Artificial intelligence-based 5g network slice attack tracing method, device and system

Abstract

The application provides a 5G network slice attack tracing method, device and system based on artificial intelligence, relates to the technical field of artificial intelligence, and comprises the following steps: acquiring control plane data and user plane data in a 5G network slice; performing extraction processing on the control plane data and the user plane data respectively to obtain multiple entities and corresponding entity relationships, and constructing a dynamic knowledge graph according to all the entities and the corresponding entity relationships; constructing a network topology graph according to the dynamic knowledge graph, and performing analysis and processing on the network topology graph based on a preset graph neural network to obtain a risk attack prediction result; and determining position information of an attack target according to the risk attack prediction result. The application integrates the control plane data and the user plane data to construct a dynamic knowledge graph, provides a comprehensive and rich information basis for attack tracing, and thus avoids the problem of inaccurate attack tracing caused by insufficient information.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and more specifically, to a method, apparatus, and system for tracing the source of 5G network slicing attacks based on artificial intelligence. Background Technology

[0002] With the widespread application of 5G networks, network slicing technology has become crucial for achieving flexible allocation of network resources and diversified services. However, the complexity and openness of 5G network slicing also present it with severe security challenges. Network attack methods are becoming increasingly sophisticated and diverse, allowing attackers to intrude into network slices through various means to steal sensitive information, disrupt services, or launch malicious traffic attacks.

[0003] Traditional network security defense methods primarily rely on pre-defined rules and feature matching, which often struggle to detect and trace attacks in a timely and effective manner when faced with complex and ever-changing attack methods. These methods typically can only detect known attack patterns, and their detection capabilities are limited for new or highly covert attacks, failing to meet the high security requirements of 5G network slicing. While some AI-based attack attribution methods have been proposed, they mostly focus only on network traffic data or a specific part of the network topology, making it difficult to comprehensively and accurately reflect the network status. Summary of the Invention

[0004] The problem solved by this invention is one or more of the aforementioned related technical problems.

[0005] To address the aforementioned issues, this invention provides a method, apparatus, and system for tracing the source of 5G network slicing attacks based on artificial intelligence.

[0006] In a first aspect, the present invention provides a method for tracing the source of 5G network slicing attacks based on artificial intelligence, comprising: Acquire control plane and user plane data from 5G network slices; The control plane data and the user plane data are extracted and processed respectively to obtain multiple entities and their corresponding entity relationships, and a dynamic knowledge graph is constructed based on all the entities and their corresponding entity relationships. A network topology graph is constructed based on the dynamic knowledge graph, and the network topology graph is analyzed and processed based on a preset graph neural network to obtain risk attack prediction results. The location information of the target area is determined based on the risk attack prediction results.

[0007] Optionally, the step of extracting data from the control plane data and the user plane data to obtain multiple entities and their corresponding entity relationships includes: Select the corresponding preset recognition method, and extract the control plane data and the user plane data according to the corresponding preset recognition method to obtain the corresponding initial entity and the corresponding initial entity relationship; Perform a homogeneous merging process on all the initial entities and their corresponding initial entity relationships to obtain the entities and their corresponding temporary entity relationships; The temporary entity relationships are fused based on a preset reinforcement learning model to obtain the corresponding entity relationships; The control plane data includes SFM policies and AMF authentication records; the user plane data includes UPF traffic protocol type and destination IP.

[0008] Optionally, the fusion of the temporary entity relationships based on a preset reinforcement learning model to obtain the corresponding entity relationship includes: Construct the reinforcement learning model and perform initialization operations on the reinforcement learning model, including parameter initialization, defining the state space and action space; The entity and its corresponding temporary entity relationship are input into the reinforcement learning model to obtain the corresponding entity relationship.

[0009] Optionally, the step of inputting the entity and the corresponding temporary entity relationship into the reinforcement learning model to obtain the corresponding entity relationship includes: The reward value is determined based on each of the entities and the corresponding temporary entity relationships; The policy gradient is determined based on the reward value, and the policy network parameters of the reinforcement learning model are updated according to the policy gradient to maximize the expected cumulative reward. The optimal fusion strategy for each temporary entity relationship is determined based on the updated strategy network parameters to obtain the entity relationship.

[0010] Optionally, the dynamic knowledge graph includes node data and corresponding relationship data; the step of constructing a network topology graph based on the dynamic knowledge graph and analyzing and processing the network topology graph based on a preset graph neural network to obtain risk attack prediction results includes: Feature extraction is performed on the node data and the corresponding relationship data respectively to obtain node feature data and corresponding relationship feature data; The network topology graph is constructed based on all the node feature data and the corresponding relationship feature data, and the network topology graph is input into the graph neural network to obtain the risk attack prediction result; The graph neural network includes a multi-graph attention mechanism module and a GNN module.

[0011] Optionally, the network topology graph includes node information and corresponding relationship information; the step of inputting the network topology graph into the graph neural network to obtain the risk attack prediction result includes: The multi-graph attention mechanism module processes the node information and the corresponding relationship information to obtain attention weight data, and obtains a node feature matrix based on the node information and the attention weight data. The node feature matrix is ​​processed by the GNN module to obtain the risk attack prediction result; The risk attack prediction results include probability data of risk attack predictions corresponding to each of the node information or the relationship information.

[0012] Optionally, the risk attack prediction result includes probability data of risk attack prediction; the risk attack prediction result includes probability data of risk attack prediction; after analyzing and processing the network topology graph based on a preset graph neural network to obtain the risk attack prediction result, it further includes: Based on preset logical rules, countermeasure instructions are generated according to the risk attack prediction results, and the countermeasure instructions are executed, including: Based on preset logical rules, countermeasure instructions are generated according to the risk attack prediction results, including: The probability data of each risk attack prediction is compared with the corresponding preset risk threshold to obtain the comparison result; The comparison result is matched with the logical rule to obtain the target logical rule, and the countermeasure instruction is generated according to the target logical rule.

[0013] Optionally, the AI-based 5G network slicing attack tracing method further includes: Obtain the feedback result of the countermeasure command and the real-time network status of the 5G network slice; The weight parameters of the graph neural network are dynamically adjusted based on the feedback results and the real-time network status, and the dynamic knowledge graph is updated based on the feedback results.

[0014] Secondly, the present invention provides an artificial intelligence-based 5G network slicing attack tracing device, comprising: The acquisition unit is used to acquire control plane data and user plane data in 5G network slices. An extraction unit is used to extract the control plane data and the user plane data respectively to obtain multiple entities and their corresponding entity relationships, and to construct a dynamic knowledge graph based on all the entities and their corresponding entity relationships. The prediction unit is used to construct a network topology graph based on the dynamic knowledge graph, and to analyze and process the network topology graph based on a preset graph neural network to obtain risk attack prediction results. The processing unit is used to determine the location information of the target based on the risk attack prediction results.

[0015] Thirdly, the present invention provides an artificial intelligence-based 5G network slice attack tracing system, including a memory and a processor; the memory is used to store a computer program; the processor is used to implement the artificial intelligence-based 5G network slice attack tracing method as described in the first aspect when the computer program is executed.

