Rearranging Traffic Data to Detect Session Time Reversal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional mobile communication network security technologies fail to detect abnormal traffic due to the reversal phenomenon of session creation time, leading to equipment failures in managing radio resources.
Innovation Solution
A method and apparatus that rearrange traffic data by calculating the Radio Resource Control (RRC) inactivity timer, determining a time window size, and analyzing traffic data to detect abnormal traffic, correcting the session creation time reversal phenomenon and improving detection performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional traffic data analysis methods are used, then the detection process is simple, but abnormal traffic cannot be detected due to session creation time reversal phenomenon
Solution Approach 1:
The patent applies preliminary action by calculating the RRC inactivity timer value before analyzing traffic data. The system determines the time window size based on this pre-calculated timer value, and then rearranges traffic data within this time window before detection. This preliminary preparation of time window parameters enables accurate detection of abnormal traffic that would otherwise be missed due to session creation time reversal, directly resolving the contradiction between detection accuracy and analysis complexity.
2Reliability
If traffic data is analyzed without rearrangement, then the analysis process is fast, but session creation time reversal causes false normal classification
Solution Approach 1:
The patent applies parameter changes by dynamically determining the time window size based on the calculated RRC inactivity timer value. Instead of using a fixed time window or analyzing all traffic data sequentially, the system adjusts the analysis scope to a specific time window parameter that is derived from network configuration. This parameter adaptation enables reliable detection of reversed session times while minimizing processing time by focusing only on relevant data within the determined window.
3Adaptability or versatility
If a fixed time window size is used for traffic analysis, then the analysis method is simple, but it cannot adapt to different RRC inactivity timer configurations
Solution Approach 1:
The patent applies parameter changes by making the time window size adaptive to different network configurations. The system calculates the RRC inactivity timer value based on network-specific parameters and uses this calculated value to determine the appropriate time window size. This dynamic parameter adjustment enables the system to adapt to various network configurations and RRC timer settings, directly resolving the contradiction between adaptability and analysis complexity.
4Measurement precision
If all traffic data is analyzed in detail, then detection accuracy is high, but the processing load and time consumption increase
Solution Approach 1:
The patent applies segmentation by dividing traffic data analysis into focused time window segments rather than analyzing all traffic data continuously. The system segments the analysis scope to specific time windows determined by the RRC inactivity timer value, examining traffic patterns only within these relevant segments. This segmentation maintains high detection precision for abnormal traffic while significantly improving processing efficiency by avoiding unnecessary analysis of unrelated traffic data.
Data Source
AI summary
Provided is a method for rearranging traffic data performed by a computing device. The method comprises obtaining traffic data transmitted and received between a base station and a terminal, calculating a value of a Radio Resource Control (RRC) inactivity timer based on a RRC release message included in the traffic data, determining a size of a time window using the calculated value of the RRC inactivity timer and rearranging, for each time window having the determined size, the traffic data of a target terminal by an RRC connection request time.