An abnormal terminal detection method and system based on double model fusion

Abstract

This invention discloses an abnormal terminal detection method and system based on dual-model fusion, belonging to the field of mobile communication network security technology. The method includes: preprocessing and windowing the signaling data of the target terminal; processing the signaling data within the window based on a bidirectional GRU autoencoder to obtain the timing anomaly score of the target terminal within that window; obtaining the statistical anomaly score of the target terminal within that window based on the statistical characteristics of the signaling data; and obtaining the detection result of the target terminal based on the timing anomaly scores and statistical anomaly scores of all windows. This invention can achieve high-precision, real-time anomaly detection across all scenarios, significantly reducing false alarms and missed alarms.

Description

Technical Field

[0001] This invention relates to the field of mobile communication network security technology, specifically to an abnormal terminal detection method and system based on dual-model fusion. Background Technology

[0002] With the large-scale deployment of fifth-generation mobile communication technology, 5G networks are rapidly penetrating various industries. Network access terminals have rapidly expanded from traditional smartphones and tablets to a massive number of heterogeneous IoT devices, industrial controllers, and vehicle-to-everything (V2X) terminals. This diversification of terminal types has led to increased complexity in access methods (such as the coexistence of cellular and non-3GPP access), significantly increasing the complexity of network access management and security. Simultaneously, this terminal diversification has also introduced serious new security threats, which can be mainly categorized into two types: First, signaling plane threats, such as unauthorized terminal spoofing, signaling flooding attacks, unauthorized acquisition of terminal location information, and abnormal session establishment. These attacks directly impact the core network signaling processing link, potentially leading to network signaling congestion or even service interruption. Second, user plane threats, including user data theft, man-in-the-middle attacks, and abnormal service traffic. These threats directly endanger user data security and privacy and may lead to the malicious occupation of network resources.

[0003] To address these threats and ensure the secure and stable operation of 5G networks, anomaly detection technology has become a crucial line of defense. Currently, anomaly detection in mobile communication networks primarily employs the following technical solutions: 1. Rule-based approach: This method matches and identifies anomalous behavior by predefining a series of security rules (e.g., "If a single terminal initiates more than 50 attach requests within one minute, it is considered abnormal"). Its advantages are intuitive rules and simple deployment. However, this method heavily relies on security expert knowledge to build and maintain the rule base, making it difficult to cope with unknown or variant attack patterns. Furthermore, when the number of rules is large, conflicts between rules are difficult to coordinate, resulting in poor system adaptability. 2. Statistical Approaches: This approach utilizes algorithms such as Isolation Forest and K-means clustering to analyze the statistical characteristics of network traffic or signaling messages (e.g., message frequency, traffic mean, variance), aiming to identify outliers that deviate from normal distribution patterns. For example, the Isolation Forest algorithm can be used to detect abnormal peaks in signaling traffic. The limitation of this approach is that it typically treats each data point as independent and identically distributed, ignoring the inherent temporal dependencies between network signaling events. Therefore, it is difficult to effectively detect attacks that depend on specific protocol interaction sequences or temporal patterns (e.g., protocol flow tampering, sequence violation attacks). 3. Traditional Machine Learning-Based Approach: This method employs classic machine learning algorithms such as Support Vector Machines, Decision Trees, and Random Forests, using labeled historical data (normal / abnormal) to train a classification model. In scenarios where the attack type is known and labeled data is sufficient, this method can achieve good detection results. However, its performance heavily relies on high-quality, large-scale labeled datasets, and obtaining anomaly labeled data across all 5G network scenarios is extremely costly. Furthermore, traditional machine learning models have limited capabilities for feature abstraction and modeling of high-dimensional, complex signaling sequence data. 4. Deep Learning-Based Approaches: To capture complex temporal patterns, this approach employs sequence models such as Long Short-Term Memory (LSTM) networks and gated recurrent units (GRUs), or uses autoencoders to learn feature representations of normal signaling sequences. For example, normal signaling sequences can be reconstructed by training an LSTM autoencoder, and the reconstruction error can be used as an anomaly criterion. While deep learning models possess strong temporal pattern learning capabilities, their sensitivity to macroscopic anomalies at the statistical level (such as sudden surges in total signaling volume within a short period) is relatively low. Furthermore, such models often suffer from a "black box" problem, making the model's decision-making process difficult to interpret, and the computational overhead for training and inference is significant, posing a challenge to 5G core network scenarios with high real-time requirements.