[0016] The beneficial effects of the artificial intelligence-based 5G network slicing attack tracing method, device, and system of the present invention are: First, control plane and user plane data from the 5G network slice are acquired. The control plane data includes SMF policies and AMF authentication records. The SMF policies specify IP address allocation and QoS rules for user equipment, while the AMF authentication records include authentication information for user equipment accessing the network. The user plane data covers UPF traffic protocol type and destination IP, reflecting the traffic transmission characteristics and data flow direction of the user equipment, respectively.

[0017] Machine learning algorithms (such as named entity recognition models) or predefined rules are used to identify and extract entities and their relationships. For example, user equipment identifiers and session identifiers are extracted from SMF policies, and authentication time and results are extracted from AMF authentication records. Subsequently, these entities and their relationships are integrated to construct a dynamic knowledge graph, which not only contains basic entity information but also covers the associations and interactions between entities, such as the connection relationship between user equipment and base stations.

[0018] Based on entities and relationships in a dynamic knowledge graph, a network topology graph is constructed, where entities are nodes and relationships are edges. Then, a pre-defined graph neural network (e.g., a hybrid model fusing multi-graph attention mechanisms and adaptive graph convolutional networks) is used for analysis. The multi-graph attention mechanism assigns different weights to edges of different relationship types, and the adaptive graph convolutional network learns the local neighborhood features of nodes and adjusts the convolutional kernel size, ultimately outputting the risk attack prediction results for each node or path.

[0019] Risk attack prediction results typically provide a risk attack prediction probability value for each node or path. This probability value quantifies the likelihood of the node or path being attacked. Nodes with probability values ​​higher than a set threshold can be filtered out, and these nodes are potential targets for attack. By using graph neural networks to analyze the connection paths between high-risk nodes, the paths that attackers may use can be identified, and key locations in the network can be determined.

[0020] Therefore, this invention, by integrating control plane and user plane data from 5G network slices, can construct a comprehensive and detailed dynamic knowledge graph, covering network configuration, policy information, and user device behavior and traffic characteristics, providing a solid data foundation for attack tracing. Secondly, by using graph neural networks to analyze the network topology, potential attack paths can be deeply explored and risk attacks accurately predicted, quickly locating the attacked location and providing crucial support for timely protection. Furthermore, this method supports real-time updates to the dynamic knowledge graph and continuous monitoring of network status, ensuring timely capture of abnormal behavior and potential threats, enabling rapid response. Simultaneously, automated risk assessment based on a pre-defined graph neural network model improves the efficiency and accuracy of risk assessment, reducing the need for manual intervention. Finally, by accurately identifying and locating the attacked location, network administrators can quickly take measures to prevent the attack from spreading, effectively reducing network losses and improving overall network security. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating a method for tracing the source of 5G network slice attacks based on artificial intelligence, according to an embodiment of the present invention. Figure 2 This is a schematic diagram of a 5G network slice attack tracing device based on artificial intelligence according to an embodiment of the present invention. Figure 3 This is a schematic diagram of the structure of a 5G network slice attack tracing system based on artificial intelligence, according to an embodiment of the present invention. Detailed Implementation

[0022] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Although some embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the accompanying drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0023] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0024] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to"; the term "based on" means "at least partially based on"; the term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments"; and the term "optionally" means "optional embodiments". Definitions of other terms will be given in the following description. It should be noted that the concepts of "first," "second," etc., mentioned in this invention are used only to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0025] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0026] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0027] To address the problems existing in the aforementioned related technologies, embodiments of the present invention provide an artificial intelligence-based method, apparatus, system, and storage medium for tracing the source of 5G network slicing attacks.

[0028] like Figure 1 As shown in the figure, an embodiment of the present invention provides a method for tracing the source of 5G network slicing attacks based on artificial intelligence, including: Step S100: Obtain control plane data and user plane data from the 5G network slice.

[0029] Specifically, control plane data typically includes SFM policies and AMF authentication records; user plane data typically includes UPF traffic protocol type and destination IP. SFM policies can be collected from the Session Management Function (SMF) entity of the 5G core network, corresponding to the control plane data of the 5G network slice. The SMF is responsible for handling session management tasks for user equipment, and its policy data contains key configurations and rules. For example, it specifies the IP address allocation mechanism for user equipment, ensuring that each device can be uniquely identified and located in the network. In addition, it includes QoS (Quality of Service) rules, which specify parameters such as the priority, bandwidth allocation, and latency requirements of different service data flows, thereby ensuring the network experience of critical services.

[0030] AMF Authentication Record Collection: Authentication records can be obtained from the Access and Mobility Management Function (AMF) entity. The AMF manages the authentication process when user equipment accesses the network, and its records detail information such as the user equipment's authentication requests, authentication responses, and authentication results. These records help trace the user equipment's access history, verify the device's legitimacy, and prevent unauthorized devices from intruding into the network.

[0031] UPF Traffic Protocol Type Collection: User plane data is collected at the User Plane Function (UPF) entity, with a focus on traffic protocol types. UPF is responsible for forwarding and processing user data. By monitoring its traffic protocol types (such as TCP, UDP, etc.), we can understand the characteristics and behavior patterns of data transmission under different protocols, and then analyze the traffic distribution of various services in the network.

[0032] Destination IP Address Collection: This section collects the destination IP address information for data transmission within the UPF. The destination IP address reflects the target server or network location for user equipment communication. Analyzing the destination IP allows for tracing data flow, identifying interactions with external networks, and promptly detecting abnormal communication targets, such as unknown malicious IP addresses.

[0033] The acquired raw data undergoes cleaning to remove noisy data, erroneous records, and duplicate information. For example, obviously abnormal traffic values ​​and incorrectly formatted authentication records are filtered out to ensure the data quality for subsequent analysis.

[0034] Control plane and user plane data from different data sources are converted into a unified format. Since data generated by entities such as SMF, AMF, and UPF may differ in structure and representation, data conversion ensures a unified format, facilitating subsequent data integration and analysis.

[0035] Integrating control plane and user plane data provides a comprehensive and rich information foundation for attack attribution. Control plane data reveals network configurations, policies, and user device access status, while user plane data reflects device traffic characteristics and communication behavior, avoiding information gaps caused by a single data source and improving the accuracy of attack attribution. SMF policy data clarifies IP address allocation and QoS rules, AMF authentication records help trace device access history, and UPF traffic protocol type and destination IP address information depicts traffic distribution and communication flow, enabling the attribution system to accurately locate the attack source and path. Simultaneously, real-time monitoring and analysis of these two types of data allows network administrators to promptly detect abnormal behavior and potential problems, quickly respond to network events, reduce downtime, and improve network reliability and stability. Furthermore, in-depth analysis of this data can provide valuable insights for network planning and optimization; analyzing traffic protocol types and destination IP address distribution can optimize network resource allocation and improve network performance and efficiency.

[0036] Step S200: Extract and process the control plane data and the user plane data respectively to obtain multiple entities and their corresponding entity relationships, and construct a dynamic knowledge graph based on all the entities and their corresponding entity relationships.

