each operator's side by window number, and extract the outlier score quantiles, mean and standard deviation for the current window; Calculate threshold candidates and apply false positive constraints: ， in, Indicates the first One operator at the window Threshold candidates, This indicates the carrier index. Indicates the sliding window index. This represents the combined weight of quantiles and mean-variance candidates. This indicates the score calculated based on the current window's rating sample. Quantiles This represents the average score for that window. This indicates the standard deviation of the rating for this window. This represents the quantile mapping coefficients corresponding to the mean-variance method. The gain coefficient representing the false alarm bias. This represents the empirical false alarm rate estimate from the previous window. Indicates the upper limit of the target false alarm rate. Represents the natural exponential function; In the formula: ， in, This represents the smoothing coefficient for the false alarm rate estimate. Indicates in window The real-time false alarm rate obtained from post-event verification / business backtracking; When performing threshold recursion and combining it with gating: ， in, Indicates the first One operator at the window The effective threshold, This indicates the threshold at which the previous window takes effect. This indicates the update step size for the index-weighted index. Represents a gated variable; In the formula: ， in, Indicates an indicator function, Indicates a delayed half-width, Indicates the hysteresis coefficient. This indicates the window index where the threshold was actually updated last time. This indicates the number of cooling steps, used to limit excessively frequent updates; When performing correlation correction to inject cross-network consistency: ， in, This represents the threshold after correlation correction. Indicates the correlation coefficient. Indicates the first Fang and the other participating parties at the window The consistency coefficient, where: ， in, Indicates the number of participating operators. Indicates and Different carrier indexes, This represents the Pearson correlation coefficient between the two score sequences within the window; the decision is based on the current score and... In comparison, high-consistency scenarios are triggered more sensitively, while low-consistency scenarios are suppressed more robustly.

8. The method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework as described in claim 1, characterized in that, The collaborative protection includes generating and distributing cryptographic threat fingerprints; The threat fingerprint includes at least: anomaly type encoding, occurrence time, involved interface / slice / peer network identifier, hash characteristics of representative signaling subsequences, validity period and signature verification; distribution is completed through the consortium message bus or inter-carrier secure channel.

9. The method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework as described in claim 1, characterized in that, After receiving threat fingerprints, each operator dynamically issues rate limiting, filtering, blacklist / whitelist policies at interconnection interfaces and key network elements, and implements policy activation, rollback, and canary release based on real-time business indicators and anomaly scores.

10. The method for identifying and protecting abnormal mobile network signaling behavior under a federated learning framework as described in claim 1, characterized in that, Federated training and model distribution are conducted online according to preset cycles or trigger conditions. When cross-domain communication is restricted, each operator degenerates into local model inference and performs model alignment and drift detection after communication is restored.

Images