Nothing Special   »   [go: up one dir, main page]

WO2021151335A1 - 一种网络事件处理方法、装置及可读存储介质 - Google Patents

一种网络事件处理方法、装置及可读存储介质 Download PDF

Info

Publication number
WO2021151335A1
WO2021151335A1 PCT/CN2020/124932 CN2020124932W WO2021151335A1 WO 2021151335 A1 WO2021151335 A1 WO 2021151335A1 CN 2020124932 W CN2020124932 W CN 2020124932W WO 2021151335 A1 WO2021151335 A1 WO 2021151335A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
network
security
message
security policy
Prior art date
Application number
PCT/CN2020/124932
Other languages
English (en)
French (fr)
Inventor
黄亚达
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021151335A1 publication Critical patent/WO2021151335A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Definitions

  • This application relates to the field of mobile communication technology, and in particular to a network event processing method, device, and readable storage medium.
  • the 5G core network has introduced many IT technologies, such as virtualization platforms and containers.
  • IT technologies such as virtualization platforms and containers.
  • the 3rd generation partnership project (3GPP) specifies that the network data analysis function (NetWork Data Analysis Function, NWDAF) network element in the 5G network architecture can perform network data analysis.
  • NWDAF Network Data Analysis Function
  • the network data analysis function can obtain data from the network function (NF) network element and the Operation, Administration, and Maintenance (OAM) system, and provide the result to the NF network element and application function after analysis and processing. (application function, AF) use.
  • the analysis of network security through NWDAF network element only includes the identification and analysis service of abnormal users. For example, if the NWDAF network element receives the first network element to subscribe to the identification service of abnormal users, the NWDAF network element can report to the corresponding network element according to the subscription. For example, access and mobility management function (AMF) network elements and session management function (session management function, SMF) network elements, etc., collect information such as user session messages and billing messages, and then NWDAF The network element can determine whether there is an abnormal user based on the collected user's session information and charging information. When it is determined that there is an abnormal user, the NWDAF network element may send a notification message of the abnormal user to the first network element subscribing to the abnormal user, and then the first network element may process the abnormal user according to the notification message.
  • AMF access and mobility management function
  • SMF session management function
  • the embodiments of the present application provide a network event processing method, device, and readable storage medium, which are used to determine N third network elements related to the second network element when a network abnormal event occurs in a second network element, so that N The third network element isolates the services corresponding to the second network element. In this way, all network elements associated with network abnormal events can be processed, so as to deal with network security risks more comprehensively, thereby improving network security .
  • an embodiment of the present application provides a network event processing method, including: a security event processing function network element receiving first indication information sent by a network data analysis function network element, the first indication information being used to indicate the first indication information An abnormal network security event occurs in the second network element; the security event processing function network element determines, according to the first indication information, N third network elements that have an association relationship with the second network element; A third network element among the third network elements, the third network element having the ability to process services of the second network element; for one third network element among the N third network elements, The security event processing function network element sends a first security policy corresponding to the third network element to the third network element, and the first security policy corresponding to the third network element includes instructions for instructing the third network element. Instruction information for the network element to isolate the service corresponding to the second network element.
  • the security event processing function network element obtains the network security abnormal event sent by the network data analysis function network element, confirms that the second network element sends the security abnormality, and then the security event processing function network element confirms with the second network element according to the second network element.
  • the third network element with which the network element has an association relationship can be a network element that performs signaling interaction with the second network element, or it can be a network element that provides services for the second network element, and sends the corresponding to the third network element.
  • the first security policy enables the third network element to isolate the related services of the second network element. Compared with the processing method of the prior art that only sends to the network element that subscribes to the security event, the second network element can be more comprehensively isolated. The impact of abnormal network events on the network, thereby improving the security of the network.
  • the third network element is the security event processing function network element that sends the first security policy corresponding to the third network element to the third network element, including the security event
  • the processing function network element sends the first security policy corresponding to the access and mobility management function network element to the AMF network element, and the first security policy corresponding to the access and mobility management function network element includes instructions for indicating Instruction information for the access and mobility management function network element to isolate the service corresponding to the second network element.
  • the isolation of the service corresponding to the second network element by the access and mobility management function network element may specifically mean that the access and mobility management function network element no longer processes the message sent by the second network element, so that it can Avoiding the occurrence of network security incidents caused by the access and mobility management function network element processing the message of the second network element that has the abnormal network security event, can further improve the network security.
  • the security event processing function network element sending the first security policy corresponding to the third network element to the third network element includes that the security event processing function network element sends a message to the third network element
  • the forwarding network element sends the first security policy corresponding to the message forwarding network element
  • the first security policy corresponding to the message forwarding network element includes instructions for instructing the message forwarding network element to stop message forwarding to the second network element Instructions.
  • the message forwarding network element can no longer forward the message of the second network element, thereby avoiding the network of the second network element caused by the message forwarding network element forwarding the message of the second network element that has the abnormal network security event.
  • the proliferation of security incidents can further improve network security.
  • the security event processing function network element sends the first security policy corresponding to the third network element to the third network element, and the security event processing function network element includes the security event processing function network element to the third network element.
  • the network function repository function (NRF) network element sends the first security policy corresponding to the NRF network element, and the first security policy corresponding to the NRF network element includes instructions for instructing the NRF network element to no longer check
  • the user authorization instruction information of the second network element, and/or the authorization instruction information of the user of the second network element is revoked; further, the NRF network element can be caused to stop or revoke the user authorization of the second network element, so that Avoiding the occurrence of network security incidents of the second network element caused by the user of the second network element can further improve network security.
  • the security event processing function network element sending the first security policy corresponding to the third network element to the third network element includes that the security event processing function network element sends the security event processing function network element to the third network element.
  • the routing and transmission controller sends a first security policy corresponding to the routing and transmission controller, and the first security policy corresponding to the routing and transmission controller includes instructions for instructing the routing and transmission controller network element to ignore access to the second network.
  • the indication information of the routing and forwarding request for the message of the network segment of the element; in turn, the routing and transmission controller can be made to stop routing and forwarding the message of the network segment of the second network element, so as to prevent the routing and transmission controller from responding to the occurrence of network security events.
  • the occurrence of a network security event of the second network element caused by the routing and forwarding of the message of the second network element can further improve network security.
  • the security event processing function network element sends the first security policy corresponding to the third network element to the third network element, and the security event processing function network element includes the security event processing function network element to the third network element.
  • the virtualized resource management network element sends a first security policy corresponding to the virtualized resource management network element, and the first security policy corresponding to the virtualized resource management network element includes instructions for instructing the virtualized resource management network element to release all The instruction information of the virtual machine corresponding to the second network element.
  • the virtualized resource management network element can be made to release the virtual machine corresponding to the second network element, so that the operation of the virtual machine of the second network element can be stopped to avoid the occurrence of network security incidents of the second network element, and the network can be further improved. safety.
  • the security event processing function network element sends the first security policy corresponding to the third network element to the third network element, and the security event processing function network element includes the security event processing function network element to the third network element.
  • the access and mobility management function network element sends the first security policy corresponding to the access and mobility management function network element, and the first security policy corresponding to the access and mobility management function network element includes instructions for indicating all The instruction information for the access and mobility management function network element to release the user bound to the second network element.
  • the access and mobility management function network element can release users of the second network element, thereby avoiding the occurrence of network security incidents of the second network element caused by the users of the second network element, and further improving network security.
  • the first indication information is also used to indicate the abnormal service corresponding to the abnormal network security event; the security event processing function network element determines that the network element corresponds to the second indication information according to the first indication information.
  • the network element has M fourth network elements with an association relationship; for a fourth network element among the M fourth network elements, the fourth network element has the ability to process the abnormal service; the security The event processing function network element sends a second security policy corresponding to the fourth network element to the fourth network element, and the second security policy corresponding to the fourth network element includes instructions for instructing the fourth network element to stop Or cancel the instruction information for processing the abnormal business.
  • the fourth network element involved in the abnormal service is determined by the abnormal service corresponding to the abnormal network security event, and then the corresponding second security policy is sent to the fourth network element, so that the fourth network element is related to the second network element.
  • Abnormal services are effectively isolated to reduce the impact of abnormal services generated by abnormal network elements on network performance.
  • the security event processing function network element sends a second security policy corresponding to the fourth network element to the fourth network element, including the security event processing function network element to the
  • the access and mobility management function network element sends the second security policy corresponding to the access and mobility management function network element, and the second security policy corresponding to the access and mobility management function network element includes instructions for indicating all Instruction information for the fourth network element to isolate the abnormal service of the second network element; in this way, the access and mobility management function network element can no longer process the abnormal service of the second network element, thereby avoiding access Incoming and mobility management function network elements process the occurrence of network security incidents caused by the abnormal services of the second network element where the abnormal network security incidents have occurred, which can further improve network security.
  • the security event processing function network element sends a second security policy corresponding to the fourth network element to the fourth network element, including the security event processing function network element to the
  • the access and mobility management function network element sends the second security policy corresponding to the access and mobility management function network element, and the second security policy corresponding to the access and mobility management function network element includes instructions for indicating all
  • the access and mobility management function network element releases the indication information of the user corresponding to the abnormal service; in this way, the access and mobility management function network element can release the user corresponding to the abnormal service of the second network element, thereby avoiding the first
  • the occurrence of network security incidents caused by users corresponding to abnormal services of the two network elements can further improve network security.
