Intelligent terminal-oriented cellular network AI security detection method and system

Abstract

The invention relates to the technical field of network security, in particular to a cellular network AI security detection method and system for an intelligent terminal. According to the method, a controllable cellular network simulation environment is constructed through software defined radio and an open source protocol stack; capturing the multi-dimensional communication flow of the terminal in the environment; the flow data are input into machine learning, deep learning and a large language model in parallel for collaborative analysis, the machine learning model identifies a known abnormal mode, the deep learning model detects unknown threat deviation, and the large language model performs semantic association reasoning; and finally, fusing a multi-model analysis result to automatically generate a security risk assessment report. The system correspondingly comprises a network environment simulation module, a flow capture module, a multi-model analysis module and a report generation module. According to the method, the low cost and high flexibility of a detection environment are realized, the intelligent detection depth and precision of encrypted traffic and unknown threats are improved, and the security analysis automation efficiency is greatly improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for AI security detection in cellular networks for smart terminals. Background Technology

[0002] As mobile communication technology evolves from the voice era to a new stage of integration with the Internet of Things and artificial intelligence, smart terminals have transformed from basic communication tools into super intelligent nodes integrating ubiquitous connectivity, multi-dimensional perception, edge computing, and cloud collaboration. As a core technology for achieving wide-area coverage and highly reliable mobile connectivity, cellular mobile communication networks constitute the "main artery" of data transmission for smart terminals, and their security directly relates to user privacy, property security, and even the stable operation of critical information infrastructure. However, the generational evolution of cellular communication protocol stacks has brought about complex legacy security issues. The coexistence of old and new standards creates "security vulnerabilities," and the implementation discount of 5G enhanced security mechanisms on the terminal side means that smart terminals face severe security threats across multiple dimensions and the entire chain in cellular communication environments, including fake base station inducements, signaling hijacking, data transmission eavesdropping, and data leakage through covert channels.

[0003] To address these threats, traditional smart terminal security testing technologies primarily rely on dedicated hardware base station simulators to build testing environments and employ detection methods based on known vulnerability signature libraries and static rules. These methods have significant limitations: First, dedicated hardware simulators are extremely expensive to purchase and maintain, lack flexibility, and struggle to quickly adapt to different standards or reproduce complex dynamic attack scenarios, creating insurmountable technical and financial barriers. Second, traditional detection methods heavily rely on prior knowledge, lacking effective encrypted traffic analysis capabilities in the face of increasingly encrypted communication content, and are unable to penetrate encryption barriers to identify threats. Furthermore, they exhibit significant detection lag and blind spots for unknown threats such as zero-day exploits lacking known characteristics and new malicious software communications. In addition, traditional detection processes are often fragmented and isolated, with protocol consistency testing, penetration testing, and traffic analysis disconnected, making it difficult to simulate the combined effects of multiple attack methods in advanced persistent threats. Moreover, the analysis results heavily depend on manual judgment by security experts, resulting in low efficiency and difficulty in ensuring consistency. Therefore, the industry urgently needs a new smart terminal cellular communication security testing solution that can overcome these shortcomings, achieving low cost, high flexibility, intelligence, and the ability to address unknown threats.

[0004] Therefore, existing technologies still need further development. Summary of the Invention

[0005] The purpose of this invention is to overcome the above-mentioned technical deficiencies and provide a cellular network AI security detection method and system for smart terminals to solve the problems existing in the prior art.

[0006] To achieve the above-mentioned technical objectives, according to a first aspect of the present invention, the present invention provides a cellular network AI security detection method for smart terminals, comprising: S100 utilizes software-defined radio hardware and loads pre-defined protocol stack software to construct a controllable cellular mobile network simulation environment. S200. Capture multi-dimensional network traffic data generated by the smart terminal in the simulated environment; S300. The multi-dimensional network traffic data is input into preset machine learning models, deep learning models and large language models in parallel or serial for analysis and processing. S400: Integrate the analysis results output by the machine learning model, deep learning model, and large language model to generate a security risk assessment report of the smart terminal in the cellular network.

[0007] Specifically, the construction of a controllable cellular mobile network simulation environment includes: By configuring the parameters of the software-defined radio hardware and the protocol stack software, a cellular network of at least one standard from 2G to 5G is simulated, and a preset network attack scenario is injected into the simulated environment.

[0008] Specifically, the network attack scenarios include at least one of the following: fake base station induction, signaling message hijacking, and forced network standard downgrade.

[0009] Specifically, capturing multi-dimensional network traffic data generated by smart terminals in a simulated environment includes: The system captures the communication signaling plane data and user plane data of the intelligent terminal in the simulated environment; it extracts metadata features of encrypted traffic from the user plane data; wherein the metadata features include at least one of packet timing, packet size, and transport layer security protocol handshake parameters.

[0010] Specifically, the step of inputting multi-dimensional network traffic data into a preset machine learning model for analysis and processing includes: Based on the machine learning model, pattern recognition is performed on the metadata features extracted from network traffic to identify traffic patterns that match a preset abnormal behavior feature library. The abnormal behaviors include malware communication and abnormal application behavior.

[0011] Specifically, the step of inputting multi-dimensional network traffic data into a preset deep learning model for analysis and processing includes: Based on an unsupervised deep learning model, representation learning is performed on massive amounts of normal network traffic data to establish a baseline for normal traffic behavior. The feature vectors of the multi-dimensional network traffic data captured in real time are compared with the baseline for normal traffic behavior to detect abnormal traffic that deviates from the baseline, thereby indicating unknown threats.

[0012] Specifically, the step of inputting multi-dimensional network traffic data into a preset large-scale language model for processing includes: Unstructured network protocol logs and intermediate analysis results are input into the large-scale language model; the large-scale language model is then used to perform semantic parsing, contextual association, and logical reasoning analysis on the input logs and results.

[0013] Specifically, the integrated analysis results generate a security risk assessment report, including: The system receives and integrates the abnormal behavior identification results output by the machine learning model, the unknown threat detection results output by the deep learning model, and the semantic analysis results output by the large language model; according to the preset risk assessment rules, it determines the risk level of the integrated results and generates a structured report containing risk description, judgment basis, and handling suggestions.

[0014] Specifically, the method further includes: Using the large language model, and based on the content of the structured report, natural language description summaries are automatically generated for users at different levels of technical understanding.

[0015] According to a second aspect of the present invention, a cellular network AI security detection system for smart terminals is provided, comprising: The network environment simulation module is used to load protocol stack software using software-defined radio hardware to build a controllable cellular mobile network simulation environment. A traffic capture module is used to capture multi-dimensional network traffic data generated by smart terminals in the simulated environment. The multi-model analysis module includes a machine learning analysis unit, a deep learning analysis unit, and a large language model analysis unit, which are used to perform parallel or serial analysis and processing on the multi-dimensional network traffic data. The report generation module is used to integrate the output results of each unit in the multi-model analysis module to generate a security risk assessment report.

[0016] Beneficial effects: The AI ​​security detection method and system for cellular networks for smart terminals provided by this invention brings significant multi-dimensional benefits through the synergistic innovation of technical architecture and core algorithms.