[0004] However, the aforementioned existing technical solutions still have the following significant defects and shortcomings when dealing with the security challenges brought about by the diversification of 5G network terminals.

[0005] First, the limitations of single detection models are significant, with blind spots. Statistical models excel at detecting traffic anomalies from an overall distribution perspective, but they cannot understand the context and sequential logic between signaling signals, making them ineffective against complex attacks such as "protocol state machine bypass." While deep learning-based sequence models can capture temporal dependencies, they are not sensitive enough to simple statistical burst anomalies. Neither type of model, when used alone, can achieve the coordinated detection of "statistical anomalies" and "temporal anomalies," making it difficult to cover all threats in 5G networks.

[0006] Secondly, the analysis of signaling timing characteristics is not deep enough. Most existing methods treat signaling messages as independent features or only perform shallow sequence analysis, failing to deeply model the strict timing and state constraints of standard signaling flows such as "RRC connection establishment → initial UE message → authentication → PDU session establishment". This makes it difficult to effectively identify timing-based attacks such as tampering, replay, and skipping of signaling flows.

[0007] Secondly, the anomaly detection thresholds lack dynamic adaptability. Existing solutions mostly use fixed empirical thresholds or statistical thresholds statically calculated based on historical data (such as "mean ± 3 standard deviations"). 5G network service load exhibits a significant tidal effect, and fixed thresholds cannot adapt to the dynamic changes in network traffic and signaling patterns. This can easily generate a large number of false alarms during peak service periods, while potentially leading to a higher false negative rate during off-peak periods.

[0008] Finally, the real-time performance and scalability of the detection system face challenges. 5G network signaling traffic is high and concurrency is high, while complex deep learning model inference is time-consuming, making it difficult to meet the real-time detection requirements with millisecond-level responses. Furthermore, existing detection solutions are mostly designed for specific protocols or scenarios (e.g., only applicable to NG interface signaling), lacking a unified and scalable framework to simultaneously adapt to various access types such as smartphones, IoT devices, and vehicle-to-everything (V2X) terminals and their heterogeneous protocols, making it difficult to achieve network-level, end-to-end security protection.

[0009] In summary, existing anomaly detection technologies suffer from inherent limitations in model capabilities, feature analysis, threshold adaptation, and system performance, making it difficult to meet the urgent needs of 5G networks for "high-precision, all-scenario, and low-latency" intelligent detection of abnormal terminal behavior. Therefore, there is a pressing need for a terminal anomaly detection solution that can deeply integrate statistical and temporal features, possess adaptive threshold adjustment capabilities, and efficiently handle high-concurrency, multi-protocol signaling streams, in order to improve the overall security level of 5G networks. Summary of the Invention

[0010] To address the aforementioned issues, this invention proposes an abnormal terminal detection method and system based on dual-model fusion, achieving high-precision, real-time anomaly detection across all scenarios and significantly reducing false alarms and missed alarms.

[0011] To achieve the above objectives, the technical solution of the present invention includes the following:

[0012] An abnormal terminal detection method based on dual-model fusion, the method comprising: Preprocessing and windowing of signaling data for the target terminal; The signaling data within the window is processed based on the bidirectional GRU autoencoder to obtain the timing anomaly score of the target terminal in the window; wherein, the bidirectional GRU autoencoder includes an encoder, a feature bottleneck layer and a decoder, the encoder is constructed based on the first bidirectional GRU layer, and the decoder is constructed based on the repeating vector layer and the second bidirectional GRU layer respectively. Based on the statistical characteristics of the signaling data within the window, obtain the statistical anomaly score of the target terminal within that window; The detection results of the target terminal are obtained based on the temporal anomaly scores and statistical anomaly scores of all windows.