  • the security event processing function network element sends a second security policy corresponding to the fourth network element to the fourth network element, including the security event processing function network element to the A policy control function (PCF) network element sends a second security policy corresponding to the PCF network element, and the second security policy corresponding to the PCF network element includes instructions for instructing the PCF network element to release the abnormal service Instruction information of the corresponding user; in this way, the PCF network element can release the user corresponding to the abnormal service of the second network element, thereby avoiding the occurrence of network security incidents caused by the user corresponding to the abnormal service of the second network element, and can further improve Network security.
  • PCF policy control function
  • the security event processing function network element sends a second security policy corresponding to the fourth network element to the fourth network element, including the security event processing function network element to the
  • the message forwarding network element sends a second security policy corresponding to the message forwarding network element, and the second security policy corresponding to the message forwarding network element includes instructions for instructing the message forwarding network element to ignore abnormalities to the second network element
  • the indication information of the message forwarding request of the service further, the message forwarding network element can be made to ignore the indication information of the message forwarding request for the abnormal service of the second network element, so as to prevent the message forwarding network element from contacting the second network where a network security event occurs.
  • the occurrence of network security incidents of abnormal services caused by the forwarding of messages of meta-abnormal services can further improve network security.
  • the security event processing function network element sends a second security policy corresponding to the fourth network element to the fourth network element, including the security event processing function network element to the
  • the NRF network element sends a second security policy corresponding to the NRF network element, and the second security policy corresponding to the NRF network element includes instructions for instructing the NRF network element to stop or cancel abnormal services to the second network element User authorization indication information; in this way, the NRF network element can stop or release the authorization of the user corresponding to the abnormal service of the second network element, thereby avoiding the occurrence of network security incidents caused by the user corresponding to the abnormal service of the second network element, Can further improve network security.
  • the security event processing function network element sends a second security policy corresponding to the fourth network element to the fourth network element, including the security event processing function network element to the
  • the routing and transmission controller sends a second security policy corresponding to the routing and transmission controller, and the second security policy corresponding to the routing and transmission controller includes instructions for instructing the routing and transmission controller to ignore network access to the second network element.
  • the instruction information of the message routing and forwarding request of the segment can be made to ignore the indication information of the message routing and forwarding request for the abnormal service of the second network element, thereby avoiding the routing of the routing and transmission controller for the message of the abnormal service of the second network element where a network security event has occurred.
  • the occurrence of network security incidents of abnormal services caused by forwarding can further improve network security.
  • a network data analysis function network element obtains message interaction behavior information of K first network elements, for one first network element among the K first network elements,
  • the message interaction behavior information of the first network element includes attribute information used to indicate the message transmitted by the first network element; the K is a positive integer; the network data analysis function network element is based on the K first network elements.
  • the message interaction behavior information of the network element determines that a network security abnormal event occurs in the second network element; the network data analysis function network element sends first indication information to the security event processing function network element, and the first indication information is used to indicate The network security abnormal event occurs in the second network element.
  • the NWDAF network element can obtain the message interaction behavior information of each network element, and then through the attribute of the message transmitted by the first network element Information is analyzed and it is determined that a network security abnormal event occurs in the second network element.
  • the method of the embodiment of the present application can obtain the network security abnormal event of the network element, which is more effective Discover network security abnormalities that cannot be found in the prior art to improve network security.
  • the attribute information of the message transmitted by the first network element includes one or more of the following: the type of the message, The message content of the message, the interface through which the message is transmitted on the first network element, and the interface through which the opposite end corresponding to the message transmits the message.
  • the attribute information of the message transmitted by the first network element to the network data analysis function network element may include related information corresponding to the message generated during the interaction between the network elements, and further, the network data analysis function network element may be generated according to the interaction between the network elements.
  • the relevant information corresponding to the message of the network element determines whether an abnormal network security event is sent between network elements, so as to effectively identify whether an abnormal network security event occurs.
  • the data analysis network element determines that the number of messages received from the second network element by the first network element is greater than a first threshold, it is determined that the second network element has an impact on the first network element.
  • a distributed denial of service (DDoS) attack event of a network element the first threshold value is determined according to the frequency of historical messages.
  • DDoS distributed denial of service
  • the network element with the network data analysis function determines that an abnormality has occurred according to the number of messages from the second network element received by the first network element, thereby determining that the second network element is an abnormal network element, and identifying the second network element.
  • a DDoS attack event occurs in the element, which can instruct the SPF to perform corresponding processing on the abnormal network security event of the DDoS attack that occurs in the second network element, thereby improving network security.
  • the message interaction behavior information of the K first network elements includes: a first message and a second message; if the data analysis network element determines the second network element in the first message If an identity is inconsistent with the second identity of the second network element in the second message, it is determined that the second network element has a network security abnormal event. Furthermore, the network element with the network data analysis function can determine that the second network element has an abnormal network security event according to the inconsistency of the identity of the second network element carried in the different messages, thereby instructing the SPF to target the second network element carried by the second network element Network security abnormal events with inconsistent IDs are handled accordingly, thereby improving network security.
  • the message interaction behavior information of the K first network elements includes: interaction behavior messages from first terminal equipment (UE) of the K first network elements; the data analysis If the network element determines that the interaction behavior messages of the first UE from the second network element are inconsistent, it is determined that the first UE from the second network element has a network security abnormal event. Furthermore, the network element with the network data analysis function can determine that there is a network security abnormal event in the first UE according to the uncorresponding messages in the interactive behavior messages related to the first UE in the different messages.
  • UE terminal equipment
  • the second network element can determine that there is a network security abnormal event in the second network element, thereby instructing the SPF to perform corresponding processing on the network security abnormal event in which the interaction behavior messages of the first UE of the second network element are inconsistent, thereby improving network security .
  • the message interaction behavior information of the K first network elements includes: interaction behavior messages of the second UE from the K first network elements and the second UE from the second network element If the data analysis network element determines that in the user information query request of the second UE from the second network element, the network element identifiers in the second network element are inconsistent, then determine the network At least two network elements corresponding to inconsistent element identifiers have a network security abnormal event.
  • Network data analysis function The network element determines that the network element involved has an abnormal network security event based on the inconsistency of the network element identification of the network element involved in the same UE in different messages, which can instruct the SPF to address the network security of the inconsistent network element identification of the involved network element Abnormal events are dealt with accordingly, thereby improving network security.
  • a communication device for implementing the above-mentioned various methods.
  • the communication device may be the security event processing function network element in the foregoing first aspect, or a device including the foregoing security event processing function network element; or, the communication device may be the network data analysis function network element in the foregoing second aspect, Or a device containing the aforementioned network data analysis function network element.
  • the communication device includes a module, unit, or means corresponding to the foregoing method, and the module, unit, or means can be implemented by hardware, software, or hardware execution of corresponding software.
  • the hardware or software includes one or more modules or units corresponding to the above-mentioned functions.
  • a communication device including: a processor and a memory; the memory is used to store computer instructions, and when the processor executes the instructions, the communication device executes the method described in any one of the above aspects.
  • the communication device may be the security event processing function network element in the foregoing first aspect, or a device including the foregoing security event processing function network element; or, the communication device may be the network data analysis function network element in the foregoing second aspect, Or a device containing the aforementioned network data analysis function network element.
  • a communication device including: a processor; the processor is configured to couple with a memory, and after reading an instruction in the memory, execute the method according to any of the foregoing aspects according to the instruction.
  • the communication device may be the security event processing function network element in the foregoing first aspect, or a device including the foregoing security event processing function network element; or, the communication device may be the network data analysis function network element in the foregoing second aspect, Or a device containing the aforementioned network data analysis function network element.
  • a computer-readable storage medium stores instructions that, when run on a computer, enable the computer to execute the method described in any of the above aspects.
  • a computer program product containing instructions which when running on a computer, enables the computer to execute the method described in any of the above aspects.
  • a communication device for example, the communication device may be a chip or a chip system
  • the communication device includes a processor for implementing the functions involved in any of the foregoing aspects.
  • the communication device further includes a memory for storing necessary program instructions and data.
  • the communication device is a chip system, it may be composed of a chip, or may include a chip and other discrete devices.
  • the technical effects brought by any one of the design methods of the fifth aspect to the tenth aspect can be referred to the technical effects brought about by the different design methods in the first aspect or the second aspect, and will not be repeated here.
  • a communication system includes: a security event processing function network element receives first indication information sent by a network data analysis function network element, and the first indication information is used to indicate the second An abnormal network security event occurs in a network element; the security event processing function network element determines, according to the first indication information, N third network elements that have an association relationship with the second network element; A third network element among the three network elements, the third network element has the ability to process services of the second network element; for one third network element among the N third network elements, so The security event processing function network element sends a first security policy corresponding to the third network element to the third network element, and the first security policy corresponding to the third network element includes instructions for instructing the third network element Indicating information for the element to isolate the service corresponding to the second network element.
  • the network element with the network data analysis function obtains the message interaction behavior information of the K first network elements.
  • the message interaction behavior information of the first network element includes: Indicates the attribute information of the message transmitted by the first network element; the K is a positive integer; the network data analysis function network element determines the second network element according to the message interaction behavior information of the K first network elements A network security abnormal event occurs; the network data analysis function network element sends first indication information to a security event processing function network element, where the first indication information is used to indicate that the second network element has the network security abnormal event.