[0017] The primary breakthrough lies in the creation of a low-cost, highly flexible, and proactively controllable testing environment. This invention abandons expensive dedicated hardware base station simulators, innovatively employing a combination of software-defined radio hardware and open-source protocol stack software to achieve software-based simulation of multi-standard cellular networks from 2G to 5G. This transformation not only reduces environment construction costs by orders of magnitude, enabling numerous small and medium-sized organizations to conduct in-depth security testing, but more importantly, it endows the environment with unparalleled flexibility and programmability. Network standards, parameters, and topologies can be quickly switched through software configuration, and preset attack scenarios such as fake base stations, signaling hijacking, and forced degradation can be proactively injected. This elevates security testing from passive observation to proactive, reproducible "range-style" stress testing, systematically stimulating and probing potential security vulnerabilities in terminals under various harsh and abnormal network conditions.

[0018] Secondly, this invention achieves a leap in the intelligence and depth of detection capabilities. By constructing a multi-model collaborative analysis engine that integrates machine learning, deep learning, and a large-scale language model, a three-dimensional perception and cognitive ability for security threats is formed. The machine learning model performs pattern recognition on encrypted traffic based on metadata features, efficiently and accurately discovering known threats; the unsupervised deep learning model establishes a dynamic baseline by self-learning from massive amounts of normal traffic, alerting to abnormal behaviors that deviate from the baseline, and possessing the forward-looking ability to detect unknown threats and zero-day attacks; the large-scale language model endows the system with "expert-level" analytical capabilities to understand unstructured protocol logs, perform contextual association, and logical reasoning, significantly improving the interpretability of detection results and the depth of decision support. This three-layer AI architecture of "pattern recognition + anomaly detection + cognitive understanding" effectively overcomes the bottleneck of traditional methods in detecting encrypted traffic and unknown threats.

[0019] Finally, this invention automates the detection process and significantly improves efficiency. From environmental simulation, traffic capture, and multi-model parallel analysis to risk fusion and report generation, the entire process forms a complete automated closed loop. In particular, by using quantitative rules to fuse and determine the results of multiple models, and by automatically generating structured security risk assessment reports and natural language summaries for different audiences using large-scale language models, security analysts are freed from the heavy workload of manual data correlation and report writing. This reduces the analysis time from "hours" or even "days" to "minutes," significantly improving detection efficiency and ensuring the consistency and operability of the analysis results, providing solid support for rapid emergency response. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the AI ​​security detection method for cellular networks for smart terminals provided in a specific embodiment of the present invention. Figure 2This is a schematic diagram of the system composition of a cellular network AI security detection system for smart terminals provided in a specific embodiment of the present invention. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Based on the embodiments in this application, other similar embodiments obtained by those skilled in the art without creative effort should all fall within the scope of protection of this application. Furthermore, directional terms mentioned in the following embodiments, such as "up," "down," "left," and "right," are only for reference to the directions in the accompanying drawings; therefore, the directional terms used are for illustrative purposes and not for limiting the invention.

[0022] The present invention will be further described below with reference to the accompanying drawings and preferred embodiments.

[0023] Please see Figure 1 This invention provides a cellular network AI security detection method for smart terminals, comprising: S100 utilizes software-defined radio hardware and loads pre-defined protocol stack software to construct a controllable cellular mobile network simulation environment. It should be further noted that the entire method is physically implemented on one or more servers running the Ubuntu 20.04 LTS operating system and connected to the necessary hardware via Ethernet and PCIe buses. This invention selects software-defined radio hardware supporting frequency bands from 70MHz to 6GHz, such as the Ettus USRPB210. This hardware is connected to the main control server via a USB 3.0 interface. The open-source 4G LTE protocol stack software srsRAN version 22.04 is installed and configured on the server. The srsRAN software suite comprises three main components: srsENB (base station), srsEPC (core network), and srsUE (user equipment simulator). In this embodiment, we run srsENB and srsEPC to build a complete, accessible LTE network. By editing the srsENB configuration file enb.conf, the specific configuration parameters are as follows: dl_earfcn=300 (corresponding to a downlink center frequency of 1840MHz), ul_earfcn=18300, n_prb=50 (corresponding to a 10MHz bandwidth), tm=1 (transmission mode 1), pci=1 (physical cell ID), tac=7 (tracking area code). This combination of parameters defines a cell with a specific frequency, bandwidth, and network identifier. When a smart terminal (i.e., the device under test, such as an Android smartphone) manually selects a network operator, it will be able to search for and identify this software-defined simulated cell and attempt to attach and register, thus operating entirely in a controlled laboratory wireless environment.

[0024] S200. Capture multi-dimensional network traffic data generated by the smart terminal in the simulated environment; It should be further explained that after the above-mentioned simulation environment is running and the smart terminal successfully connects, multi-dimensional network traffic data capture begins. This is achieved through two parallel data capture processes. The first process uses the built-in PCAP log function of srsRAN to capture and store all radio layer signaling messages (RRC messages) and NAS messages of the air interface, saving them as the air_interface.pcap file. The second process, on the main control server, uses the iptables tool of the Linux kernel to mirror all IP packets forwarded through the srs_spgw_sgi virtual network interface (which is the gateway interface between the srsRAN core network and external data networks, such as the Internet), and uses the tcpdump tool to capture them with the filename data_plane.pcap. In this way, we simultaneously obtain complete signaling plane data (air_interface.pcap) and user plane data (data_plane.pcap), forming the raw data foundation for multi-dimensional, cross-protocol layer data.

[0025] S300. The multi-dimensional network traffic data is input into preset machine learning models, deep learning models and large language models in parallel or serial for analysis and processing. It should be further explained that step S300 is a parallel processing flow. First, the data_plane.pcap file is preprocessed to extract metadata feature vectors. For each complete TCP or UDP stream (defined by a 5-tuple: source IP, destination IP, source port, destination port, and transport layer protocol), the direction (+1 for uplink, -1 for downlink) and size (in bytes) of its first 10 packets are extracted. If the number of packets in the stream is less than 10, it is padded with 0s to form a 20-dimensional initial vector. At the same time, the TLS Client Hello message of each stream is parsed (if it exists), and three key features are extracted: the length of the client-supported cipher suite list (cipher_suite_len), the length of the extension list (extensions_len), and the length of the server name indicator SNI field (sni_len). Finally, each stream is represented as a 23-dimensional feature vector F=[dir_1,size_1,dir_2,size_2,...,dir_10,size_10,cipher_suite_len,extensions_len,sni_len]. This eigenvector is then simultaneously fed into three analysis pipelines: ① The first pipeline is machine learning model analysis. We use a gradient boosting decision tree model pre-trained on the CICIDS2017 and USTC-TFC2016 public datasets. The model file ml_model.pkl is loaded into memory. The feature vector F is input into the model, and the model outputs a probability distribution containing multiple categories, for example, [Normal: 0.1, Botnet: 0.8, DDoS: 0.05, PortScan: 0.05]. We take the category with the highest probability and its confidence score as the output, for example (Abnormal Behavior: Botnet, Confidence: 0.80).

[0026] ② The second pipeline involves deep learning model analysis. We use a stacked denoising autoencoder model pre-trained with massive amounts of normal enterprise network traffic. The model file dl_model.h5 is also loaded. The feature vector F is input into the autoencoder, and its reconstruction error is calculated. The encoder part of the autoencoder compresses the 23-dimensional F into an 8-dimensional latent space representation, and the decoder part attempts to reconstruct the original 23-dimensional vector from this 8-dimensional representation. The reconstruction error RE is calculated using mean squared error. During the training phase, we calculated the reconstruction error for all samples on a validation set containing 1 million normal traffic samples and determined its 99.5th percentile error value to be threshold_99.5 = 0.15. During online detection, if the RE of the current flow > 0.15, it is judged as an unknown anomaly deviating from the normal baseline.

