User plane data detection method, communication system and related devices

Abstract

The present disclosure provides a user plane data detection method, a communication system and related equipment, and relates to the technical field of communication. The method comprises: a user plane network element detecting traffic of a user plane based on first information or second information; wherein the first information is prediction information and / or statistical information generated by an intelligent network element, and the second information is generated based on the first information. According to the embodiment of the present disclosure, the intelligent network element can assist the user plane network element to screen out abnormal data traffic, or configure and adjust according to the traffic, and then take relevant processing measures in time, thereby guaranteeing the traffic processing efficiency of the user plane.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to a user plane data detection method, communication system and related equipment. Background Technology

[0002] Since the commercialization of 5G Advancement (5GA), the increasing number of terminal types and the growth of multimodal services have brought more severe challenges to the user plane load. More specifically, the efficiency of the User Plane Function (UPF) in detecting user plane traffic and its ability to process data packets has gradually become one of the important factors for operators to avoid network congestion and provide users with a better experience. However, there are still some common problems in the processing of data packets by the UPF. For example, some data packets from the RAN (Radio Access Network) or DN (Data Network) that are misconfigured or retransmitted will waste a lot of UPF resources, greatly reduce the performance of the UPF, and sudden data traffic will also make the UPF busy and make it difficult to guarantee the user experience.

[0003] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] This disclosure provides a user plane data detection method, communication system, and related equipment. Intelligent network elements can assist user plane network elements in filtering out abnormal data traffic or adjusting configurations according to traffic, thereby taking timely processing measures to ensure the efficiency of user plane traffic processing.

[0005] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0006] According to one aspect of this disclosure, a user plane data detection method is provided, the method being executed by a user plane network element, the method comprising: detecting user plane traffic based on first information or second information; wherein the first information is predictive information and / or statistical information generated by an intelligent network element, and the second information is generated based on the first information.

[0007] In one embodiment of this disclosure, the first information is obtained by the intelligent network element through prediction and / or statistics based on the collected user plane data traffic information and / or user plane-related information in the network.

[0008] In one embodiment of this disclosure, user plane data traffic information and / or user plane-related information in the network includes one or more of the following: first input information from a session management function, second input information from a network open function or a packet flow description function, and third input information from user plane network elements; wherein, the first input information includes one or more of the following: application identifier, N4 rule, IP 5-tuple, IP triplet, Uniform Resource Locator, domain name, number of PDU sessions, number of N4 sessions, and number of users; the second input information includes one or more of the following: packet flow description identifier, IP 5-tuple, IP triplet, Uniform Resource Locator, and domain name; the third input information includes one or more of the following: application identifier, IP 5-tuple, IP triplet, start time, end time, packet length, number of packets, direction of traffic, data volume, Uniform Resource Locator, domain name, user plane network element load, user plane network element status, user plane network element resource usage, number of PDU sessions, number of N4 sessions, and number of users.

[0009] In one embodiment of this disclosure, the first information includes one or more of the following: application identifier, IP 5-tuple, IP triplet, Uniform Resource Locator, domain name, start time, end time, data packet length, number of data packets, data packet transmission frequency, data volume, traffic direction, user plane network element load, user plane network element status, user plane network element resource usage, number of PDU sessions, number of N4 sessions, number of users, and confidence level.

[0010] According to another aspect of this disclosure, a user plane data detection method is provided. The method is executed by a session management function and includes: directly or indirectly requesting first information from an intelligent network element for a user plane network element, wherein the first information is prediction information and / or statistical information generated by the intelligent network element; sending the first information or second information to the user plane network element so that the user plane network element detects user plane traffic based on the first information or the second information, wherein the second information is generated by the session management function based on the first information and the second information instructs the user plane network element to perform traffic detection rules; wherein indirectly requesting the first information from the intelligent network element for a user plane network element includes: forwarding the first request from the user plane network element to the intelligent network element and forwarding the first information from the intelligent network element to the user plane network element; directly requesting the first information from the intelligent network element for a user plane network element includes: triggering a second request to the intelligent network element based on internal configuration, receiving the first information from the intelligent network element, generating the second information based on the first information, and sending the second information to the user plane network element.

[0011] According to another aspect of this disclosure, a user plane data detection method is provided. The method is executed by an intelligent network element and includes: directly sending first information to the user plane network element, or sending the first information to the user plane network element through a third-party network element, so that the user plane network element can detect the user plane traffic based on the first information or the second information; wherein the first information is prediction information and / or statistical information generated by the intelligent network element, and the second information is generated by the third-party network element based on the first information and sent to the user plane network element.

[0012] In one embodiment of this disclosure, before sending the first information directly to the user plane network element, or sending the first information to the user plane network element through a third-party network element, the method further includes: obtaining first input information from a session management function, the first input information including one or more of the following: application identifier, N4 rule, IP 5-tuple, IP triplet, Uniform Resource Locator, domain name, PDU session count, N4 session count, and user count; obtaining second input information from a network development function or a packet flow description function, the second input information including one or more of the following: packet flow description identifier, IP 5-tuple, IP triplet, Uniform Resource Locator, and domain name; obtaining third input information from the user plane network element, the third input information including one or more of the following: application identifier, IP 5-tuple, IP triplet, start time, end time, packet length, packet count, traffic direction, data volume, Uniform Resource Locator, domain name, user plane network element load, user plane network element status, user plane network element resource usage, PDU session count, N4 session count, and user count; and generating the first information based on the first, second, and third input information.

[0013] According to another aspect of this disclosure, a user plane network element is provided, including a traffic detection module.

[0014] The traffic detection module is used to detect user plane traffic based on first information or second information; wherein, the first information is predictive information and / or statistical information generated by intelligent network elements, and the second information is generated based on the first information.

[0015] According to another aspect of this disclosure, an intelligent network element is provided, including an information transmission module.

[0016] The information sending module is used to send the first information directly to the user plane network element, or to send the first information to the user plane network element through a third-party network element, so that the user plane network element can detect the traffic of the user plane based on the first information or the second information; wherein, the first information is predictive information and / or statistical information generated by the intelligent network element, and the second information is generated by the third-party network element based on the first information and sent to the user plane network element.

[0017] According to another aspect of this disclosure, a communication system is provided, including the user plane network element and the intelligent network element described above.

[0018] According to another aspect of this disclosure, an electronic device is provided, comprising: a memory for storing instructions; and a processor for calling the instructions stored in the memory to implement the above-described user plane data detection method.

[0019] According to another aspect of this disclosure, a computer-readable storage medium is provided that stores computer instructions thereon, which, when executed by a processor, implement the user plane data detection method described above.

