Communication method and related device

Abstract

A communication method and a related device. In the method, an NWDAF network element can acquire signaling information related to a terminal behavior from a plurality of second network elements in response to a first request from a first network element, and determine a second network element with an abnormal signaling behavior from among the plurality of second network elements on the basis of the signaling information. Any network element with an abnormal signaling behavior can be effectively detected, reducing network signaling impact.

Description

Communication method and related equipment

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on December 7, 2023, with application number 202311683861.X and application name “Communication Methods and Related Equipment”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a communication method and related equipment. Background Art

[0003] In mobile communication networks, when there is a large amount of duplicate signaling or services from a faulty network element are transferred to other network elements for processing, network signaling congestion often occurs. For example, the amount of signaling to be processed exceeds the processing capacity of the network element, and the network element is unable to process the signaling correctly and quickly. As a result, many users who have already connected to the network or established sessions experience errors due to delayed signaling processing. They are forced to re-register with the network or re-establish sessions, which in turn generates more signaling, triggering a large-scale avalanche effect and causing network signaling shock. Therefore, how to detect network elements with abnormal signaling behavior and reduce network signaling shock is an unresolved problem.

[0004] Summary of the Invention

[0005] The embodiments of the present application provide a communication method and related equipment, which can effectively detect network elements with abnormal signaling behavior and reduce network signaling impact.

[0006] In a first aspect, a communication method is provided, comprising: receiving a first request from a first network element, the first request carrying a signaling anomaly analysis indication; receiving signaling information related to terminal behavior from multiple second network elements, and determining, from the multiple second network elements, a second network element with abnormal signaling behavior based on the signaling information; and sending a first response to the first network element, the first response including first information indicating the second network element with abnormal signaling behavior. In this aspect, signaling information related to terminal behavior can be obtained from the multiple second network elements in response to the first request, and the second network element with abnormal signaling behavior can be determined from the multiple second network elements based on the signaling information. This effectively detects network elements with abnormal signaling behavior and reduces network signaling impact.

[0007] Optionally, the first network element may include at least one of a network warehouse function network element, a service communication proxy network element, or an operation management and maintenance function network element. Optionally, the second network element may also be referred to as a network function network element, and may include at least one of an access and mobility management function network element, a session management function network element, a policy control function, a user plane function network element, or a unified data management function network element.

[0008] Optionally, the signaling information related to the terminal behavior may be a first signaling quantity matrix, or may be an access behavior trend of the terminal, and / or a session behavior trend of the terminal. The first signaling quantity matrix includes, per unit time in the first time period, the quantity of signaling sent by the second network element to other second network elements, and / or the quantity of signaling received from other second network elements.

[0009] Optionally, the communication method in this aspect may be executed by a network data analysis function network element.

[0010] In an optional embodiment, determining a second network element with abnormal signaling behavior from multiple second network elements based on signaling information includes: determining the second network element with abnormal signaling behavior from the multiple second network elements based on a first signaling quantity matrix of the multiple second network elements. Specifically, the first signaling quantity matrix of the multiple second network elements can be compared and analyzed with the second signaling forwarding modes of the multiple second network elements to obtain a comparative analysis result, and the second network element with abnormal signaling behavior can be determined from the multiple second network elements based on the comparative analysis result. It can be seen that in this embodiment, the second network element with abnormal signaling behavior can be directly determined from the multiple second network elements based on the first signaling quantity matrix of the multiple second network elements, which is simpler and more convenient.

[0011] In another optional embodiment, based on the first signaling quantity matrix of multiple second network elements, determining the second network element with abnormal signaling behavior from the multiple second network elements includes: determining the first signaling forwarding mode of the multiple second network elements based on the first signaling quantity matrix of the multiple second network elements; determining the second network element with abnormal signaling behavior from the multiple second network elements based on the first signaling forwarding mode and the second signaling forwarding mode of the multiple second network elements; wherein the first signaling quantity matrix of the second network element includes the number of signalings sent by the second network element to other second network elements and / or the number of signalings received from other second network elements in a unit time of the first time period; the first signaling forwarding mode is the signaling forwarding mode corresponding to the first signaling quantity matrix; the second signaling forwarding mode is the signaling forwarding mode of the second network element when the signaling behavior is normal; the signaling forwarding mode of the second network element is the signaling interaction rule related to the second network element. In this embodiment, the current or future signaling forwarding rule (i.e., the first signaling forwarding mode) of the second network element can be obtained from the first signaling quantity matrix of the multiple second network elements, which is conducive to timely detection of the second network element with abnormal signaling behavior.

[0012] In another optional embodiment, the plurality of second network elements include an access and mobility management function network element, and receiving signaling information related to terminal behavior from the second network element includes: receiving a first signaling quantity matrix from the access and mobility management function network element. It can be seen that in this embodiment, the first signaling quantity matrix of the access and mobility management function network element can be obtained directly from the access and mobility management function network element.

[0013] In another optional embodiment, the plurality of second network elements include a session management function network element, and receiving signaling information related to terminal behavior from the second network element includes: receiving a first signaling quantity matrix from the session management function network element. It can be seen that in this embodiment, the first signaling quantity matrix of the session management function network element can be obtained directly from the session management function network element.

[0014] In another optional embodiment, the plurality of second network elements include a policy control function network element, and receiving signaling information related to terminal behavior from the second network element includes: receiving a first signaling quantity matrix from the policy control function network element. It can be seen that in this embodiment, the first signaling quantity matrix of the policy control function network element can be obtained directly from the policy control function network element.

[0015] In another optional embodiment, the plurality of second network elements include a user plane function network element, and receiving signaling information related to terminal behavior from the second network element includes: receiving a first signaling quantity matrix from the user plane function network element. It can be seen that in this embodiment, the first signaling quantity matrix of the user plane function network element can be obtained directly from the user plane function network element.

[0016] In another optional embodiment, the plurality of second network elements include a unified data management function network element, and receiving signaling information related to terminal behavior from the second network element includes: receiving a first signaling quantity matrix from the unified data management function network element. It can be seen that in this embodiment, the first signaling quantity matrix of the unified data management function network element can be obtained directly from the unified data management function network element.

[0017] In yet another optional embodiment, receiving signaling information related to terminal behavior from the second network element includes: receiving a first signaling quantity matrix of at least one of an access and mobility management function network element, a session management function network element, a policy control function network element, a user plane function network element, or a unified data management function network element from a serving communication proxy network element. Thus, in this embodiment, the serving communication proxy network element is introduced, and the first signaling quantity matrix of at least one of the access and mobility management function network element, the session management function network element, the policy control function network element, the user plane function network element, or the unified data management function network element can be directly measured and obtained from the serving communication proxy network element.

[0018] In another optional embodiment, receiving signaling information related to terminal behavior from a second network element includes: receiving access behavior trends of the terminal from an access and mobility management function network element, and / or receiving session behavior trends of the terminal from a session management function network element; the terminal access behavior trends and / or the terminal session behavior trends are used to determine a first signaling quantity matrix for multiple second network elements. For example, based on the access behavior trends of the terminal, a first signaling quantity matrix for the access and mobility management function network element is determined. For another example, based on the session behavior trends of the terminal, a first signaling quantity matrix for the session management function network element is determined. For another example, based on the access behavior trends of the terminal and / or the session behavior trends of the terminal, a first signaling quantity matrix for the policy control function network element is determined. For another example, based on the session behavior trends of the terminal, a first signaling quantity matrix for the user plane function network element is determined. It can be seen that in this embodiment, the first signaling quantity matrix of multiple second network elements can be predicted based on the access behavior trend of the terminal and / or the session behavior trend of the terminal. The first signaling quantity matrix of multiple second network elements represents the future signaling behavior of multiple second network elements, which is conducive to early discovery of second network elements with abnormal signaling behavior.

[0019] In another optional embodiment, the method also includes: determining a second signaling forwarding mode of multiple second network elements based on a second signaling quantity matrix of multiple second network elements; wherein the second signaling quantity matrix of the second network elements includes the number of signaling sent by the second network element to other second network elements, and / or the number of signaling received from other second network elements within a unit time of the second time period; the time point in the second time period is earlier than the time point in the first time period.

[0020] Optionally, the second signaling forwarding mode can be obtained by performing a correlation analysis on the second signaling quantity matrices of multiple second network elements. Specifically, based on the signaling behavior status of the multiple second network elements at each moment, the second signaling quantity matrices of the multiple second network elements can be screened to obtain a third signaling quantity matrix of the multiple second network elements, and a correlation analysis algorithm (such as an Apriori algorithm or an FP-growth algorithm, etc.) or a statistical analysis algorithm can be used to perform a correlation analysis on the third signaling quantity matrix of the multiple second network elements to obtain the second signaling forwarding mode of the multiple second network elements. The third signaling quantity matrix includes the number of signaling sent to other second network elements and / or the number of signaling received from other second network elements in the unit time of the second time period when the signaling behavior of the second network element is normal.

[0021] In another optional embodiment, before determining the second signaling forwarding mode of multiple second network elements based on the second signaling quantity matrix of multiple second network elements, the method also includes at least one of the following: receiving a second signaling quantity matrix from an access and mobility management function network element, receiving a second signaling quantity matrix from a session management function network element, receiving a second signaling quantity matrix from a policy control function network element, receiving a second signaling quantity matrix from a user plane function network element, or receiving a second signaling quantity matrix from a unified data management function network element.

[0022] In yet another optional embodiment, before determining the second signaling forwarding mode of the plurality of second network elements based on the second signaling quantity matrix of the plurality of second network elements, the method further includes: receiving the second signaling quantity matrix of at least one of the access and mobility management function network element, the session management function network element, the policy control function, the user plane function network element, or the unified data management function network element from the serving communication proxy network element. It can be seen that in this embodiment, the serving communication proxy network element is introduced, and the second signaling quantity matrix of at least one of the access and mobility management function network element, the session management function network element, the policy control function network element, the user plane function network element, or the unified data management function network element can be directly measured and obtained from the serving communication proxy network element.

[0023] In another optional embodiment, after determining a second network element with abnormal signaling behavior from multiple second network elements based on the first signaling forwarding mode and the second signaling forwarding mode of multiple second network elements, the method further includes: determining an influence coefficient of the second network element connected to the second network element with abnormal signaling behavior based on the first signaling forwarding mode and the second signaling forwarding mode; the first response also includes the influence coefficient, which is used to perform signaling flow control.

[0024] The impact coefficient may include at least one of the probability of the surrounding second network element being affected, the degree of impact, or the level of impact.

[0025] In another optional implementation, the first response further includes a second signaling forwarding mode, and the second signaling forwarding mode is used to perform signaling flow control.

[0026] In another optional implementation, the first network element includes at least one of a network warehouse function network element, a service communication agent network element, or an operation management and maintenance function network element.

[0027] On the second aspect, the present application also provides another communication method, which includes: sending a first request to a network data analysis function network element, the first request carrying a signaling anomaly analysis indication; receiving a first response from the network data analysis function network element, the first response including first information, the first information being used to indicate a second network element with abnormal signaling behavior; limiting query services related to the second network element with abnormal signaling behavior, and / or limiting signaling communications related to the second network element with abnormal signaling behavior. In this aspect, a first response can be received from the network data analysis function network element, and signaling behavior control can be performed based on the first information in the first response (for example, limiting query services and / or signaling communications related to the second network element with abnormal signaling behavior), which can effectively reduce network signaling impact and prevent the formation of a signaling storm.

[0028] Optionally, the method of this aspect may be executed by a network warehouse function network element and / or a service communication agent network element.

[0029] In an optional implementation, limiting the query service related to the second network element with abnormal signaling behavior includes at least one of the following: modifying the registration status of the second network element with abnormal signaling behavior to unavailable, adding the second network element with abnormal signaling behavior to an exclusion list, or discarding the discovery service request from the second network element with abnormal signaling behavior. It can be seen that when the registration status of the second network element with abnormal signaling behavior is modified to unavailable, and / or the second network element with abnormal signaling behavior is added to the exclusion list, the query results can be filtered, and the second network element with abnormal signaling behavior can be removed from the queried second network elements, which can effectively restrict other second network elements from establishing communication connections with the second network element with abnormal signaling behavior. When the discovery service request from the second network element with abnormal signaling behavior is discarded, the second network element with abnormal signaling behavior can be effectively restricted from establishing communication connections with other second network elements.

[0030] In another optional implementation, limiting the signaling communication related to the second network element with abnormal signaling behavior includes at least one of the following: intercepting a discovery service request from the second network element with abnormal signaling behavior, intercepting a discovery service request sent to the second network element with abnormal signaling behavior, intercepting signaling from the second network element with abnormal signaling behavior, or intercepting signaling sent to the second network element with abnormal signaling behavior. It can be seen that intercepting the discovery service request sent to the second network element with abnormal signaling behavior, and / or intercepting the discovery service request from the second network element with abnormal signaling behavior can effectively limit the second network element with abnormal signaling behavior from establishing a communication connection with other second network elements. Intercepting signaling from the second network element with abnormal signaling behavior, and / or intercepting signaling sent to the second network element with abnormal signaling behavior can effectively limit the signaling communication related to the second network element with abnormal signaling behavior.

[0031] In a third aspect, a communication device is provided that can implement the communication method described in the first aspect. For example, the communication device can be a network data analysis function element or a chip within a network data analysis function element. The method can be implemented using software, hardware, or hardware executing corresponding software.