[0037] Specifically, control plane and user plane data are extracted according to preset extraction methods, such as machine learning algorithms (e.g., named entity recognition models) and predefined rules. Entities are extracted from SMF policies, such as user equipment identifiers and session identifiers; entities are extracted from AMF authentication records, such as authentication time and results; and corresponding entities are extracted from UPF traffic protocol type and destination IP address information. Simultaneously, relationships between entities are identified, such as the connection relationship between user equipment and base station, and the communication relationship between user equipment and destination IP.

[0038] Entities and their corresponding relationships are integrated to construct an initial dynamic knowledge graph. A real-time update mechanism is then used to dynamically update the knowledge graph, ensuring it reflects changes in network status in real time. For example, when a new user device connects to the network or a new traffic pattern emerges, the entities and relationships in the knowledge graph are updated promptly.

[0039] By comprehensively utilizing machine learning algorithms and predefined rules, entities and their relationships can be accurately extracted from complex control plane and user plane data, forming a comprehensive and accurate data integration that provides a rich and reliable information foundation for attack attribution analysis. The constructed dynamic knowledge graph can reflect real-time network dynamics, clearly displaying entities and their relationships within the network, which helps to quickly and accurately locate attack sources and attack paths, improving the efficiency and accuracy of attack attribution. Furthermore, the real-time update mechanism of the dynamic knowledge graph enables the system to continuously monitor network state changes, promptly detect potential security threats, and provide real-time monitoring and early warning capabilities for network security management.

[0040] Step S300: Construct a network topology graph based on the dynamic knowledge graph, and analyze and process the network topology graph based on a preset graph neural network to obtain risk attack prediction results.

[0041] Specifically, node data and edge data (relationship data) can be extracted through dynamic knowledge graphs, and a network topology graph can be constructed based on the node data and edge data. The network topology graph is then processed according to a set graph neural network (such as GCN model, GNN model, etc.) to output the risk attack prediction results for each node or path.

[0042] By constructing a network topology graph and utilizing graph neural networks for analysis, potential attack paths can be deeply uncovered. Graph neural networks comprehensively consider node and edge features and their complex relationships to achieve accurate prediction of risk attacks and improve the accuracy of attack attribution. It efficiently processes complex network topologies, rapidly analyzes large-scale data, and enhances analysis efficiency by highlighting important features and ignoring irrelevant or low-relevance features through multi-graph attention mechanisms and adaptive graph convolutional networks. Combined with real-time updates of a dynamic knowledge graph, the system can monitor network status in real time and promptly detect potential threats. Based on the risk prediction results, measures can be taken in advance to prevent and block attacks, reducing network losses.

[0043] Step S400: Determine the location information of the target based on the risk attack prediction result.

[0044] Specifically, the risk attack prediction results provide a predicted probability value for each node or path, quantifying its likelihood of being attacked. A risk threshold, such as 0.7, can be set based on network security policies and historical data as a benchmark for judging high-risk attacks.

[0045] The predicted probability values ​​of risk attacks are compared with preset risk thresholds to filter out nodes with probabilities exceeding the thresholds, identifying them as potential targets. Graph neural networks are used to analyze the connection paths between high-risk nodes, identifying paths that attackers might exploit and determining key locations in the network. Using a network topology map, high-risk nodes are pinpointed to specific network devices or links, such as specific base stations, user equipment, or servers. Entity relationships from a dynamic knowledge graph are integrated with other security monitoring data (such as intrusion detection system logs) to verify the identified attack locations, improving the accuracy and reliability of attribution.

[0046] From the perspective of network architecture and data flow, analyze the vulnerabilities of attacked locations and the attacker's intrusion methods. Compile relevant information on attacked locations, generate an attribution report, and provide detailed information to the security team to guide the formulation of subsequent defense strategies and incident response.

[0047] Through detailed risk assessment and location identification procedures, the most likely attack locations within the network can be accurately pinpointed, helping network administrators quickly concentrate resources to strengthen protection and emergency response, minimizing the impact of attacks. Real-time risk monitoring and rapid location identification allow network administrators to immediately identify the attack location and promptly take measures such as strengthening firewall rules, reconfiguring network equipment, and blocking malicious IP addresses to effectively curb the spread of attacks. In-depth analysis of the attack location reveals network vulnerabilities, facilitating targeted strengthening of security strategies, such as adding security protection equipment, updating security protocols, and implementing more stringent security audits on critical equipment. Accurately and promptly identifying the attack location and implementing effective measures can significantly reduce the impact of attacks on business operations, lower the risk of economic losses and business interruption, and maintain corporate financial stability and service continuity. Furthermore, automated location identification and verification processes reduce the time and labor costs of manual investigation, improve the efficiency of security teams in handling security incidents, and generate detailed source reports that lay a solid foundation for subsequent adjustments to security strategies and incident handling.

[0048] In this embodiment, the AI-based 5G network slicing attack tracing method first acquires control plane data and user plane data from the 5G network slice. The control plane data includes SMF policies and AMF authentication records. The SMF policies specify the IP address allocation and QoS rules for user equipment, while the AMF authentication records include authentication information when the user equipment accesses the network. The user plane data covers UPF traffic protocol type and destination IP, reflecting the traffic transmission characteristics and data flow direction of the user equipment, respectively.

[0049] Machine learning algorithms (such as named entity recognition models) or predefined rules are used to identify and extract entities and their relationships. For example, user equipment identifiers and session identifiers are extracted from SMF policies, and authentication time and results are extracted from AMF authentication records. Subsequently, these entities and their relationships are integrated to construct a dynamic knowledge graph, which not only contains basic entity information but also covers the associations and interactions between entities, such as the connection relationship between user equipment and base stations.

[0050] Based on entities and relationships in a dynamic knowledge graph, a network topology graph is constructed, where entities are nodes and relationships are edges. Then, a pre-defined graph neural network (e.g., a hybrid model fusing multi-graph attention mechanisms and adaptive graph convolutional networks) is used for analysis. The multi-graph attention mechanism assigns different weights to edges of different relationship types, and the adaptive graph convolutional network learns the local neighborhood features of nodes and adjusts the convolutional kernel size, ultimately outputting the risk attack prediction results for each node or path.

[0051] Risk attack prediction results typically provide a risk attack prediction probability value for each node or path. This probability value quantifies the likelihood of the node or path being attacked. Nodes with probability values ​​higher than a set threshold can be filtered out, and these nodes are potential targets for attack. By using graph neural networks to analyze the connection paths between high-risk nodes, the paths that attackers may use can be identified, and key locations in the network can be determined.

[0052] Therefore, this invention, by integrating control plane and user plane data from 5G network slices, can construct a comprehensive and detailed dynamic knowledge graph, covering network configuration, policy information, and user device behavior and traffic characteristics, providing a solid data foundation for attack tracing. Secondly, by using graph neural networks to analyze the network topology, potential attack paths can be deeply explored and risk attacks accurately predicted, quickly locating the attacked location and providing crucial support for timely protection. Furthermore, this method supports real-time updates to the dynamic knowledge graph and continuous monitoring of network status, ensuring timely capture of abnormal behavior and potential threats, enabling rapid response. Simultaneously, automated risk assessment based on a pre-defined graph neural network model improves the efficiency and accuracy of risk assessment, reducing the need for manual intervention. Finally, by accurately identifying and locating the attacked location, network administrators can quickly take measures to prevent the attack from spreading, effectively reducing network losses and improving overall network security.