  • the technical effects brought about by the eleventh aspect can be referred to the technical effects brought about by the above-mentioned first aspect or the second aspect, which will not be repeated here.
  • Figure 1 is a schematic diagram of a network architecture provided by this application.
  • Figure 2 is a schematic diagram of a 5G network architecture based on a service-oriented architecture
  • Figure 3 is a schematic diagram of a 5G network architecture based on a point-to-point interface
  • FIG. 4 is a schematic flowchart of a network event processing method provided by this application.
  • FIG. 5 is a schematic flowchart of a network event processing method provided by this application.
  • FIG. 6 is a schematic flowchart of a method for processing network events provided by this application.
  • FIG. 7 is a schematic flowchart of a network event processing method provided by this application.
  • FIG. 8 is a schematic diagram of a network event processing apparatus provided by this application.
  • FIG. 9 is a schematic diagram of a network event processing apparatus provided by this application.
  • Fig. 1 exemplarily shows a communication system 10 provided by an embodiment of the present application.
  • the communication system 10 includes a network element 101 with a network data analysis function and a network element 102 with a security event processing function.
  • the network data analysis function network element 101 and the security event processing function (SPF) network element 102 may communicate directly, or may communicate through the forwarding of other devices, which is not specifically limited in the embodiment of the present application.
  • SPF security event processing function
  • the network data analysis function network element 101 is used to obtain message interaction behavior information of K first network elements.
  • the message interaction behavior information of the network element includes the attribute information used to indicate the message transmitted by the first network element; the K is a positive integer; the network data analysis function network element according to the K first network element messages
  • the interactive behavior information determines that a network security abnormal event has occurred in the second network element; the network data analysis function network element sends first indication information to the SPF network element, and the first indication information is used to indicate that the second network element has occurred The network security abnormal event.
  • the security event processing function network element 102 is configured to receive first indication information sent by a network data analysis function network element, where the first indication information is used to indicate that a network security abnormal event occurs in the second network element; the SPF network element According to the first indication information, N third network elements that have an association relationship with the second network element are determined; for one third network element among the N third network elements, the third network The element has the ability to process the service of the second network element; for one third network element among the N third network elements, the SPF network element sends the third network element to the third network element.
  • a first security policy corresponding to the network element, and the first security policy corresponding to the third network element includes indication information for instructing the third network element to isolate the service corresponding to the second network element.
  • the network data analysis function network element can acquire the message interaction behavior information of each network element Then, by analyzing the attribute information of the message transmitted by the first network element, it is determined that the second network element has an abnormal network security event.
  • the abnormal behavior of the user can only be identified.
  • the network security abnormal event of the network element can be obtained, and then the network security abnormal situation that cannot be found in the prior art can be effectively found.
  • the security event processing function network element obtains the network security abnormal event sent by the network data analysis function network element 101, and confirms the first
  • the second network element sends a security exception
  • the security event processing function network element confirms the third network element associated with the second network element according to the second network element.
  • it may be a network that has a signaling interaction with the second network element. It can also be a network element that provides services for the second network element.
  • the third network element can isolate the related services of the second network element, which is compared with the existing
  • the processing method that the technology is only sent to the network elements that subscribe to the security event can more comprehensively isolate the influence of the network abnormal event generated by the second network element on the network, thereby improving the security of the network.
  • FIG. 2 and FIG. 3 exemplarily show schematic diagrams of the communication system 10 of the embodiment of the present application applied to the 5G network architecture.
  • the following describes related network elements in the system architecture with reference to Figures 2 and 3.
  • a terminal device may be a device used to implement wireless communication functions, such as a terminal or a chip that can be used in a terminal.
  • the terminal may be a user equipment (UE), an access terminal, a terminal unit, a terminal station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, and wireless communication in a 5G network or a future evolved PLMN.
  • the access terminal can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), with wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices or wearable devices, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, industrial control (industrial) Wireless terminal in control), wireless terminal in self-driving (self-driving), wireless terminal in remote medical (remote medical), wireless terminal in smart grid, wireless terminal in transportation safety (transportation safety) Terminals, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • the terminal can be mobile or fixed.
  • the above-mentioned terminal device may establish a connection with the operator's network through an interface (such as N1, etc.) provided by the operator's network, and use services such as data and/or voice provided by the operator's network.
  • the terminal device can also access the DN through the operator's network, and use the operator's service deployed on the DN and/or the service provided by a third party.
  • the above-mentioned third party may be a service party other than the operator's network and terminal equipment, and may provide other services such as data and/or voice for the terminal equipment.
  • the specific form of expression of the above-mentioned third party can be determined according to actual application scenarios, and is not limited here.
  • RAN is a sub-network of an operator's network, and an implementation system between service nodes and terminal equipment in the operator's network.
  • the terminal device To access the operator's network, the terminal device first passes through the RAN, and then can be connected to the service node of the operator's network through the RAN.
  • the RAN device in this application is a device that provides wireless communication functions for terminal devices, and the RAN device is also called an access network device.
  • the RAN equipment in this application includes but is not limited to: next-generation base stations (gnodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (RNC), node B ( node B, NB), base station controller (BSC), base transceiver station (BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit) , BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc.
  • RAN device is referred to as RAN for short in this application.
  • the RAN equipment in the embodiments of the present application refers to equipment that accesses the core network, such as a base station, a broadband network gateway (BNG), an aggregation switch, and a non-third-generation partnership plan ( 3rd generation partnership project, 3GPP) access equipment, etc.
  • Base stations may include various forms of base stations, such as macro base stations, micro base stations (also called small stations), relay stations, and access points.
  • AMF network element access and mobility management functions, mainly support terminal registration management, connectivity management, and mobility management functions. It is a control plane network element provided by the operator's network and is responsible for terminal equipment access to the operator's network Access control and mobility management, for example, include functions such as mobility status management, assigning temporary user identities, authenticating and authorizing users.
  • SMF network element session management function, mainly supports session establishment, modification and release functions. In addition, it is also responsible for UE IP address allocation and management, UPF selection and control, tunnel maintenance between UPF and AN nodes, and session continuity (Service and Session Continuity (SSC) mode selection, roaming and other session-related functions. It is a control plane network element provided by the operator's network and is responsible for managing the protocol data unit (protocol data unit, PDU) session of the terminal device.
  • PDU session is a channel used to transmit PDUs, and the terminal device needs to transmit PDUs to each other through the PDU session and the DN.
  • the PDU session is established, maintained, and deleted by the SMF network element.
  • UPF network element user plane function
  • UPF network element is mainly responsible for packet routing and forwarding of data messages. It is a gateway provided by the operator and a gateway for the communication between the operator's network and the DN.
  • UPF network elements include user plane-related functions such as data packet routing and transmission, packet inspection, service usage reporting, quality of service (QoS) processing, lawful monitoring, upstream packet inspection, and downstream packet storage.
  • QoS quality of service
  • DN also known as packet data network (PDN)
  • PDN packet data network
  • the operator’s network can be connected to multiple DNs, and multiple services can be deployed on the DN to provide terminal equipment. Services such as data and/or voice.
  • DN is the private network of a smart factory.
  • the sensors installed in the workshop of the smart factory can be terminal devices.
  • a control server for the sensors is deployed in the DN, and the control server can provide services for the sensors.
  • the sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions.
  • the DN is the internal office network of a company.
  • the mobile phones or computers of the employees of the company can be terminal devices, and the mobile phones or computers of the employees can access the information and data resources on the internal office network of the company.
  • the UDM network element is a control plane network element provided by the operator. It is responsible for storing the subscriber permanent identifier (SUPI), credential, security context, and subscription of subscribers in the operator’s network. Data and other information.
  • the information stored in the UDM network element can be used for authentication and authorization of terminal equipment accessing the operator's network.
  • the contracted users of the above-mentioned operator's network may specifically be users who use the services provided by the operator's network, such as users who use China Telecom's mobile phone core card, or users who use China Mobile's mobile phone core card.
  • the permanent subscription identifier (Subscription Permanent Identifier, SUPI) of the aforementioned subscriber may be the number of the mobile phone core card, etc.
  • the credential and security context of the aforementioned subscriber may be a small file stored such as the encryption key of the mobile phone core card or information related to the encryption of the mobile phone core card for authentication and/or authorization.
  • the aforementioned security context may be data (cookie) or token (token) stored on the user's local terminal (for example, mobile phone).
  • the contract data of the above-mentioned subscriber may be a supporting service of the mobile phone core card, such as the data package of the mobile phone core card or the use of the network.
  • permanent identifiers, credentials, security contexts, authentication data (cookies), and tokens are equivalent to information related to authentication and authorization.
  • no distinction or limitation is made for the convenience of description. If no special instructions are given, the embodiments of the present application will be described using a security context as an example, but the embodiments of the present application are also applicable to authentication and/or authorization information in other expression modes.
  • AUSF network element authentication server function, supports user access authentication. It is a control plane network element provided by the operator, and can usually be used for level 1 authentication, that is, the authentication between the terminal device (subscribed user) and the operator's network. After the AUSF network element receives the authentication request initiated by the subscriber, it can authenticate and/or authorize the subscriber through the authentication information and/or authorization information stored in the UDM network element, or generate the authentication and/or authorization of the subscriber through the UDM network element. Or authorization information. The AUSF network element can feed back authentication information and/or authorization information to the subscriber.
  • NEF network elements are control plane network elements provided by operators.
  • the NEF network element opens the external interface of the operator's network to a third party in a safe manner.