[0032] In one possible implementation, the apparatus includes: a transceiver unit and a processing unit; wherein the transceiver unit is configured to receive a first request from a first network element, the first request carrying a signaling anomaly analysis indication; the transceiver unit is further configured to receive signaling information related to terminal behavior from multiple second network elements; and the transceiver unit is further configured to send a first response to the first network element, the first response including first information, the first information being configured to indicate the second network element with abnormal signaling behavior. The processing unit is configured to determine, from the multiple second network elements, a second network element with abnormal signaling behavior based on the signaling information.

[0033] Optionally, the processing unit is used to determine a second network element with abnormal signaling behavior from multiple second network elements based on signaling information, including: determining a second network element with abnormal signaling behavior from multiple second network elements based on a first signaling quantity matrix of the multiple second network elements.

[0034] Optionally, the processing unit is used to determine a second network element with abnormal signaling behavior from multiple second network elements based on the first signaling quantity matrix of multiple second network elements, including: determining a first signaling forwarding mode of multiple second network elements based on the first signaling quantity matrix of multiple second network elements; determining a second network element with abnormal signaling behavior from multiple second network elements based on the first signaling forwarding mode and the second signaling forwarding mode of multiple second network elements; wherein the first signaling quantity matrix of the second network element includes the number of signalings sent by the second network element to other second network elements, and / or the number of signalings received from other second network elements in unit time of the first time period; the first signaling forwarding mode is the signaling forwarding mode corresponding to the first signaling quantity matrix; the second signaling forwarding mode is the signaling forwarding mode of the second network element when the signaling behavior is normal; the signaling forwarding mode of the second network element is the signaling interaction rule related to the second network element.

[0035] Optionally, the multiple second network elements include an access and mobility management function network element, and the transceiver unit is used to receive signaling information related to terminal behavior from the second network element, including: receiving a first signaling quantity matrix from the access and mobility management function network element.

[0036] Optionally, the multiple second network elements include a session management function network element, and the transceiver unit is used to receive signaling information related to terminal behavior from the second network element, including: receiving a first signaling quantity matrix from the session management function network element.

[0037] Optionally, the multiple second network elements include a policy control function network element, and the transceiver unit is used to receive signaling information related to terminal behavior from the second network element, including: receiving a first signaling quantity matrix from the policy control function network element.

[0038] Optionally, the multiple second network elements include a user plane function network element, and the transceiver unit is used to receive signaling information related to terminal behavior from the second network element, including: receiving a first signaling quantity matrix from the user plane function network element.

[0039] Optionally, the multiple second network elements include a unified data management function network element, and the transceiver unit is used to receive signaling information related to terminal behavior from the second network element, including: receiving a first signaling quantity matrix from the unified data management function network element.

[0040] Optionally, the transceiver unit is used to receive signaling information related to terminal behavior from the second network element, including: receiving a first signaling quantity matrix of at least one of the access and mobility management function network element, session management function network element, policy control function network element, user plane function network element, or unified data management function network element from the service communication agent network element.

[0041] Optionally, the transceiver unit is used to receive signaling information related to terminal behavior from the second network element, including: receiving access behavior trends of terminals from the access and mobility management function network element, and / or receiving session behavior trends of terminals from the session management function network element; the access behavior trends of the terminals, and / or the session behavior trends of the terminals are used to determine the first signaling quantity matrix of multiple second network elements.

[0042] Optionally, the processing unit is also used to: determine the second signaling forwarding mode of multiple second network elements based on the second signaling quantity matrix of multiple second network elements; wherein the second signaling quantity matrix of the second network elements includes the number of signaling sent by the second network element to other second network elements, and / or the number of signaling received from other second network elements within the unit time of the second time period; the time point in the second time period is earlier than the time point in the first time period.

[0043] Optionally, before the processing unit is used to determine the second signaling forwarding mode of multiple second network elements based on the second signaling quantity matrix of multiple second network elements, the transceiver unit is also used to perform at least one of the following: receiving the second signaling quantity matrix from the access and mobility management function network element, receiving the second signaling quantity matrix from the session management function network element, receiving the second signaling quantity matrix from the policy control function network element, receiving the second signaling quantity matrix from the user plane function network element, or receiving the second signaling quantity matrix from the unified data management function network element.

[0044] Optionally, before the processing unit is used to determine the second signaling forwarding mode of multiple second network elements based on the second signaling quantity matrix of multiple second network elements, the transceiver unit is also used to: receive the second signaling quantity matrix of at least one network element among the access and mobility management function network element, session management function network element, policy control function, user plane function network element, or unified data management function network element from the service communication agent network element.

[0045] Optionally, the processing unit is used to determine the second network element with abnormal signaling behavior from multiple second network elements based on the first signaling forwarding mode and the second signaling forwarding mode of the multiple second network elements. The processing unit is also used to: determine the influence coefficient of the second network element connected to the second network element with abnormal signaling behavior based on the first signaling forwarding mode and the second signaling forwarding mode; the first response also includes the influence coefficient, which is used to perform signaling flow control.

[0046] Optionally, the first response also includes a second signaling forwarding mode, and the second signaling forwarding mode is used to perform signaling flow control.

[0047] Optionally, the first network element includes at least one of a network warehouse function network element, a service communication agent network element, or an operation management and maintenance function network element.

[0048] In a fourth aspect, a communication device is provided that can implement the communication method described in the second aspect. For example, the communication device can be a network warehouse function network element, a service communication proxy network element, or a chip within a network warehouse function network element or a service communication proxy network element. The method can be implemented using software, hardware, or hardware executing corresponding software.

[0049] In one possible implementation, the device includes: a transceiver unit and a processing unit; wherein the transceiver unit is used to send a first request to a network data analysis function network element, the first request carrying a signaling abnormality analysis indication; and the transceiver unit is also used to receive a first response from the network data analysis function network element, the first response including first information, the first information being used to indicate a second network element with abnormal signaling behavior; the processing unit is used to limit query services related to the second network element with abnormal signaling behavior, and / or limit signaling communications related to the second network element with abnormal signaling behavior.

[0050] Optionally, the method of this aspect may be executed by a network warehouse function network element and / or a service communication agent network element.

[0051] Optionally, the processing unit is used to limit query services related to the second network element with abnormal signaling behavior, including at least one of the following: modifying the registration status of the second network element with abnormal signaling behavior to unavailable, adding the second network element with abnormal signaling behavior to an exclusion list, or discarding the discovery service request from the second network element with abnormal signaling behavior.

[0052] Optionally, the processing unit is used to limit signaling communications related to the second network element with abnormal signaling behavior, including at least one of the following: intercepting a discovery service request from the second network element with abnormal signaling behavior, intercepting a discovery service request sent to the second network element with abnormal signaling behavior, intercepting signaling from the second network element with abnormal signaling behavior, or intercepting signaling sent to the second network element with abnormal signaling behavior.

[0053] In combination with the third aspect, the fourth aspect, or any one of the third and fourth aspects, in another possible implementation, the communication device in the third aspect, the fourth aspect, or any one of the third and fourth aspects includes a processor coupled to a memory; the processor is configured to support the device in performing the corresponding functions in the above-mentioned communication method. The memory is used to couple with the processor, which stores the necessary programs (instructions) and / or data for the device. Optionally, the communication device may further include a communication interface for supporting communication between the device and other network elements. Optionally, the memory may be located inside the communication device or outside the communication device.

[0054] In combination with the third aspect, the fourth aspect, or any one of the third and fourth aspects, in another possible implementation, the communication device in the third aspect, the fourth aspect, or any one of the third and fourth aspects includes a processor and a transceiver device, the processor being coupled to the transceiver device, the processor being used to execute a computer program or instruction to control the transceiver device to receive and send information; when the processor executes the computer program or instruction, the processor is further used to implement the above method through a logic circuit or execution code instruction. The transceiver device may be a transceiver, a transceiver circuit, or an input / output interface, configured to receive signals from devices other than the communication device and transmit them to the processor, or to send signals from the processor to devices other than the communication device. When the communication device is a chip, the transceiver device is a transceiver circuit or an input / output interface.

[0055] When the communication device in the third aspect, the fourth aspect, or any of the third and fourth aspects is a chip or chip module, the sending unit may be an output unit, such as an output circuit or a communication interface; and the receiving unit may be an input unit, such as an input circuit or a communication interface. When the communication device is a terminal or access network equipment, the sending unit may be a transmitter or a transmitter; and the receiving unit may be a receiver or a receiver.

[0056] In a fifth aspect, a communication system is provided that can implement the communication method in the first aspect, the second aspect, or any one of the first and second aspects. The communication system includes a network data analysis function network element and a network warehouse function network element:

[0057] The network warehouse function network element sends a first request to the network data analysis function network element, where the first request carries a signaling anomaly analysis indication;

[0058] The network data analysis function network element receives a first request from the network warehouse function network element;

[0059] The network data analysis function network element receives signaling information related to the terminal behavior from a plurality of second network elements, and determines, based on the signaling information, a second network element having abnormal signaling behavior from the plurality of second network elements;

[0060] The network data analysis function network element sends a first response to the network warehouse function network element, where the first response includes first information, and the first information is used to indicate the second network element with abnormal signaling behavior;

[0061] The network warehouse function network element receives the first response from the network data analysis function network element and restricts the query service related to the second network element with abnormal signaling behavior.

[0062] In a sixth aspect, another communication system is provided, which can implement the communication method of the first aspect, the second aspect, or any of the first and second aspects. The communication system includes a network data analysis function network element and a service communication agent network element:

[0063] The service communication agent network element sends a first request to the network data analysis function network element, where the first request carries a signaling anomaly analysis indication;

[0064] The network data analysis function network element receives a first request from the service communication agent network element;

[0065] The network data analysis function network element receives signaling information related to the terminal behavior from a plurality of second network elements, and determines, based on the signaling information, a second network element having abnormal signaling behavior from the plurality of second network elements;

[0066] The network data analysis function network element sends a first response to the service communication proxy network element, where the first response includes first information, and the first information is used to indicate the second network element with abnormal signaling behavior;

[0067] The service communication proxy network element receives the first response from the network data analysis function network element, and limits the query service related to the second network element with abnormal signaling behavior, and / or limits the signaling communication related to the second network element with abnormal signaling behavior.

[0068] In a seventh aspect, a computer-readable storage medium is provided, in which a computer program or instruction is stored. When a computer executes the computer program or instruction, the methods described in the above aspects are implemented.

[0069] In an eighth aspect, a computer program product comprising instructions is provided, which, when executed on a communication device, causes the communication device to execute the methods described in the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments of the present application will be described below.

[0071] FIG1a is a schematic diagram of the architecture of a communication system provided by an embodiment of the present application;

[0072] FIG1b is a schematic diagram of the architecture of another communication system provided by an embodiment of the present application;

[0073] FIG2 is a schematic diagram of a signaling quantity matrix provided in an embodiment of the present application;

[0074] FIG3a is a schematic diagram of an access state transition probability matrix provided in an embodiment of the present application;

[0075] FIG3 b is a schematic diagram of an access state transition ratio matrix provided in an embodiment of the present application;

[0076] FIG3c is a schematic diagram of a matrix of the number of access state transfer terminals provided by an embodiment of the present application;

[0077] FIG4 is a flow chart of a communication method provided in an embodiment of the present application;

[0078] FIG5 is a flow chart of another communication method provided in an embodiment of the present application;

[0079] FIG6 is a flow chart of another communication method provided in an embodiment of the present application;

[0080] FIG7 is a flow chart of another communication method provided in an embodiment of the present application;

[0081] FIG8 is a schematic structural diagram of a communication device provided in an embodiment of the present application;

[0082] FIG9 is a schematic structural diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0083] In order to make the objectives, technical solutions and advantages disclosed in this application clearer, this application will be further described in detail below with reference to the accompanying drawings.

[0084] The following at least one (item) involved in this application indicates one (item) or more (items). More than one (item) refers to two (items) or more than two (items). "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. In addition, it should be understood that although the terms first, second, etc. may be used to describe each object in this application, these objects should not be limited to these terms. These terms are only used to distinguish each object from each other.

[0085] The terms "including" and "having" and any variations thereof mentioned in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices. It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any method or design described in this application as "exemplary" or "for example" should not be interpreted as being more preferred or more advantageous than other methods or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way.

[0086] The following specific embodiments illustrate the implementation of the present application. Those skilled in the art can understand other advantages and effects of the present application from the contents disclosed in this specification. Although the description of the present application will be introduced in conjunction with the preferred embodiment, this does not mean that the features of this application are limited to this implementation. On the contrary, the purpose of introducing the application in conjunction with the implementation is to cover other options or modifications that may be extended based on the claims of the present application. In order to increase the in-depth understanding of the present application, the following description will contain many specific details. The present application can also be implemented without using these details. In addition, in order to avoid confusion or blurring the focus of the present application, some specific details will be omitted in the description. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other unless there is a conflict.

[0087] Hereinafter, if used, the terms "first," "second," etc., are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly specifying the quantity of the technical features being referred to. Thus, a feature qualified as "first," "second," etc. may explicitly or implicitly include one or more of the features. Throughout the description of this application, unless otherwise specified, "plurality" means two or more.

[0088] It should be noted that in the embodiments of the present application, the terms "migration", "transfer" and "switch" may be used interchangeably, and those skilled in the art may understand their meanings.

[0089] The communication method of the embodiment of the present application can be applied to various communication systems, including but not limited to long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication system, new radio (NR) system, fifth generation (5G) mobile communication system and subsequently evolved communication systems, such as sixth generation (6G) mobile communication technology system, seventh generation (7G) mobile communication technology system, etc., and the present application is not limited to this.

