Security warning method and device of home base station, electronic equipment and storage medium

Abstract

This application discloses a security early warning method, device, electronic device, and storage medium for home base stations, belonging to the field of wireless technology, to solve the problems of high cost and weak real-time performance of related home base station security early warning technologies. The method includes: acquiring S1 MME call detail records; the S1 MME call detail records include relevant information on interactions between mobile devices and the home base station; parsing the handover signaling information in the S1 MME call detail records to obtain first cell information of neighboring cells of the home base station, and obtaining the number of handovers of multiple neighboring cells of the home base station; based on the first cell information, acquiring the latitude and longitude information of multiple neighboring cells; based on the latitude and longitude information of the multiple neighboring cells and the number of handovers, determining the target latitude and longitude information of the home base station, so as to perform security early warning for the home base station based on the target latitude and longitude information.

Description

Technical Field

[0001] This application belongs to the field of wireless technology, and specifically relates to a security early warning method, device, electronic device and storage medium for a home base station. Background Technology

[0002] Femto devices, also known as home base stations, are small indoor base stations primarily used in homes and small offices. Their characteristics include: small coverage area, typically limited to indoors; connection to the operator's core network via broadband or fiber optic; and provision of stronger signal strength, improving call quality and data transmission speed indoors. However, the portability and widespread deployment of Femto devices across the country significantly increase management complexity. Criminals may acquire Femto devices through illegal transactions or theft, using them as springboards to attack the operator's core network, directly accessing the network via the internet and causing serious security risks such as large-scale network outages, customer information theft, and harassment fraud. Therefore, research is being conducted on Femto device location technology. This technology can quickly identify the movement of Femto devices, thereby promptly detecting theft or misuse and effectively mitigating the aforementioned security risks.

[0003] There are three types of security early warning technologies for related home base stations. The first is manual inspection, which is carried out by maintenance personnel through regular inspections based on the records of the installers. The second is periodic comparison using the latitude and longitude module built into the equipment. The third is location based on the base station measurement report (MR) and key performance indicators (KPIs) of neighboring cells, and then discovery through comparison.

[0004] However, manual inspection solutions are often limited to initial installation location recording, lacking standardized processes for subsequent data verification and maintenance. This incomplete recording method leads to maintenance personnel needing to invest more time and effort in locating the equipment during later inspections, as the installer and inspector are often different individuals. This makes it difficult to quickly and accurately locate the equipment based on previous location information, and due to operational cost constraints, inspection cycles are typically only once a year, making it difficult to detect equipment theft in a timely manner. Solutions requiring the equipment's built-in latitude and longitude module increase costs due to the Global Positioning System (GPS) module, and are only suitable for outdoor scenarios, performing poorly indoors. Femto devices are primarily deployed indoors. Therefore, when Femto devices are deployed indoors, it is difficult to effectively obtain GPS location information, making it difficult to detect indoor device theft in a timely manner. Location solutions based on MR and neighbor cell handover KPIs only support devices with MR functionality. However, Femto devices supporting MR functionality are expensive, and most Femto devices do not have MR functionality. Therefore, this solution is also limited by the capabilities of the equipment. Equipment without MR functionality cannot detect displacement through positioning and cannot cover all Femto devices.

[0005] In other words, the security early warning technology for home base stations suffers from high costs and poor real-time performance. Summary of the Invention

[0006] This application provides a security early warning method, device, electronic device, and storage medium for home base stations, which can solve the problems of high cost and weak real-time performance of related home base station security early warning technologies.

[0007] In a first aspect, embodiments of this application provide a security early warning method for a home base station. The method includes: acquiring S1 MME call detail records; the S1 MME call detail records include relevant information about interactions between mobile devices and the home base station; parsing the handover signaling information in the S1 MME call detail records to obtain first cell information of neighboring cells of the home base station, and obtaining the number of handovers of multiple neighboring cells of the home base station; acquiring latitude and longitude information of multiple neighboring cells based on the first cell information; determining target latitude and longitude information of the home base station based on the latitude and longitude information of multiple neighboring cells and the number of handovers, so as to perform security early warning for the home base station based on the target latitude and longitude information.

[0008] Secondly, embodiments of this application provide a security early warning device for a home base station. The device includes: a first acquisition module, used to acquire S1 MME call detail records; the S1 MME call detail records include relevant information about interactions between mobile devices and the home base station; a parsing module, used to parse the handover signaling related information in the S1 MME call detail records to obtain first cell information of neighboring cells of the home base station, and to obtain the number of handovers of multiple neighboring cells of the home base station; a second acquisition module, used to acquire latitude and longitude information of multiple neighboring cells based on the first cell information; and a determination module, used to determine the target latitude and longitude information of the home base station based on the latitude and longitude information of the multiple neighboring cells and the number of handovers, so as to perform security early warning for the home base station based on the target latitude and longitude information.

[0009] Thirdly, embodiments of this application provide an electronic device comprising: a processor; and a memory arranged to store computer-executable instructions configured to be executed by the processor, the executable instructions including a security warning method for a home base station as described in the first aspect.

[0010] Fourthly, embodiments of this application provide a storage medium for storing computer-executable instructions that cause a computer to execute the home base station security warning method as described in the first aspect.