  • the SMF network element needs to communicate with a third-party network element
  • the NEF network element can serve as a relay for the communication between the SMF network element and the third-party network element.
  • the NEF network element can be used as the translation of the identification information of the subscriber and the translation of the identification information of the third-party network element.
  • NEF sends the SUPI of a subscriber from the operator's network to a third party, it can translate the SUPI into its corresponding external identity (identity, ID).
  • ID external identity
  • Application Function (AF) network elements mainly provide application layer services, and also support interaction with the 5G core network to provide services, such as influencing data routing decisions, policy control functions, or providing third-party services to the network side.
  • the AF network element generally refers to a third-party server or application server.
  • PCF network element policy control function
  • PCF network element supports a unified policy framework to manage network behavior.
  • policies may include access control policies, mobility management policies, charging-related policies, QoS-related policies, and authorization-related policies.
  • NRF network elements can be used to provide network element discovery functions, based on requests from other network elements, to provide network element information corresponding to the network element type, such as address information and/or identification information. NRF network elements also provide network element management services, such as network element registration, update, de-registration, and network element status subscription and push.
  • CHF network elements are used to provide charging functions and support users' offline and online charging functions.
  • NWDAF network element used for network data analysis function. Responsible for the analysis of safety data and the identification of abnormal safety events.
  • SPF network elements are used for security policy functions, support network-level security policy control, and are responsible for policy determination and coordination of security events.
  • the network element or entity corresponding to the network data analysis function network element 101 in FIG. 1 may be the NWDAF network element in the 5G network architecture, and the network element or entity corresponding to the security event processing function network element 102 in FIG. 1 may be the SPF network element in 5G network architecture.
  • the network data analysis function network element 101 is an NWDAF network element
  • the security event processing function network element 102 is an SPF network element as an example for illustration.
  • the network data analysis function network element or the security event processing function network element in the embodiment of the present application may also be referred to as a communication device, which may be a general-purpose device or a special-purpose device, which is not specifically limited in the embodiment of the present application.
  • the relevant functions of the network data analysis function network element or the security event processing function network element in the embodiments of the present application can be realized by one device, or by multiple devices, or by one or more functions in one device. Module implementation, this embodiment of the application does not specifically limit this. It is understandable that the above functions can be network elements in hardware devices, software functions running on dedicated hardware, or a combination of hardware and software, or instantiated on a platform (for example, a cloud platform) Virtualization function.
  • the network element with the network data analysis function refers to the network element with the functions of data collection and analysis and data analysis result acquisition. It can be the NWDAF network element in Figure 1 or Figure 2, or it can be a management data analysis service (Management data analysis service (MDAS) network elements or other network elements with similar functions.
  • MDAS Management data analysis service
  • this application will subsequently take the network data analysis function network element as the NWDAF network element in 5G as an example for description, and the network data analysis function network element may be referred to as the NWDAF network element for short.
  • the NWDAF network element may also be referred to as a network analysis function or a network analysis function network element, which has the same meaning, and a unified description is made here.
  • NWDAF can be implemented in a distributed manner, and distributed entities can be deployed on the 5GC NF side, the RAN side (in the figure, the RAN device is a gNB as an example), and inside the UE.
  • the NWDAF deployment on the AMF network element side and the SMF side can be independent physical devices, or independent virtual devices, or software modules deployed in the AMF network element/SMF, or at a physical location or network location.
  • NWDAF can interact with 5GC NF, gNB, OAM to obtain information, and obtain information from UE, and provide analysis results to AF, including center-side AF, and distributed mobile edge computing (Mobile Edge Computing, MEC) deployed at each edge AF entity.
  • NWDAF network elements can obtain the data to be analyzed from one or more of NF network elements (SMF, PCF network elements, RAN, UPF, etc. as shown in Figure 2 or Figure 3), AF, data warehouse, or OAM, and then perform Analyze and obtain data analysis results.
  • NF network elements SMF, PCF network elements, RAN, UPF, etc.
  • the data analysis performed by the NWDAF network element may be triggered based on a data analysis request or subscription message sent by a consumer network element (for example, the consumer network element may be an NF network element, RAN equipment, terminal equipment, etc.), or It is triggered by the data analysis network element based on other conditions, such as periodic triggering, initial event triggering, and so on.
  • the data analysis network element After the data analysis network element obtains the data analysis result, it can send the data analysis result to the consumer network element that requests the data analysis result, or store the data analysis result in a data warehouse or in the data analysis network element.
  • the 5G network architecture may also include one or more of the following network elements: network exposure function (NEF) network elements, PCF network elements, unified data management (UDM) network elements, NRF network element, AF network element, NWDAF network element, authentication server function (authentication server function, AUSF) network element, AMF network element, SMF network element, (radio) access network ((radio) access network, (R) AN ) And user plane function (UPF) network elements, etc., which are not specifically limited in the embodiment of the present application.
  • NEF network exposure function
  • PCF PCF network elements
  • UDM unified data management
  • the terminal device communicates with the AMF network element through the next generation network (next generation, N) 1 interface (N1)
  • the RAN device communicates with the AMF network element through the N2 interface (N2)
  • the RAN device communicates with the AMF network element through the N3 interface (N3).
  • UPF network element communicates with DN through N6 interface (abbreviated as N6)
  • AMF network element communicates with SMF network element through N11 interface (abbreviated as N11)
  • AMF network element communicates with UDM network element through N8 interface (abbreviated as N8) Communication
  • AMF network element communicates with AUSF network element through N12 interface (abbreviated as N12)
  • AMF network element communicates with PCF network element through N15 interface (abbreviated as N15)
  • SMF network element communicates with PCF network element through N7 interface (abbreviated as N7)
  • SMF network element communicates with UPF network element through N4 interface (abbreviated as N4)
  • SMF network element communicates with UDM network element through N10 interface (abbreviated as N10)
  • UDM network element communicates with AUSF network element through N13 interface (abbreviated as N13)
  • PCF network The element communicates with the AF network element through the N5 interface (N5 for short).
  • control plane network elements such as AMF network elements, SMF network elements, UDM network elements, AUSF network elements, PCF network elements, LSMF network elements, or AF network elements in the 5G network architecture shown in Figure 2 are also You can use a service-oriented interface for interaction.
  • the service-oriented interface provided by the AMF network element can be Namf; the service-oriented interface provided by the SMF network element can be Nsmf; the service-oriented interface provided by the UDM network element can be Nudm; the PCF network element
  • the servicing interface provided externally can be Npcf, the servicing interface provided externally by the AUSF network element can be Nausf, and the servicing interface provided externally by the AF network element can be Naf.
  • SPF network elements can be deployed in a variety of ways.
  • SPF network elements can be implemented in a distributed manner, and distributed entities can be deployed on the 5GC NF side, the RAN side (the RAN device is a gNB as an example in the figure), and inside the UE. As shown in Figure 2, it represents a possible deployment method of newly added NF SPF network elements.
  • SPF network elements can be used as the standard NF of the 5G core network and directly connect to the 5G core network NF defined by the standard through the SBA interface.
  • FIG. 3 it is a schematic diagram of a 5G network architecture based on a point-to-point interface.
  • the interface between the various network elements in Fig. 2 is a point-to-point interface, rather than a service-oriented interface.
  • terminal equipment communicates with AMF network elements through N1 interface (abbreviated as N1)
  • RAN equipment communicates with AMF network elements through N2 interface (abbreviated as N2)
  • RAN equipment communicates with UPF through N3 interface (abbreviated as N3)
  • UPF network element communicates with DN through N6 interface (referred to as N6)
  • AMF network element communicates with SMF network element through N11 interface (referred to as N11)
  • AMF network element communicates with UDM network element through N8 interface (referred to as N8)
  • the AMF network element communicates with the AUSF network element through the N12 interface (N12 for short)
  • the AMF network element communicates with the vPCF network element through the N15 interface (N15 for short)
  • the SMF network element communicates with the vPCF network element through the N7 interface (for short N7).
  • the vPCF network The element communicates with the hPCF network element through the N24 interface (abbreviated as N24), the vPCF network element communicates with the AF network element through the N5 interface (abbreviated as N5), the SMF network element communicates with the UPF network element through the N4 interface (abbreviated as N4), and the SMF network element passes through
  • the N10 interface (N10 for short) communicates with the UDM network element, and the UDM network element communicates with the AUSF network element through the N13 interface (N13 for short).
  • the embodiment of the present application also provides a deployment method of SPF network elements.
  • the SPF network element can serve as a management plane function and indirectly connect with the 5G core network NF through the management plane interface.
  • the security policy SPF network elements there can be many NFs that are connected to the security policy SPF network elements, which can be expanded with the evolution of network functions.
  • the NF that interfaces with the security policy SPF network element may include: AMF network elements/SMF network elements related to UE signaling; PCF network elements/UDM related to UE policies and subscription data; and core network NFs Communication NRF network element/SCF network element; it can also be connected to related functional areas outside the core network NF network element, such as virtualized resource management network elements and routing and transmission controller (software defined network, SDN) network elements, so as to Respond to security incidents in a wider range of functions.
  • SDN software defined network
  • this figure only shows one implementation method, and there are other deployment methods in actual applications, such as deploying one NWDAF network element and one SPF network element, or deploying SPF network element in NWDAF network element (For example, deploy in a central location).