[0013] Furthermore, based on the bidirectional GRU autoencoder, the signaling data within the window is processed to obtain the timing anomaly score of the target terminal within that window, including: Map the flow codes in the signaling data to one-hot vectors to obtain the signaling sequence; Based on the first bidirectional GRU layer, bidirectional features of the signaling sequence are extracted to obtain the multidimensional hidden state; By using a feature bottleneck layer to compress the features of the multidimensional hidden state, a fixed-length feature vector is obtained. The fixed-length feature vector is repeated a preset length by sliding window through a repeating vector layer to obtain serialized features; Based on the second bidirectional GRU layer, bidirectional features of the serialization features are extracted to obtain the signaling type probability distribution for each time step; The cross-entropy between the signaling type probability distribution and the one-hot vector is calculated and used as the timing anomaly score for multi-protocol signaling data.

[0014] Furthermore, the process of training the bidirectional GRU autoencoder includes: A training dataset was constructed based on normal signaling data; The bidirectional GRU autoencoder is trained on the training dataset.

[0015] Furthermore, based on the statistical characteristics of the signaling data within the window, the statistical anomaly score of the target terminal within that window is obtained, including: Extract the statistical features of the signaling data and normalize them; wherein the statistical features include: establishment count, release count, total number of messages, average interval, interval variance, handover frequency, service entropy and error rate; Normalized statistical features are input into the RCF model to obtain statistical anomaly scores.

[0016] Furthermore, based on the temporal anomaly scores and statistical anomaly scores of all windows, the detection results of the target terminal are obtained, including: The temporal anomaly scores and statistical anomaly scores for each window are normalized respectively. The normalized time-series outlier score is weighted with the normalized statistical outlier score to obtain the fused outlier score; Get the current dynamic threshold; The fusion anomaly score is compared with a dynamic threshold to obtain the detection result of the target terminal in this window; By combining the detection results from each window, the detection result of the target terminal is obtained.

[0017] Furthermore, the time-series outlier scores and statistical outlier scores are normalized, including: The mean of timing anomaly scores, the mean of statistical anomaly scores, the variance of timing anomaly score deviation, and the variance of statistical anomaly score deviation are obtained respectively from the normal signaling data. The target variance is then obtained based on the variance of timing anomaly score deviation and the variance of statistical anomaly score deviation. Based on the mean of the time-series anomaly score and the mean of the statistical anomaly score, the time-series anomaly score and the statistical anomaly score corresponding to the target terminal are respectively converted into a time-series anomaly score deviation value and a statistical anomaly score deviation value. ; Based on the target variance, the variance of the time series outlier score deviation, and the variance of the statistical outlier score deviation, the time series outlier score deviation and the statistical outlier score deviation are calibrated respectively to obtain the normalized time series outlier score and the normalized statistical outlier score.

[0018] Furthermore, the process of generating the dynamic threshold includes: Maintain a fixed-length dequeue, where the dequeue stores fusion anomaly scores where the detection result is normal; Calculate the mean and standard deviation of all fusion anomaly scores in the double-ended queue; A dynamic threshold is obtained based on the mean and standard deviation of all fusion anomaly scores; wherein the dynamic threshold is between a set lower limit and a set upper limit.

[0019] An abnormal terminal detection system based on dual-model fusion, the system comprising: The preprocessing module is used for preprocessing and windowing the signaling data of the target terminal; The timing score calculation module is used to process signaling data within a window based on a bidirectional GRU autoencoder to obtain the timing anomaly score of the target terminal in that window; wherein, the bidirectional GRU autoencoder includes an encoder, a feature bottleneck layer and a decoder, the encoder is constructed based on a first bidirectional GRU layer, and the decoder is constructed based on a repeating vector layer and a second bidirectional GRU layer respectively. The statistical score calculation module is used to obtain the statistical anomaly score of the target terminal in the window based on the statistical characteristics of the signaling data in the window; The results generation module is used to obtain the detection results of the target terminal based on the temporal anomaly scores and statistical anomaly scores of all windows.

[0020] A computer device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the abnormal terminal detection method based on dual-model fusion as described above.

[0021] A computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the abnormal terminal detection method based on dual-model fusion as described above.

[0022] Compared with the prior art, the present invention has at least the following beneficial effects.

[0023] Significantly improved detection accuracy: Compared with single sequence models (such as bidirectional LSTM autoencoders), this invention significantly improves the recall rate for statistical anomalies (such as a high proportion of erroneous signaling in a single terminal); compared with a single RCF model, it significantly improves the detection accuracy for temporal anomalies (such as protocol sequence violations).