[0027] ③ The third pipeline is large-scale language model analysis. We convert the air_interface.pcap and data_plane.pcap files into human-readable text log files signaling.log and data_summary.log using the tshark tool. Simultaneously, the output of the first pipeline (Botnet, 0.80) is also formatted as text. We concatenate this text information into a coherent prompt and input it into a large, finely tuned language model (e.g., Qwen1.5-7B-Chat) deployed locally. The prompt template is: "You are a network security analysis expert. Please analyze the following network logs and initial alerts, and provide correlation analysis and inferences. Signaling Log: [Content of signaling.log]. Data Flow Summary: [Content of data_summary.log]. Initial Machine Detection Results: Possible Botnet activity detected, 80% confidence. Please provide your analysis:." LLM will output a natural language analysis, such as: "Analysis: No abnormal access was found in the signaling log. The data stream shows that the terminal established a large number of short-lived TLS connections with IP addresses in multiple different countries within a short period of time, and the SNI field exhibits a pseudo-random character pattern, which is consistent with the polling behavior of C2 servers in botnets. The preliminary machine detection results are highly reliable." S400: Integrate the analysis results output by the machine learning model, deep learning model and large language model to generate a security risk assessment report of the smart terminal in the cellular network; It should be further explained that the system receives outputs from three pipelines: ML output (Botnet, 0.80), DL output (abnormal: True, RE=0.22), and LLM output text analysis conclusions. We define a simple risk fusion rule: if the ML confidence score is greater than 0.7 and the DL determines it as anomalous, the overall risk level is set to "high risk"; if only the ML confidence score is greater than 0.7 or only the DL determines it as anomalous, it is set to "medium risk"; otherwise, it is set to "low risk". According to this rule, the risk level of the current case is "high risk". The report generation module then creates a structured JSON report, including timestamps, terminal identifiers, risk levels, detailed evidence (outputs of each model), and a summary description generated by LLM.

[0028] Understandably, this invention deeply integrates a precisely controllable environment simulated by SDR, multi-dimensional full-traffic capture, and the collaborative analysis of three AI technologies: ML, DL, and LLM. This constructs a comprehensive, automated security detection closed loop, encompassing the physical layer to the application layer, known patterns to unknown anomalies, and data recognition to semantic understanding. Compared to traditional solutions, it can reproduce complex attack scenarios at extremely low cost, effectively detect known threats and unknown anomalies in encrypted traffic, and significantly reduce reliance on manual analysis by security experts, thereby improving analysis efficiency and depth.

[0029] Specifically, the construction of a controllable cellular mobile network simulation environment includes: simulating at least one cellular network standard from 2G to 5G by configuring the parameters of the software-defined radio hardware and the protocol stack software, and injecting a preset network attack scenario into the simulation environment.

[0030] It should be further explained that this specific implementation provides detailed operations for multi-standard simulation and attack scenario injection. First, the parameter configuration of the software-defined radio hardware and protocol stack software is the core of environment construction. Different protocol stack software needs to be selected for different standards. For 2G (GSM) simulation, the open-source software Open BTS can be used in conjunction with USRP hardware. Key parameters in the configuration file include: GSM.Radio.C0 (setting ARFCN, e.g., 50, corresponding to the 935.2MHz downlink frequency), GSM.Identity.MCC (Mobile Country Code, e.g., 001), and GSM.Identity.MNC (Mobile Network Code, e.g., 01). For 5G NR simulation, the open5gs (core network) and UHD-driven gNB simulator can be used. Its configuration involves NR.CellID, NR.DL.ARFCN (e.g., 632768, corresponding to the 3.5GHz n78 band), and NR.Bandwidth (e.g., 100MHz). By deploying containerization technology (such as Docker) on the main control server, it is possible to quickly switch between running different protocol stack containers, achieving "one machine, multiple modes". Secondly, injecting preset network attack scenarios into the simulated environment is achieved by programmatically controlling the protocol stack software or modifying the content of its sent messages. Specific examples are as follows: Attack Scenario 1: Fake Base Station Induction. In the srsENB configuration, in addition to setting a legitimate MCC / MNC (such as 460-00, China Mobile), the code can be modified to broadcast information about a neighboring cell with artificially high signal strength in the system information block SIB1. Its cell Identity is set to a non-existent value, but q-RxLevMin (minimum received level) is set to an extremely low negative value (e.g., -130dBm), inducing the terminal to believe that the "virtual neighboring cell" signal is superior, thus attempting to initiate a handover. Although the handover will fail, this process can be used to test the terminal's behavior under abnormal cell reselection decisions. Attack Scenario 2: Signaling Message Hijacking. This requires modifying the rrc.cc source code of srsRAN. After processing the RRC Connection Request message from the terminal, instead of sending the standard RRC Connection Setup, we construct and send an RRC Connection Reject message with a wait time value of 10 seconds. This simulates a scenario where the network maliciously denies terminal access, and can be used to test whether the terminal's connection recovery mechanism has vulnerabilities or generates abnormal signaling storms. Attack Scenario 3: Forced Network Standard Downgrade.In an LTE network simulation environment, by modifying the generation function of `dl_dcch_msg_t` in `rrc.cc`, the `redirectedCarrier Info` field is included in the `RRC Connection Release` message sent to the terminal, instructing the terminal to redirect to the GSM ARFCN50. This forces multi-mode terminals to fall back from 4G to the 2G network. On this 2G connection, tools (such as AirProbe) can be used to attempt to decrypt its A5 / 1 encrypted calls to verify the terminal's vulnerability in low-security networks. All these attack scripts are pre-written and stored in the ` / opt / attack_scripts / ` directory, allowing for one-click injection and status monitoring through a central console (e.g., a Flask-based web management interface). Beneficial effects: Through software-defined parameter configuration, this method can quickly and flexibly construct various network environments from 2G to 5G, breaking through the dependence of traditional detection methods on physical base station equipment. The ability to inject into proactive attack scenarios transforms security testing from passive observation to proactive "stress testing" and "vulnerability detection." It can systematically and repeatably verify the security and robustness of terminals under various known and potential threat models, greatly improving the depth and proactivity of detection.

[0031] Specifically, the network attack scenarios include at least one of the following: fake base station induction, signaling message hijacking, and forced network standard downgrade.

[0032] It should be further noted that this specific implementation method provides a more in-depth explanation of the implementation details, parameters, and detection objectives for each scenario: ① Fake Base Station Induction: The core of this scenario is broadcasting a more attractive fake base station signal. In practice, on the server running srsENB, we not only configure the parameters of the local cell but also periodically insert a fake neighbor cell entry into SIB5 (used for LTE neighbor cell information) by modifying the sib_scheduler.cc code. The key parameters of this entry are set as follows: physCellId=2, q-OffsetCell=5dB (indicating that the neighbor cell has a 5dB signal quality offset gain), and q-RxLevMin=-140dBm (an extremely low access threshold). Simultaneously, we run another srsENB instance, but configure it not to respond to random access requests from terminals (i.e., a "dumb base station"). When the terminal measures and considers this fake neighbor cell (PCI=2) to be superior to the serving cell (PCI=1), it initiates a handover procedure to PCI=2. Since the target "base station" does not respond, the handover process fails and may trigger an abnormal recovery procedure for the terminal. This scenario is used to detect whether there are defects in the cell reselection algorithm of the terminal, and whether the signaling behavior after a handover failure will lead to abnormal power consumption or information leakage.