  • the NF network element in this application can be the core network network element in Figure 2 or Figure 3, that is, 5G Core Network (5G Core Network, 5GC) NFs, or it can be a future communication system, such as the sixth generation (6th generation,
  • the core network elements in 6G) are 6GC NFs.
  • the embodiment of the present application takes NF as 5GC NFs as an example for description.
  • the NF may be referred to as 5GC NF, and when there are multiple NFs, it may also be described as 5GC NFs, or NFs for short.
  • the NWDAF network element is a newly introduced network function of 5G, which provides data analysis services for other network functions of the 5G core network.
  • the analyzed information can be statistical information of past events or predictive information.
  • NWDAF network elements have already supported some analysis use cases: such as analysis of slice load, service experience, network performance, and user-related behavior.
  • user-related behavior analysis involves abnormal user behavior analysis, which is used to identify hijacked or abused user terminals, so as to prevent user terminals from being stolen or used to launch attacks on the network.
  • Network functions can directly or indirectly subscribe to NWDAF network elements for security-related data analysis services.
  • a trusted consumer NF in the 5G core network can directly subscribe to NWDAF network elements for user identification analysis services, such as
  • the subscribed user identification analysis service may be NWDAF network element analysis subscription service (Nnwdaf_Analytics Subscription_Subscribe), which is used for network functions to subscribe to the NWDAF network element for abnormal user identification analysis service.
  • NWDAF network element analysis subscription service Nnwdaf_Analytics Subscription_Subscribe
  • the external application function may send a subscription request to the network exposure function (NEF); further, the NEF forwards the subscription request to the NWDAF network element, so that the AF subscribes to the NWDAF network element for the user identification analysis service.
  • NEF network exposure function
  • the NWDAF network element determines that the user behavior analysis result is the subscription message corresponding to the user identification analysis service subscribed by AF according to the analysis and the operator's strategy, and sends the user behavior analysis result to the NEF subscribing to the user behavior analysis service, so that the NEF sends it to the AF User behavior analysis results.
  • the NWDAF network element determines that the user behavior analysis result is the subscription message corresponding to the user identification analysis service subscribed by the consumer NF network element according to the analysis and the operator’s strategy, and then it can send the user to the consumer NF subscribing to the user behavior analysis service Behavioral analysis results.
  • the network element that subscribes to the abnormal user identification analysis service performs corresponding processing on the user behavior analysis result, such as releasing the corresponding terminal.
  • the NWDAF network element only analyzes the UE behavior information, and does not analyze the behavior of the core network function.
  • the 5G core network due to the introduction of many IT technologies, such as virtualization platforms, container platforms, and more and more open source third-party IT component applications, coupled with the joint participation of multiple suppliers in the networking, it directly contributes to the 5G core network.
  • NWDAF network elements cannot determine the security abnormal behaviors such as attack, infiltration, and hijacking of core network functions, resulting in hidden security risks in the core network.
  • the user behavior analysis service can only obtain the results of the user behavior analysis by the NWDAF network element by subscribing to the NWDAF network element, and in many scenarios, the security abnormal behavior involves the participation of multiple network functions, and a security abnormal behavior It may affect the normal operation of multiple network functions, and the subscription method of the user behavior analysis service mentioned above makes the user behavior analysis result only sent to the network element subscribing to the user behavior analysis service, and other security abnormal behaviors involved The network function cannot obtain the user behavior analysis result, nor can it deal with the security abnormal behavior involved, which also leads to the low security of the network elements of the core network.
  • an embodiment of the present application provides a network event processing method.
  • a schematic flow chart of the network performance data analysis method provided by this embodiment of the present application includes the following steps:
  • Step 401 The NWDAF network element obtains the message interaction behavior information of the K first network elements.
  • the message interaction behavior information may correspond to the function of the core network element.
  • the core network network element may be any network element in the foregoing embodiments.
  • the message interaction behavior information of the K first network elements may be the message interaction behavior information of the first network element subscribed by the NWDAF network element, or the message interaction behavior information of other core network elements acquired by the first network element subscribed by the NWDAF network element Behavioral information.
  • the message interaction behavior information of the first network element includes attribute information used to indicate the message transmitted by the first network element; the K is positive Integer.
  • the attribute information of the message transmitted by the first network element may include: the type of the message, and the type may be specifically determined according to the interface of the message transmitted by the first network element; the message content of the message (for example, UE ID, the IP address of the network element, the ID of the network element, the certificate of the network element, the content of the request, etc.), the interface for transmitting the message on the first network element (which can be determined according to the first network element, for example, NWDAF network Meta-analysis subscription service interface, event analysis service (Nnwdaf_AnalyticsInfo) interface, NWDAF network element analysis notification (Nnwdaf_AnalyticsInfo_Notif), AMF network element communication interface (Namf_Communication), AMF network element event open service interface, SMF event open service interface, SPF network element security Policy interface, security log (Nnf_SecurityLog) interface, etc.); the opposite end corresponding to the message transmits the message interface (which can be determined according to the opposite end of the message
  • the NWDAF network element may send a message interaction behavior information subscription request to the K first network elements for subscribing to the message interaction behavior information of the K first network elements;
  • the message interaction behavior information of the element may be the message interaction behavior information generated by the first network element, and may also be the message interaction behavior information of other core network network elements acquired by the first network element.
  • the first network element subscribed by the NWDAF network element can be an AMF network element, and the AMF network element can then connect the terminal equipment to the operator’s network access information and mobility information, for example, including mobile status information, and allocate it to the user
  • the temporary identity, authentication information and authorized user information of the user are reported to the NWDAF network element.
  • the AMF network element may also send the SMF to the AMF network element for session establishment, session modification and session release, UE's IP address, selected UPF and other session-related information as message interaction behavior information and report to the NWDAF network element.
  • the NWDAF network element sends a user behavior subscription request to the AMF network element through the open interface of the AMF network element to subscribe to the AMF network element event opening service (Namf_EventExposure) to obtain UE behavior such as terminal access mobility information.
  • the AMF network element may periodically send UE behavior messages to the NWDAF network element; UE behavior information may include: UE location information (may include the tracking area identifier TAI or cell identifier Cell ID where the UE is located), and UE access Technology type, UE moving into or out of the area of interest, UE registration status change, etc.
  • the AMF network element may subscribe or the AMF network element may send UE behavior messages to the NWDAF network element in an event manner.
  • the NWDAF network element may subscribe to the open service interface of the SMF, for example, the SMF event open service (Nsmf_EventExposure) to obtain UE behavior information such as UE session management.
  • SMF can also report UE session messages to NWDAF network elements periodically or eventually.
  • the UE session message may include the following UE behavior information: UE IP address change, PDU session release, user plane path change and other call information or billing information.
  • Step 402 The NWDAF network element determines that an abnormal network security event has occurred in the second network element according to the message exchange behavior information of the K first network elements.
  • the message interaction behavior information includes that the first network element receives a message from the second network element as an example.
  • the message interaction behavior information may also be directly sent by the first network element, or may be obtained through a signaling message sent by other network elements to the first network element, etc., which is not limited here.
  • the NWDAF network element may determine whether there is a network security abnormal event according to the message frequency sent by the message interaction behavior information. For example, if it is determined that the number of messages received from the second network element by the first network element is greater than the first threshold, it is determined that there is a DDoS attack event by the second network element on the first network element; A threshold is determined based on the frequency of historical messages.
  • the NWDAF network element may determine that there is an inconsistency between the first message of the first network element and the second message of the second network element according to the message exchange behavior information, and then it is determined that there may be a network security abnormal event.
  • the NWDAF network element determines that the second network element has a network security abnormal event that can have multiple possible implementation manners, which will be introduced in the following through implementation a1, implementation a2, and implementation a3.
  • the data analysis network element determines that a network security abnormal event may exist according to the first message and the second message included in the message interaction behavior information of the K first network elements. If it is determined that the first identity of the second network element in the first message is inconsistent with the second identity of the second network element in the second message, it is determined that the second network element has a network security abnormality event.
  • the first message is the first charging request of the first UE identity from the SMF; the second message is the registration information of the AMF network element for the UE identity; at this time, if the data analysis network element determines that the UE The identified registration information does not include the registration information of the first UE identification; it can be determined that the first UE identification in the first charging request is illegal registration information. Therefore, there may be a tampering event of the first network element.
  • Embodiment a2 The data analysis network element determines whether the first UE has network security based on the interaction behavior information of the first UE from the K first network elements included in the message interaction behavior information of the K first network elements Abnormal event. At this time, if it is determined that the interaction behavior messages of the first UE are inconsistent, it is determined that the first UE has a network security abnormal event.
  • the first network element is a charging function network element CHF and an AMF network element.
  • the first message is the first charging request of the first UE identity; the second message is the registration information of the AMF network element for the UE identity; at this time, if the data analysis network element determines the registration of the UE identity
  • the information does not include the registration information of the first UE identification; it can be determined that the first UE identification in the first charging request is illegal registration information, and it can be determined that the first UE may have a network security abnormal event that has been tampered with.
  • the NWDAF network element can perform user behavior analysis based on the UE behavior information reported by the AMF network element and SMF. Specifically, the NWDAF network element can analyze the user behavior information reported by the AMF network element and the SMF according to the internal data analysis algorithm, and identify the misused or hijacked user and user behavior. For example, it can identify abnormal UE location, abnormally long data flow, abnormal frequent access, etc., and then determine that the first UE has an abnormal network security event.