[0011] Fifthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the security early warning method for home base stations as described in the first aspect.

[0012] In a sixth aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the security early warning method for home base stations as described in the first aspect.

[0013] In this embodiment of the application, the following steps are taken: S1 MME call detail records are obtained; the S1 MME call detail records include relevant information about the interaction between the mobile device and the home base station; the handover signaling information in the S1 MME call detail records is parsed to obtain the first cell information of the neighboring cells of the home base station, and the number of handovers of the multiple neighboring cells of the home base station is obtained; based on the first cell information, the latitude and longitude information of the multiple neighboring cells is obtained; based on the latitude and longitude information of the multiple neighboring cells and the number of handovers, the target latitude and longitude information of the home base station is determined, so as to perform security warnings for the home base station based on the target latitude and longitude information. Compared to existing home base station security warning technologies, this application obtains the first cell information of the neighboring cells of the home base station by parsing the handover signaling information in the S1 MME call detail record, and obtains the handover counts of multiple neighboring cells of the home base station. Then, based on the first cell information, it obtains the latitude and longitude information of the neighboring cells. After that, by combining the latitude and longitude information of these neighboring cells with the handover counts, the target latitude and longitude information of the home base station can be determined. Therefore, it is not limited by whether the home base station has enabled MR function, nor does it require the home base station to be equipped with a GPS module; it only needs to be connected to the network. Thus, even in indoor environments with weak GPS signals, it can achieve rapid positioning of the home base station. It has lower cost, better real-time performance, and higher coverage of the home base station, reducing network security risks. It solves the problems of high cost and poor real-time performance of existing home base station security warning technologies. Attached Figure Description

[0014] Figure 1 This is a flowchart illustrating a security early warning method for a home base station provided in an embodiment of this application; Figure 2 A flowchart illustrating another security early warning method for a home base station provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of a security early warning device for a home base station provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0015] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0016] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0017] The security early warning method, device, electronic equipment, and storage medium for home base stations provided in this application will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios.

[0018] Figure 1 This invention illustrates a security early warning method for a home base station according to an embodiment of the present invention. The method can be executed by an electronic device, which may include a server and / or a terminal device, wherein the terminal device may be, for example, a vehicle-mounted terminal or a mobile phone terminal. The method includes the following steps: S102: Obtain the call detail record (CDR) of the S1 Interface Mobility Management Entity (S1 MME).

[0019] The S1 MME call detail record includes information related to the interaction between mobile devices and home base stations; the mobile devices can be one or more. The home base station is the home base station to be subject to security alerts, and there can be one or more of them.

[0020] In practical applications, when a user's mobile device interacts with a home base station, such as when the mobile device accesses the home base station's network, relevant information about the interaction between the mobile device and the home base station is generated, such as S1MME interface signaling. This information can be stored in the S1MME call detail record. Specifically, when a mobile device is detected accessing the home base station's network, steps S102 to S108 can be executed.

[0021] S104: Parse the handover signaling information in the S1 MME call detail record to obtain the first cell information of the neighboring cells of the home base station, and obtain the number of handovers of multiple neighboring cells of the home base station.

[0022] The first cell information includes, but is not limited to, one or more of the following: Tracking Area Code (TAC), Cell Identity Document (ID), E-UTRAN Cell Identifier (ECI), and eNodeB ID. The ECI is a 28-bit binary value, consisting of a 20-bit eNodeB ID and an 8-bit Cell ID. The ECI is used to uniquely identify a cell across the entire network, ensuring accurate identification of each cell throughout the network. The eNodeB ID is used to uniquely identify the base station equipment within the operator's Public Land Mobile Network (PLMN).

[0023] In practical applications, the handover signaling information in the S1 MME call detail records is parsed. If the S1 MME call detail record contains only handover signaling information for one home base station, the first cell information of the neighboring cells of that home base station can be obtained, along with the number of handovers for multiple neighboring cells. If the S1 MME call detail record contains handover signaling information for multiple home base stations, the second cell information of multiple home base stations, the first cell information of the neighboring cells of each home base station, and the number of handovers for multiple neighboring cells of each home base station can be obtained. The second cell information includes, but is not limited to, one or more of the following: TAC, Cell ID, ECI, and eNodeB ID (i.e., home base station ID).

[0024] Furthermore, since home base stations typically have a large number of neighboring cells, including multiple duplicate entries, the management of neighboring cells can be simplified by aggregating the parsed data. The parsed data can be aggregated to generate a neighboring cell list, which includes information on the second cell of the home base station, information on the first cell of its neighboring cells, and the number of handovers. Specifically, the number of handovers is calculated statistically based on the traffic volume of mobile devices, with each traffic transaction representing one data point. The number of transactions is summed, including transactions such as attachment and handover. Additionally, the number of neighboring cells for a home base station may vary due to different traffic volumes. To accurately grasp the dynamic changes in the number of neighboring cells, statistics can be aggregated in real-time or at set time intervals to obtain real-time or periodic reports on the number of neighboring cells. After obtaining the neighboring cell list, the latitude and longitude information of the corresponding neighboring cells can be obtained based on the first cell information of the neighboring cells in the list.