[0090] Next, we will use the network elements in the 5G system as an example to introduce the specific solution details.

[0091] For example, Figure 1a shows a schematic diagram of the architecture of a communication system. As shown in Figure 1a, the communication system may include a network data analysis function network element, an access and mobility management network element, a policy control network element, a user data management network element, a network repository function network element, a session management network element, a user plane network element, a terminal, and a wireless access network network element. In this communication system, the core network forms a flat architecture. Based on a service-based bus, network function network elements can discover each other through the network repository function network element and obtain each other's address information (i.e., when network function network elements discover each other through the network repository function network element and obtain each other's address information, a communication connection can be established between the network function network elements). At the same time, based on the service-based bus, network function network elements can call the service interfaces provided by each other (i.e., network function network elements can directly communicate with each other through the service-based bus). It should be noted that the network function network element includes, but is not limited to, at least one of the following: an access and mobility management network element, a policy control network element, a user data management network element, a session management network element, or a user plane network element. It should be noted that the network function network element can also be called a "network function network element entity" or other names (such as a second network element), and this application does not limit this.

[0092] 1. Network data analysis functional network element: used to provide intelligent analysis services, collect network data in the form defined by specifications through artificial intelligence and big data analysis, and output network analysis results.

[0093] In a 5G communication system, the network data analysis function network element may be a network data analysis function network element (NWDAF) or a management data analysis function network element (MDAF). In future communication systems, the network data analysis function network element may still be an NWDAF network element or an MDAF network element, or may have other names, which are not limited in this application. For ease of explanation, the embodiments of this application are exemplified using an NWDAF network element.

[0094] 2. Access and mobility management network element: It is mainly used for the attachment, mobility management, and tracking area update processes of terminals in mobile networks. The access management network element terminates non-access stratum (NAS) messages, completes registration management, connection management, and reachability management, allocates tracking area lists (TA lists) and mobility management, and transparently routes session management (SM) messages to the session management network element.

[0095] In a 5G communication system, the access and mobility management network element may be an access and mobility management function (AMF) network element. In future communication systems, the access and mobility management network element may still be an AMF network element, or may have other names, which are not limited in this application.

[0096] 3. Policy control network element: used to provide user contract data management functions, policy control functions, billing policy control functions, quality of service (QoS) control functions, etc.

[0097] In a 5G communication system, the policy control network element may be a policy control function (PCF) network element. Optionally, in an actual network, the PCF network element may also be divided into a session management PCF (SM-PCF) network element and an access management PCF (AM-PCF) network element. In future communication systems, the policy control network element may still be a PCF network element, or may have other names, which are not limited in this application.

[0098] 4. User data management network element: used to store and manage user terminal network and service contract data.

[0099] In a 5G communication system, the user data management network element may be a unified data management (UDM). In future communication systems, the user data management network element may still be a UDM network element, or may have other names, which are not limited in this application.

[0100] 5. Network warehouse functional network element: used to maintain real-time information of all network function services in the network.

[0101] In a 5G communication system, the network repository function network element may be a network registry function (NRF) network element. In future communication systems, the network repository function network element may still be an NRF network element, or may have other names, which are not limited in this application.

[0102] 6. Session Management NE: This element is primarily used for session management in mobile networks, such as session establishment, modification, and release. Specific functions include allocating Internet Protocol (IP) addresses to terminals and selecting user-plane NEs that provide packet forwarding capabilities.

[0103] In a 5G communication system, the session management network element may be a session management function (SMF) network element. In future communication systems, the session management network element may still be an SMF network element, or may have other names, which are not limited in this application.

[0104] 7. User plane network element: Mainly responsible for processing user messages, such as forwarding, billing, and legal monitoring. User plane network elements can also be called protocol data units (PDUs) or session anchors (PSAs).

[0105] In a 5G communication system, a user plane network element may be a user plane function (UPF) network element. Optionally, the UPF network element may communicate directly with the NWDAF through a service-oriented interface, or through other means, such as through an SMF or a private or internal interface between the SMF and the NWDAF. In future communication systems, the user plane network element may still be a UPF network element, or may have other names, which are not limited in this application.

[0106] 8. Terminal: A device with wireless transceiver capabilities that can be deployed on land, including indoors or outdoors, handheld, wearable, or vehicle-mounted; it can also be deployed on water (such as ships); it can also be deployed in the air (such as airplanes, balloons, and satellites). The terminal can be a mobile phone, a tablet computer, a computer with wireless transceiver capabilities, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical care, a wireless terminal in smart grids, a wireless terminal in transportation safety, a wireless terminal in smart cities, a wireless terminal in smart homes, etc. The embodiments of this application do not limit the application scenarios. The terminal is sometimes also referred to as user equipment (UE), a mobile station, and a remote station. The embodiments of this application do not limit the specific technology, device form, and name used by the terminal.

[0107] 9. Radio Access Network (RAN) Network Elements: These are responsible for wireless access to terminals. RAN network elements manage wireless resources, provide access services to terminals, and forward control signals and terminal data between the terminal and the core network. RAN network elements can also be understood as access network equipment in traditional networks. Possible deployment forms of RAN network elements include: a separate scenario with centralized units (CU) and distributed units (DU), as well as a single-site scenario. In the separate scenario, the CU supports protocols such as radio resource control (RRC), packet data convergence protocol (PDCP), and service data adaptation protocol (SDAP); the DU primarily supports radio link control (RLC), media access control (MAC), and physical layer protocols. In a single-site scenario, a single site may include a new radio Node (gNB), an evolved Node B (eNB), a radio network controller (RNC), a Node B (NB), a base station controller (BSC), a base transceiver station (BTS), a home base station, a base band unit (BBU), etc.

[0108] For example, Figure 1b shows an architectural diagram of another communication system. Compared with the communication system shown in Figure 1a, the communication system shown in Figure 1b introduces a service communication proxy (SCP) network element. In one implementation, based on the service bus, network function network elements discover each other through the network warehouse function network element, and after obtaining each other's address information, the network function network elements can communicate with each other through the SCP network element, that is, the SCP network element forwards the signaling between the network function network elements. In another implementation, the network function network elements can indirectly discover each other to the network warehouse function network element through the SCP network element and obtain each other's address information. In addition, the network function network elements communicate with each other through the SCP network element. It should be noted that this is explained using the SCP network element as an example. In other embodiments, the SCP network element can also be replaced with other names without limitation.

[0109] It should be noted that the communication system of the embodiment of the present application does not limit the number of network elements of each type. The number of network elements of one type may be one or more. For example, the communication system may include one AMF network element or multiple AMF network elements. For ease of explanation, the following embodiments are exemplified with one network element of each type.

[0110] The following describes concepts that may be involved in the embodiments of this application:

[0111] 1: Signaling quantity matrix

[0112] The signaling quantity matrix includes the number of signalings sent by the network function network element to other network function network elements and / or the number of signalings received from other network function network elements within a unit time.

[0113] For example, the following takes the network function network element as the AMF network element, and other network function network elements include the SMF network element, the PCF network element, the UPF network element and the UDM network element as an example to illustrate a schematic diagram of the signaling quantity matrix of the AMF network element. As shown in Figure 2, the first column of the signaling quantity matrix includes the number of signalings sent by the AMF network element to other network function network elements. For example, the first column of the first row may include the number of signalings sent by the AMF network element to the SMF network element; for another example, the first column of the second row may include the number of signalings sent by the AMF network element to the PCF network element; accordingly, the second column of the signaling quantity matrix includes the number of signalings sent by other network function network elements to the AMF network element (i.e., the number of signalings received by the AMF network element from other network function network elements). For example, the second column of the first row may include the number of signalings sent by the SMF network element to the AMF network element; for another example, the second column of the second row may include the number of signalings sent by the PCF network element to the AMF network element. It should be noted that the other network function network elements involved in the embodiments of the present application may refer to any other network function network elements other than this network function network element, without limitation.

[0114] Optionally, the signaling quantity matrix of the embodiment of the present application may include a first signaling quantity matrix and a second signaling quantity matrix. The first signaling quantity matrix includes the number of signalings sent by the network function network element to other network function network elements and / or the number of signalings received from other network function network elements per unit time in the first time period. The second signaling quantity matrix includes the number of signalings sent by the network function network element to other network function network elements and / or the number of signalings received from other network function network elements per unit time in the second time period. The time point of the second time period is earlier than the time point of the first time period. For example, the second time period may be a historical time period, and the first time period may be a time period to the current time or a future time. For example, taking the current time as 20:00 as an example, the second time period may be 14:00-14:10, the first time period may be 19:50-20:00, or the first time period may be 20:00-20:10.

[0115] 2. Signaling forwarding mode

[0116] The signaling forwarding mode of a network function element refers to the signaling interaction rules related to the network function element. The subsequent embodiments are described using the signaling forwarding mode of network function element A as an example.

[0117] Optionally, the signaling forwarding pattern includes a regularity between the number of signaling sent and the number of signaling received by network function network element A. For example, the number of signaling sent by network function network element A does not exceed 70% of the number of signaling received; for another example, the deviation between the number of signaling sent and the number of signaling received by network function network element A is less than 100; for another example, the deviation between the number of signaling sent and the number of signaling received by network function network element A does not exceed 10% of the number of signaling received; and so on.

[0118] Optionally, the signaling forwarding pattern includes the signaling interaction pattern between network function network element A and other network function network elements. Taking the other network function network elements including network function network element B as an example, the signaling forwarding pattern may include at least one of the pattern between the number of signaling sent by network function network element A and the number of signaling sent by network function network element B, the pattern between the number of signaling sent by network function network element A and the number of signaling received by network function network element B, the pattern between the number of signaling received by network function network element A and the number of signaling sent by network function network element B, or the pattern between the number of signaling received by network function network element A and the number of signaling received by network function network element B. For specific embodiments, please refer to the "pattern between the number of signaling sent and the number of signaling received by network function network element A", which will not be repeated here. It should be noted that in other implementation methods, the number of other network function network elements can be greater. For example, the other network function network elements may include network function network element B and network function network element C. For example, the ratio of the number of signaling sent by network function network element A to network function network elements B and C is maintained at 1:3, and the deviation does not exceed 15%. It should be noted that the network function network element A, network function network element B, and network function network element C here are arbitrary network function network elements and are not limited.

[0119] Optionally, the signaling forwarding mode of an embodiment of the present application may include a first signaling forwarding mode and a second signaling forwarding mode, the first signaling forwarding mode is the signaling forwarding mode corresponding to the first signaling quantity matrix; the second signaling forwarding mode is the signaling forwarding mode of the network function network element when the signaling behavior is normal.

[0120] In an optional implementation, the second signaling forwarding mode may be pre-configured. In this implementation, the second signaling forwarding mode may be directly acquired, which is simpler and more convenient.

[0121] In another optional implementation, the second signaling forwarding mode may be obtained by performing a correlation analysis on the second signaling quantity matrices of multiple network function network elements. Specifically, based on the signaling behavior states of the multiple network function network elements at each moment, the second signaling quantity matrices of the multiple network function network elements may be screened to obtain a third signaling quantity matrix of the multiple network function network elements, and a correlation analysis algorithm (such as an Apriori algorithm or an FP-growth algorithm, etc.) or a statistical analysis algorithm may be used to perform a correlation analysis on the third signaling quantity matrices of the multiple network function network elements to obtain the second signaling forwarding modes of the multiple network function network elements. The third signaling quantity matrix includes the number of signaling sent to other network function network elements and / or the number of signaling received from other network function network elements in a unit time of the second time period when the signaling behavior of the network function network element is in a normal state.

[0122] Among them, the signaling behavior status includes normal signaling behavior and abnormal signaling behavior. Optionally, the signaling behavior status of the network function network element can be obtained from the NRF network element. Optionally, the signaling behavior status of the network function network element can be determined by the registration information and / or load information of the network function network element. Optionally, the registration information may include but is not limited to at least one of the network element identifier, network element type, service area, or registration status. Optionally, the signaling behavior status of the network function network element can also be determined based on the signaling quantity matrix analysis between the network function network element and the NRF network element. The signaling quantity matrix can be obtained from the NRF network element. The signaling quantity matrix includes the number of discovery service requests sent by the network function network element to the NRF network element, and / or the number of discovery service responses received by the network function network element from the NRF network element. If the signaling quantity in the signaling quantity matrix increases rapidly, it can reflect that the signaling behavior of the network function network element is abnormal.

[0123] In this embodiment, through correlation analysis, the signaling forwarding rules under normal signaling behavior of network function network elements can be obtained from the third signaling quantity matrix of multiple network function network elements. Since it is obtained through real-time correlation analysis, the second signaling forwarding mode can more accurately characterize the signaling interaction rules related to the network function network element, which is conducive to improving the accuracy of detecting network function network elements with abnormal signaling behavior.

[0124] 3. UE access behavior trends

[0125] Among them, the access behavior trend of the terminal is used to describe the change in the access state of the terminal. Optionally, the access state of the terminal includes but is not limited to at least one of the connection management (CM) state, the registration management (RM) state, and the handover state. It should be noted that the CM state may include but is not limited to the CM connected (CM_CONNECTED) state and the CM idle (CM_IDLE) state; the RM state may include but is not limited to the RM deregistered (RM_DEREGISTERED) state and the RM registered (RM_REGISTERED) state. The handover state may include but is not limited to the handover in progress state, the handover failed state, or the handover successful state.