  • the data analysis network element includes the K interaction behavior messages of the second UE of the first network element and the information of the second UE from the second network element according to the message interaction behavior information of the K first network elements.
  • the user information query request determines that the network element may have a network security abnormal event. If the data analysis network element determines that in the user information query request of the second UE from the second network element, the network element identifiers in the second network element are inconsistent, then determine at least two corresponding to the inconsistent network element identifiers An abnormal network security event occurred on the network element.
  • the second network element illegally obtains the certificate of SMF1 and sends the user information query request of the second UE to the AMF network element. Take the illegally stealing user information of the second UE as an example .
  • the user information query request includes the certificate of the first network element and the network element identifier of the second network element, for example, the IP address or port of the second network element; SMF1 sends a second message to the AMF network element, and the second message may be Any message or a collection of multiple messages exchanged between SMF1 and AMF network element; wherein, the second message includes: the network element identification of the first network element, for example, the certificate of the first network element, the IP address of the first network element or Port, etc.
  • the data analysis network element may determine, according to the user information query request of the second UE and the second message, that the certificate of the network element in the user information query request of the second UE is consistent with the certificate of the network element corresponding to the second message.
  • the IP address of the network element corresponding to the user information query request of the second UE is inconsistent with the IP address of the network element in the second message, and it is determined that the network element corresponding to the user information query request of the second UE corresponds to the one in the second message. Of network elements have an abnormal network security incident.
  • Step 403 The NWDAF network element sends the first indication information to the SPF network element.
  • the first indication information is used to indicate that the network security abnormal event occurs in the second network element.
  • the network security abnormal event may include: the first network element is subject to a DDoS attack event. For example, if it is determined that the second network element initiates a DDoS attack on the first network element according to the message exchange behavior information, it can be determined that the second network element and/or the first network element has a network security abnormal event.
  • the network security abnormal event may include: the security abnormal event of the second network element and/or the first network element; the security abnormal event of the second network element and/or the first network element may have multiple abnormalities.
  • the first network element or the second network element may be at risk of fraudulent use.
  • the security abnormality of the second network element and/or the first network element can be expressed as: There is an inconsistent network security abnormal event between the first message and the second message of the second network element, and the same identification information exists in the first message and the second message; at this time, the first network element and/or the second network element can be considered There may be a risk of fraudulent use.
  • the NWDAF network element can also compare other messages related to the first message or other messages related to the second message to determine the first message and the second message of the first network element.
  • the reason for the inconsistency of the second messages of the network elements is to determine the network element that has been fraudulently used or tampered with, and furthermore, it is determined that the network security abnormal event is that the first network element and/or the second network element has been fraudulently used or tampered with.
  • the second network element and/or the first network element may have a network security abnormal event that steals user information.
  • the second network element and/or the first network element's security abnormal event can indicate It is: the first identity of the first network element is inconsistent with the second identity of the first network element, and the first network element sends a query request for user information to the second network element. At this time, the first network element may be stolen Security abnormal events of user information.
  • the abnormal network security event may further include: the abnormal network security event of the user; for example, in a possible scenario, the abnormal security event of the user may be expressed as: the first message carried in the first message sent by the first network element A user ID is the same as the first user ID carried in the second message sent by the second network element, and the first message is inconsistent with the second message. It can also be determined that the user corresponding to the first user ID has a network security abnormal event.
  • the network security abnormal event may also include: the network security abnormal event of the abnormal business.
  • the message interaction behavior information of the K first network elements includes: interaction behavior messages of the second UE from the K first network elements and user information query of the second UE from the second network element Request; if the data analysis network element determines that in the user information query request of the second UE from the second network element, the network element identifiers in the second network element are inconsistent, then the user information of the second UE can be determined
  • the query request is an abnormal service, and it is determined that at least two network elements corresponding to the inconsistent network element identifiers have network security abnormal events of the abnormal service.
  • NWDAF can obtain the message interaction behavior information of each network element, and then through the analysis of the message interaction behavior information of each network element, the abnormal behavior detection ability of network functions is improved , Thereby effectively improving the recognition rate and accuracy of the security intrusion event of the network function.
  • Step 404 The SPF network element receives the first indication information sent by the NWDAF network element.
  • the SPF network element can send a network security abnormal event subscription request to the NWDAF network element to obtain the first indication information of the network security abnormal event from the NWDAF network element.
  • it can also send the network security abnormality to the NWDAF network element.
  • the event query request is to receive the first indication information sent by the NWDAF network element, which is not limited here.
  • Step 405 The SPF network element determines N third network elements that have an association relationship with the second network element according to the first indication information.
  • the third network element has the ability to process the service of the second network element.
  • Step 406 For one third network element among the N third network elements, the SPF network element sends the first security policy corresponding to the third network element to the third network element.
  • the first security policy corresponding to the third network element includes instruction information for instructing the third network element to stop processing related services of the second network element.
  • the SPF network element can determine different security policies according to different types of abnormal network security events.
  • the isolation strategy for each third network element can be set according to the third network element associated with the network security abnormal event, and the isolation strategy for each user can also be set according to the user associated with the network security abnormal event.
  • the isolation strategy for the third network element involved in each user can be set according to the users associated with the abnormal network security event.
  • a network security abnormal event is a DDoS attack event of a second network element on the first network element; in this case, the third network element may be the second network element and/or the network element related to the second network element, which may be based on For DDoS attacks, determine the isolation strategy for the third network element. For example, the SPF network element determines to isolate the related services of the third network element according to the DDoS attack event, and releases the corresponding user on the third network element.
  • the third network element may be an AMF network element
  • the SPF network element sends a first security policy corresponding to the AMF network element to the AMF network element
  • the first security policy corresponding to the AMF network element includes using Instruction information for instructing the AMF network element to stop processing the message of the second network element
  • the first security policy corresponding to the AMF network element includes instructions for instructing the AMF network element to release the second network element The bound user.
  • the SPF network element may instruct the AMF network element to stop establishing and/or releasing the user session related to the second network element; the specific implementation process may include: the SPF network element sends a first security policy message to the AMF network element; The first security policy message is used to instruct the AMF network element to release the user session established by the second network element.
  • the third network element may be a message forwarding network element, therefore, the SPF network element may instruct the message forwarding (service communication proxy, SCP) network element to stop forwarding the message from the second network element, the specific implementation process It may include: the SPF network element sends a first security policy message to the message forwarding network element SCP network element; the first security policy message includes the NF identifier or IP address of the second network element; the first security policy message is used for To instruct the SCP network element to stop forwarding the message from the second network element.
  • SCP service communication proxy
  • the third network element may be any network element in the network that may establish a communication connection with the second network element. Therefore, the SPF network element may instruct the third network element to stop establishing a communication connection with the second network element.
  • the specific implementation process may include: the SPF network element sends a second security policy message to the third network element; the first security policy message The NF identifier of the second network element is included; the second security policy message is used by the third network element to ignore establishing a connection with the second network element.
  • the third network element is an NRF network element
  • the SPF network element sends a first security policy corresponding to the NRF network element to the NRF network element, and a first security policy corresponding to the NRF network element Including instructions for instructing the NRF network element to stop user authorization for the second network element;
  • the third network element may be a routing transmission controller SDN network element, and the SPF network element may instruct the SDN network element to prevent the routing and forwarding of messages of the network segment corresponding to the second network element.
  • the specific implementation process may include: the SPF network element sends a first security policy message to the routing and transmission controller SDN network element; the first security policy message is used to instruct the SDN network element to prevent the second network element from corresponding Routing and forwarding of messages in the network segment.
  • the third network element is a virtualized resource management (network functions virtualisation management and orchestration, MANO) network element, and the SPF network element sends the first security corresponding to the MANO network element to the MANO network element.
  • a policy, the first security policy corresponding to the MANO network element includes the first security policy for instructing the MANO network element to release the virtual machine corresponding to the second network element.
  • the first indication information may also be used to indicate the abnormal service corresponding to the abnormal network security event.
  • the SPF network element may determine the fourth network element that needs to implement the second security policy based on the abnormal service. Specifically, the SPF network element may determine, according to the first indication information, M fourth network elements that have an association relationship with the second network element; for a fourth network element among the M fourth network elements The fourth network element has the ability to process the abnormal service; for a fourth network element among the M fourth network elements, the SPF network element may send the A second security policy corresponding to the fourth network element, and the second security policy corresponding to the fourth network element includes instruction information for instructing the fourth network element to stop or cancel processing the abnormal service.
  • scenario 1 and scenario 2 are used as examples.
  • the message transmitted by the first network element includes a first message and a second message, and the interaction behavior message of the first UE in the first message is inconsistent with the interaction behavior message of the first UE in the second message ,
  • the possible reason is that the interaction behavior message of the first UE in the first message is tampered with, or the interaction behavior message of the first UE in the second message is tampered.
  • the NWDAF network element can be based on the K first network Among the meta-transmitted messages, other interaction behavior messages of the first UE involved, it is determined whether the tampered is the first message or the second message.
  • the second security policy for determining that the interaction behavior message of other first UEs is tampered can refer to the embodiment in which the first UE identifier in the first message is tampered, which will not be repeated here.
  • scenario 1 there is a tampering problem with the first UE identity in the first message, which is introduced below through examples d1-d5.
  • the fourth network element may be an SMF network element.