[0020] According to another aspect of this disclosure, a computer program product is provided, which stores instructions that, when executed by a computer, cause the computer to perform the user plane data detection method described above.

[0021] According to another aspect of this disclosure, a chip is provided, including at least one processor and an interface; the interface is used to provide program instructions or data to the at least one processor; the at least one processor is used to execute the program instructions to implement the above-described user plane data detection method.

[0022] The user plane data detection method, communication system, and related equipment provided in this disclosure enable intelligent network elements to send predicted and / or statistical information of user plane traffic to the user plane network element directly or indirectly. This allows the user plane network element to refer to the predicted and / or statistical information when detecting user plane traffic. In other words, the intelligent network element can assist the user plane network element in filtering out abnormal data traffic or adjusting its configuration according to the traffic flow, thereby taking timely processing measures to ensure efficient user plane traffic processing.

[0023] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0025] Obviously, the accompanying drawings described below are merely some embodiments of this disclosure. Those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0026] Figure 1 This diagram illustrates a user plane function traffic detection process.

[0027] Figure 2 This diagram illustrates a network architecture according to an embodiment of the present disclosure.

[0028] Figure 3-11 This diagram illustrates a flowchart of a user plane data detection method in an embodiment of this disclosure.

[0029] Figure 12 This diagram illustrates a flowchart of a user plane network element requesting information from an intelligent network element in an embodiment of this disclosure.

[0030] Figure 13-14 This diagram illustrates a flowchart of the generation of first information in an embodiment of this disclosure;

[0031] Figure 15-19 This diagram illustrates a flowchart of a user plane data detection method in an embodiment of this disclosure.

[0032] Figure 20 This diagram illustrates a user plane network element according to an embodiment of the present disclosure;

[0033] Figure 21 This diagram illustrates an intelligent network element according to an embodiment of the present disclosure.

[0034] Figure 22 This diagram illustrates a session management function in an embodiment of the present disclosure.

[0035] Figure 23-24 A schematic diagram of the communication system in an embodiment of this disclosure is shown;

[0036] Figure 25 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. The components of the embodiments of this disclosure described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed disclosure, but merely represents selected embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

[0038] Since the commercialization of 5GA, the increasing number of terminal types and the growth of multimodal services have brought more severe challenges to the user plane load. More specifically, the efficiency of UPF (User Plane Function) in detecting user plane traffic and its ability to process data packets have gradually become one of the important factors for operators to avoid network congestion and provide users with a better experience. However, there are still some common problems in the processing of data packets by UPF. For example, some data packets from RAN or DN that are misconfigured or retransmitted will waste a lot of UPF resources, greatly reducing UPF performance. Sudden data traffic will also make UPF busy and difficult to guarantee user experience. NWDAF (Network Data Analytics Function) can provide AI capabilities to the network, providing a series of data predictions and statistical analyses to consumer network elements in the form of data analysis. AI capabilities can also play an effective role in improving user plane performance. For example, it can predict user plane traffic patterns to help UPF filter out abnormal data traffic or adjust configurations according to traffic, and then handle them in a timely manner.

[0039] The 3GPP R19 AIML project addressed the key issue of "NWDAF-assisted signaling storm prediction, detection, prevention, and mitigation." This issue primarily focuses on intelligent analysis of control plane signaling to assist the network in proactively performing adaptive operations to avoid signaling storms. However, this issue did not involve research on the user plane. In the R20AIML_ph2 project, enhancing 5GC analysis to support more efficient user plane performance will be further studied as one of the key issues.

[0040] Addressing the key issue of "enhancing 5GC analysis to support more effective user plane performance" in the AIML_ph2 project of R20, this disclosure focuses on solving the problem of 5GC analysis assisting UPF in detecting abnormal data traffic, such as... Figure 1 As shown, when the UPF receives a data packet, it performs packet inspection according to the packet inspection rules issued by the SMF and then completes the corresponding packet forwarding action. Under the above mechanism, the UPF cannot directly identify abnormal data traffic, such as misconfigured data packets, abnormal retransmissions, malicious attacks, sudden traffic surges, etc. Therefore, the efficiency of the UPF in processing such traffic is greatly reduced, failing to meet user experience requirements. On the other hand, although the NWDAF in the network has the ability to provide intelligent data analysis, based on the existing mechanism, the NWDAF cannot provide intelligent capabilities to the UPF. Therefore, even if the NWDAF can analyze and predict user plane data traffic, it cannot send it to the UPF.

[0041] The deficiencies of the above solutions and the proposed solutions are the result of the inventor's practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed in this disclosure below should be considered as the inventor's contribution to this disclosure.

[0042] The following detailed description of this exemplary implementation method is provided in conjunction with the accompanying drawings and embodiments.

[0043] Figure 2 This illustration shows a network architecture diagram according to an embodiment of the present disclosure, such as... Figure 2 As shown, the network architecture includes user plane network elements, intelligent network elements, third-party network elements, and user terminals (UEs). In some embodiments, the user plane network element may be a UPF (User Plane Function), the intelligent network element may be an NWDAF (Network Data Analytics Function), and the third-party network element may be an SMF (Session Management Function).

[0044] Figure 3 This diagram illustrates a flowchart of a user plane data detection method according to an embodiment of the present disclosure, such as... Figure 3 As shown, in this embodiment of the disclosure, the user plane network element can directly or indirectly obtain first information from the intelligent network element, and then detect user plane traffic based on the first information. It is understood that when the user plane network element directly obtains the first information from the intelligent network element, the intelligent network element directly sends the first information to the user plane network element; when the user plane network element indirectly obtains the first information from the intelligent network element, the intelligent network element sends the first information to a third-party network element, and the third-party network element forwards the first information to the user plane network element. In some embodiments, the first information is prediction information and / or statistical information generated by the intelligent network element. In some embodiments, the first information is prediction information and / or statistical information generated by the intelligent network element for user plane traffic. In some embodiments, the first information is prediction information (traffic pattern prediction) and / or statistical information of the intelligent network element for user plane service patterns.

[0045] The AnalyticsID provided by NWDAF in the current 3GPP specification only includes congestion control and network load, and does not include content related to user plane traffic detection. This solution enhances the intelligent function of NWDAF, enabling it to provide services related to user plane traffic detection, thus filling the gap in the standard.

[0046] User plane efficiency is crucial for ensuring user experience. The solutions disclosed in this embodiment can help operators deploy user plane (ieUPF) in advance, thereby helping the user plane to effectively cope with sudden traffic surges. At the same time, it assists the UPF in detecting abnormal traffic, avoiding performance degradation and resource waste caused by abnormal traffic.