[0025] For example, the first cell information is the neighboring cell ID, and the second cell information is the home base station ID; the neighboring cell list can be shown in Table 1 below: Table 1

[0026] It should be noted that the aforementioned home base station ID, neighboring cell ID, number of handovers, and neighbor cell list are for ease of understanding only and do not constitute specific limitations.

[0027] S106: Based on the information of the first cell, obtain the latitude and longitude information of multiple adjacent cells.

[0028] Specifically, the information of the first neighboring cell can be used as an index to quickly match the corresponding latitude and longitude information in the operator's public resource data.

[0029] S108: Based on the latitude and longitude information and handover count of multiple adjacent cells, determine the target latitude and longitude information of the home base station, and conduct security early warning for the home base station based on the target latitude and longitude information.

[0030] Specifically, based on the number of handovers, the proportion of each neighboring cell's handover count in the total number of handovers of multiple neighboring cells can be determined, and this proportion can be used as the initial weighting coefficient for each neighboring cell. Based on the initial weighting coefficient and latitude and longitude information of each neighboring cell, a weighted average can be performed to obtain the target latitude and longitude information of the home base station.

[0031] Following the example above, the neighbor cell list can also include the latitude and longitude information and initial weighting coefficients of multiple neighboring cells, as shown in Table 2 below: Table 2

[0032] Based on the initial weighting coefficients and latitude and longitude information of each neighboring cell, the weighted average is calculated as follows: Weighted average longitude = (longitude 1) Weight 1 + Longitude 2 Weight 2 + ... + Longitude n (weight n) / (weight1+weight2+...+weight n); Weighted average latitude = (latitude 1) Weight 1 + Latitude 2 Weight 2 + ... + latitude n The formula is: (weight n) / (weight1 + weight2 + ... + weight n); where weight1 is 0.4 as shown in Table 2, weight2 is 0.1 as shown in Table 2, ..., and n is the number of neighboring cells. Thus, the target latitude and longitude information of the home base station is obtained.

[0033] It should be noted that the aforementioned home base station ID, neighboring cell ID, number of handovers, latitude and longitude information, initial weight coefficient, and neighbor cell list are for ease of understanding only and do not constitute specific limitations.

[0034] The security early warning method for home base stations provided in this embodiment of the invention obtains S1 MME call detail records (CDRs); the S1 MME CDRs include relevant information on interactions between mobile devices and home base stations; the handover signaling information in the S1 MME CDRs is parsed to obtain first cell information of neighboring cells of the home base station, and the number of handovers of multiple neighboring cells of the home base station is obtained; based on the first cell information, the latitude and longitude information of multiple neighboring cells is obtained; based on the latitude and longitude information of multiple neighboring cells and the number of handovers, the target latitude and longitude information of the home base station is determined, so as to perform security early warning for the home base station based on the target latitude and longitude information. Compared to existing home base station security warning technologies, this application obtains the first cell information of the home base station's neighboring cells by parsing the handover signaling information in the S1 MME call detail record (CDR) and the number of handovers of multiple neighboring cells. Based on the first cell information, it then obtains the latitude and longitude information of the neighboring cells. By combining this latitude and longitude information with the number of handovers, the target latitude and longitude information of the home base station can be determined. Therefore, it is not limited by whether the home base station has MR functionality enabled, nor does it require a GPS module; it only needs network access. This allows for rapid positioning of the home base station even in indoor environments with weak GPS signals. It is low-cost, has good real-time performance, and provides high coverage for the home base station, reducing network security risks. This solves the problems of high cost and poor real-time performance associated with existing home base station security warning technologies.

[0035] In one implementation, the target latitude and longitude information of the home base station is determined based on the latitude and longitude information of multiple neighboring cells and the number of handovers (i.e., S108), which can be achieved by executing the following steps A1 to A2: Step A1: Based on the number of handovers, determine the weight coefficients of each neighboring cell using a pre-trained random forest model.

[0036] Considering that mobile devices frequently handover to a particular neighboring cell, they may be closer to that cell, allowing for a higher weighting coefficient for that neighboring cell. Specifically, the handover counts of multiple neighboring cells can be input into a pre-trained random forest model, which then outputs the weighting coefficient for each neighboring cell.

[0037] Step A2: Determine the target latitude and longitude information of the home base station based on the weighting coefficients and latitude and longitude information.

[0038] Specifically, the target latitude and longitude information of the home base station can be obtained by weighted summation based on the weight coefficients and latitude and longitude information.

[0039] In this embodiment, the weight coefficients of each neighboring cell are determined by combining a pre-trained random forest model, thereby more accurately determining the target latitude and longitude information of the home base station.

[0040] In one implementation, based on the number of handovers, the weight coefficients of each neighboring cell are determined using a pre-trained random forest model (i.e., step A2), which can be achieved by executing steps B1 to B2 as follows: Step B1: Based on the number of handovers, determine the proportion of the number of handovers of each neighboring cell in the total number of handovers of multiple neighboring cells, and use the proportion as the initial weight coefficient of each neighboring cell.

[0041] Step B2: Based on the initial weight coefficients, generate the weight coefficients for each neighboring cell using a pre-trained random forest model.