  • the SPF network element may isolate the service of the first UE initiated by the SMF network element, that is, it may instruct the SMF network element to stop performing operations corresponding to the first UE. For example, stop executing the service request of the first UE generated by the SMF network element, and release the session between the first UE and the SMF network element.
  • the specific implementation process may include: the SPF network element generates a second security policy request; the second security policy request is used to stop executing the service request of the first UE generated by the SMF network element; and release the A session between the first UE and the SMF network element.
  • the fourth network element is an AMF network element
  • the SPF network element sends a second security policy corresponding to the AMF network element to the AMF network element
  • the second security policy corresponding to the AMF network element includes A request used to instruct the AMF network element to stop executing the abnormal service;
  • the abnormal service may be a session of the first UE related to the first network element, and the AMF network element may release the session of the first UE.
  • it may include: the SPF network element sends a security policy request of the abnormal user to the AMF network element; the security policy request of the abnormal user is used to instruct the AMF network element to release the session of the first UE.
  • the SPF network element may also send a second security policy corresponding to the AMF network element to the AMF network element, and the second security policy corresponding to the AMF network element includes instructions for instructing the AMF network element to release The user corresponding to the abnormal service, for example, the first UE.
  • the fourth network element is an AMF network element. If the SPF network element determines that the SMF network element is at risk of fraudulent use, the SPF network element can also isolate the services of the AMF network element and the SMF network element. For example, the AMF network element related to the SMF network element may be instructed to release the session with the UE identified by the first UE involved in the request initiated by the SMF network element to the AMF network element. At this time, since the network elements that may be involved in the risk of fraudulent use may include multiple network elements, all or part of the service request initiated by the SMF network element can be isolated.
  • the fraudulent network element can be used as an isolated network element to isolate the services initiated by the fraudulent network element. If the SPF network element cannot determine the fraudulent network element and the fraudulent network element, but can only determine that the network element has a risk of fraudulent use, all services initiated by the network element with the risk of fraudulent use can be isolated. In the specific implementation process, it may include: the SPF network element sends a security policy request of the abnormal user to the AMF network element; the security policy request of the abnormal user is used to instruct the AMF network element to release the related SMF network element UE's session.
  • Example d4 the fourth network element is a PCF network element, the SPF network element sends a second security policy corresponding to the PCF network element to the PCF network element, and the second security policy corresponding to the PCF network element includes It is used to instruct the PCF network element to release the user corresponding to the abnormal service, so that the PCF network element isolates the user related to the first UE identity.
  • the specific implementation process may include: the SPF network element sends a security policy request of the abnormal user to the PCF network element; the security policy request of the abnormal user is used to instruct the PCF network element to release the session identified by the first UE and The internet.
  • Example d5 If the SPF network element determines that the tampering object identified by the first UE is the second network element, it can be considered that the second network element is at risk of being fraudulently used, and further, it can initiate an attack on the second network element to the fourth network element.
  • the second security strategy for the isolation of meta-abnormal business Specifically, the SPF network element may send a second security policy request to the fourth network element; the second security policy request is used to instruct to isolate the abnormal service of the second network element.
  • the fourth network element is an SCP network element, the SPF network element sends a second security policy corresponding to the SCP network element to the SCP network element, and the second security policy corresponding to the SCP network element includes using Instruct the SCP network element to stop forwarding the message of the abnormal service to the second network element; or, the fourth network element is an NRF network element, and the SPF network element sends the NRF to the NRF network element A second security policy corresponding to the network element, and the second security policy corresponding to the NRF network element includes a user authorization for instructing the NRF network element to stop the abnormal service of the second network element; or, the fourth The network element is an SDN network element, the SPF network element sends a second security policy corresponding to the SDN network element to the SDN network element, and the second security policy corresponding to the SDN network element includes instructions for instructing the SDN network The element stops routing and forwarding the message of the network segment of the abnormal service of the second network element.
  • the NWDAF network element or the SPF network element can determine that there may be a network security incident that steals the user’s private information by querying user information through the presence of the network element, and the NWDAF network element or SPF network element passes the second message in the first message.
  • the first identity of the network element is inconsistent with the second identity of the second network element in the second message. If it is determined that the object of stealing the user’s private message is the second network element, it can be determined that the second network element has been spoofed. The risk of using.
  • the NWDAF network element or the SPF network element can also determine that there is an object stealing the user's private message based on the inconsistency of other interactive behavior messages, which will not be repeated here.
  • the first message may include: the third network element sent by the second network element to the first network element UE information query request; the query request includes the first identity of the first network element; the second message includes: the second identity of the first network element. If the NWDAF network element is inconsistent with the second identity of the second network element according to the first identity of the second network element, and the first identity has a network security abnormal event, it can be determined The second network element corresponding to an identity is an abnormal network element. At this time, the security abnormal event may include: indicating that the first SMF is an abnormal network element.
  • the SPF network element is inconsistent with the second identity of the second network element according to the first identity of the second network element, and the first identity has a network security abnormal event, it can be determined
  • the first identity corresponding to the first SMF is an abnormal network element.
  • the first identity may be the IP address IP1 corresponding to the first SMF network element. If the second network element steals the TSL certificate of the second SMF, it is used to verify the third UE information query request sent to the first network element.
  • the NWDAF network element may receive the first message from the AMF network element.
  • the first message includes: the IP1 of the first SMF network element, the TSL certificate of the second SMF network element, and the third UE information query request.
  • the NWDAF network element may also receive a second message sent by the second SMF network element, where the second message includes: the IP2 of the second SMF network element and the TSL certificate of the second SMF network element.
  • the NWDAF network element can determine, according to the first message and the second message, that the third UE information query request sent by the first SMF network element has a network security abnormality. Further, the NWDAF network element may also send a query request for other UE information including the TSL certificate sent by the second SMF network element, and the second identity of the second SMF network element (IP address IP2 corresponding to the second SMF network element). ), confirming that the first SMF network element is an abnormal network element.
  • the SPF network element determines the second security policy according to the network security abnormal event of the NWDAF network element.
  • the second security policy may be a session or network isolation for the second network element, and/or a user session or network isolation for the second network element. Specifically, it may include: the SPF network element generates a second security policy according to the abnormal network element, isolates the services of the abnormal network element, and/or releases the corresponding user on the abnormal network element; The fourth network element sends a second security policy; the second security policy is used to instruct the fourth network element to stop sending user related information to the abnormal network element.
  • the NWDAF network element when the NWDAF network element detects a security abnormal event, it can also notify the newly-added security event processing function SPF network element of the network security abnormal event, and then the SPF network element passes through the new security policy interface in each field , Coordination and joint multi-functional fields, respond to network security incidents, effectively improve the handling of security abnormal events, and effectively improve network security performance. It can effectively control the impact of security exceptions on the network.
  • a specific implementation method includes two main network functions.
  • One is the NWDAF network element, which is responsible for the analysis of security data and the identification of abnormal security events.
  • the NWDAF is used to subscribe to the message exchange information of its corresponding network element.
  • One is the newly-added security policy network element SPF network element, which is responsible for the determination of network security incidents and the handling of abnormal network security incidents.
  • FIG. 5 it is a schematic flowchart of a method for analyzing network performance data provided by an embodiment of this application.
  • the method includes the following steps:
  • Step 501 The NWDAF network element receives message interaction behavior information of the first network element.
  • the AMF network element can be obtained through the extended event open service (Namf_EventExposure) interface, and the SMF can Obtained through the extended event open service (Nsmf_EventExposure) interface.
  • the message interaction behavior information interface can also be an extended event analysis service (Nnwdaf_AnalyticsInfo) interface, which is used to increase the analysis types of message interaction behavior information, such as abnormal NF behavior and abnormal user behavior.
  • the NF screening parameters may include at least one of the following: NF type, NF identifier or NF list, and parameters such as slices to which the NF belongs.
  • the NWDAF network element sends a subscription request for the message interaction information of the NF to the NF to obtain the message interaction behavior information sent by the NF.
  • the NWDAF network element obtains the message interaction behavior information of the NF can be the message interaction behavior information of the NF and other NF signaling interactions, or it can subscribe to the NF message interaction behavior to the NF through new signaling, for example, the NF security log (Nnf_SecurityLog) information.
  • the message interaction behavior information of the subscribed NF may include all the interface message types sent and received by the NF, the events of all messages and the content of the interface messages, etc. Among them, the content of the interface message may include: complete data, summary, key information, etc. of the interface message.
  • the second network element is maliciously infiltrated and controlled by external users, by frequently sending first messages to surrounding NFs, for example, SMF1 sends multiple first messages to AMF network element 1 through the AMF network element communication interface (Namf_Communication) in a short time, resulting in AMF
  • the processing resources and interface bandwidth resources of the network element 1 are occupied, and the ability to process normal services is reduced.
  • the AMF network element 1 periodically or eventually reports the message sent by the second network element to the first network element according to the collection requirement of the NWDAF network element message interaction behavior information, as the message interaction behavior information of the first network element.
  • Step 502 The NWDAF network element classifies and judges the interaction events of the AMF network element 1, and determines the network security abnormal event.
  • the network security abnormal event is that the first network element receives a DDoS attack from the second network element.
  • the NWDAF network element determines that the message received from the second network element NF within a specified period of time exceeds a preset threshold according to the internal algorithm, for example, according to a specified rule judgment, such as the historical traffic model of the AMF network element 1. It is determined that a sudden business surge occurs during the interaction event process of AMF network element 1, and there may be a DDoS attack.