[0047] Existing 5GC AI intelligent functions do not include analysis and prediction related to user plane traffic detection. This disclosure applies the AI ​​capabilities provided by NWDAF to user plane traffic analysis and prediction. In existing technologies and standards, NWDAF cannot directly provide analysis and prediction information to the user plane network element UPF. This disclosure proposes enabling NWDAF to provide information to UPF through direct or indirect means, allowing the user plane to utilize the network's AI capabilities. This solution applies the core network's AI capabilities to address the issue of improving user plane efficiency, further ensuring user experience, and uses artificial intelligence to reduce manual configuration, making the network more autonomous.

[0048] In some embodiments, the first information is obtained by intelligent network elements through prediction and / or statistics based on collected user plane data traffic information and / or user plane-related information in the network.

[0049] In some embodiments, user plane data traffic information and / or user plane-related information in the network includes one or more of the following: first input information from the Session Management Function (SMF), second input information from the Network Open Function (NEF) or Packet Traffic Description Function (PFDF), and third input information from user plane network elements.

[0050] In some embodiments, the first input information includes one or more of the following: application ID, N4 rule, IP 5-tuple, IP triplet, Uniform Resource Locator (URL), domain name, PDU session count, N4 session count, and user count. In some embodiments, the IP 5-tuple includes the destination IP address, destination port, source IP address, source port, and transport layer protocol; the IP triplet includes the destination IP address, source IP address, and transport layer protocol.

[0051] In some embodiments, the second input information includes one or more of the following: Packet Flow Description Identifier (PFD ID), IP 5-tuple, IP triplet, Uniform Resource Locator (URL), and domain name.

[0052] In some embodiments, the third input information includes one or more of the following: application ID, IP 5-tuple, IP triplet, start time, end time, packet length, number of packets, traffic direction (UL uplink or DL ​​downlink), data volume, Uniform Resource Locator (URL), domain name, user plane network element load (UPF load), user plane network element status (UPF status), user plane network element resource usage (UPF resource usage), number of PDU sessions, number of N4 sessions, and number of users. The data volume represents the size of the traffic data and may include uplink data volume and downlink data volume.

[0053] In some embodiments, the intelligent network element can generate first information based on one or more of the first input information, the second input information, and the third input information.

[0054] In this embodiment of the disclosure, the intelligent network element predicts the service mode of the user plane based on the collected user plane data traffic information and / or user plane-related information in the network, and then sends this information to the user plane network element directly or indirectly. The user plane network element first detects the user plane data traffic based on the information provided by the intelligent network element. This first information can help the user plane network element filter out abnormal data traffic and improve the efficiency of user plane data traffic detection.

[0055] In some embodiments, such as Figure 4 As shown, the user plane network element can obtain first information from the intelligent network element or second information from a third-party network element, and then detect the user plane traffic based on the first or second information. In some embodiments, the second information is generated based on the first information. In some embodiments, the second information is generated by the third-party network element based on the first information; that is, after the intelligent network element sends the first information to the third-party network element, the third-party network element generates the second information based on the first information and sends the second information to the user plane network element.

[0056] In some embodiments, the first information includes one or more of the following: application identifier (AnalyticsID), IP 5-tuple, IP triplet, Uniform Resource Locator (URL), domain name, start time, end time, packet length, number of packets, packet transmission frequency (number of packets within a specified time), data volume, traffic direction (uplink UL or downlink DL), user plane network element load (UPFload), user plane network element status (UPF status), user plane network element resource usage (UPF resource usage), number of PDU sessions, number of N4 sessions, number of users, and confidence level.

[0057] In some embodiments, the second information includes one or more of the first information described above. In some embodiments, the second information includes predictive information and / or statistical information generated by the intelligent network element. In some embodiments, the second information includes predictive information and / or statistical information generated by the intelligent network element for user plane traffic. In some embodiments, the second information includes predictive information and / or statistical information of user plane service patterns by the intelligent network element.

[0058] In some embodiments, such as Figure 5 As shown, the user plane network element is UPF, the intelligent network element is NWDAF, and the third-party network element is SMF. SMF also distributes N4 rules to UPF. In this embodiment, UPF detects user plane traffic based on N4 rules and the first or second information, which provides more reference information and improves detection efficiency.

[0059] In some embodiments, the detection of user plane traffic based on first information includes one or more of the following:

[0060] When the IP 5-tuple of the detected traffic matches the IP 5-tuple in the first information, but the data packet length of the traffic does not match the data packet length in the first information, the traffic is identified as abnormal traffic. For example, based on the first information (prediction information), the IP 5-tuple of the data traffic in a certain future time period and the data packet length corresponding to that IP 5-tuple can be obtained. If the UPF detects that the data packet length with that IP 5-tuple is too long during that time period, it may not be traffic from a normal UE or a normal application server. It may be data packets generated by stealing the identity of the UE or an abnormal application server. Therefore, the traffic is judged as abnormal traffic.

[0061] When the detected traffic's IP 5-tuple, start time, and packet length match those in the first information, but the traffic's packet transmission frequency does not match the packet transmission frequency in the first information, the traffic is identified as abnormal traffic. For example, based on the first information (prediction information), the IP 5-tuple of data traffic and the transmission frequency of the corresponding packet for a certain future time period can be obtained. If the UPF detects that the frequency of data with that IP 5-tuple is too high during that time period, that is, a large number of packets are being transmitted in a short period of time, it may be that a server is sending a large amount of data to attack the UE or the UE is sending a large amount of data to attack a server, and the traffic is then judged as abnormal traffic.

[0062] If the first information indicates a sudden increase in packet traffic containing a target IP 5-tuple within a target time period, and data traffic containing the target IP 5-tuple is detected within that time period, then the data traffic containing the target IP 5-tuple is identified as abnormal traffic. This sudden increase in packet traffic includes one or more increases in the number of packets, packet transmission frequency, user plane network element load, and user plane network element resource usage. If the first information indicates a sudden increase in the number of packets containing a specific IP 5-tuple within a certain time period (i.e., a sudden increase in packet transmission frequency and / or a sudden increase in UPF load and / or UPF resource usage), and the UPF detects data traffic containing that IP 5-tuple within that time period (a future time period), then it is possible that an application will generate a large amount of data at a certain time, potentially impacting UPF performance; therefore, this data traffic is identified as abnormal traffic.

[0063] In some embodiments, if a user plane network element detects abnormal traffic, it executes a preset measure to reduce the impact of abnormal traffic on the efficiency of user plane traffic processing.