[0126] Optionally, the access behavior trend of the terminal may include at least one of the following: the probability of the terminal transferring from the current access state to the next access state within a unit time (which may be referred to as "the access state transfer probability of the terminal within a unit time"), the proportion of terminals transferring from the current access state to the next access state within a unit time (which may be referred to as "the terminal transfer proportion within a unit time"), or the number of terminals transferring from the current access state to the next access state within a unit time (which may be referred to as "the number of terminal transfers within a unit time"). It should be noted that this application does not limit the unit time, and the unit time may be 1 second, 10 seconds, 30 seconds, 1 minute or 5 minutes, etc. For the sake of convenience, the embodiment of this application is exemplified by taking the unit time of 1 minute as an example.

[0127] The following takes the access states of the terminal including CM_CONNECTED state, CM_IDLE state, RM_DEREGISTERED state, RM_REGISTERED state, and switching state as examples, and exemplifies the access state transition probability matrix of the terminal per unit time, the access state transition ratio matrix of the terminal per unit time, or the terminal transition number matrix of the specified access state per unit time.

[0128] Please refer to Figure 3a, which shows a schematic diagram of the access state transition probability matrix for a terminal per unit time. As shown in Figure 3a, for example, if the probability of a terminal transitioning from the current CM_CONNECTED state to the RM_REGISTERED state after one minute is 80%, then the element in the access state transition probability matrix corresponding to the row corresponding to the CM_CONNECTED state and the column corresponding to the RM_REGISTERED state is 80%. It should be noted that the other elements in the access state transition probability matrix can be similarly referred to above and will not be repeated here.

[0129] Please refer to Figure 3b, which shows a schematic diagram of the terminal transfer ratio matrix per unit time. As shown in Figure 3b, for example, if 41% of terminals transition from the current CM_CONNECTED state to the RM_REGISTERED state after one minute, then the element in the terminal transfer ratio matrix corresponding to the CM_CONNECTED state row and the RM_REGISTERED state column is 0.41. It should be noted that the other elements in this terminal transfer ratio matrix can be similarly referred to above and will not be repeated here.

[0130] Please refer to Figure 3c, which shows a schematic diagram of a terminal access state transition matrix per unit time. As shown in Figure 3c, for example, if 350 terminals transition from the current CM_CONNECTED state to the RM_REGISTERED state within one minute, then the element in the terminal transition matrix corresponding to the row corresponding to the CM_CONNECTED state and the column corresponding to the RM_REGISTERED state is 350. It should be noted that the other elements in this terminal transition matrix are similar to those described above and are not further elaborated here. Optionally, the terminal transfer ratio per unit time can be calculated through the signaling number of each target state in each row of the terminal transfer number matrix. For example, the number of terminals transferred from the current CM_CONNECTED state to the RM_REGISTERED state after 1 minute is 350, and the total number of terminals transferred from the CM_CONNECTED state to other states is 854 (i.e., 200+104+350+200). It can be calculated that the ratio of terminals transferred from the current CM_CONNECTED state to the RM_REGISTERED state after 1 minute is 0.41 (i.e., 350 / 854). After such processing, the elements of the terminal transfer number matrix can be calculated to obtain the terminal transfer ratio matrix. For the terminal transfer ratio matrix, please refer to the above description and will not be repeated here.

[0131] UE session behavior trends

[0132] The terminal's session behavior trend is used to describe changes in the terminal's session state. Optionally, the terminal's session state includes but is not limited to at least one of session establishment, session established, user plane activation, or user plane deactivation.

[0133] Optionally, the terminal's session behavior trend may include at least one of the following: the probability of the terminal transitioning from the current session state to the next session state per unit time (which may be referred to as the "terminal session state transition probability per unit time"), the proportion of terminals transitioning from the current session state to the next session state per unit time (which may be referred to as the "terminal transition proportion per unit time"), or the number of terminals transitioning from the current session state to the next session state per unit time (which may be referred to as the "terminal transition number per unit time"). For related explanations, please refer to the terminal access behavior trend and will not be elaborated here.

[0134] To facilitate understanding of the embodiments disclosed in this application, the following three points are explained.

[0135] (1) The scenarios in the embodiments disclosed in this application are described using the scenarios of the NR network in the wireless communication network as an example. It should be noted that the solutions in the embodiments disclosed in this application can also be applied to other wireless communication networks, and the corresponding names can also be replaced by the names of corresponding functions in other wireless communication networks.

[0136] (2) The embodiments disclosed herein will present various aspects, embodiments, or features of the present invention in the context of systems including multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all of the devices, components, modules, etc. discussed in conjunction with the accompanying figures. Furthermore, combinations of these schemes may also be used.

[0137] (3) The embodiments disclosed in this application are not limited to the message names listed, and other message names may be used instead. It should be understood that the relevant information included in the message may also be carried in other messages, and this application document does not limit this.

[0138] The following describes in detail how to implement the communication method of the embodiment of the present application based on the above communication system:

[0139] As shown in Figure 4, a flow chart of a communication method provided in an embodiment of the present application is provided. Optionally, the communication method may be performed by the first network element, the NWDAF network element, or the network function network element. Exemplarily, the method may include but is not limited to the following steps:

[0140] S101: A first network element sends a first request to an NWDAF network element.

[0141] Correspondingly, the NWDAF network element receives the first request from the first network element.

[0142] The first request carries a signaling anomaly analysis indication; the signaling anomaly analysis indication is used to instruct the NWDAF network element to perform a signaling anomaly analysis. Optionally, the signaling anomaly analysis indication may be located in any field of the first request, for example, the signaling anomaly analysis indication may be located in the analysis service identification field of the first request. Optionally, the signaling anomaly analysis indication may be represented by at least one of a character, a numeric value, or a bit value. For example, the signaling anomaly analysis indication may be represented by the character "Signaling Anomaly" in the analysis service identification field.

[0143] Optionally, the first request includes area information, where the area information is used to indicate a network area where signaling anomaly analysis is required, and the area information includes but is not limited to a TAI (Tracking Area Identifier) ​​and / or a TAI list. For example, when the area information included in the first request is a TAI list, the first request is used to request signaling anomaly analysis for network function network elements whose service scope is within each tracking area in the TAI list.

[0144] Optionally, the first network element may be at least one of an NRF network element, an SCP network element, or an operations administration and maintenance (OAM) network element.

[0145] Optionally, the first network element may periodically send the first request to the NWDAF network element. For example, the first network element sends the first request to the NWDAF network element based on a first period, where the first period refers to a time interval between two adjacent sending operations performed by the first network element.

[0146] S102: Multiple network function network elements send terminal behavior-related signaling information to the NWDAF network element respectively.

[0147] Accordingly, the NWDAF network element receives signaling information related to the terminal behavior from multiple network function network elements.

[0148] The plurality of network function network elements include but are not limited to at least one of an AMF network element, an SMF network element, a PCF network element, a UPF network element, or a UDM network element. Optionally, the number of each type of network function network element may be one or more, without limitation.

[0149] In an optional implementation, the signaling information related to the terminal behavior of multiple network function network elements may include a first signaling quantity matrix of the multiple network function network elements. The multiple network function network elements may respectively send the first signaling quantity matrix to the NWDAF network element, that is, each network function network element may respectively send the first signaling quantity matrix of each network function network element to the NWDAF network element.

[0150] For example, when multiple network function network elements include an AMF network element, step S102 includes: the AMF network element sends a first signaling quantity matrix of the AMF network element to the NWDAF network element, and correspondingly, the NWDAF network element receives the first signaling quantity matrix from the AMF network element; for another example, when multiple network function network elements include an SMF network element, step S102 includes: the SMF network element sends a first signaling quantity matrix of the SMF network element to the NWDAF network element, and correspondingly, the NWDAF network element receives the first signaling quantity matrix from the SMF network element; for another example, when multiple network function network elements include a PCF network element, step S102 includes: the PCF network element sends a first signaling quantity matrix of the SMF network element to the NWDAF network element. The first signaling quantity matrix of the PCF network element, and correspondingly, the NWDAF network element receives the first signaling quantity matrix from the PCF network element; for another example, when multiple network function network elements include a UPF network element, step S102 includes: the UPF network element sends the first signaling quantity matrix of the UPF network element to the NWDAF network element, and correspondingly, the NWDAF network element receives the first signaling quantity matrix from the UPF network element; for another example, when multiple network function network elements include a UDM network element, step S102 includes: the UDM network element sends the first signaling quantity matrix of the UDM network element to the NWDAF network element, and correspondingly, the NWDAF network element receives the first signaling quantity matrix from the UDM network element.

[0151] Optionally, in other implementations, the NWDAF network element may also receive from the SCP network element a first signaling quantity matrix corresponding to the signaling sent by each network function network element to other network elements through the SCP network element or the signaling received from other network elements. For example, when multiple network function network elements include an AMF network element, step S102 includes: the AMF network element sends signaling to other AMF network elements, SMF network elements, PCF network elements or UDM network elements through the SCP network element, or receives signaling from other AMF network elements, SMF network elements, PCF network elements or UDM network elements through the SCP network element. The SCP network element counts the number of signalings sent by the AMF network element to each other network element, or counts the number of signalings received by the AMF from each other network element, to obtain the first signaling quantity matrix of the AMF network element, and then the SCP network element sends the first signaling quantity matrix of the AMF network element to the NWDAF network element. Accordingly, the NWDAF network element receives the first signaling quantity matrix of the AMF network element through the SCP network element. Similarly, the SCP network element sends the first signaling quantity matrix of the SMF network element, PCF network element, UPF network element, and UDM network element to the NWDAF network element. Correspondingly, the NWDAF network element receives the first signaling quantity matrix from the SMF network element, PCF network element, UPF network element, and UDM network element from the SCP network element.

[0152] In this case, the NWDAF network element can directly obtain the first signaling quantity matrix of multiple network function network elements, and the first time period of the first signaling quantity matrix can be the time period up to the current moment. It can be seen that in this embodiment, the first signaling quantity matrix of multiple network function network elements represents the current signaling behavior of the multiple network function network elements, which is conducive to discovering network function network elements with abnormal signaling behavior.

[0153] In another optional implementation, the signaling information related to the terminal behavior may include the access behavior trend of the terminal, and / or the session behavior trend of the terminal. The access behavior trend of the terminal, and / or the session behavior trend of the terminal are used to determine a first signaling quantity matrix of multiple network function network elements. Step S102 may include: the AMF network element sends the access behavior trend of the terminal to the NWDAF network element, and / or the SMF network element sends the session behavior trend of the terminal to the NWDAF network element, and accordingly, the NWDAF network element receives the access behavior trend of the terminal from the AMF network element, and / or the NWDAF network element receives the session behavior trend of the terminal from the SMF network element. In this case, after step S102, the method further includes: the NWDAF network element determines a first signaling quantity matrix of multiple network function network elements based on the access behavior trend of the terminal, and / or the session behavior trend of the terminal.

[0154] For example, the NWDAF network element determines the first signaling quantity matrix of the AMF network element based on the access behavior trend of the terminal. Optionally, when the access behavior trend of the terminal is the probability or proportion of the access state transition of the terminal per unit time, the first signaling quantity matrix of the AMF network element can be determined by the following formula: first signaling quantity matrix = number of terminals * access state transition probability (or proportion) matrix of the terminal * average signaling quantity matrix of access state transition; Optionally, when the access behavior trend of the terminal is the number of terminal transfers per unit time, the first signaling quantity matrix can be determined by the following formula: first signaling quantity matrix = terminal transfer quantity matrix * average signaling quantity matrix of access state transfer. Among them, each element of the average signaling quantity matrix of access state transfer is the average number of signalings that the network element needs to process when a terminal transfers between two different access states.

[0155] For another example, the NWDAF network element determines the first signaling quantity matrix of the SMF network element based on the session behavior trend of the terminal. Optionally, when the session behavior trend of the terminal is the probability or proportion of session state transfer of the terminal per unit time, the first signaling quantity matrix of the SMF network element can be determined by the following formula: first signaling quantity matrix = average number of sessions per terminal * number of terminals * session state transfer probability (or proportion) matrix of terminals * average signaling quantity matrix of session state transfer, or first signaling quantity matrix = number of sessions * session state transfer probability (or proportion) matrix of terminals * average signaling quantity matrix of session state transfer; Optionally, when the session behavior trend of the terminal is the number of terminal transfers per unit time, the first signaling quantity matrix can be determined by the following formula: first signaling quantity matrix = average number of sessions per terminal * number of terminals * terminal transfer quantity matrix * average signaling quantity matrix of session state transfer, or first signaling quantity matrix = average number of sessions per terminal * terminal transfer quantity matrix * average signaling quantity matrix of session state transfer. Each element of the average signaling quantity matrix of session state transfer is the average signaling quantity that the network element needs to process when a terminal transfers between two different session states.

[0156] For another example, the NWDAF network element determines the first signaling quantity matrix of the PCF network element based on the access behavior trend of the terminal and / or the session behavior trend of the terminal. Optionally, when the access behavior trend of the terminal is the access state transition probability or ratio of the terminal per unit time, and the session behavior trend of the terminal is the session state transition probability or ratio of the terminal per unit time, the first signaling quantity matrix of the PCF network element can be determined by the following formula: First signaling quantity matrix = Average number of sessions per terminal * Number of terminals * Session state transition probability (or ratio) matrix of terminals * Average session policy management signaling quantity matrix for session state transition + Number of terminals * Access state transition probability (or ratio) matrix of terminals * Average access management policy signaling quantity matrix for access state transition.

