5G low-altitude slice network abnormal behavior detection and dynamic response method and device

Abstract

The invention relates to a 5G low-altitude slice network abnormal behavior detection and dynamic response method and device. The method comprises the following steps: acquiring multi-dimensional network data in a 5G core network and a base station; performing feature engineering processing of fusing a slice state on the multi-dimensional network data to extract a slice security state feature; a dynamic slicing behavior baseline model based on a hybrid machine learning model is constructed, and slicing security state features are learned to pre-judge whether the slicing behavior at the next moment is abnormal or not and identify the abnormal type; and carrying out abnormity alarm based on the service priority, and carrying out slice dynamic response based on security perception. According to the method, the abnormality is pre-judged and the abnormality type is identified by establishing the dynamic slice behavior baseline model, so that the detection accuracy of the low-altitude dynamic service abnormal behavior is greatly improved; and through linkage with slice management and dynamic routing, automatic responses such as slice-level accurate isolation, limitation and shrinkage, rerouting and the like to threats are realized.

Description

Technical Field

[0001] This invention relates to the fields of wireless communication, network security and machine learning, and specifically to a method and apparatus for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks. Background Technology

[0002] With the application of 5G slicing private networks in the low-altitude communication field, the network can provide customized QoS (Quality of Service) guarantees for services such as drones and the Internet of Things. However, the high mobility and relatively weak security protection capabilities of low-altitude equipment (UE) make it vulnerable to becoming a springboard for network attacks.

[0003] Existing network security detection methods typically operate at the network edge, lacking awareness of "sliced" services within the 5G core network. They cannot distinguish between normal high bandwidth (such as video backhaul) within one slice and abnormal high bandwidth (such as DDoS attacks) in another slice. Furthermore, while 5G slicing technology achieves resource isolation, if devices within a slice are hijacked, they may still abuse the resources allocated to that slice or attempt cross-slice penetration attacks, leading to a degradation of the QoS of legitimate services.

[0004] Therefore, there is an urgent need for a security mechanism that can sense the status of 5G slices, identify abnormal behavior of low-altitude dynamic services, and respond quickly in conjunction with network functions. Summary of the Invention

[0005] This invention provides a method and apparatus for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks, in order to solve at least one of the above-mentioned technical problems.

[0006] The technical solution of this invention to solve the above-mentioned technical problems is as follows: A method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks, comprising: S1 collects multi-dimensional network data related to slicing and low-altitude services in the 5G core network and base stations; S2, perform feature engineering processing on the multidimensional network data to fuse slice state features, so as to extract slice security state features; S3, construct a dynamic slice behavior baseline model based on a hybrid machine learning model, and use the dynamic slice behavior baseline model to learn the slice security status characteristics in order to predict whether the slice behavior is abnormal in the next moment and identify the abnormality type. S4, when an anomaly is detected, an anomaly alarm is issued based on business priority, and a security-aware slice dynamic response is performed.

[0007] Based on the above technical solution, the present invention can be further improved as follows.

[0008] Furthermore, in S1, the multidimensional network data includes slice identification data, QoS traffic data, mobility management data, and slice configuration data.

[0009] Furthermore, in S2, the slice security status characteristics include intra-slice behavior characteristics, inter-slice behavior characteristics, QoS deviation characteristics, and UE mobility characteristics; The slice-based behavioral features include a traffic profile characterizing the total bandwidth, protocol distribution, and packet size distribution within the slice, as well as a connection profile characterizing the rate of new connection establishment, the number of concurrent connections, and the average connection duration. The inter-slice behavioral characteristics include isolation features used to detect unauthorized access attempts between slices.

[0010] Furthermore, S3 specifically refers to: Construct a baseline model for dynamic slicing behavior based on a hybrid machine learning model; The dynamic slice behavior baseline model is used to learn the temporal and spatial characteristics of the slice security status features; Based on the temporal and spatial characteristics, predict whether the slicing behavior at the next moment is abnormal and identify the type of abnormality.

[0011] Furthermore, the hybrid machine learning model includes a recurrent neural network model and a convolutional neural network model; The dynamic slice behavior baseline model is used to learn the temporal and spatial features of the slice security state characteristics, specifically including: The slice security status features are input into the recurrent neural network model to learn the normal traffic patterns and QoS deviation fluctuation range of the slice at different times, and output the time features. The security status features of the slice are input into the convolutional neural network model to analyze the packet payload or traffic matrix of the slice and identify the fingerprint of the attack pattern, and output the spatial features.