[0064] In some embodiments, the user plane network element may also execute preset measures based on the first information or the second information. These preset measures include measures to prevent a decrease in user plane traffic processing efficiency. In some embodiments, executing preset measures based on the first information or the second information may involve determining and executing target measures within the preset measures, whereby the target measures are used to prevent a decrease in user plane traffic processing efficiency.

[0065] After detecting abnormal traffic, the user plane network element takes measures to avoid the impact of abnormal traffic on user plane efficiency. Alternatively, the user plane network element can take measures in advance based on the first piece of information to avoid a decrease in user plane efficiency.

[0066] In some embodiments, the preset measures include one or more of the following: discarding abnormal data packets, adjusting traffic thresholds (increasing or decreasing them), sending abnormal information to the session management function (including information such as detecting abnormal data traffic, traffic surges, traffic drops, and insufficient capacity), reconfiguring parameters on user plane network elements (e.g., queues, buffering, jitter, latency, etc.), and security-related measures (e.g., tracing the source of abnormal traffic and investigating user identities). In some embodiments, the above preset measures may also include capacity expansion.

[0067] In this embodiment of the disclosure, the intelligent network element predicts the service mode of the user plane based on the collected user plane data traffic information and / or user plane-related information in the network, and then sends the information to the user plane network element directly or indirectly. The user plane network element first performs anomaly detection on the user plane data traffic based on the information provided by the intelligent network element. If abnormal traffic is detected, the abnormal traffic is processed in a timely manner, such as directly discarding data packets, expanding the UPF, and promptly notifying the network that it cannot meet the demand, etc.

[0068] In the above embodiments, before the user plane network element detects the user plane traffic based on the first information or the second information, it directly obtains the first information from the intelligent network element, or indirectly obtains the first information from the intelligent network element through a third-party network element, or obtains the second information from the third-party network element; the second information is generated by the third-party network element based on the first information.

[0069] In the above embodiments, the intelligent network element can proactively trigger the sending of the first information directly or indirectly to the user plane network element, or proactively trigger the sending of the first information to a third-party network element, so that the third-party network element generates second information based on the first information and sends it to the user plane network element. The user plane network element can then detect user plane traffic based on the first or second information, improving the traffic detection efficiency of the user plane network element. It is understood that the proactive triggering method requires fewer signaling messages for the entire solution.

[0070] It should be noted that, from the perspective of how user plane network elements acquire the first and second information, the solutions of this disclosure embodiment can be divided into two types. The first type involves the user plane network element passively receiving the first or second information, including receiving the first information from an intelligent network element and receiving the first or second information from a third-party network element. The second type involves the user plane network element actively acquiring the first or second information, that is, the user plane network element directly or indirectly sends a request to the intelligent network element to request the first or second information, and then receives the first or second information. It is understood that the above two solutions can be implemented separately or simultaneously. Simultaneous implementation means that while retaining the passive receiving method, the user plane network element can also actively acquire the first or second information.

[0071] Figures 6-8 The flowchart of the user plane data detection method for passively receiving the first or second information by the aforementioned user plane network element is shown.

[0072] like Figure 6 As shown, the user plane data detection method includes steps S601-S602. In step S601, the intelligent network element directly sends first information to the user plane network element; in step S602, the user plane network element detects the user plane traffic based on the first information.

[0073] like Figure 7 As shown, the user plane data detection method includes steps S701-S702. In step S701, the intelligent network element indirectly sends first information to the user plane network element through a third-party network element; in step S702, the user plane network element detects the user plane traffic based on the first information.

[0074] like Figure 8 As shown, the user plane data detection method includes steps S801-S804. In S801, the intelligent network element sends first information to a third-party network element; in S802, the third-party network element generates second information based on the first information; in S803, the third-party network element sends the second information to the user plane network element; and in S804, the user plane network element detects the user plane traffic based on the second information.

[0075] Figures 9-11 The flowchart of the user plane data detection method for the above-mentioned user plane network element to actively obtain the first information or the second information is shown.

[0076] like Figure 9 As shown, the user plane data detection method includes steps S901-S603. In step S901, the user plane network element directly sends a first request to the intelligent network element, the first request being used to request first information from the intelligent network element; in step S902, the intelligent network element directly sends the first information to the user plane network element; in step S903, the user plane network element detects the user plane traffic based on the first information.

[0077] In some embodiments, the first request includes one or more of the following information: Analytics ID, IP 5-tuple (including one or more of the following: destination IP address, destination port, source IP address, source port, and transport layer protocol), Uniform Resource Locator (URL), Application ID, Filter information, and Target of reporting. It should be noted that the IP 5-tuple, URL, and Application ID can be included as either filter information or target of reporting.

[0078] like Figure 10 As shown, the user plane data detection method includes steps S1001-S1003. In S1001, the user plane network element indirectly sends a first request to the intelligent network element through a third-party network element. The first request is used to request first information from the intelligent network element. In S1002, the intelligent network element indirectly sends the first information to the user plane network element through a third-party network element. In S1003, the user plane network element detects the user plane traffic based on the first information. In some embodiments, the third-party network element is a session management function.

[0079] like Figure 11 As shown, the user plane data detection method includes steps S1101-S1105. In S1101, the user plane network element indirectly sends a first request to the intelligent network element through a third-party network element. The first request is used to request first information from the intelligent network element. In S1102, the intelligent network element sends the first information to the third-party network element. In S1103, the third-party network element generates second information based on the first information. In S1104, the third-party network element sends the second information to the user plane network element. In S1105, the user plane network element detects the user plane traffic based on the second information.

[0080] In some embodiments, such as Figure 12 As shown, the process of a user plane network element sending a request to an intelligent network element indirectly can also be S1201-S1203. In S1201, the user plane network element sends a first request to the third-party network element; in S1202, the third-party network element generates a second request based on the first request, the second request being used to request first information from the intelligent network element; in S1203, the third-party network element sends the second request to the intelligent network element. In some embodiments, the second request includes one or more of the following information: Analytics ID, IP 5-tuple, Uniform Resource Locator, Application Identifier, Filter Information, and Reporting Target Information.

[0081] Figure 13 The process of generating the first information in an embodiment of this disclosure is shown, such as Figure 13 As shown, generating the first information may include S1301-S1304.

[0082] In S1301, the intelligent network element obtains the first input information from the session management function. The first input information includes one or more of the following: application identifier, N4 rule, IP 5-tuple, IP triplet, Uniform Resource Locator, domain name, PDU session count, N4 session count, and number of users.

[0083] In S1302, the intelligent network element obtains second input information from the network development function or the packet flow description function. The second input information includes one or more of the following: packet flow description identifier, IP 5-tuple, IP triplet, Uniform Resource Locator, and domain name.