[0157] Optionally, when the access behavior trend of the terminal is the number of terminal transfers per unit time, and the session behavior trend of the terminal is the number of terminal transfers per unit time, the first signaling quantity matrix of the PCF network element can be determined by the following formula: First signaling quantity matrix = Average number of sessions per terminal * Terminal transfer quantity matrix * Average session policy management signaling quantity matrix of session state transfer + Terminal transfer quantity matrix * Average access management policy signaling quantity matrix of access state transfer.

[0158] Among them, each element of the average session policy management signaling number matrix of session state transfer is the average number of session management policy signalings that the PCF network element needs to process when a terminal transfers between two different session states; each element of the average access management policy signaling number matrix of access state transfer is the average number of access management policy signalings that the PCF network element needs to process when a terminal transfers between two different access states.

[0159] It should be noted that for scenarios where the access behavior trend of the terminal is the number of terminal transfers per unit time, and the session behavior trend of the terminal is the probability or proportion of session state transfers per unit time, or where the access behavior trend of the terminal is the probability or proportion of access state transfers per unit time, and the session behavior trend of the terminal is the number of terminal transfers per unit time, please refer to the aforementioned embodiments and will not be repeated here.

[0160] For another example, the NWDAF network element determines the first signaling quantity matrix of the UPF network element based on the session behavior trend of the terminal. Optionally, when the session behavior trend of the terminal is the probability or proportion of session state transfer within a unit time, the first signaling quantity matrix of the UPF network element can be determined by the following formula: First signaling quantity matrix = average number of sessions per terminal * number of terminals * probability of session state transfer of the terminal (or proportion * average N4 interface signaling quantity matrix of session state transfer. Optionally, when the session behavior trend of the terminal is the number of terminal transfers within a unit time, the first signaling quantity matrix of the UPF network element can be determined by the following formula: First signaling quantity matrix = average number of sessions per terminal * terminal transfer quantity matrix * average N4 interface signaling quantity matrix of session state transfer. Among them, each element of the average N4 interface signaling quantity matrix of session state transfer is the average number of N4 interface signalings that the UPF needs to process when a terminal transfers between two different session states.

[0161] In this case, the NWDAF network element determines the first signaling quantity matrix of multiple network function network elements based on the access behavior trend of the terminal and / or the session behavior trend of the terminal. It can also be understood that the NWDAF network element predicts the first signaling quantity matrix of multiple network function network elements based on the access behavior trend of the terminal and / or the session behavior trend of the terminal. The first time period of the first signaling quantity matrix can be a time period to a future moment. It can be seen that in this embodiment, the NWDAF network element can predict the first signaling quantity matrix of multiple network function network elements based on the access behavior trend of the terminal and / or the session behavior trend of the terminal. The first signaling quantity matrix of multiple network function network elements represents the future signaling behavior of multiple network function network elements, which is conducive to early detection of network function network elements with abnormal signaling behavior.

[0162] Optionally, before step S102, the method further includes: the NWDAF network element sends a second request to the multiple network function network elements respectively, and accordingly, the multiple network function network elements receive the second request from the NWDAF network element, where the second request is used to request signaling information related to the terminal behavior. In this case, step S102 may include the multiple network function network elements sending the signaling information related to the terminal behavior to the NWDAF network element respectively, or step S102 may also include the multiple network function network elements sending a second response to the NWDAF network element respectively, where the second response includes the signaling information related to the terminal behavior.

[0163] Optionally, corresponding to the implementation of "the NWDAF network element receives from the SCP network element a first signaling quantity matrix corresponding to signaling sent by each network function network element to other network elements via the SCP network element, or signaling received from other network elements," before step S102, the method further includes: the NWDAF network element sending a second request to the SCP network element, and the SCP network element receiving the second request from the NWDAF network element. In this case, the SCP network element may send to the NWDAF network element the first signaling quantity matrix corresponding to signaling sent by each network function network element to other network elements via the SCP network element, or signaling received from other network elements.

[0164] Optionally, the multiple network function network elements in the embodiment of the present application may refer to registered network function network elements.

[0165] S103: The NWDAF network element determines, from among multiple network function network elements, a network function network element having abnormal signaling behavior based on the signaling information.

[0166] In an optional implementation, based on a first signaling quantity matrix of multiple network function network elements, a network function network element with abnormal signaling behavior is determined from the multiple network function network elements. This step may specifically include but is not limited to the following two implementations:

[0167] (1) Comparing and analyzing the first signaling quantity matrix of multiple network function network elements with the second signaling forwarding mode of multiple network function network elements to obtain a comparative analysis result, and determining the network function network element with abnormal signaling behavior from the multiple network function network elements based on the comparative analysis result. For example, for network function network element A, the first signaling quantity matrix of network function network element A can be compared and analyzed with the second signaling forwarding mode of network function network element A. If the first signaling quantity matrix does not satisfy the second signaling forwarding mode, network function network element A is a network function network element with abnormal signaling behavior; if the first signaling quantity matrix satisfies the second signaling forwarding mode, network function network element A is a network function network element with normal signaling behavior. For example, taking the example of the second signaling forwarding mode including the number of signaling sent by network function network element A not exceeding 70% of the number of signaling received, if the number of signaling sent by network function network element A is 75% of the number of signaling received, and the first signaling quantity matrix does not satisfy the second signaling forwarding mode, then network function network element A is a network function network element with abnormal signaling behavior; if the number of signaling sent by network function network element A is 68% of the number of signaling received, and the first signaling quantity matrix satisfies the second signaling forwarding mode, then network function network element A is a network function network element with normal signaling behavior. In this implementation, the network function network element with abnormal signaling behavior can be directly determined from multiple network function network elements based on the first signaling quantity matrix of multiple network function network elements, which is simpler and more convenient.

[0168] (2) Based on the first signaling quantity matrix of the plurality of network function network elements, determine the first signaling forwarding mode of the plurality of network function network elements, and based on the first signaling forwarding mode and the second signaling forwarding mode of the plurality of network function network elements, determine the network function network element with abnormal signaling behavior from the plurality of network function network elements. For example, firstly perform an association analysis on the first signaling quantity matrix of the plurality of network function network elements based on an association analysis algorithm to determine the first signaling forwarding mode of the plurality of network function network elements, then perform a comparative analysis on the first signaling forwarding mode and the second signaling forwarding mode of the plurality of network function network elements to obtain a comparative analysis result, and determine the network function network element with abnormal signaling behavior from the plurality of network function network elements based on the comparative analysis result. For example, for network function network element A, a comparison and analysis can be performed between the first signaling forwarding mode of network function network element A and the second signaling forwarding mode of network function network element A. If the first signaling forwarding mode is not a subset of the second signaling forwarding mode, network function network element A is a network function network element with abnormal signaling behavior; if the first signaling quantity matrix is ​​a subset of the second signaling forwarding mode, network function network element A is a network function network element with normal signaling behavior. The first signaling forwarding mode being a subset of the second signaling forwarding mode means that the element range of the first signaling forwarding mode is within the element range of the second signaling forwarding mode. For example, taking the example that the second signaling forwarding mode includes the number of signaling sent by network function network element A not exceeding 70% of the number of signaling received, if the first signaling forwarding mode includes the number of signaling sent by network function network element A not exceeding 68% of the number of signaling received, then the element range of the first signaling forwarding mode is within the element range of the second signaling forwarding mode, and the first signaling forwarding mode is a subset of the second signaling forwarding mode; if the first signaling forwarding mode includes the number of signaling sent by network function network element A not exceeding 75% of the number of signaling received, then the element range of the first signaling forwarding mode is not within the element range of the second signaling forwarding mode, and the first signaling forwarding mode is not a subset of the second signaling forwarding mode. For another example, the second signaling forwarding mode is that the ratio of the number of signaling sent by network function network element A to network function network elements B and C is maintained at 1:3, and the deviation does not exceed 15%. If the ratio of the number of signaling sent by network element A to network function network elements B and C calculated according to the first signaling quantity matrix has reached 1:4, or the deviation exceeds 15%, then the first signaling forwarding mode calculated by the first signaling quantity matrix is ​​not a subset of the second signaling forwarding mode.

[0169] Optionally, the first signaling forwarding patterns of multiple network function network elements can be obtained by performing correlation analysis on the first signaling quantity matrices of the multiple network function network elements. Specifically, a correlation analysis algorithm (such as an Apriori algorithm or an FP-growth algorithm, etc.) or a statistical analysis algorithm can be used to perform correlation analysis on the first signaling quantity matrices of the multiple network function network elements to obtain the first signaling forwarding patterns of the multiple network function network elements. In this implementation, through correlation analysis, the current or future signaling forwarding rules of the network function network elements can be mined from the first signaling quantity matrices of the multiple network function network elements, which is conducive to timely detection of network function network elements with abnormal signaling behavior.

[0170] S104: The NWDAF network element sends a first response to the first network element.

[0171] Correspondingly, the first network element receives the first response from the NWDAF network element.

[0172] The first response includes first information, and the first information is used to indicate a network function element with abnormal signaling behavior.

[0173] Optionally, the first response also includes the influence coefficient of the network function network element connected to the network function network element with abnormal signaling behavior (i.e., the influence coefficient of the network function network element surrounding the network function network element with abnormal signaling behavior); for example, assuming that the AMF network element is an abnormal network function network element, and the network function network elements surrounding the AMF network element include SMF network elements and PCF network elements connected to the AMF network element, then the influence coefficient of the surrounding SMF network element and / or the influence coefficient of the PCF network element can be determined. The influence coefficient is used to perform signaling flow control. The larger the influence coefficient, the more stringent the signaling flow control needs to be performed by the surrounding network function network elements. Then, before the NWDAF network element sends the first response to the first network element, the method also includes: determining the influence coefficient of the network function network element connected to the network function network element with abnormal signaling behavior based on the first signaling quantity matrix and the second signaling forwarding mode; or determining the influence coefficient of the network function network element connected to the network function network element with abnormal signaling behavior based on the first signaling forwarding mode and the second signaling forwarding mode.

[0174] The impact coefficient may include at least one of the probability of the surrounding network function network elements being affected, the degree of impact, or the level of impact. It should be noted that the embodiment of the present application does not limit the way of dividing the degree of impact. For example, the degree of impact may include mild and severe, or may include mild, moderate, and severe. The embodiment of the present application does not limit the way of dividing the levels. For example, the levels may include level 1 and level 2, or may include level 1, level 2, and level 3. Optionally, the degree of impact in the embodiment of the present application may also correspond to the level. For example, level 1 corresponds to mild, level 2 corresponds to moderate, level 3 corresponds to severe, and so on. Optionally, the influence coefficient of the surrounding network function network elements is related to the deviation between the first signaling quantity matrix and the second signaling forwarding mode. For example, taking the second signaling forwarding mode including the number of signaling sent by network function network element A not exceeding 70% of the number of signaling received as an example, if the number of signaling sent by network function network element A is 75% of the number of signaling received, then the deviation between the first signaling quantity matrix and the second signaling forwarding mode is 75%-70%=5%; Optionally, the influence coefficient of the surrounding network function network elements is related to the deviation between the first signaling forwarding mode and the second signaling forwarding mode. For example, taking the second signaling forwarding mode including the number of signaling sent by network function network element A not exceeding 10% of the number of signaling received as an example, if the first signaling forwarding mode includes the number of signaling sent by network function network element A not exceeding 15% of the number of signaling received, then the deviation between the first signaling transfer mode and the second signaling forwarding mode is 15%-10%=5%.

[0175] Optionally, the first response further includes a second signaling forwarding mode. The second signaling forwarding mode can also be used to perform signaling flow control, for example, setting signaling flow control parameters for the abnormal signaling network element and surrounding network elements according to the normal signaling interaction rules reflected by the second signaling forwarding mode.

[0176] In other optional implementations, the first request may also be a subscription message, that is, the first network element may subscribe to the first response from the NWDAF network element. In this case, the NWDAF network element may periodically execute step S103, and immediately execute step S104 when a network function network element with abnormal signaling behavior is found, or periodically execute step S104. For example, the NWDAF network element may execute step S103 based on a second period, where the second period refers to the time interval between two adjacent determination operations performed by the NWDAF network element. For example, the NWDAF network element may execute step S104 based on a third period, where the third period refers to the time interval between two adjacent sending operations performed by the NWDAF network element. It should be noted that the embodiment of the present application does not limit the value of the period (including the first period, the second period, or the third period, etc.), for example, the period may be 30 seconds, 1 minute, etc. Optionally, if the first request is a subscription message, the first request may also include a subscription time period, for example, subscribing to the first response in the next 5 minutes.

[0177] Further, optionally, the method may further include step S105: limiting query services related to network function elements with abnormal signaling behaviors, and / or limiting signaling communications related to network function elements with abnormal signaling behaviors.

[0178] In an optional implementation, if the first network element is an NRF network element, query services related to network function network elements with abnormal signaling behavior are restricted, including at least one of the following: the NRF network element modifies the registration status of the network function network element with abnormal signaling behavior to unavailable, the NRF network element adds the network function network element with abnormal signaling behavior to an exclusion list (such as exclude-nfinst-list), and the NRF network element discards the discovery service request from the network function network element with abnormal signaling behavior. It can be seen that when the NRF network element modifies the registration status of the network function network element with abnormal signaling behavior to unavailable, and / or adds the network function network element with abnormal signaling behavior to the exclusion list, the NRF network element can filter the query results and remove the network function network element with abnormal signaling behavior from the queried network function network elements, which can effectively restrict other network function network elements from establishing communication connections with the network function network element with abnormal signaling behavior. When an NRF network element discards a discovery service request from a network function network element with abnormal signaling behavior, the NRF network element may discard the discovery service request, which can effectively restrict the network function network element with abnormal signaling behavior from establishing communication connections with other network function network elements.