[0024] Highly adaptive: The dynamic threshold mechanism can automatically adjust the judgment criteria according to changes in the network environment (such as a sudden increase in signaling traffic during the morning peak), without the need for manual intervention.

[0025] Real-time performance meets 5G requirements: Improve real-time performance and meet the real-time requirements of the 5G core network by using model lightweighting (such as GRU to replace deep LSTM) and parallel inference.

[0026] High scalability: Supports multiple signaling protocols such as NGAP and RRC, and can be adapted to multiple terminal types such as smartphones, IoT devices, and vehicle networking terminals; Model parameters support dynamic adjustment (such as window size and number of GRU neurons), and can be flexibly configured according to the network scale and business scenarios of different operators.

[0027] Low deployment cost: Model training supports both batch and online modes. Online training only requires a small amount of new data (such as 1% of normal signaling data added daily) to update parameters, without the need for full retraining. It also supports linkage with existing core network PCC policies (such as issuing access control policies through PCF), without the need to reconstruct the network architecture, thus significantly reducing deployment costs.

[0028] More precise hierarchical control: By matching three levels of anomalies with differentiated strategies, "one-size-fits-all" control is avoided: normal terminals do not interfere with business, terminals with minor anomalies retain basic access rights, and terminals with severe anomalies are quickly disconnected to block risks; at the same time, it is deeply linked with the core network PCC policy to ensure that security control policies can be implemented. Compared with the traditional single control method, the impact on user business is reduced and the efficiency of risk blocking is improved. Attached Figure Description

[0029] Figure 1 This is the overall flowchart of this method.

[0030] Figure 2 Sequence model flowchart.

[0031] Figure 3Statistical model flowchart.

[0032] Figure 4 Flowchart of dual-model fusion. Detailed Implementation

[0033] To enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings.

[0034] The anomaly detection system of this invention adopts a modular architecture, with each component working together to achieve the entire process of "data input - feature processing - dual-model detection - fusion decision - result output", as shown in the specific architecture below. Figure 1 As shown.

[0035] I. Data Preprocessing Module.

[0036] This data preprocessing module is used to access multi-protocol signaling data (NGAP, RRC, etc.), parse the data packet format, unify the timestamp (e.g., convert it to "YYYY-MM-DD HH:MM:SS.sss"), and clean up outliers (e.g., signaling with missing procedure codes).

[0037] In addition, this data preprocessing module is also used to segment the signaling stream using a fixed-length sliding window (e.g., a window size of 7), with a window step size of m (i.e., the window slides m positions forward for every m new signaling messages received), ensuring real-time capture of short-term temporal dependencies. For example, if the signaling stream is [S1,S2,S3,S4,S5,S6,S7,S8] with a step size of 1, then the first window is [S1-S7], and the second window is [S2-S8].

[0038] II. Sequence Model Module.

[0039] This sequence model module is based on a bidirectional GRU autoencoder. It models the timing features of the signaling sequence within a sliding time window and outputs the reconstruction error as a timing anomaly score.

[0040] The GRU model simplifies the gate mechanism through an "update gate + reset gate," resulting in advantages such as reduced parameter size, fast training convergence, low inference overhead, accurate capture of signaling timing correlations, and effective identification of anomalies like protocol violations and out-of-order signaling. Based on these advantages, this invention further customizes the GRU model by introducing a bidirectional structure. Parallel forward and backward GRUs synchronously extract the forward dependencies (e.g., the normal flow of "RRC establishment → initial UE message") and reverse correlations (e.g., the logical closed loop of "PDU session release → RRC release") of signaling sequences, improving the accuracy of identifying complex timing anomalies. Combined with an autoencoder architecture, an unsupervised learning mode of "encoding-compression-decoding" is adopted, requiring only normal signaling data for training. This reconstructs the error quantification of the deviation of the signaling sequence from the normal pattern, solving the problem of difficult labeling of abnormal samples in 5G scenarios. The resulting bidirectional GRU autoencoder retains the low overhead and timing modeling advantages of the GRU model, while also enhancing the adaptability of 5G signaling detection through structural modifications, thus becoming the core implementation of the timing model in this paper.