[0042] Considering the possibility that mobile devices may frequently handover to a particular neighboring cell, even when the distance between the home base station and that neighboring cell is not the shortest, the initial weight coefficients are adjusted using a pre-trained random forest model. Optionally, signal strength information of the mobile device during neighboring cell handovers can be obtained, and the initial weight coefficients and signal strength information can be input into the pre-trained random forest model to generate weight coefficients for each neighboring cell. Alternatively, the MME processing time information for multiple neighboring cells in the S1 MME call detail record can be determined, and the MME processing time information and initial weight coefficients can be input into the pre-trained random forest model to generate weight coefficients for each neighboring cell.

[0043] In this embodiment, the initial weight coefficients are adjusted using a pre-trained random forest model to determine the weight coefficients of each neighboring cell, thereby more accurately determining the target latitude and longitude information of the home base station.

[0044] In one implementation, the handover signaling information in the S1 MME call detail record is parsed to obtain the first cell information of the neighboring cells of the home base station (i.e., S104). The following step C1 can be executed: Step C1: Based on the process type field in the S1 MME call detail record, determine the handover signaling related information in the S1 MME call detail record, and parse the handover signaling related information to obtain the second cell information of the home base station and the first cell information of the adjacent cell adjacent to the cell where the home base station is located.

[0045] Specifically, the S1 MME call detail record includes a procedure type field with multiple values. Among them, the procedure type fields ProcedureType=15 and ProcedureType=16 correspond to the handover in and handover out sub-procedures in the handover process, respectively. By filtering by ProcedureType=15 and ProcedureType=16, handover signaling-related information can be obtained.

[0046] In one implementation, the aforementioned handover signaling information includes the aforementioned process type field, the adjacent OtherECI field, and the Cell ID field; parsing the handover signaling information yields the second cell information of the home base station and the first cell information of the adjacent cell next to the cell where the home base station is located (i.e., step C1), and the following steps D1 to D2 can be executed: Step D1: If the process type field in the handover signaling information corresponds to the first preset value, generate the third cell information of the cell where the home base station is located based on the corresponding Other ECI field, and generate the fourth cell information of the adjacent cell based on the corresponding Cell ID field.

[0047] The process type field corresponds to the first preset value, which indicates that the mobile device switches from an adjacent cell to the cell where the home base station is located.

[0048] In step D2, if the process type field in the handover signaling information corresponds to the second preset value, the fifth cell information of the adjacent cell is generated based on the corresponding Other ECI field, and the sixth cell information of the cell where the home base station is located is generated based on the corresponding Cell ID field.

[0049] The process type field corresponds to the second preset value, which indicates that the mobile device switches from the cell where the home base station is located to an adjacent cell; the second cell information includes the third cell information and / or the sixth cell information; the first cell information includes the fourth cell information and / or the fifth cell information.

[0050] Specifically, in the handover signaling information, the femtocell flexibly plays the roles of both source and target cell: in the handover initiation process, the mobile device hands over from a neighboring cell to the femtocell's cell, i.e., the neighboring cell is the source cell and the femtocell's cell is the target cell; in the handover outitiation process, the mobile device hands over from the femtocell's cell to a neighboring cell, i.e., the femtocell's cell is the source cell and the neighboring cell is the target cell. In the handover signaling information, the Other ECI field and the CellL ID field correspond to the identifiers of the source and target cells, respectively.

[0051] For example, when the process type field in the switching signaling information corresponds to the first preset value, the switching signaling information corresponds to the following Table 3: Table 3

[0052] The first preset value is 15 in Table 3. Based on the Other ECI field in Table 3, the third cell information of the cell where the home base station is located is generated, and based on the Cell ID field in Table 3, the fourth cell information of the adjacent cell is generated.

[0053] When the process type field in the switching signaling information corresponds to the second preset value, the corresponding switching signaling information is shown in Table 4 below: Table 4

[0054] The second preset value is 16 in Table 4. Based on the Other ECI field in Table 4, the fifth cell information of the adjacent cell is generated, and based on the Cell ID field in Table 4, the sixth cell information of the cell where the home base station is located is generated.

[0055] It should be noted that the above handover signaling information is for ease of understanding only and does not constitute a specific limitation on the handover signaling information.

[0056] In one implementation, after determining the target latitude and longitude information of the home base station based on the latitude and longitude information and the number of handovers of multiple neighboring cells (i.e., S108), the following steps E1 to E2 can also be performed to provide a security warning for the home base station: Step E1: Obtain the installation and location information of the home base station, and compare the installation and location information with the target latitude and longitude information to obtain the comparison result.

[0057] Step E2: Based on the comparison results, conduct security warnings for home base stations.

[0058] The comparison result can include location offset information between the installed and recorded location information and the target's latitude and longitude information. Specifically, when the location offset information exceeds a preset location offset threshold, it can trigger a home base station theft warning SMS and work order, notifying local maintenance personnel to handle the situation. The preset location offset threshold is, for example, 500 meters.

[0059] Figure 2 This is a flowchart illustrating another security early warning method for home base stations provided in an embodiment of this application. Figure 2 As shown, the method includes: Step 202: Obtain the S1 MME call detail record.