[0179] In another optional implementation, if the first network element is an SCP network element, then query services related to network function network elements with abnormal signaling behavior are restricted, including: the SCP network element intercepting discovery service requests from network function network elements with abnormal signaling behavior, and / or the SCP network element intercepting discovery service requests sent to network function network elements with abnormal signaling behavior. It can be seen that when the SCP network element intercepts discovery service requests from network function network elements with abnormal signaling behavior, it can effectively restrict the network function network elements with abnormal signaling behavior from establishing communication connections with other network function network elements. It can be seen that when the SCP network element intercepts discovery service requests sent to network function network elements with abnormal signaling behavior, it can effectively restrict other network function network elements from establishing communication connections with network function network elements with abnormal signaling behavior.

[0180] If the first network element is an SCP network element, restricting signaling communications related to the network function network element with abnormal signaling behavior includes: the SCP network element intercepting signaling from the network function network element with abnormal signaling behavior, and / or the SCP network element intercepting signaling sent to the network function network element with abnormal signaling behavior. Thus, signaling communications related to the network function network element with abnormal signaling behavior can be effectively restricted.

[0181] It should be noted that in other embodiments, the NWDAF network element may also determine from multiple network function network elements that there is no network function network element with abnormal signaling behavior. In this case, the first response may also include second information, and the second information is used to indicate that there is no network function network element with abnormal signaling behavior.

[0182] It can be seen that in the embodiment of the present application, the NWDAF network element can obtain signaling information related to the terminal behavior from multiple network function network elements in response to the first request, and determine the network function network element with abnormal signaling behavior from multiple network function network elements based on the signaling information, so as to effectively detect the network element with abnormal signaling behavior and reduce the network signaling impact.

[0183] Furthermore, when the signaling information related to the terminal behavior represents the future signaling behavior of multiple network function network elements, it is beneficial for the NWDAF network element to detect the network function network element with abnormal signaling behavior as early as possible, thereby reducing the network signaling impact in advance.

[0184] Please refer to Figure 5, which is a flow chart of another communication method provided in an embodiment of the present application. In which, the communication method takes the first network element including the NRF network element, and the network function network element including the AMF network element, the SMF network element, the PCF network element, the UPF network element and the UDM network element as an example to exemplify the detailed embodiment of the present application. The communication method can be applied to the communication system shown in Figure 1a or other systems similar to the communication system shown in Figure 1a. The AMF network element, the SMF network element, the PCF network element, the UPF network element and the UDM network element in the communication method can discover each other through the NRF network element and establish a communication connection. At the same time, the AMF network element, the SMF network element, the PCF network element, the UPF network element and the UDM network element can perform signaling communication based on the service bus. As shown in Figure 5, the method may include but is not limited to the following steps:

[0185] S201: The NRF network element sends a first request to the NWDAF network element.

[0186] Correspondingly, the NWDAF network element receives the first request from the NRF network element.

[0187] It should be noted that for the relevant description of step S201, please refer to step S101 and will not be repeated here.

[0188] S202: The AMF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0189] Correspondingly, the NWDAF network element receives signaling information related to terminal behavior from the AMF network element.

[0190] S203: The SMF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0191] Correspondingly, the NWDAF network element receives signaling information related to terminal behavior from the SMF network element.

[0192] S204: The PCF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0193] Correspondingly, the NWDAF network element receives signaling information related to the terminal behavior from the PCF network element.

[0194] S205: The UPF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0195] Correspondingly, the NWDAF network element receives signaling information related to the terminal behavior from the UPF network element.

[0196] S206: The UDM network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0197] Correspondingly, the NWDAF network element receives signaling information related to the terminal behavior from the UDM network element.

[0198] It should be noted that the embodiment of the present application does not limit the execution order of steps S202 to S206. For example, steps S202 to S206 may be executed sequentially, or in the order of S206 to S202, or simultaneously.

[0199] It should be noted that for the relevant description of steps S202 to S206, please refer to step S102 and will not be repeated here.

[0200] S207: The NWDAF network element determines the network function network element with abnormal signaling behavior from the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element based on the signaling information.

[0201] S208: The NWDAF network element sends a first response to the NRF network element.

[0202] Correspondingly, the NRF network element receives the first response from the NWDAF network element.

[0203] S209: The NRF network element restricts query services related to network function network elements with abnormal signaling behaviors.

[0204] Optionally, the NRF network element restricts query services related to network function network elements with abnormal signaling behavior, including at least one of the following: the NRF network element modifies the registration status of the network function network element with abnormal signaling behavior to unavailable, the NRF network element adds the network function network element with abnormal signaling behavior to an exclusion list (such as exclude-nfinst-list), and the NRF network element discards the discovery service request from the network function network element with abnormal signaling behavior. It can be seen that when the NRF network element modifies the registration status of the network function network element with abnormal signaling behavior to unavailable, and / or adds the network function network element with abnormal signaling behavior to the exclusion list, the NRF network element can filter the query results and remove the network function network element with abnormal signaling behavior from the queried network function network elements, which can effectively restrict other network function network elements from establishing communication connections with the network function network element with abnormal signaling behavior. When the NRF network element discards the discovery service request from the network function network element with abnormal signaling behavior, the NRF network element can discard the discovery service request, which can effectively restrict the network function network element with abnormal signaling behavior from establishing communication connections with other network function network elements.

[0205] S210: The NRF network element sends notification messages to the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element respectively.

[0206] Among them, the notification message is used to indicate the refresh of the status of the locally cached network function network element. When the NRF network element sends notification messages to the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element respectively, it is beneficial for the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element to timely update the status of the locally cached network function network element, which can effectively limit the signaling communication between the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element and the network function network element with abnormal signaling behavior in the local cache.

[0207] It should be noted that in the embodiment of the present application, at least one of step S209 or step S210 may be executed. Furthermore, when it is necessary to execute step S209 and step S210 simultaneously, the execution order of step S209 and step S210 is not limited. Step S209 may be executed first, step S210 may be executed first, or both steps S209 and S210 may be executed simultaneously.

[0208] It can be seen that in the embodiment of the present application, the NWDAF network element can respond to the first request from the NRF network element to obtain signaling information related to the terminal behavior from the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element respectively, and based on the signaling information, determine the network function network element with abnormal signaling behavior from the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element, which can effectively detect the network element with abnormal signaling behavior and reduce the network signaling impact. At the same time, when the NWDAF network element sends the first information indicating the network function network element with abnormal signaling behavior to the NRF network element, the NRF network element can perform signaling behavior control (for example, limiting the query service related to the network function network element with abnormal signaling behavior), which can effectively reduce the network signaling impact and prevent the formation of a signaling storm.

[0209] Please refer to Figure 6, which is a flow chart of another communication method provided in an embodiment of the present application. In which, the communication method takes the first network element including the NRF network element and the SCP network element, and the network function network element including the AMF network element, the SMF network element, the PCF network element, the UPF network element and the UDM network element as an example to exemplify the detailed embodiment of the present application. The communication method can be applied to the communication system shown in Figure 1b or other systems similar to the communication system shown in Figure 1b. The AMF network element, the SMF network element, the PCF network element, the UPF network element and the UDM network element in the communication method can discover each other through the NRF network element and establish a communication connection. At the same time, the AMF network element, the SMF network element, the PCF network element, the UPF network element and the UDM network element can communicate with each other through the SCP network element. As shown in Figure 6, the method may include but is not limited to the following steps:

[0210] S301: The NRF network element sends a first request to the NWDAF network element, and the SCP network element sends a first request to the NWDAF network element.

[0211] Correspondingly, the NWDAF network element receives the first request from the NRF network element and the first request from the SCP network element.

[0212] It should be noted that for the relevant description of step S301, please refer to step S101 and will not be repeated here.

[0213] S302: The AMF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0214] Correspondingly, the NWDAF network element receives signaling information related to terminal behavior from the AMF network element.

[0215] S303: The SMF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0216] Correspondingly, the NWDAF network element receives signaling information related to terminal behavior from the SMF network element.

[0217] S304: The PCF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0218] Correspondingly, the NWDAF network element receives signaling information related to the terminal behavior from the PCF network element.

[0219] S305: The UPF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0220] Correspondingly, the NWDAF network element receives signaling information related to the terminal behavior from the UPF network element.

[0221] S306: The UDM network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0222] Correspondingly, the NWDAF network element receives signaling information related to the terminal behavior from the UDM network element.

[0223] It should be noted that the embodiment of the present application does not limit the execution order of steps S302 to S306. For example, steps S302 to S306 may be executed sequentially, or in the order of step S306 to S302, or may be executed simultaneously.

[0224] Optionally, in another implementation of the embodiment of the present application, the NWDAF network element may also receive the signaling information related to the terminal behavior of each network function network element in the above steps S302 to S306 from the SCP network element. Then after step S301, the method may further include:

[0225] S307: The NWDAF network element receives signaling information related to the terminal behavior of at least one of the AMF network element, SMF network element, PCF network element, UPF network element or UDM network element from the SCP network element.

[0226] It should be noted that steps S302 to S306 have similar effects to those achieved by step S307. The embodiment of the present application may only execute steps S302 to S306 without executing step S307, or only execute step S307 without executing steps S302 to S306, or may also execute steps S302 to S306 and step S307 without limitation.

[0227] It should be noted that for the relevant description of steps S302 to S307, please refer to step S102 and will not be repeated here.

[0228] S308: The NWDAF network element determines the network function network element with abnormal signaling behavior from the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element based on the signaling information.

[0229] S309: The NWDAF network element sends a first response to the NRF network element, and sends a first response to the SCP network element.

[0230] Accordingly, the NRF network element receives the first response from the NWDAF network element, and the SCP network element receives the first response from the NWDAF network element.

[0231] S310: The SCP network element restricts signaling communications related to network function network elements with abnormal signaling behaviors.

[0232] Optionally, the SCP network element restricts signaling communications related to the network function network element with abnormal signaling behavior, including: the SCP network element intercepting signaling from the network function network element with abnormal signaling behavior, and / or the SCP network element intercepting signaling sent to the network function network element with abnormal signaling behavior. It can be seen that in this embodiment, signaling communications related to the network function network element with abnormal signaling behavior can be effectively restricted.

[0233] S311: The NRF network element restricts query services related to network function network elements with abnormal signaling behaviors.

[0234] It should be noted that for the relevant description of step S311, please refer to step S209 and will not be repeated here.

[0235] It should be noted that the embodiment of the present application does not limit the execution order of step S310 and step S311. For example, step S310 can be executed first and then step S311, or step S311 can be executed first and then step S310, or step S310 and step S311 can be executed simultaneously, and so on.

[0236] It can be seen that in an embodiment of the present application, the NWDAF network element can respond to the first request to obtain signaling information related to the terminal behavior from the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element respectively, and the first request comes from the NRF network element and the SCP network element, and based on the signaling information, determine the network function network element with abnormal signaling behavior from the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element, which can effectively detect the network element with abnormal signaling behavior and reduce the network signaling impact. In addition, when the NWDAF network element sends the first information indicating the network function network element with abnormal signaling behavior to the SCP network element, the SCP network element can perform signaling behavior control (for example, limit the signaling communication related to the network function network element with abnormal signaling behavior), which can effectively reduce the network signaling impact and prevent the formation of a signaling storm. The NRF network element can perform signaling behavior control (for example, limit the query service related to the network function network element with abnormal signaling behavior), which can further reduce the network signaling impact and prevent the formation of a signaling storm.

[0237] Please refer to Figure 7, which is a flow chart of another communication method provided in an embodiment of the present application. The communication method takes the first network element package SCP network element, and the network function network elements include AMF network element, SMF network element, PCF network element, UPF network element and UDM network element as an example to exemplify the detailed embodiment of the present application. The communication method can be applied to the communication system shown in Figure 1b or other systems similar to the communication system shown in Figure 1b. The AMF network element, SMF network element, PCF network element, UPF network element and UDM network element in the communication method can be indirectly discovered by the NRF network element through the SCP network element to establish a communication connection. At the same time, the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element perform signaling communication through the SCP network element. As shown in Figure 7, the method may include but is not limited to the following steps:

[0238] S401: The SCP network element sends a first request to the NWDAF network element.

[0239] Correspondingly, the NWDAF network element receives the first request from the SCP network element.

[0240] It should be noted that for the relevant description of step S401, please refer to step S101 and will not be repeated here.

[0241] S402: The AMF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0242] Correspondingly, the NWDAF network element receives signaling information related to terminal behavior from the AMF network element.

[0243] S403: The SMF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0244] Correspondingly, the NWDAF network element receives signaling information related to terminal behavior from the SMF network element.

[0245] S404: The PCF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0246] Correspondingly, the NWDAF network element receives signaling information related to the terminal behavior from the PCF network element.

[0247] S405: The UPF network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0248] Correspondingly, the NWDAF network element receives signaling information related to the terminal behavior from the UPF network element.

[0249] S406: The UDM network element sends signaling information related to the terminal behavior to the NWDAF network element.

[0250] Correspondingly, the NWDAF network element receives signaling information related to the terminal behavior from the UDM network element.

[0251] It should be noted that the embodiment of the present application does not limit the execution order of steps S402 to S406. For example, steps S402 to S406 may be executed sequentially, sequentially, or simultaneously.