[0041] Specifically, the sequence model models the temporal dependencies of signaling sequences. Its core is a bidirectional GRU autoencoder, which analyzes temporal pattern anomalies through an "encoding-compression-decoding" process. The specific design is as follows: Figure 2 As shown.

[0042] (a) Input encoding.

[0043] The signaling procedure code is mapped to a one-hot vector containing n known signaling types, and the length of the encoded vector is n+1 (n known types + 1 unknown type as a fallback).

[0044] (ii) Self-encoder structure.

[0045] The autoencoder employs a "symmetric bidirectional GRU" structure, consisting of three parts: an encoder, a feature bottleneck layer, and a decoder. The encoder includes a bidirectional GRU layer that performs bidirectional feature extraction on the signaling sequence within the input window (e.g., capturing the dependency between S1 and S7 forward and the dependency between S7 and S1 backward), outputting multidimensional hidden states (e.g., 128 dimensions each in both directions). The feature bottleneck layer compresses features through a fully connected layer to obtain a fixed-length feature vector, reducing information redundancy. The decoder uses a RepeatVector layer to repeat the feature vector across a sliding window of a preset length (matching the window length), inputting it into the bidirectional GRU reconstructed sequence, and finally outputting the signaling type probability distribution for each time step.

[0046] (iii) Comparator and reconstruction error.

[0047] Using cross-entropy loss as the temporal anomaly score: For each sliding window, calculate the cross-entropy between the probability distribution of the model output and the input encoding vector, using the following formula: Where N is the window length (e.g., 7) and M is the total number of signaling types (e.g., 38). One-hot encoding (0 or 1) for input signaling. This represents the probability output by the model. A higher Loss value indicates that the signaling sequence within the window is more difficult to reconstruct from a normal pattern, and the degree of temporal anomaly is higher.

[0048] (iv) Training optimization.

[0049] The main aspects of training optimization include: 1. The training data uses normal signaling sequences (such as signaling from user terminals and IoT devices in attack-free scenarios), and the model is optimized with the goal of "reconstructing normal sequences"; 2. Introduce EarlyStopping (monitoring the loss and stopping training if it does not decrease for several consecutive rounds) and Dropout to avoid overfitting; 3. Supports online training: Regularly (e.g., daily) update model parameters with newly collected normal signaling data to adapt to the evolution of signaling patterns (e.g., specific signaling types for newly added IoT devices).

[0050] III. Statistical Model Module.

[0051] The statistical model module in this embodiment is based on the RCF algorithm, which extracts signaling statistical features (such as total number of messages, switching frequency, and service entropy) within the sliding time window and outputs a statistical anomaly score.

[0052] The statistical model models the macroscopic statistical characteristics of signaling traffic. Its core is the RCF algorithm, which detects statistical anomalies using multiple randomly cleaved trees (RCTrees). The specific design is as follows: Figure 3 As shown.

[0053] (a) Statistical feature extraction.

[0054] This embodiment extracts multidimensional statistical features from signaling data within a sliding time window (e.g., a 5-second time window) to ensure coverage of dimensions such as "quantity, frequency, distribution, and error rate." These multidimensional statistical features are shown in Table 1. Table 1. Statistical Characteristics Then, the extracted features are standardized to avoid the model's judgment being affected by differences in feature magnitude (e.g., the range of "total number of messages" is 10-100, and the range of "error rate" is 0-1).

[0055] (II) RCF model construction and outlier score calculation.

[0056] 1. Model initialization: Construct multiple RCF forests (configurable) to form an RCF forest, with each tree having a maximum of k leaf nodes (to avoid inference delays caused by excessive tree depth). 2. Incremental data processing: For each new statistical feature vector (corresponding to a t-second time window), insert it into each RTree and automatically delete the earliest inserted node in the tree (if the number of leaf nodes exceeds k), supporting real-time processing of streaming data; 3. Anomaly Score Calculation: The statistical anomaly score is calculated using "Cooperative Outlier Scale (CODISP)": For the inserted feature vector, the ratio of its path length in each RTree to the average path length of nodes at the same depth is calculated, and the average of multiple trees is taken as the final statistical anomaly score. The higher the score, the further the feature vector deviates from the normal statistical distribution.

[0057] IV. Model Fusion Module.