[0012] Furthermore, based on the temporal and spatial features, it is determined whether the slicing behavior at the next moment is abnormal and the type of abnormality is identified, specifically including: The recurrent neural network model is used to analyze the time features to predict the slicing behavior at the next moment, and the prediction result is obtained. The prediction result is compared with the actual observation result. When the difference between the prediction result and the actual observation result exceeds a preset dynamic threshold, the slicing behavior is determined to be abnormal. The convolutional neural network model combined with the spatial features is used to perform in-depth analysis of abnormal slicing behavior in order to identify the anomaly type.

[0013] Furthermore, in S4, the security-aware slice dynamic response includes a dynamic routing linkage response, which specifically includes: When a DDoS attack is detected by a low-altitude device, the dynamic resource allocation module is notified to adjust the routing weight of the low-altitude device or its path in the current slice to "infinite" or "high cost" to recalculate the path and achieve route-level isolation.

[0014] Furthermore, in S4, the security-aware slice dynamic response includes a slice resource management linkage response, which specifically includes: When abnormal slice traffic is detected, the slice resource management module is notified to perform dynamic resource limiting on the slice.

[0015] Furthermore, in S4, the security-aware slice dynamic response includes a dynamic access control response, which specifically includes: When a low-altitude device is detected performing inter-slice scanning, the Access and Mobility Management module is notified to force the low-altitude device to re-authenticate or temporarily isolate it in a restricted network.

[0016] Based on the above-mentioned method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks, this invention also provides a device for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks.

[0017] A device for detecting and dynamically responding to abnormal behavior in a 5G low-altitude slicing network includes a processor, a memory, and a computer program stored in the memory. When the computer program is executed by the processor, it implements the 5G low-altitude slicing network abnormal behavior detection and dynamic response method as described above.

[0018] The beneficial effects of this invention are as follows: In the 5G low-altitude slice network abnormal behavior detection and dynamic response method and apparatus of this invention, by establishing a dynamic slice behavior baseline model to predict anomalies and identify anomaly types, the detection accuracy of low-altitude dynamic service abnormal behavior is greatly improved, the false alarm rate is reduced, and the defect of traditional security systems not being aware of slices is overcome; at the same time, this invention uses QoS deviation as a key input for security detection, realizing a unified view of "performance" and "security", and can detect "resource abuse" attacks earlier than traditional NIDS; in addition, this invention is not just about alarms, but also achieves automated responses such as slice-level precise isolation, restriction, and rerouting of threats through linkage with slice management and dynamic routing, ensuring the SLA and stability of high-priority services; therefore, this invention can effectively prevent the risk of the entire slice service quality deteriorating or even paralyzing due to the hacking of a single device, and improve the overall robustness of the 5G low-altitude private network. Attached Figure Description

[0019] Figure 1 This is a flowchart of a method for detecting and dynamically responding to abnormal behavior in a 5G low-altitude slicing network according to the present invention. Figure 2 Diagram of dynamic slicing architecture for 5G networks; Figure 3 This is a structural block diagram of a 5G low-altitude slice network abnormal behavior detection and dynamic response device according to the present invention. Detailed Implementation

[0020] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0021] like Figure 1 As shown, a method for detecting and dynamically responding to abnormal behavior in a 5G low-altitude slicing network includes: S1 collects multi-dimensional network data related to slicing and low-altitude services in the 5G core network and base stations; S2, perform feature engineering processing on the multidimensional network data to fuse slice state features, so as to extract slice security state features; S3, construct a dynamic slice behavior baseline model based on a hybrid machine learning model, and use the dynamic slice behavior baseline model to learn the slice security status characteristics in order to predict whether the slice behavior is abnormal in the next moment and identify the abnormality type. S4, when an anomaly is detected, an anomaly alarm is issued based on business priority, and a security-aware slice dynamic response is performed.

[0022] This invention provides a method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slice networks. This method is applicable to network slice security, abnormal behavior detection, and dynamic resource management for low-altitude devices (such as drones and IoT devices) in a 5G slice private network environment. The aim is to: (1) construct a dynamic and adaptive security behavior baseline for each low-altitude service slice (such as drone logistics and emergency communication); (2) use a hybrid machine learning model (integrating CNN and RNN) to detect abnormal activities that deviate from the normal behavior baseline in real time, such as resource abuse, QoS attacks, and illegal probing, so as to realize the linkage between the security detection system and the 5G slice management and dynamic routing system, and perform dynamic and accurate security responses at the slice level to ensure the SLA and QoS of high-priority services.