[0252] Optionally, in another implementation of the embodiment of the present application, the NWDAF network element may also receive the signaling information related to the terminal behavior of each network function network element in the above steps S402 to S406 from the SCP network element. Then after step S401, the method may further include:

[0253] S407: The NWDAF network element receives signaling information related to the terminal behavior of at least one of the AMF network element, SMF network element, PCF network element, UPF network element or UDM network element from the SCP network element.

[0254] It should be noted that steps S402 to S406 have similar effects to those achieved by step S407. The embodiment of the present application may only execute steps S402 to S406 without executing step S407, or only execute step S407 without executing steps S402 to S406, or may also execute steps S402 to S406 and step S407 without limitation.

[0255] It should be noted that for the relevant description of steps S402 to S407, please refer to step S102 and will not be repeated here.

[0256] S408: The NWDAF network element determines the network function network element with abnormal signaling behavior from the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element based on the signaling information.

[0257] S409: The NWDAF network element sends a first response to the SCP network element.

[0258] Correspondingly, the SCP network element receives the first response from the NWDAF network element.

[0259] S410: The SCP network element restricts signaling communications related to network function network elements with abnormal signaling behaviors.

[0260] It should be noted that for the relevant description of step S410, please refer to step S310 and will not be repeated here.

[0261] S411: The SCP network element restricts query services related to network function network elements with abnormal signaling behaviors.

[0262] In an optional embodiment, the SCP network element restricts query services related to network function network elements with abnormal signaling behavior, including: the SCP network element intercepting discovery service requests from network function network elements with abnormal signaling behavior, and / or the SCP network element intercepting discovery service requests sent to network function network elements with abnormal signaling behavior. Optionally, the SCP network element intercepting discovery service requests sent to network function network elements with abnormal signaling behavior includes: the SCP network element agent modifies the registration status of the network function network element with abnormal signaling behavior to unavailable, and / or adds the network function network element with abnormal signaling behavior to an exclusion list (such as exclude-nfinst-list), that is, removes the network function network element with abnormal signaling behavior from the queried network function network elements, which can effectively restrict other network function network elements from establishing communication connections with the network function network element with abnormal signaling behavior. Optionally, the SCP network element intercepting discovery service requests from network function network elements with abnormal signaling behavior includes: the SCP network element discarding discovery service requests from network function network elements with abnormal signaling behavior, which can effectively restrict the network function network element with abnormal signaling behavior from establishing communication connections with other network function network elements.

[0263] It should be noted that in the embodiment of the present application, at least one of step S410 or step S411 may be performed. Furthermore, when it is necessary to perform step S410 and step S411 simultaneously, the order of performing step S410 and step S411 is not limited. Step S410 may be performed first, step S411 may be performed first, or both steps S410 and S411 may be performed simultaneously.

[0264] It can be seen that in the embodiment of the present application, the NWDAF network element can respond to the first request from the SCP network element to obtain signaling information related to the terminal behavior from the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element respectively, and based on the signaling information, determine the network function network element with abnormal signaling behavior from the AMF network element, SMF network element, PCF network element, UPF network element and UDM network element, which can effectively detect the network element with abnormal signaling behavior and reduce the network signaling impact. At the same time, when the NWDAF network element sends the first information indicating the network function network element with abnormal signaling behavior to the SCP network element, the NRF network element can perform signaling behavior control (for example, limiting the query service and / or signaling communication related to the network function network element with abnormal signaling behavior), which can effectively reduce the network signaling impact and prevent the formation of a signaling storm.

[0265] It should be noted that, in other embodiments, the first network element shown in Figures 5 to 7 may further include an OAM network element. Taking the communication method of Figure 5 as an example, step S201 may specifically include: the NRF network element sends a first request to the NWDAF network element, and the OAM network element sends a first request to the NWDAF network element. Accordingly, the NWDAF network element receives the first request from the NRF network element, and receives the first request from the OAM network element. At the same time, step S208 may specifically include: the NWDAF network element sends a first response to the NRF network element, and sends a first response to the OAM network element. Accordingly, the NRF network element receives the first response from the NWDAF network element, and the OAM network element receives the first response from the NWDAF network element and sends it to the OAM network element. In addition, after step S209, the method may further include step S210: the OAM network element performs network management, including but not limited to at least one of the following: the OAM network element modifies the network function network element with abnormal signaling behavior (such as modifying the network configuration of the network function network element with abnormal signaling behavior, restarting the network function network element with abnormal signaling behavior, etc.), the OAM network element sets signaling flow control parameters for the surrounding network function network elements based on the influence coefficient carried by the first response, or the OAM network element sets signaling flow control parameters for multiple network function network elements based on the second signaling forwarding mode.

[0266] It can be understood that in each of the above embodiments, the methods and / or steps implemented by the NWDAF network element can also be implemented by components of the NWDAF network element (such as chips or circuits); the methods and / or steps implemented by the NRF network element can also be implemented by components of the NRF network element (such as chips or circuits); the methods and / or steps implemented by the SCP network element can also be implemented by components of the SCP network element (such as chips or circuits); the methods and / or steps implemented by the AMF network element can also be implemented by components of the AMF network element (such as chips or circuits); the methods and / or steps implemented by the SMF network element can also be implemented by components of the SMF network element (such as chips or circuits); the methods and / or steps implemented by the PCF network element can also be implemented by components of the PCF network element (such as chips or circuits); the methods and / or steps implemented by the UPF network element can also be implemented by components of the UPF network element (such as chips or circuits); the methods and / or steps implemented by the UDM network element can also be implemented by components of the UDM network element (such as chips or circuits).

[0267] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of interaction between various network elements. Accordingly, the embodiment of the present application also provides a communication device, which is used to implement the above various methods. The communication device can be the NWDAF network element in the above method embodiment or a component of the NWDAF network element; or, the communication device can be the NRF network element in the above method embodiment or a component of the NRF network element; or, the communication device can be the SCP network element in the above method embodiment or a component of the SCP network element; or, the communication device can be the AMF network element in the above method embodiment or a component of the AMF network element; or, the communication device can be the SMF network element in the above method embodiment or a component of the SMF network element; or, the communication device can be the PCF network element in the above method embodiment or a component of the PCF network element; or, the communication device can be the UPF network element in the above method embodiment or a component of the UPF network element; or, the communication device can be the UDM network element in the above method embodiment or a component of the UDM network element.

[0268] It is understandable that, in order to realize the above functions, the communication device includes hardware structures and / or software modules corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0269] In the embodiment of the present application, the functional modules of the communication device can be divided according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing unit. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. In actual implementation, there may be other division methods.

[0270] Based on the same concept of the above communication method, the present application also provides the following communication device:

[0271] As shown in FIG8 , a schematic diagram of the structure of a communication device provided in an embodiment of the present application is shown. The communication device 800 includes a transceiver unit 801 and a processing unit 802 .

[0272] When the communication device is used to implement the functions of the NWDAF network element in the above method embodiment, the transceiver unit 801 is used to perform the operations of the NWDAF network element in S101, S102, and S104 in the embodiment shown in Figure 4, and the processing unit 802 is used to perform the operation of the NWDAF network element in S103 in the embodiment shown in Figure 4; or, the transceiver unit 801 is used to perform the operations of the NWDAF network element in S201, S202, S203, S204, S205, S206, and S208 in the embodiment shown in Figure 5, and the processing unit 802 is used to perform the operation of the NWDAF network element in S207 in the embodiment shown in Figure 5; or The transceiver unit 801 is used to perform the operations of the NWDAF network element in S301, S302, S303, S304, S305, S306, S307, and S309 in the embodiment shown in Figure 6, and the processing unit 802 is used to perform the operation of the NWDAF network element in S308 in the embodiment shown in Figure 6; or, the transceiver unit 801 is used to perform the operations of the NWDAF network element in S401, S402, S403, S404, S405, S406, S407, and S409 in the embodiment shown in Figure 7, and the processing unit 802 is used to perform the operation of the NWDAF network element in S408 in the embodiment shown in Figure 6.

[0273] When the communication device is used to implement the functions of the NRF network element in the above method embodiment, the transceiver unit 801 is used to perform the operations of the NRF network element in S201, S208, and S210 in the embodiment shown in Figure 5, and the processing unit 802 is used to perform the operations of the NRF network element in S209 in the embodiment shown in Figure 5; or, the transceiver unit 801 is used to perform the operations of the NRF network element in S301 and S309 in the embodiment shown in Figure 6, and the processing unit 802 is used to perform the operations of the NRF network element in S311 in the embodiment shown in Figure 6.

[0274] When the communication device is used to implement the functions of the SCP network element in the above method embodiment, the transceiver unit 801 is used to perform the operations of the SCP network element in S301, S307, and S309 in the embodiment shown in Figure 6, and the processing unit 802 is used to perform the operations of the SCP network element in S310 in the embodiment shown in Figure 6; alternatively, the transceiver unit 801 is used to perform the operations of the SCP network element in S401, S407, and S409 in the embodiment shown in Figure 7, and the processing unit 802 is used to perform the operations of the SCP network element in S410 and S411 in the embodiment shown in Figure 7.

[0275] When the communication device is used to implement the functions of the AMF network element in the above method embodiment, the transceiver unit 801 is used to perform the operations of the AMF network element in S202 and S210 in the embodiment shown in Figure 5; or, the transceiver unit 801 is used to perform the operations of the AMF network element in S302 in the embodiment shown in Figure 6; or, the transceiver unit 801 is used to perform the operations of the AMF network element in S402 in the embodiment shown in Figure 7.

[0276] When the communication device is used to implement the functions of the SMF network element in the above method embodiment, the transceiver unit 801 is used to perform the operations of the SMF network element in S203 and S210 in the embodiment shown in Figure 5; or, the transceiver unit 801 is used to perform the operations of the SMF network element in S303 in the embodiment shown in Figure 6; or, the transceiver unit 801 is used to perform the operations of the SMF network element in S403 in the embodiment shown in Figure 7.

[0277] When the communication device is used to implement the functions of the PCF network element in the above method embodiment, the transceiver unit 801 is used to perform the operations of the PCF network element in S204 and S210 in the embodiment shown in Figure 5; or, the transceiver unit 801 is used to perform the operations of the PCF network element in S304 in the embodiment shown in Figure 6; or, the transceiver unit 801 is used to perform the operations of the PCF network element in S404 in the embodiment shown in Figure 7.

[0278] When the communication device is used to implement the functions of the UPF network element in the above method embodiment, the transceiver unit 801 is used to execute the operations of the UPF network element in S205 and S210 in the embodiment shown in Figure 5; or, the transceiver unit 801 is used to execute the operations of the UPF network element in S305 in the embodiment shown in Figure 6; or, the transceiver unit 801 is used to execute the operations of the UPF network element in S405 in the embodiment shown in Figure 7.

[0279] When the communication device is used to implement the functions of the UDM network element in the above method embodiment, the transceiver unit 801 is used to perform the operations of the UDM network element in S206 and S210 in the embodiment shown in Figure 5; or, the transceiver unit 801 is used to perform the operations of the UDM network element in S306 in the embodiment shown in Figure 6; or, the transceiver unit 801 is used to perform the operations of the UDM network element in S406 in the embodiment shown in Figure 7.

[0280] As shown in Figure 9, it is a structural diagram of another communication device provided in an embodiment of the present application, and the communication device 900 includes a processor 901 and a memory 903. The memory 903 is used to store instructions executed by the processor 901, or to store input data required for the processor 901 to run instructions, or to store data generated after the processor 901 runs instructions. Optionally, the communication device 900 may further include an interface circuit 902 (represented by a dotted line in the figure), and the processor 901 and the interface circuit 902 are coupled to each other. It will be understood that the interface circuit 902 can be a transceiver or an input and output interface. Among them, the processor 901 is used to implement the functions of the processing unit 802 in the embodiment shown in Figure 8 above; and the interface circuit 902 is used to implement the functions of the transceiver unit 801 in the embodiment shown in Figure 8 above.

[0281] When the communication device is a chip used in an NWDAF network element, the chip implements the functions of the NWDAF network element in the above method embodiments. The chip receives information from other modules (such as a radio frequency module or antenna) in the NWDAF network element, or the chip sends information to other modules (such as a radio frequency module or antenna) in the NWDAF network element.

[0282] When the communication device is a chip used in an NRF network element, the chip implements the functions of the NRF network element in the above method embodiment. The chip receives information from other modules (such as a radio frequency module or an antenna) in the NRF network element, or the chip sends information to other modules (such as a radio frequency module or an antenna) in the NRF network element.

[0283] When the communication device is a chip used in an SCP network element, the chip implements the functions of the SCP network element in the above method embodiments. The chip receives information from other modules (such as a radio frequency module or antenna) in the SCP network element, or sends information to other modules (such as a radio frequency module or antenna) in the SCP network element.

[0284] When the above-mentioned communication device is a chip applied to an AMF network element, the chip implements the functions of the AMF network element in the above-mentioned method embodiment. The chip receives information from other modules (such as a radio frequency module or antenna) in the AMF network element, or the chip sends information to other modules (such as a radio frequency module or antenna) in the AMF network element.

[0285] When the above-mentioned communication device is a chip applied to an SMF network element, the chip implements the functions of the SMF network element in the above-mentioned method embodiment. The chip receives information from other modules (such as a radio frequency module or an antenna) in the SMF network element, or the chip sends information to other modules (such as a radio frequency module or an antenna) in the SMF network element.