[0084] In S1303, the intelligent network element obtains third input information from the user plane network element. The third input information includes one or more of the following: application identifier, IP 5-tuple, IP 3-tuple, start time, end time, packet length, number of packets, direction of traffic, data volume, Uniform Resource Locator, domain name, user plane network element load, user plane network element status, user plane network element resource usage, number of PDU sessions, number of N4 sessions, and number of users.

[0085] In S1304, the intelligent network element generates the first information based on one or more of the first input information, the second input information, and the third input information.

[0086] It is understandable that S1304 generates the first information based on one or more of the input information in S1301-S1303. Therefore, S1301-S1303 do not need to be executed in their entirety, and only some steps need to be executed.

[0087] In some embodiments, the session management function, network development function, packet traffic description function, and user plane network element can proactively send first input information, second input information, and third input information to the intelligent network element. In some embodiments, the session management function, network development function, packet traffic description function, and user plane network element can also send the first input information, second input information, and third input information to the intelligent network element after receiving a data request from the intelligent network element.

[0088] like Figure 14 As shown, in S1401, the intelligent network element sends a first data request to the SMF; in S1402, the SMF sends first input information to the intelligent network element; in S1403, the intelligent network element sends a second data request to the NEF (PFDF); in S1404, the NEF (PFDF) sends second input information to the intelligent network element; in S1405, the intelligent network element sends a third data request to the user plane network element; in S1406, the user plane network element sends third input information to the intelligent network element; and in S1407, the intelligent network element generates first information based on one or more of the first, second, and third input information.

[0089] It should also be noted that in the above-mentioned user plane data detection scheme where the user plane network element passively acquires the first or second information, steps S1301-S1304 (or S1401-S1407) can be steps actively executed by the intelligent network element. In the above-mentioned user plane data detection scheme where the user plane network element actively acquires the first or second information, steps S1301-S1304 (or S1401-S1407) can be steps executed by the intelligent network element after receiving the first or second request.

[0090] Figure 15 This diagram illustrates a flowchart of a user plane data detection method according to an embodiment of the present disclosure, such as... Figure 15 As shown, the user plane data detection method provided in this embodiment includes S1501-S1510. Among them, S1502-S1508 are similar to S1401-S1407; S1501, and S1509-S1510 are similar to S601-S603.

[0091] Figure 16 This diagram illustrates a flowchart of a user plane data detection method according to an embodiment of the present disclosure, such as... Figure 16 As shown, the user plane data detection method provided in this embodiment includes S1601-S1610. Among them, S1602-S1608 are similar to S1401-S1407; S1601, and S1609-S1610 are similar to S1001-S1003.

[0092] Figure 17 This disclosure illustrates a user plane data detection method in an embodiment, which is executed by a session management function, such as... Figure 17 As shown, the user plane data detection method provided in this embodiment includes S1701-S1702.

[0093] In S1701, the user plane network element directly or indirectly requests the first information from the intelligent network element, and the first information is the service mode prediction information and / or statistical information generated by the intelligent network element.

[0094] In S1702, the first information or the second information is sent to the user plane network element so that the user plane network element can detect the traffic of the user plane based on the first information or the second information. The second information is generated by the session management function based on the first information and the second information instructs the user plane network element to perform abnormal traffic detection rules.

[0095] The indirect request for first information from a user plane network element to an intelligent network element includes: forwarding the first request from the user plane network element to the intelligent network element, and forwarding the first information from the intelligent network element to the user plane network element; the direct request for first information from a user plane network element to an intelligent network element includes: triggering a second request to the intelligent network element based on internal configuration, receiving the first information from the intelligent network element, generating the second information based on the first information, and sending the second information to the user plane network element.

[0096] In some embodiments, the second request is used to request first information from the intelligent network element; in some embodiments, the second request includes one or more of the following information: Analytics ID, IP 5-tuple, Uniform Resource Locator, Application Identifier, Filter Information, and Reporting Target Information.

[0097] In this embodiment of the disclosure, the session management function can directly or indirectly request first information from the intelligent network element for the user plane network element, and send the first information or second information to the user plane network element to assist the user plane network element in traffic detection and improve detection efficiency.

[0098] In some embodiments, the session management function directly requests first information from the intelligent network element for the user plane network element. Alternatively, it can trigger a third request to the intelligent network element based on internal configuration or operator policies. The third request is used to subscribe to the first information from the intelligent network element for the user plane network element, so that the intelligent network element sends the first information to the user plane network element. In some embodiments, the third request includes an Analytics ID, and may also include one or more of the following: IP 5-tuple, Uniform Resource Locator, Application Identifier, filter information, and reporting target information. In this embodiment, the session management function can proactively trigger the sending of a third request to the intelligent network element, thereby enabling the intelligent network element to directly send the first information to the user plane network element. The first information can assist the user plane network element in traffic detection, improving detection efficiency.

[0099] In some embodiments, the user plane network element detects user plane traffic based on first information or second information, including one or more of the following:

[0100] When the IP 5-tuple of the detected traffic matches the IP 5-tuple in the first information, but the packet length of the traffic does not match the packet length in the first information, the traffic is identified as abnormal traffic.

[0101] When the detected traffic's IP 5-tuple, start time, and packet length match those in the first information, but the traffic's packet transmission frequency does not match that in the first information, the traffic is identified as abnormal traffic.

[0102] If the first information shows a sudden increase in the traffic of data packets containing the target IP 5-tuple within the target time period, and the data traffic containing the target IP 5-tuple is detected within the target time period, then the data traffic containing the target IP 5-tuple is identified as abnormal traffic. The sudden increase in data packet traffic includes one or more of the following: increase in the number of data packets, increase in the frequency of data packet transmission, increase in the load of user plane network elements, and increase in the usage of user plane network element resources.

[0103] Figure 18 This invention discloses a user plane data detection method in an embodiment of the present disclosure. The method is executed by a user plane network element, such as... Figure 18As shown, the user plane data detection method provided in this embodiment includes S1801. In S1801, the user plane network element detects the user plane traffic based on first information or second information; wherein, the first information is prediction information and / or statistical information generated by the intelligent network element, and the second information is generated based on the first information.

[0104] The user plane data detection method provided in this disclosure allows intelligent network elements to send predicted and / or statistical information of user plane traffic to the user plane network element directly or indirectly. When detecting user plane traffic, the user plane network element can refer to the predicted and / or statistical information. In other words, the intelligent network element can assist the user plane network element in filtering out abnormal data traffic or adjusting the configuration according to the traffic, and then take relevant processing measures in a timely manner to ensure the efficiency of user plane traffic processing.