[0060] The S1 MME call detail record includes information related to the interaction between mobile devices and home base stations.

[0061] Step 204: Based on the process type field in the S1 MME call detail record, determine the handover signaling related information in the S1 MME call detail record, and parse the handover signaling related information to obtain the second cell information of the home base station, the number of handovers of multiple adjacent cells of the home base station, and the first cell information of the adjacent cells adjacent to the cell where the home base station is located.

[0062] Step 206: Based on the information of the first cell, obtain the latitude and longitude information of multiple adjacent cells.

[0063] Step 208: Based on the number of handovers, determine the weight coefficient of each neighboring cell using a pre-trained random forest model.

[0064] Step 210: Determine the target latitude and longitude information of the home base station based on the weighting coefficients and latitude and longitude information.

[0065] Step 212: Obtain the installation and location information of the home base station, and compare the installation and location information with the target latitude and longitude information to obtain the comparison result.

[0066] Step 214: Based on the comparison results, conduct security warnings for home base stations.

[0067] The specific processes of steps 202 to 214 above have been described in detail in the above embodiments, and will not be repeated here.

[0068] In this embodiment, the following steps are taken: First, the S1 MME call detail records (CDRs) are obtained. The S1 MME CDRs include information related to the interaction between the mobile device and the home base station. Second, the handover signaling information in the S1 MME CDRs is parsed to obtain the first cell information of the neighboring cells of the home base station, and the number of handovers for multiple neighboring cells. Third, based on the first cell information, the latitude and longitude information of multiple neighboring cells is obtained. Finally, based on the latitude and longitude information of multiple neighboring cells and the number of handovers, the target latitude and longitude information of the home base station is determined, and a security warning for the home base station is performed based on the target latitude and longitude information. Compared to existing home base station security warning technologies, this application obtains the first cell information of the home base station's neighboring cells by parsing the handover signaling information in the S1 MME call detail record (CDR) and the number of handovers of multiple neighboring cells. Based on the first cell information, it then obtains the latitude and longitude information of the neighboring cells. By combining this latitude and longitude information with the number of handovers, the target latitude and longitude information of the home base station can be determined. Therefore, it is not limited by whether the home base station has MR functionality enabled, nor does it require a GPS module; it only needs network access. This allows for rapid positioning of the home base station even in indoor environments with weak GPS signals. It is low-cost, has good real-time performance, and provides high coverage for the home base station, reducing network security risks. This solves the problems of high cost and poor real-time performance associated with existing home base station security warning technologies.

[0069] Corresponding to the security early warning method for home base stations provided in the above embodiments, based on the same technical concept, this embodiment of the invention also provides a security early warning device for home base stations. Figure 3 This is a schematic diagram of a security early warning device for a home base station according to an embodiment of the present invention. The security early warning device for the home base station is used to perform... Figures 1 to 2 The described security early warning method for home base stations, such as Figure 3 As shown, the security early warning device for home base stations includes: a first acquisition module 310, a parsing module 320, a second acquisition module 330, and a determination module 340.

[0070] The first acquisition module 310 is used to acquire S1 MME call detail records; the S1 MME call detail records include relevant information about the interaction between the mobile device and the home base station; The parsing module 320 is used to parse the handover signaling related information in the S1 MME call detail record to obtain the first cell information of the neighboring cells of the home base station, and to obtain the number of handovers of multiple neighboring cells of the home base station. The second acquisition module 330 is used to acquire latitude and longitude information of multiple adjacent cells based on the information of the first cell; The determination module 340 is used to determine the target latitude and longitude information of the home base station based on the latitude and longitude information and the number of handovers of multiple adjacent cells, so as to conduct security warnings for the home base station based on the target latitude and longitude information.

[0071] In one implementation, module 340 is defined, including: The first determining unit is used to determine the weight coefficient of each neighboring cell based on the number of handovers using a pre-trained random forest model. The second determining unit is used to determine the target latitude and longitude information of the home base station based on the weighting coefficients and latitude and longitude information.

[0072] In one implementation, the first determining unit is specifically used for: Based on the number of handovers, determine the proportion of the number of handovers of each neighboring cell in the total number of handovers of multiple neighboring cells, and use the proportion as the initial weight coefficient of each neighboring cell; Based on the initial weight coefficients, the weight coefficients of each neighboring cell are generated using a pre-trained random forest model.

[0073] In one implementation, the parsing module 320 is specifically used for: Based on the process type field in the S1 MME call detail record, the handover signaling related information in the S1 MME call detail record is determined, and the handover signaling related information is parsed to obtain the second cell information of the home base station and the first cell information of the adjacent cell adjacent to the cell where the home base station is located.