[0053] Optionally, the step of extracting data from the control plane data and the user plane data to obtain multiple entities and their corresponding entity relationships includes: Select the corresponding preset recognition method, and extract the control plane data and the user plane data according to the corresponding preset recognition method to obtain the corresponding initial entity and the corresponding initial entity relationship; Perform a homogeneous merging process on all the initial entities and their corresponding initial entity relationships to obtain the entities and their corresponding temporary entity relationships; The temporary entity relationships are fused based on a preset reinforcement learning model to obtain the corresponding entity relationships; The control plane data includes SFM policies and AMF authentication records; the user plane data includes UPF traffic protocol type and destination IP.

[0054] Optionally, the fusion of the temporary entity relationships based on a preset reinforcement learning model to obtain the corresponding entity relationship includes: Construct the reinforcement learning model and perform initialization operations on the reinforcement learning model, including parameter initialization, defining the state space and action space; The entity and its corresponding temporary entity relationship are input into the reinforcement learning model to obtain the corresponding entity relationship.

[0055] Optionally, the step of inputting the entity and the corresponding temporary entity relationship into the reinforcement learning model to obtain the corresponding entity relationship includes: The reward value is determined based on each of the entities and the corresponding temporary entity relationships; The policy gradient is determined based on the reward value, and the policy network parameters of the reinforcement learning model are updated according to the policy gradient to maximize the expected cumulative reward. The optimal fusion strategy for each temporary entity relationship is determined based on the updated strategy network parameters to obtain the entity relationship.

[0056] Specifically, based on data type and characteristics, preset identification methods are selected for control plane data and user plane data respectively. Named entity recognition models and regular expressions are used to extract entities such as user equipment identifiers and session identifiers from SMF policies, identifying the relationships between them to form initial entity relationships. User equipment identifiers, authentication times, and other entities and their relationships are extracted from AMF authentication records. Corresponding entities and relationships are extracted from UPF traffic protocol types and destination IPs.

[0057] All initial entities and their relationships are merged based on their common origin, including: Extract entity features from the initial entity, such as user equipment identifier, IP address, and geographical location; The similarity between entities is calculated using methods such as cosine similarity or Jaccard similarity, and a similarity threshold (e.g., 0.8) is set. Entities with similarity exceeding the threshold are merged to solve the problem of inconsistent representation of the same entity in different data sources.

[0058] Construct a reinforcement learning model, initialize parameters (such as randomly initializing weight parameters and setting the learning rate to 0.01), and define the state space (including feature vectors of entities and their relationships) and action space (such as operations like retaining, deleting, and merging relationships).

[0059] The reward value is determined based on each entity and its temporary entity relationships, taking into account the accuracy, consistency, and importance of the relationships. For example, if the merged entity relationships match known real relationships, a positive reward is given; otherwise, a negative reward is given. The reward value for each temporary entity relationship is calculated based on the reward function.

[0060] The policy gradient is determined based on the reward value, and the policy network parameters of the reinforcement learning model are updated according to the policy gradient to maximize the expected cumulative reward. A policy gradient algorithm is employed, using gradient ascent to update parameters and guide the model towards a better policy direction.

[0061] Based on the updated policy network parameters, the optimal fusion strategy for each temporary entity relationship is determined, key entity relationships are retained, and redundant or erroneous relationships are deleted to obtain accurate entity relationships.

[0062] By selecting appropriate preset identification methods, initial entities and relationships can be accurately extracted from complex control plane and user plane data. Homogeneous source merging enhances data consistency and accuracy, laying a reliable foundation for attack attribution analysis. Introducing a reinforcement learning model, through the reasonable definition of reward functions and policy gradient update mechanisms, allows the model to automatically adapt to data complexity, dynamically adjust the fusion strategy, maximize expected cumulative rewards, and improve the accuracy of entity relationships. This optimizes data quality, reduces manual intervention, and enhances the system's automation level. The reinforcement learning model continuously updates policy parameters based on new data and feedback, helping the system automatically adapt to changing network environments, accurately perceive network conditions, and keenly detect attack behavior.

[0063] In some embodiments, taking a typical 5G network slicing scenario as an example, this network slice supports enhanced mobile broadband (eMBB) services, covering multiple base stations and a large number of user equipment. Various potential attack risks exist in the network, such as unauthorized access by user equipment and malicious traffic attacks. By applying the method of this invention, the aim is to achieve accurate source tracing and effective countermeasures against network attacks.

[0064] Select the preset recognition method: SMF Policy Data Identification: A Named Entity Recognition (NER) model combined with regular expressions is used to identify entities such as user equipment identifiers, session identifiers, IP address allocation information, and QoS rules from SMF policy data. For example, a record in the SMF policy data might read: "Assign IP address 192.168.1.100 to user equipment IMEI_12345, establish session ID_sess1, and set the QoS rule to high priority." Using a pre-trained NER model, the entities "user equipment IMEI_12345," "session ID_sess1," "IP address 192.168.1.100," and "QoS rule: high priority" can be identified, and the relationships between them can be determined: "User equipment IMEI_12345 has session ID_sess1, the IP address of session ID_sess1 is 192.168.1.100, and the QoS rule of session ID_sess1 is high priority."

[0065] AMF Authentication Record Identification: Utilizing regular expressions and pattern matching methods, this section extracts entities such as the user equipment identifier, authentication time, authentication result, and authentication server address from AMF authentication records. For example, an AMF authentication record might read: "User equipment IMEI_12345 was authenticated through base station A on 2024-07-20 10:00:00, with a successful authentication result. The authentication server address is 192.168.10.1." Through regular expression matching, the entities "User equipment IMEI_12345," "Authentication time 2024-07-20 10:00:00," "Authentication result: Success," "Base station A," and "Authentication server address 192.168.10.1" can be identified, along with their relationship: "User equipment IMEI_12345 was authenticated through base station A at authentication time 2024-07-20 10:00:00, with a successful authentication result. The authentication server address is 192.168.10.1."

[0066] UPF Traffic Protocol Type and Destination IP Identification: By using traffic analysis tools in conjunction with a protocol parsing library, entities such as traffic protocol type, source IP address, destination IP address, and traffic size can be identified from UPF traffic data. For example, a record in the UPF traffic data shows: "User device IMEI_12345 sent a TCP protocol data packet at 10:00:05 on 2024-07-20, with a source IP address of 192.168.1.100, a destination IP address of 202.100.100.200, and a traffic size of 1024 bytes." Using traffic analysis tools and protocol parsing libraries, the entity "User Equipment IMEI_12345", "Traffic Protocol Type: TCP", "Source IP Address 192.168.1.100", "Destination IP Address 202.100.100.200", and "Traffic Size: 1024 bytes" can be identified, along with the relationship between them: "User Equipment IMEI_12345 sent a TCP protocol data packet with a source IP address of 192.168.1.100, a destination IP address of 202.100.100.200, and a traffic size of 1024 bytes."

