NWDAF Abnormal Handover Detection for 5G Misbehaving Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As 5G technology advances, there is a need to detect abnormal behavior in user equipment (UE) mobile devices, such as rapid switching between base stations or cells, which can be caused by malicious malware, poor network planning, or environmental factors, leading to negative impacts on core network equipment and user experience.
Innovation Solution
The implementation of a network data analytics function (NWDAF) that subscribes to location change-related events in a cellular network, analyzes these events to detect abnormal handover behavior when a UE mobile device changes its selection of a base station or cell more than N times in M minutes, and reports the detected behavior with an identifier of the UE mobile device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network monitors and analyzes location change events to detect abnormal handover behavior, then the ability to identify misbehaving devices is improved, but the complexity of the network system increases due to the need for NWDAF component and event subscription mechanisms
Solution Approach 1:
The NWDAF component serves as an intermediary that subscribes to location change events from the AMF and performs analysis to detect abnormal handover behavior. This mediator approach allows the detection functionality to be separated from the core mobility management functions, improving detection accuracy while managing system complexity through modular architecture.
2Loss of time
If the network analyzes location change events in real-time to detect abnormal behavior, then the response time to address issues is improved, but the signaling load and processing requirements increase
Solution Approach 1:
The NWDAF subscribes to location change events and analyzes them to detect abnormal handover behavior characterized by excessive handovers within a specific time window (N times in M minutes). This approach focuses analysis on partial data (location change events) rather than all network signaling, reducing overall processing requirements while maintaining effective detection capability for abnormal behavior.
3Measurement precision
If the system sets a low threshold for detecting abnormal handovers (high N, low M), then the precision of detecting misbehaving devices is improved, but the frequency of false positives increases affecting normal user experience
Solution Approach 1:
The system detects abnormal handover behavior by analyzing the pattern of handovers (N times in M minutes) rather than using a simple threshold. This parameter-based approach allows flexible configuration of detection sensitivity and enables differentiation between abnormal ping-pong behavior and normal mobility patterns, reducing false positives while maintaining detection precision for actual misbehaving devices.
Data Source
AI summary
The disclosed technology teaches detecting abnormal behavior of a UE mobile device, including a network data analytics function component, in communication with core network components of a cellular network, subscribing to location change-related events that report a change event for a UE device connection to and/or drop or handover from a cell. Included is analyzing location change-related events to detect abnormal handover behavior when the UE device changes its selection of a base station or cell more than N times in not more than M minutes, and reporting the detected abnormal handover behavior with an identifier of the UE mobile device involved and the involved cell's ID. The technology also applies to a group of UE devices selected for analysis, by device, geography or custom-defined affinity, with selection changes among a set of base stations or neighboring cells, each selected at least twice by the UE device in M minutes.