[0023] The steps of the method of the present invention are described in detail below.

[0024] S1: Multidimensional network data acquisition with slice perception.

[0025] Deploying probes in the 5G core network (such as AMF, SMF, UPF) and base stations (gNB) not only collects traditional network data, but also must collect multi-dimensional network data related to network slicing and low-altitude services. This multi-dimensional network data includes: Slice identification data: S-NSSAI (Single Network Slice Selection Auxiliary Information); QoS traffic data: Real-time traffic, latency, and packet loss rate for each QoS Flow; Mobility management data: UE handover events, location information, topology changes; Slice configuration data: Slice resource quotas (bandwidth, computing), SLA requirements, and service type (e.g., video, sensor).

[0026] S2: Feature engineering of fused slice states.

[0027] The collected multidimensional network data is preprocessed to extract features that reflect the security status of the slices. These slice security status features include: In-slice behavioral features, specifically: Traffic profiling: total bandwidth, protocol distribution, and packet size distribution within a slice; Connection profile: new connection rate, number of concurrent connections, and average connection duration.

[0028] The behavioral characteristics between slices are as follows: Isolation feature: Monitors unauthorized access attempts between slices.

[0029] QoS deviation characteristics, specifically: Calculate the "deviation" between the actual QoS (real-time latency, packet loss rate) and the given SLA for the slice; security attacks (such as DDoS) will significantly increase this deviation.

[0030] UE mobility characteristics, specifically: Whether the switching frequency and movement trajectory of the UE (such as a drone) conform to its business logic (such as whether it is on a preset flight path).

[0031] S3: Baseline modeling of dynamic slice behavior based on hybrid machine learning models.

[0032] Specifically, S3 is: Construct a baseline model for dynamic slicing behavior based on a hybrid machine learning model; The dynamic slice behavior baseline model is used to learn the temporal and spatial characteristics of the slice security status features; Based on the temporal and spatial characteristics, predict whether the slicing behavior at the next moment is abnormal and identify the type of abnormality.

[0033] The hybrid machine learning model includes a recurrent neural network model and a convolutional neural network model. The dynamic slice behavior baseline model is used to learn the temporal and spatial features of the slice security state characteristics, specifically including: The slice security status features are input into the recurrent neural network model to learn the normal traffic patterns and QoS deviation fluctuation range of the slice at different times, and output the time features. The security status features of the slice are input into the convolutional neural network model to analyze the packet payload or traffic matrix of the slice and identify the fingerprint of the attack pattern, and output the spatial features.

[0034] Based on the temporal and spatial features, predict whether the slicing behavior at the next moment is abnormal and identify the type of abnormality, specifically including: The recurrent neural network model is used to analyze the time features to predict the slicing behavior at the next moment, and the prediction result is obtained. The prediction result is compared with the actual observation result. When the difference between the prediction result and the actual observation result exceeds a preset dynamic threshold, the slicing behavior is determined to be abnormal. The convolutional neural network model combined with the spatial features is used to perform in-depth analysis of abnormal slicing behavior in order to identify the anomaly type.

[0035] Specifically, considering the highly dynamic nature of low-altitude operations, this invention employs a hybrid machine learning model. The hybrid machine learning model includes: Recurrent Neural Networks (RNN / LSTM) are used to learn temporal features. A separate RNN / LSTM model is trained for each slice type (e.g., logistics, emergency response) to learn its normal traffic patterns and QoS deviation fluctuation range at different times (e.g., takeoff, cruise). Convolutional Neural Networks (CNNs) are models used to extract spatial features. They are used to analyze packet payloads or traffic matrices to identify the "fingerprints" of specific attack patterns (such as scanning and worms).

[0036] Anomaly detection: The RNN / LSTM model predicts the slice behavior (such as traffic and QoS deviation) in real time for the next time step. When the difference between the actual observation and the RNN / LSTM prediction (i.e., the anomaly score) exceeds a dynamic threshold, it is judged as an anomaly. When an anomaly occurs, the CNN model is triggered to perform in-depth analysis of the abnormal traffic to identify the specific attack type.

[0037] S4, a security-aware slice dynamic response.