[0067] Based on a preset identification method, SMF policy data, AMF authentication records, and UPF traffic data are extracted and processed to obtain the corresponding initial entities and relationships. For example, the initial entities and relationships extracted from SMF policy data include: Entities: User Equipment IMEI_12345, Session ID_sess1, IP Address 192.168.1.100, QoS Rule: High Priority.

[0068] Relationship: User equipment IMEI_12345 has session ID_sess1, the IP address of session ID_sess1 is 192.168.1.100, and the QoS rule of session ID_sess1 is high priority.

[0069] The initial entities and relationships extracted from the AMF certification records include: Entity: User Equipment IMEI_12345, Authentication Time: 2024-07-20 10:00:00, Authentication Result: Success, Base Station A, Authentication Server Address: 192.168.10.1.

[0070] Relationship: User equipment IMEI_12345 was authenticated through base station A at authentication time 2024-07-20 10:00:00, and the authentication result was successful. The authentication server address was 192.168.10.1.

[0071] The initial entities and relationships extracted from the UPF traffic data include: Entity: User Equipment IMEI_12345, Traffic Protocol Type: TCP, Source IP Address: 192.168.1.100, Destination IP Address: 202.100.100.200, Traffic Size: 1024 bytes.

[0072] Relationship: User equipment IMEI_12345 sent a TCP protocol data packet with a source IP address of 192.168.1.100, a destination IP address of 202.100.100.200, and a data size of 1024 bytes.

[0073] Perform a common-origin merging process on all initial entities and their corresponding initial entity relationships: Feature extraction and similarity calculation: Features of entities are extracted, such as user equipment identifier, IP address, geographic location, and timestamp. The similarity between entities is calculated using the cosine similarity method. For example, the similarity between user equipment IMEI_12345 in SMF policy data and AMF authentication records is calculated. Assume the user equipment feature vector in the SMF policy data is [IMEI_12345, 192.168.1.100, sess1], and the user equipment feature vector in the AMF authentication record is [IMEI_12345, Base Station A, 2024-07-20 10:00:00]. The cosine similarity calculation yields a similarity of 0.9, exceeding the set similarity threshold of 0.8.

[0074] Merge Entities: Entities with similarity exceeding a threshold are merged. In this example, the user equipment IMEI_12345 in the SMF policy data and AMF authentication record is merged into a single entity "User Equipment IMEI_12345", and their relationships are integrated to obtain the merged entity and temporary entity relationships: Entities: User Equipment IMEI_12345, Session ID_sess1, IP Address 192.168.1.100, QoS Rule: High Priority, Authentication Time 2024-07-20 10:00:00, Authentication Result: Success, Base Station A, Authentication Server Address 192.168.10.1, Traffic Protocol Type: TCP, Source IP Address 192.168.1.100, Destination IP Address 202.100.100.200, Traffic Size: 1024 bytes.

[0075] Relationship: User equipment IMEI_12345 has session ID_sess1, the IP address of session ID_sess1 is 192.168.1.100, and the QoS rule of session ID_sess1 is high priority; User equipment IMEI_12345 authenticated through base station A at authentication time 2024-07-20 10:00:00, and the authentication result was successful. The authentication server address is 192.168.10.1; User equipment IMEI_12345 sent a TCP protocol data packet with source IP address 192.168.1.100, destination IP address 202.100.100.200, and the data size was 1024 bytes.

[0076] Construct a reinforcement learning model based on policy gradient for entity relationship fusion: Parameter initialization: Randomly initialize the weight parameters in the range of [-0.1, 0.1], and set the learning rate to 0.01.

[0077] Define the state space: The state space includes feature vectors of entities and their relationships. For example, for the relationship between user equipment IMEI_12345 and base station A, the state space feature vector is: [IMEI_12345, base station A, authentication time 2024-07-20 10:00:00, authentication result: successful].

[0078] Define the action space: The action space includes operations such as retaining, deleting, and merging relationships. For example, for the relationship between user equipment IMEI_12345 and base station A, the action space is to retain the relationship, delete the relationship, or merge it with other relationships.

[0079] The reward value is determined based on each entity and its corresponding temporary entity relationship: Define a reward function that comprehensively considers the accuracy, consistency, and importance of the relationship. For example, if the merged entity relationship matches the known true relationship, a positive reward is given; otherwise, a negative reward is given. In this example, the known true relationship is "User equipment IMEI_12345 has a connection relationship with base station A, and the authentication result is successful," while the relationship obtained through initial extraction is "User equipment IMEI_12345 has a connection relationship with base station A, authentication time 2024-07-20 10:00:00, and the authentication result is successful." Define the reward function as follows: if the merged entity relationship matches the true relationship, the reward value is +1; otherwise, it is -1.

[0080] Calculate the reward value: Calculate the reward value for each temporary entity relationship according to the reward function. In this example, the merged entity relationship matches the real relationship, so a reward value of +1 is given.

[0081] The process involves determining the policy gradient based on the reward value, and updating the policy network parameters of the reinforcement learning model according to the policy gradient to maximize the expected cumulative reward. Calculate the policy gradient: Based on the current policy network parameters and reward value, calculate the policy gradient. Assume the current policy network parameters are... The reward value is +1, and the policy gradient is calculated. [0.2, -0.3, 0.1].

[0082] Parameter update: Parameters are updated using gradient ascent with a learning rate of 0.01. Updated parameters. ,Right now Through this update method, the model can gradually learn better entity relationship fusion strategies.

[0083] The optimal fusion strategy for each temporary entity relationship is determined based on the updated policy network parameters to obtain accurate entity relationships: Evaluation of fusion strategy: After multiple iterations and updates, the model learned that for entity relationships such as "connection relationship between user equipment and base station", the weight of the relationship should be higher, while for entity relationships such as "communication relationship between user equipment and unknown destination IP", the rationality needs to be further verified.

[0084] Determining the optimal strategy: Based on the updated strategy network parameters, the model determines the optimal fusion strategy for different temporary entity relationships. For example, for the "connection relationship between user equipment IMEI_12345 and base station A", the model chooses to retain this relationship; for the "communication relationship between user equipment IMEI_12345 and destination IP address 202.100.100.200", since this destination IP address appears infrequently in historical data and the communication traffic is abnormal, the model chooses to further verify the relationship, and delete the relationship if the verification fails.

[0085] Optionally, the dynamic knowledge graph includes node data and corresponding relationship data; the step of constructing a network topology graph based on the dynamic knowledge graph and analyzing and processing the network topology graph based on a preset graph neural network to obtain risk attack prediction results includes: Feature extraction is performed on the node data and the corresponding relationship data respectively to obtain node feature data and corresponding relationship feature data; The network topology graph is constructed based on all the node feature data and the corresponding relationship feature data, and the network topology graph is input into the graph neural network to obtain the risk attack prediction result; The graph neural network includes a multi-graph attention mechanism module and a GNN module.

[0086] Optionally, the network topology graph includes node information and corresponding relationship information; the step of inputting the network topology graph into the graph neural network to obtain the risk attack prediction result includes: The multi-graph attention mechanism module processes the node information and the corresponding relationship information to obtain attention weight data, and obtains a node feature matrix based on the node information and the attention weight data. The node feature matrix is ​​processed by the GNN module to obtain the risk attack prediction result; The risk attack prediction results include probability data of risk attack predictions corresponding to each of the node information or the relationship information.