[0074] In one implementation, the aforementioned handover signaling information includes a process type field, an Other ECI field, and a Cell ID field. The handover signaling information is parsed to obtain the second cell information of the home base station and the first cell information of the adjacent cells adjacent to the cell where the home base station is located, including: When the process type field in the handover signaling information corresponds to the first preset value, the third cell information of the cell where the home base station is located is generated based on the corresponding Other ECI field, and the fourth cell information of the neighboring cell is generated based on the corresponding Cell ID field; wherein, the process type field corresponding to the first preset value indicates that the mobile device switches from the neighboring cell to the cell where the home base station is located. When the process type field in the handover signaling information corresponds to the second preset value, the fifth cell information of the neighboring cell is generated based on the corresponding Other ECI field, and the sixth cell information of the cell where the home base station is located is generated based on the corresponding Cell ID field; wherein, the process type field corresponding to the second preset value indicates that the mobile device hands over from the cell where the home base station is located to the neighboring cell; the second cell information includes the third cell information and / or the sixth cell information; the first cell information includes the fourth cell information and / or the fifth cell information.

[0075] In one implementation, the security early warning device for the home base station also includes an early warning module. The early warning module is specifically used for: Obtain the installation and location information of the home base station, and compare the installation and location information with the target latitude and longitude information to obtain the comparison result; Based on the comparison results, security warnings are issued for home base stations.

[0076] In this embodiment, the following steps are taken: First, the S1 MME call detail records (CDRs) are obtained. The S1 MME CDRs include information related to the interaction between the mobile device and the home base station. Second, the handover signaling information in the S1 MME CDRs is parsed to obtain the first cell information of the neighboring cells of the home base station, and the number of handovers for multiple neighboring cells. Third, based on the first cell information, the latitude and longitude information of multiple neighboring cells is obtained. Finally, based on the latitude and longitude information of multiple neighboring cells and the number of handovers, the target latitude and longitude information of the home base station is determined, and a security warning for the home base station is performed based on the target latitude and longitude information. Compared to existing home base station security warning technologies, this application obtains the first cell information of the home base station's neighboring cells by parsing the handover signaling information in the S1 MME call detail record (CDR) and the number of handovers of multiple neighboring cells. Based on the first cell information, it then obtains the latitude and longitude information of the neighboring cells. By combining this latitude and longitude information with the number of handovers, the target latitude and longitude information of the home base station can be determined. Therefore, it is not limited by whether the home base station has MR functionality enabled, nor does it require a GPS module; it only needs network access. This allows for rapid positioning of the home base station even in indoor environments with weak GPS signals. It is low-cost, has good real-time performance, and provides high coverage for the home base station, reducing network security risks. This solves the problems of high cost and poor real-time performance associated with existing home base station security warning technologies.

[0077] Those skilled in the art will understand that the above-described security warning device for home base stations can be used to implement the security warning method for home base stations described above. The detailed description therein should be similar to the method description in the above text. To avoid repetition, it will not be repeated here.

[0078] Based on the same technical concept, this application also provides an electronic device for executing the above-described security early warning method for home base stations. Figure 4 This is a schematic diagram of the structure of an electronic device to implement various embodiments of this application. The electronic device can vary significantly due to differences in configuration or performance, and may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440. The processor 410, communications interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can call a computer program stored in the memory 430 and executable on the processor 410 to perform the following steps: Obtain S1 MME call detail records; S1 MME call detail records include information related to the interaction between mobile devices and home base stations; The handover signaling information in the S1 MME call detail record is parsed to obtain the first cell information of the neighboring cells of the home base station, and the number of handovers of multiple neighboring cells of the home base station. Based on the information of the first cell, obtain the latitude and longitude information of multiple adjacent cells; Based on the latitude and longitude information and handover times of multiple neighboring cells, the target latitude and longitude information of the home base station is determined, and security early warning of the home base station is carried out based on the target latitude and longitude information.

[0079] In this embodiment, the following steps are taken: First, the S1 MME call detail records (CDRs) are obtained. The S1 MME CDRs include information related to the interaction between the mobile device and the home base station. Second, the handover signaling information in the S1 MME CDRs is parsed to obtain the first cell information of the neighboring cells of the home base station, and the number of handovers for multiple neighboring cells. Third, based on the first cell information, the latitude and longitude information of multiple neighboring cells is obtained. Finally, based on the latitude and longitude information of multiple neighboring cells and the number of handovers, the target latitude and longitude information of the home base station is determined, and a security warning for the home base station is performed based on the target latitude and longitude information. Compared to existing home base station security warning technologies, this application obtains the first cell information of the home base station's neighboring cells by parsing the handover signaling information in the S1 MME call detail record (CDR) and the number of handovers of multiple neighboring cells. Based on the first cell information, it then obtains the latitude and longitude information of the neighboring cells. By combining this latitude and longitude information with the number of handovers, the target latitude and longitude information of the home base station can be determined. Therefore, it is not limited by whether the home base station has MR functionality enabled, nor does it require a GPS module; it only needs network access. This allows for rapid positioning of the home base station even in indoor environments with weak GPS signals. It is low-cost, has good real-time performance, and provides high coverage for the home base station, reducing network security risks. This solves the problems of high cost and poor real-time performance associated with existing home base station security warning technologies.

[0080] The specific implementation steps can be found in the various steps of the above-described security early warning method embodiment for home base stations, and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0081] It should be noted that the electronic devices in the embodiments of this application include: servers, terminals, or other devices besides terminals.