[0286] When the communication device is a chip used in a PCF network element, the chip implements the functions of the PCF network element in the above method embodiments. The chip receives information from other modules (such as a radio frequency module or antenna) in the PCF network element, or the chip sends information to other modules (such as a radio frequency module or antenna) in the PCF network element.

[0287] When the communication device is a chip used in a UPF network element, the chip implements the functions of the UPF network element in the above method embodiments. The chip receives information from other modules (such as a radio frequency module or antenna) in the UPF network element, or the chip sends information to other modules (such as a radio frequency module or antenna) in the UPF network element.

[0288] When the communication device is a chip used in a UDM network element, the chip implements the functions of the UDM network element in the above method embodiments. The chip receives information from other modules (such as a radio frequency module or antenna) in the UDM network element, or the chip sends information to other modules (such as a radio frequency module or antenna) in the UDM network element.

[0289] In addition, it should be noted that the aforementioned transceiver unit and / or processing unit may be implemented through virtual modules, for example, the processing unit may be implemented through a software function unit or a virtual device, and the transceiver unit may be implemented through a software function or a virtual device. Alternatively, the processing unit or transceiver unit may also be implemented through a physical device, for example, if the device is implemented using a chip / chip circuit, the transceiver unit may be an input / output circuit and / or a communication interface, performing input operations (corresponding to the aforementioned receiving operations) and output operations (corresponding to the aforementioned sending operations); the processing unit may be an integrated processor, microprocessor, or integrated circuit.

[0290] The division of modules in this application is illustrative and represents only a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the examples of this application may be integrated into a single processor, exist physically as separate modules, or two or more modules may be integrated into a single module. The aforementioned integrated modules may be implemented in either hardware or software functional modules.

[0291] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0292] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program or instruction is stored. When the computer program or instruction is executed, the method in the above embodiment is implemented.

[0293] An embodiment of the present application further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method in the above embodiment.

[0294] An embodiment of the present application also provides a communication system, including the above-mentioned communication device.

[0295] The present application also provides a circuit, which is coupled to a memory and is used to execute the method shown in the above embodiment. The circuit may include a chip circuit.

[0296] It should be noted that the above units or one or more of the units can be implemented by software, hardware, or a combination of the two. When any of the above units or units is implemented by software, the software exists in the form of computer program instructions and is stored in a memory, and a processor can be used to execute the program instructions and implement the above method flow.

[0297] In this application, a processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in this application. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in this application may be directly executed by a hardware processor, or by a combination of hardware and software modules within the processor.

[0298] The processor can be built into a system on chip (SoC) or ASIC, or it can be a standalone semiconductor chip. In addition to the core that executes software instructions to perform calculations or processing, the processor can also include necessary hardware accelerators, such as field programmable gate arrays (FPGAs), programmable logic devices (PLDs), or logic circuits that implement specialized logic operations.

[0299] When the above units or units are implemented in hardware, the hardware can be any one or any combination of a CPU, a microprocessor, a digital signal processing (DSP) chip, a microcontroller unit (MCU), an artificial intelligence processor, an ASIC, a SoC, an FPGA, a PLD, a dedicated digital circuit, a hardware accelerator or a non-integrated discrete device, which can run the necessary software or not rely on the software to execute the above method flow.

[0300] Optionally, an embodiment of the present application further provides a chip system, comprising: at least one processor and an interface, wherein the at least one processor is coupled to a memory via the interface, and when the at least one processor executes a computer program or instruction in the memory, the chip system executes the method in any of the above method embodiments. Optionally, the chip system may be composed of a chip, or may include a chip and other discrete devices, which is not specifically limited in the embodiments of the present application.

[0301] In the present application, the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), or a volatile memory, such as a random-access memory (RAM). The memory is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in the present application may also be a circuit or any other device that can implement a storage function, for storing program instructions and / or data.

[0302] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented using a software program, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0303] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art can understand and implement other changes to the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit can implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0304] It is understood that the various numbers used in the embodiments of this application are merely for ease of description and are not intended to limit the scope of the embodiments of this application. The order of the sequence numbers of the above-mentioned processes does not necessarily imply a specific order of execution; the order of execution of the processes should be determined by their functions and inherent logic.

[0305] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0306] The components in the device of the embodiment of the present application can be merged, divided, or deleted according to actual needs. Those skilled in the art can combine or combine the different embodiments and features of the different embodiments described in this specification.

[0307] The above embodiments are intended only to illustrate the technical solutions of the present application and are not intended to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they may still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein with equivalents; and such modifications or replacements do not deviate from the essence of the corresponding technical solutions within the scope of the technical solutions of the embodiments of the present application.

[0308] In this application, under the premise of no logical contradiction, the examples can reference each other, for example, the methods and / or terms between method embodiments can reference each other, for example, the functions and / or terms between device embodiments can reference each other, for example, the functions and / or terms between device examples and method examples can reference each other.

[0309] Obviously, those skilled in the art may make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: The method comprises: receiving a first request from a first network element, wherein the first request carries a signaling abnormality analysis indication; receiving signaling information related to the terminal behavior from a plurality of second network elements, and determining a second network element having abnormal signaling behavior from the plurality of second network elements based on the signaling information; A first response is sent to the first network element, where the first response includes first information, and the first information is used to indicate a second network element whose signaling behavior is abnormal.

2. The method according to claim 1, characterized in that The determining, based on the signaling information, from the plurality of second network elements, a second network element with abnormal signaling behavior includes: Based on the first signaling quantity matrix of the plurality of second network elements, determining a second network element having abnormal signaling behavior from the plurality of second network elements; The first signaling quantity matrix includes the number of signaling sent by the second network element to other second network elements and / or the number of signaling received from other second network elements within a unit time of the first time period.

3. The method according to claim 2, characterized in that The determining, based on the first signaling quantity matrix of the plurality of second network elements, a second network element with abnormal signaling behavior from the plurality of second network elements comprises: Determining a first signaling forwarding mode of the plurality of second network elements based on a first signaling quantity matrix of the plurality of second network elements; Based on the first signaling forwarding mode and the second signaling forwarding mode of the multiple second network elements, determining a second network element with abnormal signaling behavior from the multiple second network elements; The first signaling quantity matrix of the second network element includes the number of signaling sent by the second network element to other second network elements and / or the number of signaling received from other second network elements within a unit time of the first time period; The first signaling forwarding mode is a signaling forwarding mode corresponding to the first signaling quantity matrix; the second signaling forwarding mode is a signaling forwarding mode of the second network element when the signaling behavior is normal; The signaling forwarding mode of the second network element is a signaling interaction rule related to the second network element.

4. The method according to claim 2 or 3, characterized in that The multiple second network elements include an access and mobility management function network element, and the receiving of signaling information related to the terminal behavior from the multiple second network elements includes: A first signaling quantity matrix is ​​received from the access and mobility management function network element.

5. The method according to claim 2 or 3, characterized in that: The multiple second network elements include a session management function network element, and the receiving of signaling information related to the terminal behavior from the multiple second network elements includes: A first signaling quantity matrix is ​​received from the session management function network element.

6. The method according to claim 2 or 3, characterized in that: The multiple second network elements include a policy control function network element, and the receiving of signaling information related to the terminal behavior from the multiple second network elements includes: A first signaling quantity matrix is ​​received from the policy control function network element.

7. The method according to claim 2 or 3, characterized in that: The multiple second network elements include a user plane function network element, and the receiving signaling information related to the terminal behavior from the multiple second network elements includes: A first signaling quantity matrix is ​​received from the user plane function network element.

8. The method according to claim 2 or 3, characterized in that: The multiple second network elements include a unified data management function network element, and the receiving of signaling information related to the terminal behavior from the multiple second network elements includes: A first signaling quantity matrix is ​​received from the unified data management function network element.

9. The method according to claim 2 or 3, characterized in that: The receiving signaling information related to the terminal behavior from multiple second network elements includes: A first signaling quantity matrix of at least one of an access and mobility management function network element, a session management function network element, a policy control function network element, a user plane function network element, or a unified data management function network element is received from a serving communication proxy network element.

10. The method according to claim 2 or 3, characterized in that: The receiving signaling information related to the terminal behavior from multiple second network elements includes: Receiving an access behavior trend of a terminal from an access and mobility management function network element, and / or receiving a session behavior trend of a terminal from a session management function network element; The access behavior trend of the terminal and / or the session behavior trend of the terminal are used to determine the first signaling quantity matrix of the multiple second network elements.

11. The method according to claim 3, characterized in that The method further comprises: Determining a second signaling forwarding mode of the plurality of second network elements based on a second signaling quantity matrix of the plurality of second network elements; Among them, the second signaling quantity matrix of the second network element includes the number of signaling sent by the second network element to other second network elements, and / or the number of signaling received from other second network elements within the unit time of the second time period; the time point of the second time period is earlier than the time point of the first time period.

12. The method according to claim 11, characterized in that Before determining the second signaling forwarding mode of the plurality of second network elements based on the second signaling quantity matrix of the plurality of second network elements, the method further includes at least one of the following: receiving a second signaling quantity matrix from an access and mobility management function network element, receiving a second signaling quantity matrix from a session management function network element, receiving a second signaling quantity matrix from a policy control function network element, receiving a second signaling quantity matrix from a user plane function network element, or A second signaling quantity matrix is ​​received from the unified data management function network element.

13. The method according to claim 11, characterized in that Before determining the second signaling forwarding mode of the plurality of second network elements based on the second signaling quantity matrix of the plurality of second network elements, the method further includes: A second signaling quantity matrix of at least one of an access and mobility management function network element, a session management function network element, a policy control function, a user plane function network element, or a unified data management function network element is received from the serving communication proxy network element.

14. The method according to any one of claims 3 to 13, characterized in that After determining the second network element with abnormal signaling behavior from the multiple second network elements based on the first signaling forwarding mode and the second signaling forwarding mode of the multiple second network elements, the method further includes: Determine, based on the first signaling forwarding mode and the second signaling forwarding mode, an influence coefficient of a second network element connected to the second network element with abnormal signaling behavior; The first response also includes the influence coefficient, and the influence coefficient is used to perform signaling flow control.

15. The method according to any one of claims 3 to 14, characterized in that The first response also includes the second signaling forwarding mode, and the second signaling forwarding mode is used to perform signaling flow control.

16. The method according to any one of claims 1 to 15, characterized in that The first network element includes at least one of a network warehouse function network element, a service communication agent network element, or an operation management and maintenance function network element.

17. A communication method, characterized in that: The method comprises: Sending a first request to a network data analysis function network element, wherein the first request carries a signaling anomaly analysis indication; receiving a first response from the network data analysis function network element, the first response comprising first information, the first information being used to indicate a second network element with abnormal signaling behavior; Limiting query services related to the second network element with abnormal signaling behavior, and / or limiting the second network element with abnormal signaling behavior Related signaling communications.

18. The method according to claim 17, characterized in that The limiting of the query service related to the second network element with abnormal signaling behavior includes at least one of the following: Modify the registration status of the second network element with abnormal signaling behavior to unavailable, adding the second network element with abnormal signaling behavior to an exclusion list, Or, discard the discovery service request from the second network element with abnormal signaling behavior.

19. The method according to claim 17, characterized in that The limiting of the signaling communication related to the second network element with abnormal signaling behavior includes at least one of the following: intercepting a discovery service request from the second network element with abnormal signaling behavior, intercepting a discovery service request sent to the second network element with abnormal signaling behavior, intercepting signaling from the second network element with abnormal signaling behavior, Or, intercepting the signaling sent to the second network element with abnormal signaling behavior.

20. A communication system, characterized in that: The communication system includes a network data analysis function network element and a network warehouse function network element: The network warehouse function network element sends a first request to the network data analysis function network element, where the first request carries a signaling anomaly analysis indication; The network data analysis function network element receives the first request from the network warehouse function network element; The network data analysis function network element receives signaling information related to terminal behavior from a plurality of second network elements, and determines a second network element with abnormal signaling behavior from the plurality of second network elements based on the signaling information; The network data analysis function network element sends a first response to the network warehouse function network element, where the first response includes first information, and the first information is used to indicate the second network element with abnormal signaling behavior; The network warehouse function network element receives the first response from the network data analysis function network element, and limits the query service related to the second network element with abnormal signaling behavior.

21. A communication system, characterized in that: The communication system includes a network data analysis function network element and a service communication agent network element: The service communication proxy network element sends a first request to the network data analysis function network element, where the first request carries a signaling anomaly analysis indication; The network data analysis function network element receives the first request from the service communication agent network element; The network data analysis function network element receives signaling information related to terminal behavior from a plurality of second network elements, and determines a second network element with abnormal signaling behavior from the plurality of second network elements based on the signaling information; The network data analysis function network element sends a first response to the service communication proxy network element, where the first response includes first information, and the first information is used to indicate a second network element with abnormal signaling behavior; The service communication agent network element receives the first response from the network data analysis function network element, and limits the query service related to the second network element with abnormal signaling behavior, and / or limits the signaling communication related to the second network element with abnormal signaling behavior.

22. A communication device, characterized in that: The device includes a module or unit for implementing the method according to any one of claims 1 to 16, or the device includes a module or unit for implementing the method according to any one of claims 17 to 19.

23. A communication device, characterized in that: including memory and processor; The memory is used to store instructions or computer programs; The processor is used to execute the computer program or instructions stored in the memory, so that the communication device executes the method according to any one of claims 1 to 16, or executes the method according to any one of claims 17 to 19.

24. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 16 is implemented, or the method according to any one of claims 17 to 19 is implemented.

Images