[0087] In some embodiments, for example, node data in a dynamic knowledge graph includes base stations, user equipment, network functional entities (such as SMF, AMF, UPF), etc., and relationship data includes connection relationships, communication relationships, etc.

[0088] Node Feature Extraction: For base station nodes, extract features such as base station ID, geographical location, coverage area, and traffic load. For example, the feature vector of base station A is [ID_A, Geographical Location_A, Coverage Area_A, Traffic Load_A]. ​​For user equipment nodes, extract features such as device type, IMEI number, access time, and traffic consumption. For example, the feature vector of user equipment X is [Type_X, IMEI_X, Access Time_X, Traffic Consumption_X]. For network function entity nodes, extract features such as instance ID, function type, and processing capacity. For example, the feature vector of SMF instance 1 is [Instance ID_1, Function Type_SMF, Processing Capacity_1].

[0089] Relationship Feature Extraction: For connection relationships, features such as connection strength, connection duration, and connection stability are extracted. For example, the feature vector for the connection relationship between base station A and user equipment X is [connection strength_AX, connection duration_AX, connection stability_AX]. For communication relationships, features such as communication frequency, data transmission volume, and protocol type are extracted. For example, the feature vector for the communication relationship between user equipment X and destination IP address Y is [communication frequency_XY, data transmission volume_XY, protocol type_XY].

[0090] The extracted node feature data and relationship feature data are used to construct a network topology graph. In the graph, nodes (node ​​information) represent entities in the network (such as base stations, user equipment, etc.), and edges represent relationships between entities (such as connection relationships, communication relationships, etc.) (relationship information).

[0091] A network topology graph is formed by combining nodes and edges into a graph structure. For example, the connection between user equipment and base station is represented by an edge in the graph, connecting the corresponding user equipment node and base station node.

[0092] Input the node information and its corresponding relationship information into the preset graph neural network.

[0093] The multi-graph attention mechanism module processes the information of each node and its corresponding relationships to obtain attention weight data. Assume there are two types of relationships: connection relationships and communication relationships. For a node pair (base station A, user equipment X), calculate its attention weight under both relationship types. Assume the attention weight for a connection relationship is 0.7 and the attention weight for a communication relationship is 0.3.

[0094] The node feature matrix is ​​obtained based on node information and attention weight data. The feature vector of base station A [ID_A, Geographic Location_A, Coverage Area_A, Traffic Load_A] is multiplied by the attention weight of connection relationship (0.7) to obtain the feature representation of base station A from the perspective of connection relationship. Similarly, the feature vector of user equipment X [Type_X, IMEI_X, Access Time_X, Traffic Consumption_X] is multiplied by the attention weight of communication relationship (0.3) to obtain the feature representation of user equipment X from the perspective of communication relationship. Integrating the feature representations of all nodes from different relationship perspectives yields the final node feature matrix.

[0095] The GNN module processes the node feature matrix to obtain the risk attack prediction result. The GNN module processes the node feature matrix, comprehensively considering the node's own features and the features of its neighboring nodes, and updates the node's feature representation. Through this information aggregation method, the model can capture local and global structural information in the network, ultimately obtaining the risk attack prediction result. For example, in a network topology diagram containing base stations, user equipment, and network functional entities, the initial feature vector of user equipment X is [Type_X, IMEI_X, Access Time_X, Traffic Consumption_X]. During the propagation and updating process of the GNN module, the feature vector of user equipment X is fused with the feature information of its connected base station A and SMF instance 1, resulting in an updated feature vector [Type_X', IMEI_X', Access Time_X', Traffic Consumption_X', Base Station Impact_X, SMF Impact_X]. Based on the updated feature vector, the risk attack prediction probability value corresponding to the node is calculated. Assuming the risk attack prediction probability value of user equipment X is 0.8, it means that the node has an 80% probability of being threatened by an attack.

[0096] The risk attack prediction results include the probability data of risk attacks corresponding to the data or relationship data of each node. For example, the prediction results are as follows: the risk attack prediction probability value of user equipment X is 0.8; the risk attack prediction probability value of base station A is 0.3; and the risk attack prediction probability value of the communication relationship between user equipment X and destination IP address Y is 0.6.

[0097] By extracting features and constructing network topology graphs, the system comprehensively represents entities and their relationships within the network. The multi-graph attention mechanism module of the graph neural network highlights the importance of different relationships, while the GNN module deeply understands the network structure, making risk attack predictions more accurate and effectively identifying potential attack points. Constructing network topology graphs and utilizing graph neural networks for analysis enables efficient processing of complex network data and improves analysis efficiency. Risk attack prediction results provide detailed information on attack probability, helping to quickly locate attack sources and attack paths, thereby improving attack attribution efficiency. For example, the graph neural network can identify user device X as having a high probability of being targeted by a risk attack, providing a basis for countermeasures. Its ability to efficiently process complex network topologies is enhanced through the multi-graph attention mechanism and adaptive graph convolutional network technology, highlighting key relationship features and accelerating analysis speed. The combination of dynamic knowledge graphs and graph neural networks allows for real-time monitoring of network status and timely detection of potential threats. Based on risk attack prediction results, proactive measures can be taken to prevent and block attacks, reducing network losses.

[0098] Optionally, the risk attack prediction result includes probability data for risk attack prediction; after analyzing and processing the network topology graph based on a preset graph neural network to obtain the risk attack prediction result, it further includes: Based on preset logical rules, countermeasure instructions are generated according to the risk attack prediction results.

[0099] Specifically, the risk attack prediction results output by the graph neural network are analyzed to extract the risk probability value of each path and related attack feature information, such as the attack source, attack target, and key nodes on the attack path.

[0100] A pre-defined logical rule base is used, with rules set according to common attack patterns and security policies. Each rule includes a condition and an action. For example, "If the risk prediction value of a user device's connection path is determined to be a high-risk attack path, then restrict the user device's access permissions." Attack paths identified as high-risk are matched against rules in the logical rule base to find applicable rules.

[0101] Based on the matched logical rules, specific countermeasure commands are generated. These commands include, but are not limited to, isolating devices, restricting access permissions, adjusting network configurations, and sending alarms. For example, commands such as "block communication between user equipment A and destination IP B" or "restrict upload traffic of user equipment C" are generated. The generated countermeasure commands are sent to the corresponding execution modules, which then execute the countermeasure operations within the 5G network slice. For example, commands may be sent to the core network's policy control module to restrict user equipment access; or commands may be sent to the base station to isolate specific devices.

[0102] This method of generating and executing countermeasures based on risk prediction results and logical rules can quickly and accurately respond to potential attacks, promptly block attacks, and reduce network losses.

[0103] Optionally, based on preset logical rules, countermeasure instructions are generated according to the risk attack prediction results, including: The probability data of each risk attack prediction is compared with the corresponding preset risk threshold to obtain the comparison result; The comparison result is matched with the logical rule to obtain the target logical rule, and the countermeasure instruction is generated according to the target logical rule.