[0033] ② Signaling Message Hijacking: This scenario aims to interfere with or manipulate normal control plane signaling flows. A more complex implementation is a man-in-the-middle attack. We need two USRP hardware units: one acts as a "malicious base station" communicating with the terminal, and the other acts as a "malicious terminal" communicating with the real network or another simulated core network. A custom signaling forwarding and tampering procedure runs between the two. For example, when the terminal initiates an "Attach Request," the malicious base station can tamper with the encryption algorithm support section of the "UE Network Capability" field, such as removing all algorithms except EEA0 (empty encryption), before forwarding it to the network. If the network accepts this request, subsequent user plane data may be transmitted in plaintext, making it easier for the malicious base station to eavesdrop. This scenario is used to test whether the terminal will verify security configurations issued by the network that are inconsistent with its own capabilities, and is key to evaluating the robustness of the terminal's security protocol implementation.

[0034] ③ Forced Network Standard Downgrade: This scenario utilizes network-side commands to force the terminal to use an older, less secure standard. In a 4G LTE simulation environment, besides redirection via RRC Connection Release, a more covert method is to utilize the "CS Fallback" process. When a terminal initiates a voice call on an LTE network, the network can send an ExtendedService Request message, instructing the terminal to fall back to a 2G or 3G network for circuit-switched communication. We can simulate the network and actively send such a message to a VoLTE terminal under test, forcing it to fall back to 2G. On a 2G network, communication uses the publicly cracked A5 / 1 or A5 / 2 encryption algorithm. At this point, we can use the open-source tool Kalibrate-RTL to scan and lock the 2G control channel, capture air interface data using gr-gsm and Wireshark, and attempt to decrypt the call content in real time using tools like AirProbe. This scenario directly verifies whether the terminal will still conduct sensitive voice communication when facing a downgrade attack, and whether it has a security mechanism to prevent downgrade (such as only supporting 4G and above).

[0035] Understandably, these three scenarios target three key aspects—network selection, signaling interaction, and security negotiation—forming a comprehensive testing solution for the security of the smart terminal access layer and connection management layer. Their specificity and programmability make it possible to automate and batch-test a large number of terminals for consistent security, providing a powerful technical means for terminal network access security authentication.

[0036] Specifically, the step of inputting multi-dimensional network traffic data into a preset machine learning model for analysis and processing includes: based on the machine learning model, performing pattern recognition on the metadata features extracted from the network traffic to identify traffic patterns that match a preset abnormal behavior feature library, wherein the abnormal behavior includes malware communication and abnormal application behavior.

[0037] It should be further explained that this specific implementation method will elaborate on the entire process of model training, feature engineering, and online recognition. First, a "pre-defined abnormal behavior feature library" is constructed, i.e., a deployable machine learning model is trained. The specific scheme is as follows: Step S401, Data Collection and Labeling: We collected over 1 million network flow data points from public datasets (such as CSE-CIC-IDS2018) and traffic captured by internal honeypots. Each flow was identified by a 5-tuple. Security experts labeled each flow based on the destination IP reputation, payload content (after decryption), and contextual behavior. Label categories included: Normal, Botnet, DDoS (Distributed Denial-of-Service attack), Port Scan, and Data Exfiltration.

[0038] Step S402, Feature Engineering: For each stream, we extract a 50-dimensional feature vector. This includes: (1) Basic statistical characteristics: stream duration, total number of uplink / downlink packets, total number of uplink / downlink bytes, average uplink / downlink packet length, standard deviation of uplink / downlink packet length, and uplink / downlink byte entropy.

[0039] (2) Forward packet timing characteristics: the arrival time interval (IAT) of the first 10 data packets (filled with 0 if insufficient).

[0040] (3) TLS / SSL handshake features: length of the cipher suite list, length of the extension list, length of SNI, whether session tickets are supported, and whether the application layer protocol negotiation (ALPN) extension is included in the Client Hello.

[0041] (4) DNS characteristics: query domain name length, query type, number of returned IP addresses, and average returned TTL. The formula for calculating byte entropy is: in It is a byte value The frequency of occurrence of data in the payload of all packets in this stream. A high entropy value may indicate encrypted or compressed data.

[0042] Step S403, Model Training: We chose the Light GBM framework, an efficient gradient boosting decision tree implementation. 70% of the data (700,000 streams) was used as the training set, 15% as the validation set, and 15% as the test set. The model hyperparameters were optimized using grid search, and the final optimal values ​​were: num_leaves=31 (controlling tree complexity; too large leads to overfitting, too small leads to underfitting; 31 is a balance between efficiency and performance), max_depth=-1 (no depth limit, indirectly controlled by num_leaves), learning_rate=0.05 (a smaller learning rate combined with more iterations results in a smoother loss curve and better generalization), n_estimators=100 (100 iterations), subsample=0.8 (each tree uses 80% of the sample rows to prevent overfitting), colsample_bytree=0.8 (each tree uses 80% of the feature columns to increase diversity). Training was performed using a multiclass objective and a cross_entropy loss function. After achieving 95% accuracy on the validation set, the model was saved as lightgbm_model.txt.

[0043] Step S404, Online Identification: During online detection, the same 50-dimensional feature vector is extracted in real time for each newly captured stream. This vector is then input into the loaded Light GBM model. The model outputs a probability array for each category, for example, [0.02, 0.85, 0.10, 0.03], corresponding to [Normal, Botnet, DDoS, Port Scan], respectively. We set a confidence threshold of 0.7. The category with the highest probability is selected; if its probability value is greater than 0.7, it is considered an anomaly in that category; if the highest probability belongs to Normal or is less than 0.7, it is considered "unidentified anomaly" or "requires further review." Choosing 0.7 as the threshold is based on selecting a balance point that maintains high precision (>90%) while also achieving a reasonable recall (>80%) after plotting the precision-recall curve on the validation set. The advantage of this model is that it is based on metadata and does not rely on decryption. It can quickly (in milliseconds) identify known malicious traffic patterns with statistical significance, such as the regular heartbeats of botnets, the flood traffic of DDoS attacks, and the fan-shaped connections of port scans. It is the first efficient line of defense against known threats.

[0044] Specifically, capturing multi-dimensional network traffic data generated by a smart terminal in a simulated environment includes: capturing the communication signaling plane data and user plane data of the smart terminal in the simulated environment; extracting metadata features of encrypted traffic from the user plane data; wherein the metadata features include at least one of packet timing, packet size, and transport layer security protocol handshake parameters.

[0045] It should be further noted that this specific implementation provides a complete and operable data acquisition and feature extraction pipeline. The entire capture and extraction process is driven by a series of automated scripts (implemented in Python), specifically including: ① Step S501, Signaling Plane Data Capture: When starting srsENB, enable its built-in PCAP logging function via the command-line parameters --pcap.enable=true --pcap.filename=signaling.pcap. This function encapsulates air interface signaling messages (such as RRC Connection Setup, RRC Connection Reconfiguration, NAS Attach Request / Accept, etc.) into PCAP format and saves them at the MAC / RLC / PDCP layer. Simultaneously, we run a tcpdump process to capture the traffic between srsENB and srsEPC via the S1-AP protocol on the local loopback interface lo. The command is tcpdump -i lo -w s1ap.pcap port 36412. These two files together constitute the complete signaling plane data, covering the control plane interactions from radio access to the core network.