[0058] To address the issues of inconsistent output scales and fixed weight allocation between sequence models and statistical models, this invention designs a fusion mechanism of bias calibration and adaptive weights to ensure complementary advantages between the two models. Figure 4 This is a flowchart of the dual-model fusion process.

[0059] (a) Normalization.

[0060] During the model training phase, the "normal baseline value" of the two models is calculated based on normal signaling data, and the output scale is unified through scaling calibration.

[0061] Baseline value calculation.

[0062] (1) Preliminary value of sequence model ( ): For the normal signaling window in the training set, calculate the mean of the timing anomaly scores; (2) Statistical model baseline value ( ): For the normal statistical feature vectors in the training set, calculate the mean of the statistical anomaly scores; 2. Deviation Standardization: Converts the model output in real-time detection into "deviation relative to the baseline value", the formula is: in, For real-time time-series anomaly scores, To collect abnormal scores in real time, , These are the deviation values ​​for the sequence model and the statistical model, respectively (deviation > 1 indicates deviation from the normal pattern). 3. Variance Alignment: Calculate the variance of the deviation from the normal data during the training phase (…). The variances of the two models are adjusted to the same level (such as the target variance) through scaling calibration. The formula is: in, , The calibrated deviation value ensures that the outputs of the two models are comparable.

[0063] (II) Dynamic weight allocation and calculation of comprehensive score.

[0064] Model weights are dynamically assigned based on the calibrated deviation values. Models with higher deviation values ​​have greater weights during fusion (indicating that the model is currently more sensitive to anomalies).

[0065] 1. Weight calculation.

[0066] Weights of sequence models Weights of the statistical model They are respectively: Among them, the smoothing coefficient (To avoid a denominator of 0) .

[0067] 2. Calculation of fused scores.

[0068] Final fusion anomaly score The fusion anomaly score The combined detection results of the two models cover both temporal and statistical anomalies.

[0069] (iii) Dynamic threshold adjustment mechanism.

[0070] To adapt to changes in the network environment (such as increased signaling traffic during peak hours), this invention establishes a dynamic threshold mechanism based on "normal behavior history".

[0071] 1. Normal history management: Maintain a fixed-length double-ended queue (e.g., queue length 30) to store the fusion scores of those recently detected as "normal". If the test result is "abnormal", it will not be added to the queue to avoid contaminating the normal behavior distribution; 2. Threshold Calculation: A dynamic threshold is calculated based on the normal scores in the queue. The formula is: in, This represents the mean of the normal scores. Standard deviation, The adjustment coefficient is 2.1 by default, which can be adjusted according to the detection accuracy requirements: the larger the coefficient, the lower the false alarm rate and the higher the false alarm rate; conversely, the smaller the coefficient, the higher the false alarm rate and the lower the false alarm rate.

[0072] In a preferred embodiment, the present invention further sets upper and lower limits for the threshold (e.g., This avoids the threshold being too high or too low due to short-term abnormal data (such as 1-2 high-scoring normal samples mixed in the queue).

[0073] (iv) Output the test results.

[0074] The above final fusion anomaly score With dynamic threshold The results are compared to obtain the anomaly detection results of the terminal. If it is determined to be "normal", the fusion score is added to the normal history queue; if it is determined to be "abnormal", as shown in Table 2, the abnormal terminal ID (such as UE SUPI), abnormal level, abnormal type and triggering conditions are recorded. Table 2 Comparison Table of Anomaly Levels, Security Control Strategies, and Triggering Conditions If the anomaly is determined to be Level 1 (minor anomaly), a "minor anomaly alarm" (including terminal ID, rate limiting measures, and anomaly score) is sent to the network management system. No manual intervention is required; the system will automatically execute the rate limiting policy. If the anomaly is determined to be Level 2 serious, a "serious anomaly alarm" will be sent immediately, and the core network PCC policy will be linked: the Npcf_PolicyAuthorization service will be called through the security control function to issue a "disconnect PDU session" security control policy to the PCF network element. The PCF will generate the corresponding session management PCC rules and issue them to the SMF. The SMF and UPF will work together to execute the disconnection operation to completely block the network access of the abnormal terminal. Once the abnormal terminal returns to normal (five consecutive tests showing a level of 0), the system will automatically lift the rate limit or re-establish the PDU session, restoring the terminal's normal network service.