[0104] Specifically, assume that the risk attack prediction results include risk attack prediction probability data corresponding to the data or relationship data of each node. For example, the risk attack prediction probability value of user equipment X is 0.8, the risk attack prediction probability value of base station A is 0.3, and the risk attack prediction probability value of the communication relationship between user equipment X and destination IP address Y is 0.6.

[0105] Set a preset risk threshold, such as 0.7. Compare the predicted probability data of each risk attack with the corresponding preset risk threshold to obtain the comparison result. In this example: The predicted probability of a risk attack on user device X is 0.8, which is higher than the threshold of 0.7, and the comparison result is "high risk".

[0106] The predicted probability of a risk attack on base station A is 0.3, which is lower than the threshold of 0.7, so the comparison result is "low risk".

[0107] The predicted probability value of a risk attack on the communication relationship between user equipment X and destination IP address Y is 0.6, which is lower than the threshold of 0.7. The comparison result is "low risk".

[0108] A pre-defined logic rule base contains multiple logic rules, each with a condition and an action part. For example: Rule 1: If the probability of a user device being attacked is higher than 0.7, then the user device's access permissions will be restricted.

[0109] Rule 2: If the probability of a communication risk attack between a user equipment and a specific destination IP address is higher than 0.7, then the communication between the user equipment and the destination IP address shall be blocked.

[0110] The comparison results are matched against the logical rules to obtain the target logical rule, and a counter instruction is generated based on the target logical rule. In this example: The predicted probability of a risk attack on user device X is 0.8, which is higher than the threshold of 0.7. It matches rule 1 and generates a countermeasure instruction "Restrict access permissions to user device X".

[0111] The probability of a potential attack on the communication relationship between user equipment X and destination IP address Y is 0.6, which is below the threshold of 0.7. Therefore, it does not match any rules and no countermeasure instruction is generated.

[0112] The probability of a risk attack predicted for base station A is 0.3, which is lower than the threshold of 0.7. It does not match any rules and no countermeasure instruction is generated.

[0113] By comparing predicted attack probabilities with preset risk thresholds and generating countermeasures based on logical rules, precise countermeasures can be implemented against attacks of different risk levels. For example, in the case of a high-risk user device X, the system promptly restricts its access permissions to block potential attacks. Based on preset logical rules, the system automatically matches risk prediction results with countermeasures, reducing manual intervention, improving decision-making and response efficiency, rapidly processing large amounts of risk prediction results, generating and executing countermeasures, and effectively responding to network attacks. The logical rules can be flexibly adjusted and optimized according to the actual network environment and security needs. For example, different risk thresholds and countermeasure strategies can be set according to the importance and security requirements of different services, enabling the system to better adapt to changing network environments and attack patterns, providing targeted security protection.

[0114] Optionally, the AI-based 5G network slicing attack tracing method further includes: Obtain the feedback result of the countermeasure command and the real-time network status of the 5G network slice; The weight parameters of the graph neural network are dynamically adjusted based on the feedback results and the real-time network status, and the dynamic knowledge graph is updated based on the feedback results.

[0115] Specifically, for example, when the system executes the countermeasure instruction "restrict access permissions to user device X", it is necessary to evaluate the effect of the instruction.

[0116] Obtaining Feedback Results: Collect feedback results after the execution of countermeasure commands through the network management system. For example, monitor whether user device X still exhibits abnormal traffic behavior after its permissions are restricted. If user device X's traffic decreases significantly and it no longer attempts to connect to suspicious IP addresses, the feedback result is "countermeasure successful"; if user device X's traffic remains abnormal and it attempts to bypass the restrictions, the feedback result is "countermeasure failed".

[0117] Obtain real-time network status: Collect network status data of 5G network slices in real time, including base station load, user equipment connection status, traffic distribution, etc. For example, if it is found that the load of base station A does not change significantly after the countermeasures and the overall network operation is stable, the real-time network status is "stable operation"; if the countermeasures cause some legitimate user equipment connections of base station A to be interrupted, the real-time network status is "partially interrupted".

[0118] Based on the feedback result of "successful countermeasure" and the real-time network status of "stable operation," the performance of the graph neural network in this risk prediction is analyzed. If the prediction is accurate and the countermeasure does not affect normal business operations, it indicates that the network parameter settings are reasonable.

[0119] If the feedback result is "countermeasure failed" or the real-time network status shows that the countermeasure has a significant impact on normal business, the weight parameters of the graph neural network are adjusted according to the reinforcement learning mechanism. For example, if the countermeasure fails because the network fails to accurately identify the malicious behavior of user device X, the weight parameters related to the user device's behavioral characteristics are appropriately increased, such as adjusting the traffic mutation weight from 0.3 to 0.5 to improve the model's sensitivity to similar behaviors.

[0120] Update based on feedback results: Integrate the feedback results of countermeasure commands into the dynamic knowledge graph. For example, update the node information of user device X in the knowledge graph, add the "countermeasure successful" attribute, and record that the device was previously restricted in access and its behavior has returned to normal.

[0121] Based on real-time network status updates: Adjust the relationship data in the knowledge graph according to the real-time network status. If the real-time network status shows that some legitimate user equipment connections to base station A are interrupted, update the connection relationship between base station A and these user equipment, mark the status as "temporary interruption", and record information such as the interruption time.

[0122] Dynamically adjusting the weight parameters of the graph neural network allows the model to self-optimize based on countermeasure instructions and real-time network conditions, thus better adapting to changes in the network environment and new attack patterns, improving the accuracy and reliability of risk attack prediction. For example, in subsequent similar attack scenarios, the adjusted model can more accurately identify malicious behavior and reduce the false positive rate. Simultaneously, updating the dynamic knowledge graph based on feedback results and real-time network conditions ensures that the knowledge graph reflects the latest network status and historical events in real time, providing more comprehensive and accurate information support for attack attribution and network management. For example, network administrators can use the updated knowledge graph to quickly identify previously attacked devices and effective countermeasures, thereby formulating more reasonable network security strategies.

[0123] like Figure 2 As shown in the figure, an embodiment of the present invention provides a 5G network slicing attack tracing device based on artificial intelligence, comprising: The acquisition unit is used to acquire control plane data and user plane data in 5G network slices. An extraction unit is used to extract the control plane data and the user plane data respectively to obtain multiple entities and their corresponding entity relationships, and to construct a dynamic knowledge graph based on all the entities and their corresponding entity relationships. The prediction unit is used to construct a network topology graph based on the dynamic knowledge graph, and to analyze and process the network topology graph based on a preset graph neural network to obtain risk attack prediction results. The processing unit is used to determine the location information of the target based on the risk attack prediction results.

[0124] like Figure 3As shown in the figure, an embodiment of the present invention provides a 5G network slice attack tracing system based on artificial intelligence, including a memory and a processor; the memory is used to store a computer program; the processor is used to implement the 5G network slice attack tracing method based on artificial intelligence as described above when the computer program is executed.