[0046] ② Step S502, User Plane Data Capture: The SGi interface of srsEPC is usually bound to a virtual network interface card named srs_spgw_sgi. We start traffic mirroring on this network interface card: sudotcpreplay-isrs_spgw_sgi-Tmillisec-wuser_plane.pcap. This command writes all IP packets passing through this network interface card, along with timestamps accurate to milliseconds, into the user_plane.pcap file in real time.

[0047] ③ Step S503, Metadata Feature Extraction: We developed a feature extractor, feature_extractor.py, whose process for processing user_plane.pcap is as follows: (1) Use the scapy library to read the pcap file and reassemble the data packets into streams based on the 5-tuples.

[0048] (2) For each TCP / UDP stream, calculate its duration T (seconds). If T < 1.0 seconds, we will perform in-depth feature extraction, because short streams are usually interactive or command and control traffic, which are more valuable for security analysis. For long streams (such as video streams), we may only record their basic statistical information.

[0049] (3) For flows that meet the criteria, extract the timing features of the data packets: record the arrival timestamps t_i of the first N=20 data packets (i from 1 to 20), and then calculate the adjacent packet interval iat_i=t_{i+1}-t_i (i from 1 to 19). We calculate the mean iat_mean, standard deviation iat_std, and coefficient of variation iat_cv=iat_std / iat_mean (if iat_mean is not 0) of these 19 IATs. The coefficient of variation can effectively reflect the stability of traffic bursts, and the heartbeat traffic of botnets usually has a very low iat_cv.

[0050] (4) Extract packet size features: Record the size s_i (in bytes) of the first 20 packets. Calculate its mean s_mean and standard deviation s_std, and calculate the ratio r = s_sum5 / s_sum10 of the cumulative sum of the sizes of the first 5 packets to the cumulative sum of the sizes of the first 10 packets. This ratio r can distinguish different types of connection establishment modes. For example, the first few packets of TLS handshake traffic are larger, resulting in a higher r.

[0051] (5) Extract TLS handshake parameters: Attempt to parse the first TCP payload in the stream with the direction of "client to server" and look for the TLS Client Hello record. If found, extract: cipher_suites_count (number of cipher suites, usually a multiple of 2, such as 32 for 16 suites), extensions_count (number of extensions), and sni_length (SNI hostname length in bytes). If the TLS Client Hello is not found, these feature values ​​are set to -1. 6. Finally, each stream is represented as a multidimensional feature vector V=[T,iat_mean,iat_std,iat_cv,s_mean,s_std,r,cipher_suites_count,extensions_count,sni_length]. This 10-dimensional vector is the input for subsequent machine learning and deep learning models. The selection of these specific features and thresholds such as N=20 and T<1.0 seconds is based on experience from analyzing a large amount of normal and malicious traffic, which can preserve the information used to distinguish different traffic patterns to the greatest extent while ensuring computational efficiency.

[0052] Understandably, this method accurately captures all signaling and user plane data and extracts highly discriminative time-series, statistical, and protocol metadata features from encrypted user plane data, providing high-quality, high-dimensional input for upper-layer AI models. This enables security analysis to penetrate encryption barriers and discern potential threats from traffic behavior patterns, providing the fundamental data guarantee for the entire system to achieve intelligent analysis.

[0053] Specifically, the step of inputting multi-dimensional network traffic data into a preset deep learning model for analysis and processing includes: performing representation learning on massive amounts of normal network traffic data based on an unsupervised deep learning model to establish a baseline for normal traffic behavior; comparing the feature vectors of the multi-dimensional network traffic data captured in real time with the baseline for normal traffic behavior to detect abnormal traffic that deviates from the baseline, thereby indicating unknown threats.

[0054] It should be further noted that this specific implementation will describe in detail the entire process of building, training, thresholding, and online detection of the unsupervised deep learning model. We choose an improved deep autoencoder model, whose structure includes an encoder and a decoder, with a bottleneck layer in the middle for representation learning. Specific methods include: ① Step S601, Model Design and Training Data Preparation: The model input is the feature vector V. First, the training data is preprocessed: a dataset containing at least 5 million pure normal network streams (collected over a long period in a controlled internal environment) is used. Each feature is Z-score standardized using the following formula: in It is the original value of the j-th dimension feature. and Let be the mean and standard deviation of the j-th feature in the training set, respectively. The standardized vector is denoted as . .

[0055] ② Step S602, Autoencoder Model Structure: Encoder Part: Input Layer (10 nodes), Fully Connected Layer (8 nodes, using ReLU activation function), Fully Connected Layer (4 nodes, using ReLU activation function). This 4-node layer is the bottleneck layer, which learns the compressed representation (latent encoding) of normal traffic features. Decoder Part: Fully Connected Layer (8 nodes, using ReLU activation function), Output Layer (10 nodes, using linear activation function). The goal of the model is to minimize the input... With output The reconstruction error between the two sides, i.e., the mean squared error loss function, is specifically formulated as follows: in, It refers to the batch size. It is the input vector of the i-th sample. It is the reconstructed output vector of the i-th sample. Let L2 norm be denoted. We use the Adam optimizer with a learning rate of 0.001 and a batch size of 256, training for 100 epochs on the training set. The model is implemented using the TensorFlow 2.x framework.

[0056] ③ Step S603, Baseline Establishment and Threshold Calculation: After training, we use the trained autoencoder to process each sample on an independent validation set (1 million streams) that also contains only normal traffic. Calculate its reconstruction error Record all samples. The values ​​form an error distribution. We choose the 99.5th percentile of this distribution as the anomaly detection threshold TH_anomaly. This means that in purely normal traffic, only 0.5% of the samples will be flagged due to their inherent slight fluctuations. This threshold will be exceeded. The calculated TH_anomaly value is 0.08. The choice of this threshold represents a trade-off between false positives and false negatives. A 99.5% quantile means we expect 0.5% false positives in normal traffic, which is an acceptable level in practice. If a lower false positive rate is desired, the quantile can be increased (e.g., to 99.9%), but this may result in missing some more subtle anomalies.

[0057] ④ Step S604, Online Anomaly Detection: During online detection, for each new flow's feature vector V_new, the feature vector saved during training is used... and By performing the same standardization, we obtain .Will Input the data into the loaded autoencoder model and calculate its reconstruction error. .if If the value is 0.08, the traffic is marked as "abnormal," potentially representing an unknown threat that deviates significantly from normal patterns. We can also calculate an anomaly score. , The larger the value, the further it deviates from the normal baseline, and the higher the likelihood of a threat. The power of this method lies in its unsupervised nature; it does not require any malicious samples for training. By learning the inherent distribution of massive amounts of normal traffic, it can effectively detect unprecedented new attacks or zero-day exploit traffic that does not conform to the distribution, greatly expanding the coverage of the detection system.

[0058] Specifically, the integrated analysis results generate a security risk assessment report, including: receiving and fusing the abnormal behavior identification results output by the machine learning model, the unknown threat detection results output by the deep learning model, and the semantic analysis results output by the large language model; determining the risk level of the fused results according to preset risk assessment rules, and generating a structured report containing risk descriptions, judgment criteria, and handling suggestions.