[0082] The above electronic device structure does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or arrange them differently. For example, an input unit may include a Graphics Processing Unit (GPU) and a microphone, and a display unit may use a liquid crystal display (LCD), organic light-emitting diode (OLED), or other similar display panels. User input units include at least one of a touch panel and other input devices. A touch panel is also called a touchscreen. Other input devices may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be elaborated further here.

[0083] Memory can be used to store software programs and various data. Memory can primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area can store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, memory can include volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (Synchlink DRAM, SLDRAM), and direct memory bus RAM (DRRAM).

[0084] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly handles operations related to the operating system, user interface, and applications, while the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into the processor.

[0085] This application also provides a storage medium storing computer-executable instructions. When these computer-executable instructions are executed by a processor, they implement the various processes of the above-described home base station security early warning method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0086] The processor is the processor in the electronic device described in the above embodiments. The storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0087] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run programs or instructions to implement the various processes of the above-described home base station security early warning method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0088] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0089] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the various processes of the above-described home base station security early warning method embodiment and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0090] It should be understood that the training and prediction processes of the AI ​​models involved in the various embodiments of this specification all adhere to multiple legal and compliant principles, including legal data sources, compliant data content, compliant data governance, compliant training objectives and schemes, compliant training processes, compliant training environments and tools, and compliant ethical verification of training results, and comply with the requirements of Article 5 of the Patent Law. Among them: Data source legitimacy: All datasets used for AI model training were obtained through legal means, covering three categories: publicly authorized data, data authorized by partners, and self-collected compliant data. Publicly authorized data comes from compliant data sources following open-source licenses such as Apache 2.0, with complete copyright attribution and authorization scope clearly marked, and no unauthorized open-source code or data reuse. Data authorized by partners has been subject to formal data usage agreements, clearly defining the scope, duration, and confidentiality obligations, and possessing a complete authorization chain. For self-collected data involving personal information, strict informed consent procedures have been followed, and anonymization processes (including but not limited to field masking, feature anonymization, and differential privacy technology applications) have been implemented to remove personally identifiable information, fully complying with the requirements of relevant laws and regulations such as the "Interim Measures for the Administration of Generative Artificial Intelligence Services" and the "Personal Information Protection Law."

[0091] Data content compliance: The AI ​​model's dataset undergoes multiple screenings and cleaning processes to remove all content that may violate social morality or harm public interests. It contains no obscene, pornographic, violent, discriminatory, or information that endangers national or public safety, nor does it involve the illegal acquisition or use of genetic resources. For data in sensitive fields (such as healthcare and finance), an additional privacy-preserving computation module (including federated learning and secure multi-party computation technologies) ensures that the data is "usable but not visible," avoiding compliance risks during the original data transmission process and ensuring that the data application scenarios and uses comply with public order and good morals and industry regulatory requirements.

[0092] Data governance norms: A complete data traceability system is established during the AI ​​model training process to automatically record the source, collection time, annotation process, cleaning rules, and permission allocation of training data, generating traceable compliance reports to ensure that the data is verifiable throughout its entire lifecycle. The dataset annotation process for AI models is completed by a professional human R&D team, clearly defining the proportion of human creative contributions and avoiding reliance on AI-generated data that has not undergone substantial human modification, thus meeting the examination requirements for "human main contributions" in AI patent applications.

[0093] Training objectives and plans are compliant: The AI ​​model training objective focuses on weight coefficient generation. The training scheme and final output results do not violate any mandatory provisions of laws and administrative regulations, do not harm the public interest or the legitimate rights and interests of others, and do not pose any potential risks of being used for illegal activities, privacy infringement, or public safety disruption. The model strictly adheres to the ethical principle of "intelligent for good".

[0094] Training process compliance: A closed-loop training framework is adopted to ensure compliance and controllability of the training process. The specific process is as follows: First, training samples are obtained through compliant data sources. After the aforementioned data cleaning and desensitization, they are input into the neural network model to generate preliminary training results. Second, an expert system is introduced to verify the preliminary results. Based on preset rules and human expert experience, the feasibility of the results is evaluated, and outputs that may pose ethical risks or compliance hazards are corrected (such as removing decision-making logic that violates public order and good morals, and adjusting model parameters that do not comply with safety regulations). Finally, the loss function weights are dynamically optimized based on expert system feedback to strengthen the model's learning of compliant results, avoid overfitting errors or non-compliant labels, and form a closed-loop control of "data input - model training - expert verification - parameter optimization - result feedback" to ensure that the entire training process complies with A5 ethical review requirements.

[0095] Training environment and tool compliance: AI model training is implemented using nationally licensed chips and a compliant training platform. All open-source frameworks and components used in the training process have obtained their corresponding licenses, and copyright statements and patent citation information are fully retained, with no instances of infringement or reuse. The training environment is built using virtual devices (containers / virtual machines) with fixed random seeds and initial parameter configurations to ensure the reproducibility of the training process. Furthermore, through access control and operation log recording, risks such as data leakage and parameter tampering during training are prevented, ensuring the security and compliance of the training process.

[0096] Training results ethical verification compliance: After the model is trained, it undergoes additional third-party ethical compliance assessment and algorithm filing review to verify that the model output does not violate social morality or harm public interests. For potentially sensitive scenarios (such as public services and intelligent decision-making), a special result verification mechanism is established to ensure that the model always complies with Article 5 of the Patent Law and relevant laws and regulations in practical applications.