[0038] Once an anomaly is detected, this invention will escalate the alarm to a closed-loop linkage with network functions.

[0039] Security alerts are correlated with priorities: detected anomaly alerts are associated with business priority protection algorithms. Anomalies in emergency communication slices will trigger the highest level of response.

[0040] Dynamic Routing Allocation (DRAA Allocation): Scenario: A UE (e.g., a drone) is detected launching a DDoS attack. Response: The slice security brain (with functions for data collection, feature engineering, machine learning modeling, and dynamic response) immediately notifies the Dynamic Resource Allocation Module (DRAA) to adjust the routing weight of the UE or its path in the current slice to "infinite" or "high cost," forcing DRAA to recalculate the path, achieving route-level isolation, and ensuring communication for other normal UEs within the slice.

[0041] Slice resource management linkage: Scenario: Abnormal traffic is detected in a slice (such as IoT), suspected of being used for cryptocurrency mining. Response: The slice resource management module is notified to perform dynamic resource limiting on that slice (such as reducing the bandwidth limit) to prevent resource abuse, while not affecting the QoS of other slices.

[0042] Dynamic Access Control: Scenario: A UE is detected performing an inter-slice scan. Response: Notify the AMF (Access and Mobility Management Function) to force the UE to re-authenticate or temporarily isolate it in a restricted network.

[0043] Figure 2 This diagram illustrates the dynamic slicing architecture of a 5G network constructed according to the method of this invention. It primarily showcases the three-layer core architecture: the dynamic slicing engine, the slice security brain, and the data plane.

[0044] The DynamicSlice Engine, located at the top layer of the architecture, is responsible for the dynamic management and resource scheduling of slices. It comprises four core modules: Dynamic Routing Group (DRA), Slice Resource Management (SRM), Service Priority Assurance (BPA), and Security Orchestration. DRA performs route isolation and cost adjustment; SRM performs resource limiting and quota adjustment; BPA ensures that security responses for high-priority services are executed first; and Security Orchestration receives alarms, formulates response policies, and outputs response commands.

[0045] Slice Security Brain: Located in the middle layer of the architecture, it is the core decision-making unit for slice security, comprising three core modules: Machine Learning Detection (ML Detection), Slice-Aware Feature Engineering, and Multi-Dimensional Data Probes. The ML Detection module uses RNN / LSTM to establish a dynamic baseline, CNN for attack classification, and outputs security alerts / response commands. Slice-Aware Feature Engineering extracts slice-aware features, calculates QoS deviation and slice behavior profiles, and outputs processed features. Multi-Dimensional Data Probes collects underlying data and outputs raw features.

[0046] Data Plane: Located at the bottom layer of the architecture, it is the physical foundation for network data transmission and includes three core modules: 5G RAN (gNBs / Base Stations), 5G Core Network (AMF, SMF, UPF), and Low-Altitude UEs (Drones, IoT). 5G RAN (gNBs / Base Stations) is responsible for radio access; 5G Core Network (AMF, SMF, UPF) is responsible for core network functions; and Low-Altitude UEs (Drones, IoT) are end users such as low-altitude drones and IoT devices.

[0047] In the 5G network dynamic slicing architecture diagram, data is collected from the underlying data plane by multi-dimensional data probes. After slice-aware feature engineering processing, it is input into the machine learning detection module for security analysis, outputting security alarms / response commands. Simultaneously, the dynamic slicing engine dynamically adjusts routing, resource allocation, and security policies based on security commands, service priorities, etc., forming a closed loop of "data collection - feature processing - security detection - dynamic scheduling." This architecture, through the flexible scheduling of the dynamic slicing engine, the intelligent protection of the slice security brain, and the underlying support of the data plane, enables the 5G network to adapt to the differentiated needs of different service scenarios, ensuring efficient utilization of network resources and service security. The invention is illustrated below with specific examples.

[0048] Example 1: Unmanned Aerial Vehicle (UAV) Logistics Transportation (Enhanced Safety).

[0049] Scenario Overview: A logistics drone is hijacked and disguised as a normal business operation, but continuously launches DDoS attacks against specific targets (such as other drones or ground stations) in an attempt to consume sliced ​​bandwidth, causing other drones to experience increased latency and deviate from their flight paths.