[0059] It should be further noted that this specific implementation will provide a concrete and quantifiable fusion rule and report generation template. A risk fusion engine is defined, whose input is the output of three models, and whose output is a structured JSON report. Specific methods include: ① Step S701, Input Standardization: Assume that within a certain detection period (e.g., the past 5 minutes), for the same target terminal (IP 192.168.5.100), the outputs of the three models are as follows: Machine Learning Model (ML) output: {"label":"Botnet","confidence":0.85,"flow_id":"flow_123"}. Deep Learning Model (DL) output: {"is_anomaly":true,"reconstruction_error":0.25,"anomaly_score":3.125,"flow_id":"flow_123"}, where anomaly_score = 0.25 / 0.08 = 3.125. Large Language Model (LLM) output: A natural language text summary: "Analysis shows that the terminal established TLS connections with multiple unknown IPs on port 443 within a short period of time, and the SNI field of the connections was mostly random strings. This behavior is highly similar to the pattern of botnet nodes searching for C2 servers. Corresponding signaling logs revealed that the terminal made several frequent cell reselection attempts during this period, possibly indicating that it was in a mobile state or was subject to signal interference."

[0060] ② Step S702, Evidence Fusion and Risk Level Determination: We define a risk score calculation function RiskScore=w1 S_ml+w2 S_dl+w3 S_llm. Where S_ml is the ML confidence score, directly taken as the confidence value (0.85). S_dl is the DL anomaly score, but it needs to be normalized. We define a Sigmoid function to map it to the [0,1] interval: in, It is anomaly_score (3.125). It is the steepness factor, set to 1.5. The calculation yields... S_llm is the quantitative score for LLM analysis. We process summary_text using a simple text sentiment / risk classifier (e.g., a small text classification model based on BERT), outputting a risk probability, or by keyword matching: if summary_text contains keywords such as "high risk," "serious," "botnet," or "C2," then S_llm is set to 0.9; if it contains keywords such as "suspicious" or "possible," it is set to 0.6; otherwise, it is 0.3. Assume S_llm = 0.9 here. The weights w1, w2, and w3 are set to 0.4, 0.4, and 0.2 respectively, reflecting a higher degree of trust in the results of the objective model (ML, DL).

[0061] Calculate RiskScore = 0.4 0.85 + 0.4 0.92 + 0.2 0.9 = 0.888.

[0062] We define risk level thresholds: A RiskScore of <0.3 indicates "low risk"; A score of 0.3 <= RiskScore < 0.7 indicates a "medium risk" risk. A RiskScore of 0.7 or higher indicates "high risk".

[0063] Therefore, this case is classified as "high risk".

[0064] ③ Step S703, Structured Report Generation: Generate the following JSON report: "{ "report_id":"RPT-20231027-001", "timestamp":"2023-10-27T14:30:25Z", "target":{"ip":"192.168.5.100","imei":"490154203237518"}, "risk_level":"HIGH", "risk_score": 0.888, "details":{ "ml_evidence":{"label":"Botnet","confidence":0.85}, "dl_evidence":{"is_anomaly":true,"reconstruction_error":0.25,"anomaly_score":3.125}, "llm_analysis_summary":"Analysis shows that the terminal established TLS connections with multiple unfamiliar IPs on port 443 within a short period of time..." "correlation_logic": "The ML model detected a botnet pattern with high confidence, while the DL model detected significant traffic anomalies, corroborating each other. The LLM analysis further supports the inference of botnet activity from a behavioral semantic perspective." }, "recommended_actions":[ 1. Immediately isolate the target terminal from the network. 2. Extract terminal memory and storage images for in-depth forensics. 3. Check if other terminals on the same network segment have similar communication patterns. ] } ".

[0065] Understandably, this fusion and report generation mechanism organically combines different types and levels of confidence of evidence in a quantitative way, and automatically determines the risk level and generates handling recommendations according to clear rules. This achieves the automated conversion from multi-source alarms to actionable security intelligence, greatly improving the response efficiency and decision consistency of the Security Operations Center (SOC).

[0066] Specifically, the step of inputting multi-dimensional network traffic data into a preset large-scale language model for processing includes: inputting unstructured network protocol logs and intermediate analysis results into the large-scale language model; and using the large-scale language model to perform semantic parsing, contextual association, and logical reasoning analysis on the input logs and results.

[0067] It should be further explained that this specific implementation will provide a detailed description of the construction of input data, the LLM prompting process, and the analysis process of its execution. The specific methods include: Step S801, Input Data Construction: First, the unstructured network protocol logs are cleaned and formatted. For example, the command `tshark -r signaling.pcap -Y "rrc" -T fields -e frame.time_epoch -errc.message` is used to extract RRC messages from the signaling pcap, add timestamps, and generate text lines. Similarly, from `data_plane.pcap`, key fields are extracted using `tshark -r data_plane.pcap -T fields -e frame.time_epoch -eip.src -e ip.dst -e tcp.srcport -e tcp.dstport -e tls.handshake.extensions_server_name`. Intermediate results from ML and DL are also formatted as text. Then, this information is organized into a structured prompt and input into the LLM.

[0068] Furthermore, for ease of understanding, this invention provides a specific example of a Prompt, as follows: "You are a senior cybersecurity analyst. Based on the following logs and alerts, please provide in-depth analysis and inferences. Please follow these steps in your thinking:" (1) Summarize the key events of the signaling plane and the user plane respectively.

[0069] (2) Find the correlation between different events in terms of time, IP address, port and other dimensions.

[0070] (3) Based on your cybersecurity knowledge, infer the possible security incidents and their severity.

[0071] [Signaling Log Begins]: 0.5s: The UE (IMSI:001010123456789) sends an RRCConnectionRequest.

[0072] 0.52s: eNB replies to RRCConnectionSetup.

[0073] 0.55s: The UE sends RRCConnectionSetupComplete, carrying AttachRequest.

[0074] 0.6s: MME issues AuthenticationRequest.

[0075] 0.65s: UE responds with AuthenticationResponse (success).

[0076] 1.2s: The UE initiates a ServiceRequest (periodic tracking area update).

[0077] 300.1s: The eNB issues an RRCConnectionRelease (reason: other) to release the RRC connection.

[0078] [End of signaling log]; [Data Stream Summary Begins]: Starting at 301.5s, UEIP (192.168.5.100) initiates TLS connections to the following targets within 5 seconds: Target 1: 185.234.216.34:443, SNI: xjfhe82d.com; Target 2:45.133.216.112:443, SNI:kd93jdhdw.org; Target 3: 176.103.130.130:443, SNI: p0e84nndd.net; (Each connection lasts approximately 2 seconds and closes after transmitting <1KB of data); [End of data stream summary]; [Machine Analysis Alert]: Machine learning engine: Detected a traffic pattern highly similar to "botnet heartbeats or C2 communication", with a confidence level of 87%; Deep learning engine: Detected significant traffic anomaly (anomaly score: 3.8), deviating from the normal communication baseline.