[0097] In summary, the data and training process used in the AI ​​model of this specification strictly comply with the relevant provisions of Article 5 of the Patent Law and the Patent Examination Guidelines (2023 Edition), and there are no violations of laws, social ethics, public interests, or illegal use of genetic resources. It fully meets the compliance requirements for patent authorization.

[0098] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include multitasking and parallel processing according to the functions involved, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0099] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of the various embodiments of this application.

[0100] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A security early warning method for home base stations, characterized in that, The method includes: Obtain the call detail records (CDRs) of the S1 MME (Mobile Management Entity) via the S1 interface; the S1 MME CDRs include relevant information about the interaction between the mobile device and the home base station. The handover signaling information in the S1 MME call detail record is parsed to obtain the first cell information of the neighboring cells of the home base station, and the number of handovers of the multiple neighboring cells of the home base station is obtained. Based on the information of the first cell, obtain the latitude and longitude information of multiple adjacent cells; Based on the latitude and longitude information of multiple adjacent cells and the number of handovers, the target latitude and longitude information of the home base station is determined, so as to perform security early warning for the home base station based on the target latitude and longitude information.

2. The method according to claim 1, characterized in that, The determination of the target latitude and longitude information of the home base station based on the latitude and longitude information of multiple neighboring cells and the number of handovers includes: Based on the number of handovers, the weight coefficients of each neighboring cell are determined using a pre-trained random forest model; Based on the weighting coefficients and the latitude and longitude information, the target latitude and longitude information of the home base station is determined.

3. The method according to claim 2, characterized in that, The step of determining the weight coefficient of each neighboring cell based on the number of handovers using a pre-trained random forest model includes: Based on the number of handovers, the proportion of the number of handovers of each neighboring cell in the total number of handovers of multiple neighboring cells is determined, and the proportion is used as the initial weighting coefficient of each neighboring cell; Based on the initial weight coefficients, the weight coefficients for each of the neighboring cells are generated using the pre-trained random forest model.

4. The method according to claim 1, characterized in that, The step of parsing the handover signaling information in the S1 MME call detail record to obtain the first cell information of the neighboring cells of the home base station includes: Based on the process type field in the S1 MME call detail record, the handover signaling related information in the S1 MME call detail record is determined, and the handover signaling related information is parsed to obtain the second cell information of the home base station and the first cell information of the adjacent cell that is adjacent to the cell where the home base station is located.

5. The method according to claim 4, characterized in that, The handover signaling related information includes the process type field, the adjacent base station cell number (Other ECI) field, and the cell identifier (Cell ID) field; The step of parsing the handover signaling information to obtain the second cell information of the home base station and the first cell information of the adjacent cells adjacent to the cell where the home base station is located includes: When the process type field in the handover signaling information corresponds to a first preset value, the third cell information of the cell where the home base station is located is generated based on the corresponding Other ECI field, and the fourth cell information of the neighboring cell is generated based on the corresponding Cell ID field; wherein, the process type field corresponding to the first preset value indicates that the mobile device switches from the neighboring cell to the cell where the home base station is located. When the process type field in the handover signaling information corresponds to a second preset value, the fifth cell information of the adjacent cell is generated based on the corresponding Other ECI field, and the sixth cell information of the cell where the home base station is located is generated based on the corresponding Cell ID field; wherein, the process type field corresponding to the second preset value indicates that the mobile device hands over from the cell where the home base station is located to the adjacent cell; the second cell information includes the third cell information and / or the sixth cell information; the first cell information includes the fourth cell information and / or the fifth cell information.

6. The method according to claim 1, characterized in that, After determining the target latitude and longitude information of the home base station based on the latitude and longitude information of multiple neighboring cells and the number of handovers, the method further includes: Obtain the installation and location information of the home base station, and compare the installation and location information with the target latitude and longitude information to obtain the comparison result; Based on the comparison results, a security warning is issued for the home base station.

7. A security early warning device for a home base station, characterized in that, The device includes: The first acquisition module is used to acquire S1 MME call detail records; the S1 MME call detail records include relevant information on the interaction between the mobile device and the home base station; The parsing module is used to parse the handover signaling related information in the S1 MME call detail record to obtain the first cell information of the neighboring cells of the home base station, and to obtain the handover count of multiple neighboring cells of the home base station; The second acquisition module is used to acquire the latitude and longitude information of multiple adjacent cells based on the first cell information; The determination module is used to determine the target latitude and longitude information of the home base station based on the latitude and longitude information of multiple adjacent cells and the number of handovers, so as to perform security warnings for the home base station based on the target latitude and longitude information.

8. An electronic device, characterized in that, include: processor; as well as A memory configured to store computer-executable instructions configured to be executed by the processor, the executable instructions including instructions for performing a security warning method for a home base station as described in any one of claims 1-6.

9. A storage medium, characterized in that, The storage medium is used to store computer-executable instructions that cause a computer to perform the security early warning method for a home base station as described in any one of claims 1-6.

10. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the security early warning method for home base stations as described in any one of claims 1-6.

Images