[0050] Applications of this invention: (1) The RNN model of this invention detected a sharp increase in the "QoS deviation" and "traffic profile" features (total bandwidth, traffic of a specific target IP) of the slice, exceeding the normal logistics business baseline. (2) The CNN model analysis confirmed it as a DDoS attack. (3) The system automatically linked the business priority protection algorithm to confirm that the business had a high priority and other devices needed to be protected. (4) The system called the interface to set the routing cost of the UE ID of the drone that launched the attack to the highest level, so that its traffic could not reach other devices, achieving second-level isolation and ensuring the normal operation of other drones.

[0051] Example 2: Low-altitude IoT communication (security enhancement).

[0052] Scenario Overview: A low-altitude IoT device (such as a weather sensor) is infected with malware and begins to perform slow, covert port scans on other network slices (such as emergency communication slices).

[0053] Applications of this invention: (1) This invention detects abnormal "inter-slice behavior characteristics" (e.g., cross-slice access that should not have occurred). (2) At the same time, scanning characteristics such as TCP SYN appear in the "protocol profile" of the sensor. (3) The system determines that it is an illegal probe, immediately calls the access management interface, "kicks" the device offline or isolates it in a "honeypot" slice, preventing the threat from spreading to high-value emergency communication slices.

[0054] Example 3: Emergency Communication (Enhanced Security).

[0055] Scenario Overview: In the event of an emergency, attackers launch a "resource preemption" attack on a high-value emergency communication slice. A large number of fake UEs attempt to access the slice, consuming slice management resources.

[0056] Applications of this invention: (1) The model of this invention detects anomalies in the "connection profile" feature (the rate of newly established connections far exceeds the baseline). (2) The system immediately triggers a response, notifies the slice resource management module, temporarily raises the access threshold of the slice (such as enabling stricter identity verification), and dynamically increases its management surface resources to ensure that access requests from real rescue personnel (in accordance with the high priority strategy of the business priority guarantee algorithm) are given priority processing and attack traffic is filtered out.

[0057] Based on the above-mentioned method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks, this invention also provides a device for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks.

[0058] like Figure 3 As shown, a 5G low-altitude slice network abnormal behavior detection and dynamic response device includes a processor, a memory, and a computer program stored in the memory. When the computer program is executed by the processor, it implements the 5G low-altitude slice network abnormal behavior detection and dynamic response method as described above.

[0059] In one optional embodiment, a 5G low-altitude slice network abnormal behavior detection and dynamic response device is provided, such as... Figure 3 As shown. Figure 3 The illustrated 5G low-altitude slicing network abnormal behavior detection and dynamic response device includes a processor and a memory. The processor and memory are connected, for example, via a bus. Optionally, the 5G low-altitude slicing network abnormal behavior detection and dynamic response device may further include a transceiver, which can be used for data interaction between the 5G low-altitude slicing network abnormal behavior detection and dynamic response device and other electronic devices, such as data transmission and / or data reception. It should be noted that in practical applications, the transceiver is not limited to one unit, and the structure of this 5G low-altitude slicing network abnormal behavior detection and dynamic response device does not constitute a limitation on the embodiments of the present invention.

[0060] The processor can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), a PLC (Programmable Logic Controller), a FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this invention. The processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0061] A bus can include a pathway for transmitting information between the aforementioned components. The bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0062] The memory may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited to these.

[0063] The memory stores application code (computer program) that executes the present invention, and its execution is controlled by a processor. The processor executes the application code stored in the memory to implement the content shown in the foregoing method embodiments.

[0064] The 5G low-altitude slice network abnormal behavior detection and dynamic response device can also be a terminal device. The terminal device can be any device that can install applications, including at least one of smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, smart TVs, and smart vehicle devices.