[0079] [Machine analysis alarm ended]; Please begin your analysis: Step S802, LLM Analysis Process: We input the above prompt into the Qwen1.5-7B-Chat model deployed on the local server (using the vLLM framework for inference acceleration). The model performs inference based on its vast pre-trained knowledge (including network protocols, security threats, etc.), and its internal inference process can be deconstructed as follows: 1. Semantic parsing: Understanding "RRCConnectionRelease(reason:other)" means that the network has actively released the connection; the "SNI" field is the domain name that the client wants to access during the TLS handshake.

[0080] 2. Contextual Relationship: Note that the signaling connection was released at 300.1 seconds, while the abnormal TLS connection started at 301.5 seconds. This suggests that the abnormal data activity started "immediately" after the signaling connection was released, possibly triggered by the terminal in an idle state or just entering an idle state. Note that the SNIs of the three TLS connections (xjfhe82d.com, kd93jdhdw.org, p0e84nndd.net) all exhibit pseudo-random character characteristics, a typical feature of Domain Name Generation Algorithms (DGAs).

[0081] 3. Logical Reasoning: Combining the "DGA domain name," "multiple rapidly established short-lived TLS connections," and "high-confidence machine engine alerts," the model can infer that: "This endpoint is likely infected with botnet malware that uses DGA technology to resolve C2 server addresses. Shortly after the RRC connection was released, the malware began attempting to contact its C2 server. This is a high-risk insider threat that could lead to data breaches or acceptance of further attack instructions." The model will generate a natural language analysis paragraph containing this inference.

[0082] Step S803, Output and Formatting: The LLM output is captured and passed to the report generation module as the llm_analysis_summary field. This process endows the entire system with "security expert" level semantic understanding, contextualization, and threat attribution capabilities, enabling the extraction of coherent, threat intelligence-valued narrative analyses from discrete, technical logs and alerts. This is key to improving the system's interpretability and decision support capabilities.

[0083] Specifically, the method further includes: using the large language model to automatically generate natural language description summaries for users at different levels of technical understanding, based on the content of the structured report.

[0084] It should be further explained that this specific implementation details how to use LLM to generate customized summaries for the same structured report, and the specific methods include: ① Step S901, Report Summary Generation: After generating the structured JSON report `report_json`, the system uses it as input to call LLM to generate different versions of the summary. This is achieved by designing different "system prompts". The system maintains a mapping table of "user roles - prompt templates", as shown in the example below: (1) Version A: For senior security analysts. The system prompt is: "You are an experienced security incident response engineer. Please generate a highly concise technical summary based on the following structured security incident report. Focus on: 1. Attack chain reconstruction (if any).

[0085] 2. The technologies, tactics, and procedures used.

[0086] 3. Solid evidence and confidence level.

[0087] 4. The most urgent response steps. Avoid any background information or embellishing language. "LLM input is report_json, and the output might be:" Event Summary: A high confidence level (fusion score 0.89) indicates that an internal host has been suspected of being infected with a botnet.

[0088] TTP: After the RRC connection is released, the terminal immediately attempts to establish short-term TLS connections with multiple overseas IPs using the domain name generated by DGA (suspected C2 heartbeat).

[0089] Evidence: The ML model identified the Botnet pattern (0.87); the DL model detected a significant anomaly (score 3.8); the traffic pattern conformed to the DGA characteristics.

[0090] Recommendation: Immediately isolate the host (192.168.5.100), perform memory forensics, and scan for hosts on the same network segment. (2) Version B: For IT managers or non-technical management. The system prompt is: "You are reporting a security incident to company management. Please explain the following security report in plain language, without technical jargon. Key points: 1. What happened (in terms of business impact).

[0091] 2. What are the possible consequences (such as data breaches or service interruptions)?

[0092] 3. What decisions do we need to make now (e.g., whether to notify customers, whether to activate emergency response)?

[0093] 4. What is the risk level? When LLM inputs report_json, the output might be: "Management Briefing: We have discovered that one of our employees' mobile phones may have been compromised by malware. This software is attempting to secretly contact an external server."

[0094] Risk: High risk. This could result in the theft of internal company data or the phone being used to attack the company network.

[0095] Current situation: The system has automatically blocked and issued an alert; the phone has been temporarily disconnected from the network.

[0096] Recommended Action: Approve the security team to immediately conduct a thorough inspection of the phone and notify the department head. Determine whether a higher-level incident response is needed based on the inspection results. ② Step S902, Distribution and Presentation: The generated summary is stored in association with the complete structured report. On the Security Operations Center (SOC) dashboard, senior analysts can see the "Technical Summary" version and quickly click to view the full report and original evidence. Simultaneously, the system can automatically send the "Management Briefing" version to relevant business or management personnel via email or instant messaging, along with a link to a security portal for more detailed information. This feature ensures that technical analysis results reach different stakeholders in the most appropriate form, guaranteeing technical rigor while significantly improving the efficiency and effectiveness of cross-departmental communication. It is a significant manifestation of the automation and intelligence level of security operations.

[0097] Please see Figure 2 The present invention provides another embodiment, which provides a cellular network AI security detection system for smart terminals. The cellular network AI security detection system for smart terminals includes: The network environment simulation module 100 is used to load protocol stack software using software-defined radio hardware to build a controllable cellular mobile network simulation environment. Traffic capture module 200 is used to capture multi-dimensional network traffic data generated by smart terminals in the simulated environment; The multi-model analysis module 300 includes a machine learning analysis unit, a deep learning analysis unit, and a large language model analysis unit, which are used to perform parallel or serial analysis and processing on the multi-dimensional network traffic data. The report generation module 400 is used to integrate the output results of each unit in the multi-model analysis module to generate a security risk assessment report.

[0098] It should be further noted that this specific implementation will describe in detail the hardware composition, software architecture, inter-module interfaces, and data flow of the system, enabling those skilled in the art to clearly and accurately construct the system. The system adopts a distributed microservice architecture, deployed across multiple servers, and connected via a network and message queues. Hardware composition: 1. SDR Simulation Server: A high-performance industrial control computer equipped with an Intel Core i7-12700K processor, 32GB DDR4 memory, and a 1TB NVMe SSD. It connects to an Ettus USRPB210 software-defined radio via a USB 3.0 interface for RF signal transmission and reception. The server is equipped with a high-gain omnidirectional antenna covering the laboratory frequency band.

[0099] 2. Data Analysis Server: One server equipped with dual AMD EPYC7B12 processors, 256GB DDR4 memory, and two NVIDIA RTX 4090 GPUs. Primarily responsible for AI model loading and inference calculations.

[0100] 3. Storage and Management Server: A server equipped with a large-capacity hard disk array (4x8TBHDD in RAID10) for storing raw traffic data, model files, configurations and reports.

[0101] 4. Network switch: One gigabit Ethernet switch to connect all servers and management terminals used for monitoring.

[0102] Furthermore, the network environment simulation module 100 runs as a Docker container on the SDR simulation server. The core containers include: the srsran-enb container (running the eNodeB component of srsRAN) and the srsran-epc container (running the core network component). A RESTful API is provided through an Orchestrator web service (port 5000) written in Python Flask, receiving external commands (such as POST / api / network / start, carrying the parameters {"dl_earfcn":300, "n_prb":50, "attack_scenario":"fake_bs"}) to dynamically start and stop the network, configure parameters, and inject attack scripts.