[0125] Alternatively, an AI-based 5G network slicing attack tracing system includes a memory and a processor coupled to the memory; the memory is configured to store a computer program; the processor is configured to perform the following operations when the computer program is executed: Acquire control plane and user plane data from 5G network slices; The control plane data and the user plane data are extracted and processed respectively to obtain multiple entities and their corresponding entity relationships, and a dynamic knowledge graph is constructed based on all the entities and their corresponding entity relationships. A network topology graph is constructed based on the dynamic knowledge graph, and the network topology graph is analyzed and processed based on a preset graph neural network to obtain risk attack prediction results. The location information of the target area is determined based on the risk attack prediction results.

[0126] This invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the artificial intelligence-based 5G network slicing attack tracing method described above.

[0127] Alternatively, a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform the following operations: Acquire control plane and user plane data from 5G network slices; The control plane data and the user plane data are extracted and processed respectively to obtain multiple entities and their corresponding entity relationships, and a dynamic knowledge graph is constructed based on all the entities and their corresponding entity relationships. A network topology graph is constructed based on the dynamic knowledge graph, and the network topology graph is analyzed and processed based on a preset graph neural network to obtain risk attack prediction results. The location information of the target area is determined based on the risk attack prediction results.

[0128] The present invention describes an AI-based 5G network slicing attack tracing system that can serve as a server or client for the present invention, and is an example of a hardware device that can be applied to various aspects of the present invention. The AI-based 5G network slicing attack tracing system is intended to represent various forms of digital electronic computer devices, such as laptops, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The AI-based 5G network slicing attack tracing system can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0129] The AI-based 5G network slicing attack tracing system includes a computing unit that can execute various appropriate actions and processes based on computer programs stored in read-only memory (ROM) or loaded from a storage unit into random access memory (RAM). The RAM can also store various programs and data required for device operation. The computing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0130] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc. In this application, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of the present invention according to actual needs. Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units can be implemented in hardware or as software functional units.

[0131] While the present invention has been disclosed above, its scope of protection is not limited thereto. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention, and all such changes and modifications will fall within the scope of protection of the present invention.

Claims

1. A method for tracing the source of 5G network slicing attacks based on artificial intelligence, characterized in that, include: Acquire control plane and user plane data from 5G network slices; The control plane data and the user plane data are extracted and processed respectively to obtain multiple entities and their corresponding entity relationships, and a dynamic knowledge graph is constructed based on all the entities and their corresponding entity relationships. A network topology graph is constructed based on the dynamic knowledge graph, and the network topology graph is analyzed and processed based on a preset graph neural network to obtain risk attack prediction results. The location information of the target area is determined based on the risk attack prediction results.

2. The artificial intelligence-based 5G network slicing attack tracing method according to claim 1, characterized in that, The process of extracting data from the control plane and the user plane to obtain multiple entities and their corresponding relationships includes: Select the corresponding preset recognition method, and extract the control plane data and the user plane data according to the corresponding preset recognition method to obtain the corresponding initial entity and the corresponding initial entity relationship; All the initial entities and their corresponding initial entity relationships are merged from the same source to obtain the entities and their corresponding temporary entity relationships. The temporary entity relationships are fused based on a preset reinforcement learning model to obtain the corresponding entity relationships; The control plane data includes SFM policies and AMF authentication records; the user plane data includes UPF traffic protocol type and destination IP.

3. The artificial intelligence-based 5G network slicing attack tracing method according to claim 2, characterized in that, The method of fusing the temporary entity relationships based on a preset reinforcement learning model to obtain the corresponding entity relationships includes: Construct the reinforcement learning model and perform initialization operations on the reinforcement learning model, including parameter initialization, defining the state space and action space; The entity and its corresponding temporary entity relationship are input into the reinforcement learning model to obtain the corresponding entity relationship.

4. The artificial intelligence-based 5G network slicing attack tracing method according to claim 3, characterized in that, The step of inputting the entity and the corresponding temporary entity relationship into the reinforcement learning model to obtain the corresponding entity relationship includes: The reward value is determined based on each of the entities and the corresponding temporary entity relationships; The policy gradient is determined based on the reward value, and the policy network parameters of the reinforcement learning model are updated according to the policy gradient to maximize the expected cumulative reward. The optimal fusion strategy for each temporary entity relationship is determined based on the updated strategy network parameters to obtain the entity relationship.

5. The artificial intelligence-based 5G network slicing attack tracing method according to claim 1, characterized in that, The dynamic knowledge graph includes node data and corresponding relationship data; The step of constructing a network topology graph based on the dynamic knowledge graph and analyzing the network topology graph based on a preset graph neural network to obtain risk attack prediction results includes: Feature extraction is performed on the node data and the corresponding relationship data respectively to obtain node feature data and corresponding relationship feature data; The network topology graph is constructed based on all the node feature data and the corresponding relationship feature data, and the network topology graph is input into the graph neural network to obtain the risk attack prediction result; The graph neural network includes a multi-graph attention mechanism module and a GNN module.

6. The artificial intelligence-based 5G network slicing attack tracing method according to claim 5, characterized in that, The network topology diagram includes node information and corresponding relationship information; The step of inputting the network topology graph into the graph neural network to obtain the risk attack prediction result includes: The multi-graph attention mechanism module processes the node information and the corresponding relationship information to obtain attention weight data, and obtains a node feature matrix based on the node information and the attention weight data. The node feature matrix is ​​processed by the GNN module to obtain the risk attack prediction result; The risk attack prediction results include probability data of risk attack predictions corresponding to each of the node information or the relationship information.

7. The artificial intelligence-based 5G network slicing attack tracing method according to claim 1, characterized in that, The risk attack prediction results include probability data for risk attack predictions; After analyzing and processing the network topology graph based on a preset graph neural network to obtain the risk attack prediction result, the method further includes: Based on preset logical rules, countermeasure instructions are generated according to the risk attack prediction results, including: The probability data of each risk attack prediction is compared with the corresponding preset risk threshold to obtain the comparison result; The comparison result is matched with the logical rule to obtain the target logical rule, and the countermeasure instruction is generated according to the target logical rule.

8. The artificial intelligence-based 5G network slicing attack tracing method according to claim 7, characterized in that, The AI-based 5G network slicing attack tracing method also includes: Obtain the feedback result of the countermeasure command and the real-time network status of the 5G network slice; The weight parameters of the graph neural network are dynamically adjusted based on the feedback results and the real-time network status, and the dynamic knowledge graph is updated based on the feedback results.

9. A device for tracing the source of 5G network slicing attacks based on artificial intelligence, characterized in that, include: The acquisition unit is used to acquire control plane data and user plane data in 5G network slices. An extraction unit is used to extract the control plane data and the user plane data respectively to obtain multiple entities and their corresponding entity relationships, and to construct a dynamic knowledge graph based on all the entities and their corresponding entity relationships. The prediction unit is used to construct a network topology graph based on the dynamic knowledge graph, and to analyze and process the network topology graph based on a preset graph neural network to obtain risk attack prediction results. The processing unit is used to determine the location information of the target based on the risk attack prediction results.

10. A 5G network slicing attack tracing system based on artificial intelligence, characterized in that, It includes a memory and a processor; the memory is used to store a computer program; the processor is used to implement, when executing the computer program, the artificial intelligence-based 5G network slice attack tracing method as described in any one of claims 1 to 8.

Images