[0065] It should be noted that, Figure 3 The 5G low-altitude slice network abnormal behavior detection and dynamic response device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0066] In summary, the present invention, a method and apparatus for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks, significantly improves the detection accuracy of abnormal behavior in low-altitude dynamic services and reduces the false alarm rate by establishing a dynamic slice behavior baseline model to predict and identify anomalies, overcoming the shortcomings of traditional security systems that are unaware of slices. Simultaneously, the present invention uses QoS deviation as a key input for security detection, achieving a unified view of "performance" and "security," enabling earlier detection of "resource abuse" attacks than traditional NIDS. Furthermore, the present invention goes beyond simply issuing alarms; through linkage with slice management and dynamic routing, it achieves automated responses such as slice-level precise isolation, restriction, and rerouting of threats, ensuring the SLA and stability of high-priority services. Therefore, the present invention effectively prevents the risk of a decline in the service quality or even paralysis of the entire slice due to the hacking of a single device, improving the overall robustness of the 5G low-altitude private network. The above descriptions are merely preferred embodiments of the present invention and are not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks, characterized in that, include: S1 collects multi-dimensional network data related to slicing and low-altitude services in the 5G core network and base stations; S2, perform feature engineering processing on the multidimensional network data to fuse slice state features, so as to extract slice security state features; S3, construct a dynamic slice behavior baseline model based on a hybrid machine learning model, and use the dynamic slice behavior baseline model to learn the slice security status characteristics in order to predict whether the slice behavior is abnormal in the next moment and identify the abnormality type. S4, when an anomaly is detected, an anomaly alarm is issued based on business priority, and a security-aware slice dynamic response is performed.

2. The method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks according to claim 1, characterized in that, In S1, the multidimensional network data includes slice identification data, QoS traffic data, mobility management data, and slice configuration data.

3. The method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks according to claim 1, characterized in that, In S2, the slice security status characteristics include intra-slice behavior characteristics, inter-slice behavior characteristics, QoS deviation characteristics, and UE mobility characteristics; The slice-based behavioral features include a traffic profile characterizing the total bandwidth, protocol distribution, and packet size distribution within the slice, as well as a connection profile characterizing the rate of new connection establishment, the number of concurrent connections, and the average connection duration. The inter-slice behavioral characteristics include isolation features used to detect unauthorized access attempts between slices.

4. The method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks according to claim 1, characterized in that, Specifically, S3 is: Construct a baseline model for dynamic slicing behavior based on a hybrid machine learning model; The dynamic slice behavior baseline model is used to learn the temporal and spatial characteristics of the slice security status features; Based on the temporal and spatial characteristics, predict whether the slicing behavior at the next moment is abnormal and identify the type of abnormality.

5. The method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks according to claim 4, characterized in that, The hybrid machine learning model includes a recurrent neural network model and a convolutional neural network model; The dynamic slice behavior baseline model is used to learn the temporal and spatial features of the slice security state characteristics, specifically including: The slice security status features are input into the recurrent neural network model to learn the normal traffic patterns and QoS deviation fluctuation range of the slice at different times, and output the time features. The security status features of the slice are input into the convolutional neural network model to analyze the packet payload or traffic matrix of the slice and identify the fingerprint of the attack pattern, and output the spatial features.

6. The method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks according to claim 5, characterized in that, Based on the temporal and spatial features, predict whether the slicing behavior at the next moment is abnormal and identify the type of abnormality, specifically including: The recurrent neural network model is used to analyze the time features to predict the slicing behavior at the next moment, and the prediction result is obtained. The prediction result is compared with the actual observation result. When the difference between the prediction result and the actual observation result exceeds a preset dynamic threshold, the slicing behavior is determined to be abnormal. The convolutional neural network model is used in conjunction with the spatial features to perform in-depth analysis of abnormal slicing behavior in order to identify the anomaly type.

7. The method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks according to claim 1, characterized in that, In step S4, the security-aware slice dynamic response includes a dynamic routing linkage response, which specifically includes: When a DDoS attack is detected by a low-altitude device, the dynamic resource allocation module is notified to adjust the routing weight of the low-altitude device or its path in the current slice to "infinite" or "high cost" to recalculate the path and achieve route-level isolation.

8. The method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks according to claim 1, characterized in that, In step S4, the security-aware slice dynamic response includes a slice resource management linkage response, which specifically includes: When abnormal slice traffic is detected, the slice resource management module is notified to perform dynamic resource limiting on the slice.

9. The method for detecting and dynamically responding to abnormal behavior in 5G low-altitude slicing networks according to claim 1, characterized in that, In step S4, the security-aware slice dynamic response includes a dynamic access control response, which specifically includes: When a low-altitude device is detected performing inter-slice scanning, the Access and Mobility Management module is notified to force the low-altitude device to re-authenticate or temporarily isolate it in a restricted network.

10. A device for detecting and dynamically responding to abnormal behavior in a 5G low-altitude slicing network, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory, wherein the computer program, when executed by the processor, implements the 5G low-altitude slice network abnormal behavior detection and dynamic response method as described in any one of claims 1 to 9.

Images