[0075] To verify the technical effectiveness of this invention, researchers built an experimental environment on the Free5GC open-source core network platform, constructing two types of datasets: core network scenario and base station scenario (anomaly types covering frequent registration, frequent handover, and out-of-order signaling). The performance of this invention was compared with existing technologies (single model, traditional anomaly detection methods), and the experimental results are shown in Tables 3 and 4. Performance metrics include precision, recall, F1 score, false positive rate (FPR), false negative rate (FNR), and AUC-ROC. Table 3 Comparison of Core Network Scene Detection Performance Table 4 Comparison of Base Station Scene Detection Performance Experimental results show that the anomaly detection scheme proposed in this invention, which integrates the bidirectional GRU autoencoder and the RCF statistical model, exhibits significantly better overall performance than single models (bidirectional GRU, RCF) and traditional anomaly detection methods (isolated forest, LOF, type-1 SVM, PCA) in both core network and base station scenarios.

[0076] In summary, the dual-model collaborative architecture of this invention is the first to deeply integrate the "bidirectional GRU sequence autoencoder" and the "RCF statistical model". The sequence model captures the temporal dependencies of signaling, while the statistical model captures macroscopic statistical features. The two types of models complement each other, covering the entire scenario of "temporal anomalies + statistical anomalies" and solving the problem of blind spots in single-model detection.

[0077] This invention, through a bidirectional GRU and sliding window mechanism, not only analyzes the "type characteristics" of signaling, but also mines the "sequence dependencies" between signaling (such as the normal process of "RRC establishment → initial UE message"), and can accurately identify complex attacks such as protocol sequence tampering and signaling timing flooding.

[0078] This invention designs a deviation calibration mechanism to unify the output scale of the two models, avoiding fusion failure due to differences in the magnitude of the model outputs; at the same time, it dynamically allocates weights based on real-time deviation values ​​to ensure that the advantages of each model can be fully utilized in different scenarios (such as when the statistical model is more sensitive during peak hours).

[0079] This invention updates the threshold in real time based on the historical queue of normal behavior, adapting to changes in the network environment (such as an increase in the average normal score due to increased signaling traffic during peak hours). Compared with a fixed threshold, the false alarm rate and the false negative rate are significantly reduced.

[0080] This invention employs parallel inference (synchronous computation of sequence model and statistical model) and incremental training (supporting online updating of model parameters) to meet the high concurrency requirements of 5G; it also supports multiple signaling protocols such as NGAP and RRC, and can be extended to multiple terminal scenarios such as IoT and vehicle networking.

[0081] This invention is based on a three-level control system of fusion score and abnormal duration, namely Level 0 (normal), Level 1 (mild anomaly), and Level 2 (severe anomaly), which are matched with "no processing", "rate limiting", and "disconnect PDU session" policies respectively. At the same time, it is linked with the core network PCC policy issuance process to achieve the security goal of "no interference in normal situations, controllable in mild cases, and blocking in severe cases". Moreover, the setting of the detection window is closely aligned with the complete signaling process, which further improves the accuracy of policy triggering.

[0082] Finally, it should be noted that the above description is only a preferred embodiment of the present invention, used to illustrate the technical solution of the present invention and not to limit it; those skilled in the art can modify or equivalently replace the configuration snapshot field range, cross-service relationship extraction method, predicate set design, SMT encoding strategy, solver type, and interpretation minimization implementation method without departing from the spirit and scope of the present invention, and all of these should be covered within the protection scope of the present invention.

Claims

1. An abnormal terminal detection method based on dual-model fusion, characterized in that, The method includes: Preprocessing and windowing of signaling data for the target terminal; The signaling data within the window is processed based on the bidirectional GRU autoencoder to obtain the timing anomaly score of the target terminal in the window; wherein, the bidirectional GRU autoencoder includes an encoder, a feature bottleneck layer and a decoder, the encoder is constructed based on the first bidirectional GRU layer, and the decoder is constructed based on the repeating vector layer and the second bidirectional GRU layer respectively. Based on the statistical characteristics of the signaling data within the window, obtain the statistical anomaly score of the target terminal within that window; The detection results of the target terminal are obtained based on the temporal anomaly scores and statistical anomaly scores of all windows.