[0105] Figure 19 This disclosure illustrates a user plane data detection method in an embodiment, which is executed by an intelligent network element, such as... Figure 19 As shown, the user plane data detection method provided in this embodiment includes S1901. In S1901, the intelligent network element directly sends the first information to the user plane network element, or sends the first information to the user plane network element through a third-party network element, so that the user plane network element can detect the user plane traffic based on the first information or the second information; wherein, the first information is prediction information and / or statistical information generated by the intelligent network element, and the second information is generated by the third-party network element based on the first information and sent to the user plane network element.

[0106] The user plane data detection method provided in this disclosure allows intelligent network elements to send predicted and / or statistical information of user plane traffic to the user plane network element directly or indirectly. When detecting user plane traffic, the user plane network element can refer to the predicted and / or statistical information. In other words, the intelligent network element can assist the user plane network element in filtering out abnormal data traffic or adjusting the configuration according to the traffic, and then take relevant processing measures in a timely manner to ensure the efficiency of user plane traffic processing.

[0107] In embodiments of this disclosure, the terms “first,” “second,” and “third” are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0108] In this disclosure, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0109] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result.

[0110] In some embodiments, certain steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be broken down into multiple steps for execution.

[0111] Based on the same inventive concept, this disclosure also provides a user plane network element, such as... Figure 20 As shown, the user plane network element includes a traffic detection module 2001.

[0112] The traffic detection module 2001 is used to detect user plane traffic based on first information or second information; wherein, the first information is predictive information and / or statistical information generated by intelligent network elements, and the second information is generated based on the first information.

[0113] In some embodiments, the traffic detection module 2001 detects user plane traffic based on first information, including one or more of the following:

[0114] When the IP 5-tuple of the detected traffic matches the IP 5-tuple in the first information, but the packet length of the traffic does not match the packet length in the first information, the traffic is identified as abnormal traffic.

[0115] When the detected traffic's IP 5-tuple, start time, and packet length match those in the first information, but the traffic's packet transmission frequency does not match that in the first information, the traffic is identified as abnormal traffic.

[0116] If the first information shows a sudden increase in the traffic of data packets containing the target IP 5-tuple within the target time period, and the data traffic containing the target IP 5-tuple is detected within the target time period, then the data traffic containing the target IP 5-tuple is identified as abnormal traffic. The sudden increase in data packet traffic includes one or more of the following: increase in the number of data packets, increase in the frequency of data packet transmission, increase in the load of user plane network elements, and increase in the usage of user plane network element resources.

[0117] In some embodiments, the user plane network element includes a processing execution module.

[0118] The processing execution module is used to execute preset measures when abnormal traffic is detected. These preset measures are used to reduce the impact of abnormal traffic on the efficiency of user plane traffic processing.

[0119] In some embodiments, the user plane network element includes a processing execution module.

[0120] The processing execution module is used to determine and execute target measures from preset measures based on the first information or the second information, wherein the target measures are used to prevent the user plane traffic processing efficiency from decreasing.

[0121] In some embodiments, the preset measures include one or more of the following: discarding abnormal data packets, adjusting traffic thresholds, sending abnormal information to the session management function, reconfiguring parameters on the user plane network element, and security-related measures.

[0122] In some embodiments, the user plane network element includes an information acquisition module.

[0123] The information acquisition module is used to obtain first information directly from the intelligent network element, or indirectly obtain first information from the intelligent network element through a third-party network element, or obtain second information from the third-party network element; the second information is generated by the third-party network element based on the first information.

[0124] In some embodiments, the user plane network element includes an information request module.

[0125] The information request module is used to send a first request to the intelligent network element, or to send a first request indirectly to the intelligent network element through a third-party network element; wherein, the first request is used to request first information from the intelligent network element.

[0126] Based on the same inventive concept, this disclosure also provides an intelligent network element, such as... Figure 21 As shown, the intelligent network element includes an information sending module 2101.

[0127] The information sending module 2101 is used to send the first information directly to the user plane network element, or to send the first information to the user plane network element through a third-party network element, so that the user plane network element can detect the traffic of the user plane based on the first information or the second information; wherein, the first information is prediction information and / or statistical information generated by the intelligent network element, and the second information is generated by the third-party network element based on the first information and sent to the user plane network element.

[0128] Based on the same inventive concept, this disclosure also provides a session management function, such as... Figure 22 As shown, the session management function includes a request module 2201 and a sending module 2202.

[0129] Request module 2201 is used to directly or indirectly request first information from intelligent network element for user plane network element, the first information being prediction information and / or statistical information generated by intelligent network element;

[0130] The sending module 2202 is used to send first information or second information to the user plane network element so that the user plane network element can detect the traffic of the user plane based on the first information or second information. The second information is generated by the session management function based on the first information and the second information indicates the rules for the user plane network element to perform traffic detection.

[0131] The indirect request for first information from a user plane network element to an intelligent network element includes: forwarding the first request from the user plane network element to the intelligent network element, and forwarding the first information from the intelligent network element to the user plane network element; the direct request for first information from a user plane network element to an intelligent network element includes: triggering a second request to the intelligent network element based on internal configuration, receiving the first information from the intelligent network element, generating the second information based on the first information, and sending the second information to the user plane network element.

[0132] Based on the same inventive concept, this disclosure also provides a communication system, such as... Figure 23 As shown, the communication system includes a user plane network element 2301 and an intelligent network element 2302. The user plane network element 2301 can be the user plane network element described in the above embodiments, for example... Figure 20 The user plane network element; the intelligent network element 2302 can be the intelligent network element described in the above embodiments, such as... Figure 21 Intelligent network elements.

[0133] Based on the same inventive concept, this disclosure also provides a communication system, such as... Figure 24 As shown, the communication system includes a user plane network element 2401, an intelligent network element 2402, and a session management function 2403. The user plane network element 2401 can be the user plane network element described in the above embodiments, for example... Figure 20 The user plane network element; the intelligent network element 2402 can be the intelligent network element described in the above embodiments, such as... Figure 21 The intelligent network element; the session management function 2403 can be the intelligent network element described in the above embodiments, such as... Figure 22 Intelligent network elements.

[0134] The concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to define the order of functions performed by these devices, modules or units or their interdependencies.

[0135] Regarding the user plane network elements, intelligent network elements, session management functions, and communication systems in the above embodiments, the specific methods by which each module performs its operations have been described in detail in the embodiments related to the user plane data detection method, and will not be elaborated upon here.

[0136] It should be noted that although several modules or units of the device used for action execution are mentioned in the detailed description above, this division is not mandatory.