[0103] Furthermore, the traffic capture module 200 consists of two sub-modules. The Signaling Capture Daemon is a background process running on the SDR simulation server, responsible for starting and managing the PCAP logging function of srsran-enb, and transmitting the generated signaling.pcap file to the / data / signaling / directory of the storage server in real time. The Data PlaneSniffer is an independent process running on the data analysis server, using the DPDK library to perform zero-copy packet capture on the srs_spgw_sgi virtual interface. After timestamping and identifying each packet, it publishes it to the raw_packets topic of the Kafka message queue, while simultaneously storing the raw pcap file in / data / user_plane / .

[0104] Furthermore, the multi-model analysis module 300 is deployed on the data analysis server, divided into three independent microservices. ML-Analysis-Service: Implemented in Python, it loads lightgbm_model.txt. It subscribes to the Kafka flow_features topic (results published by the feature extractor), predicts each flow feature vector, and publishes the results {"flow_id":"xx","label":"yy","confidence":zz} to the ml_results topic. DL-Anomaly-Service: Deploys autoencoder models using TensorFlow Serving. It also subscribes to the flow_features topic, calculates reconstruction error and anomaly scores, and publishes the results {"flow_id":"xx","is_anomaly":true / false,"anomaly_score":aa} to the dl_results topic. LLM-Analysis-Service: Implemented using the Fast API, it internally integrates a vLLM inference engine to load the Qwen1.5-7B-Chat model. It listens on a REST endpoint, / analyze, and when called by the report generation module (400), receives aggregated logs and alert texts and returns an analysis summary. These three services work in parallel, decoupled through a shared message queue, enabling high-throughput processing.

[0105] Furthermore, the report generation module 400 is a centralized service, Report-Generator, written in Go. It subscribes to the ml_results and dl_results topics and reads relevant raw logs from the storage server. It implements an event correlation engine to correlate detection results from different models targeting the same terminal within the same time period (e.g., a 5-minute window). Upon successful correlation, it calls its internal risk scoring logic to generate a preliminary risk record. Then, it calls the / analyze interface of LLM-Analysis-Service to obtain a semantic analysis summary. Finally, it integrates all information, generates a structured JSON report, stores it in a MongoDB database, and simultaneously publishes a concise alert message to the Kafka alerts topic for consumption and display on the SOC dashboard. All modules are orchestrated and managed via Docker Compose or Kubernetes, with configuration information stored in a unified Consul configuration center. This system has a clear architecture, with modules communicating through standard interfaces (RESTAPI, Kafka), exhibiting high cohesion, low coupling, and scalability. It can stably and efficiently implement all the methodologies described in this invention, forming a complete and automated intelligent terminal cellular network security detection platform.

[0106] In a preferred embodiment, this application also provides an electronic device, the electronic device comprising: The computer device includes a memory and a processor, wherein the memory stores computer-readable instructions that, when executed by the processor, implement the described cellular network AI security detection method for smart terminals. The computer device can be broadly categorized as a server, terminal, or any other electronic device with the necessary computing and / or processing capabilities. In one embodiment, the computer device may include a processor, memory, network interface, communication interface, etc., connected via a system bus. The processor of the computer device can be used to provide the necessary computing, processing, and / or control capabilities. The memory of the computer device may include a non-volatile storage medium and internal memory. The non-volatile storage medium may store an operating system, computer programs, etc. The internal memory can provide an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface and communication interface of the computer device can be used to connect and communicate with external devices via a network. When the computer program is executed by the processor, it performs the steps of the method of the present invention.

[0107] The technical features described above can be combined arbitrarily. Although not all possible combinations of these technical features are described, any combination of these technical features should be considered to be covered by this specification, provided that such combination does not contain contradictions.

[0108] The specific embodiments of the present invention described above do not constitute a limitation on the scope of protection of the present invention. Any other corresponding changes and modifications made in accordance with the technical concept of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for AI security detection in cellular networks for smart terminals, characterized in that, include: S100 utilizes software-defined radio hardware and loads pre-defined protocol stack software to construct a controllable cellular mobile network simulation environment. S200. Capture multi-dimensional network traffic data generated by the smart terminal in the simulated environment; S300. The multi-dimensional network traffic data is input into preset machine learning models, deep learning models and large language models in parallel or serial for analysis and processing. S400: Integrate the analysis results output by the machine learning model, deep learning model, and large language model to generate a security risk assessment report of the smart terminal in the cellular network.

2. The method according to claim 1, characterized in that, The construction of a controllable cellular mobile network simulation environment includes: By configuring the parameters of the software-defined radio hardware and the protocol stack software, a cellular network of at least one standard from 2G to 5G is simulated, and a preset network attack scenario is injected into the simulated environment.

3. The method according to claim 2, characterized in that, The network attack scenarios include at least one of the following: fake base station induction, signaling message hijacking, and forced network standard downgrade.

4. The method according to claim 1, characterized in that, The method of capturing multi-dimensional network traffic data generated by smart terminals in a simulated environment includes: The system captures the communication signaling plane data and user plane data of the smart terminal in the simulated environment; it extracts metadata features of encrypted traffic from the user plane data; wherein the metadata features include at least one of packet timing, packet size, and transport layer security protocol handshake parameters.

5. The method according to claim 1, 2, 3 or 5, characterized in that, The step of inputting multi-dimensional network traffic data into a preset machine learning model for analysis and processing includes: Based on the machine learning model, pattern recognition is performed on the metadata features extracted from network traffic to identify traffic patterns that match a preset abnormal behavior feature library. The abnormal behaviors include malware communication and abnormal application behavior.

6. The method according to claim 1, 2, 3 or 5, characterized in that, The step of inputting multi-dimensional network traffic data into a preset deep learning model for analysis and processing includes: Based on an unsupervised deep learning model, representation learning is performed on massive amounts of normal network traffic data to establish a baseline for normal traffic behavior. The feature vectors of the multi-dimensional network traffic data captured in real time are compared with the baseline for normal traffic behavior to detect abnormal traffic that deviates from the baseline, thereby indicating unknown threats.

7. The method according to claim 1, 2, 3 or 5, characterized in that, The process of inputting multi-dimensional network traffic data into a preset large-scale language model for processing includes: Unstructured network protocol logs and intermediate analysis results are input into the large-scale language model; the large-scale language model is then used to perform semantic parsing, contextual association, and logical reasoning analysis on the input logs and results.

8. The method according to claim 8, characterized in that, The integrated analysis results generate a security risk assessment report, including: The system receives and integrates the abnormal behavior identification results output by the machine learning model, the unknown threat detection results output by the deep learning model, and the semantic analysis results output by the large language model; according to the preset risk assessment rules, it determines the risk level of the integrated results and generates a structured report containing risk description, judgment basis, and handling suggestions.

9. The method according to claim 7, characterized in that, The method further includes: Using the large language model, and based on the content of the structured report, natural language description summaries are automatically generated for users at different levels of technical understanding.

10. A cellular network AI security detection system for smart terminals, used to implement the method according to any one of claims 1 to 9, characterized in that, include: The network environment simulation module is used to load protocol stack software using software-defined radio hardware to build a controllable cellular mobile network simulation environment. A traffic capture module is used to capture multi-dimensional network traffic data generated by smart terminals in the simulated environment. The multi-model analysis module includes a machine learning analysis unit, a deep learning analysis unit, and a large language model analysis unit, which are used to perform parallel or serial analysis and processing on the multi-dimensional network traffic data. The report generation module is used to integrate the output results of each unit in the multi-model analysis module to generate a security risk assessment report.

Images