2. The method according to claim 1, characterized in that, The signaling data within the window is processed based on a bidirectional GRU autoencoder to obtain the timing anomaly score of the target terminal within that window, including: Map the flow codes in the signaling data to one-hot vectors to obtain the signaling sequence; Based on the first bidirectional GRU layer, bidirectional features of the signaling sequence are extracted to obtain the multidimensional hidden state; By using a feature bottleneck layer to compress the features of the multidimensional hidden state, a fixed-length feature vector is obtained. The fixed-length feature vector is repeated a preset length by sliding window through a repeating vector layer to obtain serialized features; Based on the second bidirectional GRU layer, bidirectional features of the serialization features are extracted to obtain the signaling type probability distribution for each time step; The cross-entropy between the signaling type probability distribution and the one-hot vector is calculated and used as the timing anomaly score for multi-protocol signaling data.

3. The method according to claim 1, characterized in that, The process of training the bidirectional GRU autoencoder includes: A training dataset was constructed based on normal signaling data; The bidirectional GRU autoencoder is trained on the training dataset.

4. The method according to claim 1, characterized in that, Based on the statistical characteristics of the signaling data within the window, obtain the statistical anomaly score of the target terminal within that window, including: Extract the statistical features of the signaling data and normalize them; wherein the statistical features include: establishment count, release count, total number of messages, average interval, interval variance, handover frequency, service entropy and error rate; Normalized statistical features are input into the RCF model to obtain statistical anomaly scores.

5. The method according to claim 1, characterized in that, Based on the temporal anomaly scores and statistical anomaly scores of all windows, the detection results of the target terminal are obtained, including: The temporal anomaly scores and statistical anomaly scores for each window are normalized respectively. The normalized time-series outlier score is weighted with the normalized statistical outlier score to obtain the fused outlier score; Get the current dynamic threshold; The fusion anomaly score is compared with a dynamic threshold to obtain the detection result of the target terminal in this window; By combining the detection results from each window, the detection result of the target terminal is obtained.

6. The method according to claim 5, characterized in that, Normalization was performed on time-series outlier scores and statistical outlier scores, including: The mean of timing anomaly scores, the mean of statistical anomaly scores, the variance of timing anomaly score deviation, and the variance of statistical anomaly score deviation are obtained respectively from the normal signaling data. The target variance is then obtained based on the variance of timing anomaly score deviation and the variance of statistical anomaly score deviation. Based on the mean of the time-series anomaly score and the mean of the statistical anomaly score, the time-series anomaly score and the statistical anomaly score corresponding to the target terminal are respectively converted into a time-series anomaly score deviation value and a statistical anomaly score deviation value. ; Based on the target variance, the variance of the time series outlier score deviation, and the variance of the statistical outlier score deviation, the time series outlier score deviation and the statistical outlier score deviation are calibrated respectively to obtain the normalized time series outlier score and the normalized statistical outlier score.

7. The method according to claim 5, characterized in that, The process of generating the dynamic threshold includes: Maintain a fixed-length dequeue, where the dequeue stores fusion anomaly scores where the detection result is normal; Calculate the mean and standard deviation of all fusion anomaly scores in the double-ended queue; A dynamic threshold is obtained based on the mean and standard deviation of all fusion anomaly scores; wherein the dynamic threshold is between a set lower limit and a set upper limit.

8. An abnormal terminal detection system based on dual-model fusion, characterized in that, The system includes: The preprocessing module is used for preprocessing and windowing the signaling data of the target terminal; The timing score calculation module is used to process signaling data within a window based on a bidirectional GRU autoencoder to obtain the timing anomaly score of the target terminal in that window; wherein, the bidirectional GRU autoencoder includes an encoder, a feature bottleneck layer and a decoder, the encoder is constructed based on a first bidirectional GRU layer, and the decoder is constructed based on a repeating vector layer and a second bidirectional GRU layer respectively. The statistical score calculation module is used to obtain the statistical anomaly score of the target terminal in the window based on the statistical characteristics of the signaling data in the window; The results generation module is used to obtain the detection results of the target terminal based on the temporal anomaly scores and statistical anomaly scores of all windows.

9. A computer device, characterized in that, The computer device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the abnormal terminal detection method based on dual-model fusion as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the abnormal terminal detection method based on dual-model fusion as described in any one of claims 1-7.

Images