[0137] In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0138] Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0139] The following reference Figure 25 This describes the electronic device provided in the embodiments of this disclosure. Figure 25 The electronic device 2500 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0140] Figure 25 This diagram illustrates the architecture of an electronic device 2500 provided in an embodiment of the present invention. Figure 25 As shown, the electronic device 2500 includes, but is not limited to, at least one processor 2510 and at least one memory 2520.

[0141] Memory 2520 is used to store instructions.

[0142] In some embodiments, memory 2520 may include a readable medium in the form of volatile memory cells, such as random access memory (RAM) 25201 and / or cache memory 25202, and may further include read-only memory (ROM) 25203.

[0143] In some embodiments, the memory 2520 may also include a program / utility 25204 having a set (at least one) of program modules 25205, such program modules 25205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0144] In some embodiments, the memory 2520 may store an operating system. This operating system may be a real-time operating system (RTX), such as Linux, UNIX, Windows, or OS X.

[0145] In some embodiments, the memory 2520 may also store data.

[0146] As an example, processor 2510 can read data stored in memory 2520, which may be stored at the same memory address as the instruction, or the data may be stored at a different memory address than the instruction.

[0147] Processor 2510 is configured to invoke instructions stored in memory 2520 to implement the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of this disclosure. For example, processor 2510 can execute the steps of the user plane data detection method embodiments described above.

[0148] It should be noted that the processor 2510 described above can be a general-purpose processor or a special-purpose processor. The processor 2510 may include one or more processing cores, and the processor 2510 executes various functional applications and data processing by running instructions.

[0149] In some embodiments, processor 2510 may include a central processing unit (CPU) and / or a baseband processor.

[0150] In some embodiments, the processor 2510 may determine an instruction based on the priority identifier and / or function category information carried in each control instruction.

[0151] In this disclosure, the processor 2510 and the memory 2520 can be configured separately or integrated together.

[0152] As an example, the processor 2510 and memory 2520 can be integrated on a single board or a system on chip (SOC).

[0153] like Figure 25 As shown, the electronic device 2500 is presented in the form of a general-purpose computing device. The electronic device 2500 may also include a bus 2530.

[0154] Bus 2530 can represent one or more of several types of bus structures, including a memory bus or memory controller, peripheral bus, graphics acceleration port, processor, or a local bus using any of the various bus structures.

[0155] Electronic device 2500 can also communicate with one or more external devices 2540 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 2500, and / or with any device that enables electronic device 2500 to communicate with one or more other computing devices (e.g., router, modem, etc.). Such communication can be performed through input / output (I / O) interface 2550.

[0156] Furthermore, the electronic device 2500 can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via the network adapter 2560.

[0157] like Figure 25 As shown, network adapter 2560 communicates with other modules of electronic device 2500 via bus 2530.

[0158] It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 2500, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0159] It is understood that the structure illustrated in the embodiments of this disclosure does not constitute a specific limitation on the electronic device 2500. In other embodiments of this disclosure, the electronic device 2500 may include more than Figure 25 This may involve more or fewer components, or combining certain components, or splitting certain components, or different component arrangements. Figure 25 The components shown can be implemented in hardware, software, or a combination of both.

[0160] This disclosure also provides a computer-readable storage medium storing computer instructions thereon, which, when executed by a processor, implement the user plane data detection method described in the above method embodiments.

[0161] In this embodiment of the disclosure, the computer-readable storage medium is a computer instruction that can be sent, propagated, or transmitted for use by or in conjunction with an instruction execution system, apparatus, or device.

[0162] As an example, a computer-readable storage medium is a non-volatile storage medium.

[0163] In some embodiments, more specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, USB flash drives, portable hard drives, or any suitable combination of the foregoing.

[0164] In this embodiment of the disclosure, the computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, wherein computer instructions (readable program code) are carried.

[0165] The transmitted data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0166] In some examples, computational instructions contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0167] This disclosure also provides a computer program product that stores instructions that, when executed by a computer, cause the computer to implement the user plane data detection method described in the above method embodiments.

[0168] The aforementioned instructions can be program code. In practice, the program code can be written using any combination of one or more programming languages.

[0169] Programming languages ​​include object-oriented programming languages—such as Java and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages.

[0170] The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0171] In cases involving remote computing devices, the remote computing devices can be connected to user computing devices via any type of network, including local area networks (LANs) or wide area networks (WANs), or they can be connected to external computing devices (e.g., via the Internet using an Internet service provider).

[0172] This disclosure also provides a chip, including at least one processor and an interface; the interface is used to provide program instructions or data to at least one processor; the at least one processor is used to execute the program instructions to implement the user plane data detection method described in the above method embodiments.

[0173] In some embodiments, the chip may further include a memory for storing program instructions and data, the memory being located within or outside the processor.

[0174] Those skilled in the art will understand that all or part of the steps of the above embodiments can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which can be collectively referred to as "circuit", "module" or "system".

[0175] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein.

[0176] This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method for detecting user plane data, characterized in that, The method is executed by a user plane network element, and the method includes: Traffic on the user plane is detected based on the first information or the second information; wherein the first information is predictive information and / or statistical information generated by intelligent network elements, and the second information is generated based on the first information.

2. The method according to claim 1, characterized in that, The first information is obtained by the intelligent network element through prediction and / or statistics based on the collected user plane data traffic information and / or user plane-related information in the network.

3. The method according to claim 2, characterized in that, The user plane data traffic information and / or user plane-related information in the network include one or more of the following: The first input information comes from the session management function, the second input information comes from the network open function or packet traffic description function, and the third input information comes from the user plane network element; The first input information includes one or more of the following: application identifier, N4 rule, IP 5-tuple, IP triplet, Uniform Resource Locator, domain name, PDU session count, N4 session count, and number of users. The second input information includes one or more of the following: packet flow descriptor identifier, IP 5-tuple, IP triplet, Uniform Resource Locator, and domain name; The third input information includes one or more of the following: application identifier, IP 5-tuple, IP triplet, start time, end time, data packet length, number of data packets, direction of traffic, data volume, Uniform Resource Locator, domain name, user plane network element load, user plane network element status, user plane network element resource usage, number of PDU sessions, number of N4 sessions, and number of users.

4. The method according to claim 1, characterized in that, The first information includes one or more of the following: Application identifier, IP 5-tuple, IP 3-tuple, Uniform Resource Locator, domain name, start time, end time, packet length, number of packets, packet transmission frequency, data volume, traffic direction, user plane network element load, user plane network element status, user plane network element resource usage, number of PDU sessions, number of N4 sessions, number of users, confidence level.

5. The method according to claim 4, characterized in that, The detection of user-plane traffic based on the first information includes one or more of the following: When the IP 5-tuple of the detected traffic matches the IP 5-tuple in the first information, but the data packet length of the traffic does not match the data packet length in the first information, the traffic is identified as abnormal traffic. When the IP 5-tuple, start time, and packet length of the detected traffic match the IP 5-tuple, start time, and packet length in the first information, but the packet transmission frequency of the traffic does not match the packet transmission frequency in the first information, the traffic is identified as abnormal traffic. When the first information shows a sudden increase in data packet traffic containing a target IP 5-tuple within a target time period, and data traffic containing the target IP 5-tuple is detected within the target time period, the data traffic containing the target IP 5-tuple is identified as abnormal traffic; wherein, the sudden increase in data packet traffic includes one or more of the following: increase in the number of data packets, increase in data packet transmission frequency, increase in user plane network element load, and increase in user plane network element resource usage.

6. The method according to claim 1, characterized in that, The method further includes: If abnormal traffic is detected, preset measures are executed to reduce the impact of abnormal traffic on the efficiency of user plane traffic processing.

7. The method according to claim 1, characterized in that, The method further includes: Based on the first information or the second information, a preset measure is executed, which is used to prevent a decrease in the efficiency of user plane traffic processing.

8. The method according to claim 6 or 7, characterized in that, The preset measures include one or more of the following: Discarding abnormal data packets, adjusting traffic thresholds, sending abnormal information to the session management function, reconfiguring parameters on user plane network elements, and security-related measures.

9. The method according to any one of claims 1-7, characterized in that, Before detecting user plane traffic based on the first information or the second information, the method further includes: The first information is obtained directly from the intelligent network element, or indirectly from the intelligent network element through a third-party network element, or the second information is obtained from the third-party network element; the second information is generated by the third-party network element based on the first information.

10. The method according to claim 9, characterized in that, Before obtaining the first information directly from the intelligent network element, or obtaining the first information from the intelligent network element from a third-party network element, or obtaining the second information from a third-party network element, the method further includes: Send a first request to the intelligent network element, or send a first request indirectly to the intelligent network element through a third-party network element; wherein the first request is used to request the first information from the intelligent network element.

11. The method according to claim 10, characterized in that, The third-party network element is for session management functions.

12. The method according to claim 10, characterized in that, The first request includes one or more of the following information: Analyze identifiers, IP 5-tuples, Uniform Resource Locators, application identifiers, filter information, and reporting target information.

13. A user plane data detection method, characterized in that, The method is executed by the session management function, and the method includes: The user plane network element requests first information from the intelligent network element, which is service mode prediction information and / or statistical information generated by the intelligent network element; The first information or the second information is sent to the user plane network element so that the user plane network element can detect the user plane traffic based on the first information or the second information. The second information is generated by the session management function based on the first information. The second information indicates the rules for the user plane network element to perform abnormal traffic detection. The indirect method for a user plane network element to request first information from an intelligent network element includes: forwarding the first request from the user plane network element to the intelligent network element, and forwarding the first information from the intelligent network element to the user plane network element; the direct method for a user plane network element to request first information from an intelligent network element includes: triggering a second request to the intelligent network element based on internal configuration, receiving the first information from the intelligent network element, generating the second information based on the first information, and sending the second information to the user plane network element.

14. The method according to claim 13, characterized in that, The direct request for first information from the intelligent network element by the user plane network element also includes: A third request is sent to the intelligent network element based on internal configuration or operator policy. The third request is used to subscribe to the first information from the intelligent network element for the user plane network element, so that the intelligent network element sends the first information to the user plane network element.

15. The method according to claim 13 or 14, characterized in that, The user plane network element detects user plane traffic based on the first information or the second information, including one or more of the following: When the IP 5-tuple of the detected traffic matches the IP 5-tuple in the first information, but the data packet length of the traffic does not match the data packet length in the first information, the traffic is identified as abnormal traffic. When the IP 5-tuple, start time, and packet length of the detected traffic match the IP 5-tuple, start time, and packet length in the first information, but the packet transmission frequency of the traffic does not match the packet transmission frequency in the first information, the traffic is identified as abnormal traffic. When the first information shows a sudden increase in data packet traffic containing a target IP 5-tuple within a target time period, and data traffic containing the target IP 5-tuple is detected within the target time period, the data traffic containing the target IP 5-tuple is identified as abnormal traffic; wherein, the sudden increase in data packet traffic includes one or more of the following: increase in the number of data packets, increase in data packet transmission frequency, increase in user plane network element load, and increase in user plane network element resource usage.

16. A user plane data detection method, characterized in that, The method is executed by an intelligent network element, and the method includes: The first information is sent directly to the user plane network element, or the first information is sent to the user plane network element through a third-party network element, so that the user plane network element can detect the traffic of the user plane based on the first information or the second information; Wherein, the first information is prediction information and / or statistical information generated by the intelligent network element, and the second information is generated by the third-party network element based on the first information and sent to the user plane network element.

17. The method according to claim 16, characterized in that, Before directly sending the first information to the user plane network element, or sending the first information to the user plane network element through a third-party network element, the method further includes: Obtain first input information from the session management function, the first input information including one or more of the following: application identifier, N4 rule, IP 5-tuple, IP triplet, Uniform Resource Locator, domain name, PDU session count, N4 session count, and number of users; Obtain second input information from the network development function or packet flow description function, the second input information including one or more of the following: packet flow description identifier, IP 5-tuple, IP triplet, Uniform Resource Locator, and domain name; Obtain third input information from user plane network elements. The third input information includes one or more of the following: application identifier, IP 5-tuple, IP triplet, start time, end time, data packet length, number of data packets, direction of traffic, data volume, Uniform Resource Locator, domain name, user plane network element load, user plane network element status, user plane network element resource usage, number of PDU sessions, number of N4 sessions, and number of users. The first information is generated based on the first input information, the second input information, and the third input information.

18. A user plane network element, characterized in that, include: The traffic detection module is used to detect user plane traffic based on first information or second information; wherein the first information is prediction information and / or statistical information generated by intelligent network elements, and the second information is generated based on the first information.

19. An intelligent network element, characterized in that, include: The information sending module is used to send the first information directly to the user plane network element, or to send the first information to the user plane network element through a third-party network element, so that the user plane network element can detect the traffic of the user plane based on the first information or the second information; Wherein, the first information is prediction information and / or statistical information generated by the intelligent network element, and the second information is generated by the third-party network element based on the first information and sent to the user plane network element.

20. A communication system, characterized in that, It includes the user plane network element as described in claim 18 and the intelligent network element as described in claim 19.

Images