  • a specified rule judgment such as the historical traffic model of the AMF network element 1.
  • Another possible implementation is based on machine learning or artificial intelligence (AI) algorithms, based on historical abnormality or normal service signaling interaction data training model, the interaction event process of the first network element AMF network element 1 Perform classification to determine whether there is a DDoS attack.
  • AI artificial intelligence
  • the embodiment of the application does not limit the specific algorithm, and the NWDAF network element may determine that the first network element NF may be attacked by DDos according to the specific algorithm adopted.
  • Step 503 The NWDAF network element sends the first indication information to the SPF network element.
  • the first indication information may be a NWDAF network element analysis notification (Nnwdaf_AnalyticsInfo_Notif) message, including: the first network element AMF network element 1 may be DDos attacked by the second network element SMF1.
  • NWDAF network element analysis notification Nnwdaf_AnalyticsInfo_Notif
  • the SPF network element can send a network security abnormal event subscription request to the NWDAF network element through the analysis service (Nnwdaf_AnalyticsInfo) interface of the NWDAF network element, and the NWDAF network element can then follow the network security abnormal event subscription request , It is determined that it is necessary to report to the SPF network element that the first network element AMF network element 1 may be DDos attacked by the second network element SMF1.
  • the analysis service Nnwdaf_AnalyticsInfo
  • Step 504 The SPF network element determines a first security policy according to the first indication information.
  • the security policy may be a security policy configured locally or in the background. Furthermore, the SPF network element determines that the SMF of the second network element may be invaded according to the NF type, and determines the condition of the security policy corresponding to other NFs such as DDoS attacks. Security policy implemented on the second network element.
  • the SPF network element may send the security policy instruction to the network element of the control center corresponding to the service or network, so that the network element of the control center corresponding to the service or network executes the security policy message corresponding to the second network element.
  • the SPF network element sends the first security policy to the third network element.
  • the third network element is an SCP network element
  • the SPF network element may send the first security policy to the SCP network element, instructing the SCP network element to stop forwarding the message of the second network element, where the first security policy message may carry the first security policy message.
  • the third network element is an NRF network element.
  • the SPF network element may send the first security policy to the NRF network element, instructing the NRF network element to isolate the mutual discovery between NF and SMF1 and avoid SMF1 Establish a connection with NF.
  • the message can carry the NF identifier corresponding to SMF1.
  • the third network element is a PCF network element or an AMF network element
  • the SPF network element may send the first security policy to the PCF network element or the AMF network element for instructing to release the user session of the corresponding second network element.
  • the SPF network element can send the security policy message of the second network element to the PCF network element or directly to the corresponding AMF network element to instruct the release of the corresponding SMF1 user.
  • the SPF network element may directly send the security policy message of the second network element to the corresponding AMF network element to instruct the release of the user corresponding to the SMF1.
  • the third network element is an SDN network element
  • the SPF network element may also send a first security policy to the SDN network element to instruct the SDN network element to isolate the network segment corresponding to SMF1 at the routing level, so that the SPF network element Realize the isolation of SMF1 from network elements outside the 5G core network NF range.
  • the third network element receives the first security policy and executes the first security policy.
  • the SCP network element receives the first security policy, and according to the indicated first security policy, stops the message forwarding corresponding to SMF1, and can perform packet loss processing for the message sent by the second network element SMF1 that has been received.
  • the NRF network element rejects all discovery requests to other NFs initiated by the SMF1 according to the indicated first security policy, and does not return SMF1 as the discovery requests of other NFs to SMFs. Isolate the connection initiation between SMF1 and other NFs.
  • step 505c after the AMF network element accepts the first security policy of the SPF network element, it initiates connection release for the user session established by SMF1.
  • step 505d after receiving the first security policy, the SDN network element sends the configuration to the corresponding router, rejecting routing forwarding corresponding to the original address network segment or the target address network segment of the SMF1.
  • the following specific implementation method includes two main network functions, which can be deployed on one network element or separately, and is not limited here.
  • the first network element includes the functions of NWDAF, NWDAF network element, and security policy network element SPF network element.
  • the first network element is responsible for security data analysis and abnormal security event identification, and subscribes to the network.
  • the first network element is also responsible for determining the security policy of the security event and coordinating the handling of security abnormal events.
  • the SPF network element may not be deployed as a separate NF, but is embedded in the NWDAF network element as a function.
  • FIG. 6 it is a schematic flowchart of a network event processing method provided by an embodiment of this application. The method includes the following steps:
  • Step 601 The AMF network element sends message interaction behavior information to the NWDAF network element.
  • the message interaction behavior information may be a message that UE1 completes registration, or may be a service message of UE1 initiated by the UE.
  • the AMF network element can report the registered message interaction behavior information of the UE1 to the NWDAF network element through the event publishing service interface or the security log interface, indicating that the UE1 has been registered.
  • Step 602 The second network element sends a first message to the first network element.
  • the second network element is a network element that has been tampered with, and sends a service request to the first network element.
  • the second network element is SMF1
  • the user identity UE1 in SMF1 is tampered with the user identity UE2.
  • the specific tampering method may be that in the tampered first network element SMF1, there may be a processing module for charging messages that has been tampered with.
  • the processing module of the first network element SMF1 is injected with a malicious program, which can attack the user of the user. Identifies that the user ID in the charging bill generated by UE1 is modified to UE2.
  • the first message is a charging request message (Nchf_ConvergedCharging) sent by SMF1, and the charging request carries the tampered user identification (UE2).
  • Step 603 The CHF sends message interaction behavior information to the NWDAF network element.
  • the CHF may send the first message sent by the second network element to the NWDAF network element as message interaction behavior information.
  • the CHF may generate a charging bill for the user UE2 according to the charging request sent by the second network element.
  • the CHF may send the charging bill and the first message as message interaction behavior information to the NWDAF network element.
  • the charging bill may also be sent to the NWDAF network element as a message exchange behavior information, and used to instruct the first network element SMF1 to request a charging network behavior for the UE2.
  • Step 604 The NWDAF network element/SPF network element determines the network security abnormal event, and sends the first indication information to the PSF.
  • the NWDAF network element can determine whether there is an abnormal network security event of malicious theft based on the integrity of the UE2 charging message.
  • SMF1 may be hijacked.
  • the NWDAF network element may not be able to determine whether there is a malicious fraud based on the integrity of the billing message. Therefore, the NWDAF network element can be based on the same number of network elements involved. The related interactive messages of the user's conversation are compared to see if there are inconsistent messages, and then the tampered object is determined.
  • the first message may be a charging message involving SMF1 processing UE2
  • the second message may be a session message involving SMF1 processing UE2
  • the second message may be a session message involving other network elements processing UE2
  • the NWDAF network element It can be determined whether there is a network security abnormal event based on whether the first message is inconsistent with the second message. For example, if it is determined that the first network element does not report the second message that SMF1 processes the session service of UE2, the NWDAF network element can determine that SMF1 does not process the service of UE2, and can determine the network behavior of SMF1 requesting UE2 to generate a charging request There is an abnormal network security, and the session corresponding to UE2 is not processed by the first network element.
  • the key module of SMF1 may be invaded, making the key service data of the first network element billing data Has been tampered with.
  • the NWDAF network element may determine abnormal billing according to rule abnormalities, or use other AI algorithms such as big data, etc., to determine abnormal charging bills, and then determine abnormal network security events.
  • Step 605 The SPF network element determines a second security policy according to the network security event, and sends the second security policy to the fourth network element.
  • the SPF network element sends a second security policy to the AMF network element.
  • the second security policy is used to indicate that the UE1 user of SMF1 is abnormal. It is recommended that the AMF network element stop charging the abnormal user UE1 and release the corresponding user UE1. .
  • the message format of the second security policy may be the analysis service message (nwdaf_AnalyticsInfo) of the NWDAF network element or the security policy message (SecPolicy) of the SPF network element.
  • Step 605b The SPF network element sends the second security policy to the CHF, notifying the SMF1 that the charging message of the UE2 sent by the SMF1 is an abnormal charging message.
  • Step 605c The SPF network element sends a second security policy to the PCF network element to notify the UE1 of the abnormality, which is used to instruct the user of the UE1 to stop using the network or to stop the use of the specified session by the UE1.
  • the fourth network element receives the second security policy and executes the second security policy.
  • Step 606a The AMF network element may initiate a release message to UE1 according to the second security policy.
  • Step 606b The CHF stops the generation of the charging bill of the UE2 initiated by the SMF1 according to the second security policy.
  • Step 606c According to the second security policy, the PCF network element may stop the user of UE1 from using the network, or stop UE1 from using the specified session.
  • Step 607 The SPF network element determines the first security policy according to the network security event, and sends the first security policy to the third network element.
  • Step 607a The SPF network element sends the first security policy to the NRF network element.
  • the first security policy is used to indicate that the first network element SMF1 is abnormal, and the first network element SMF1 needs to be isolated.
  • Step 607 The third network element executes the first security policy according to the first security policy.
  • Step 608a The NRF network element can stop the mutual discovery between SMF1 and other network elements NF according to the security policy message.
  • the first security policy in the first embodiment can also be applied to this embodiment, and the specific selected solution can be determined according to the first security policy of the SPF network element.
  • the following specific implementation method includes two main network functions, which can be deployed on one network element, that is, the first network element includes NWDAF, NWDAF network element, security policy network element, SPF network element, and the first network element is responsible for Security data analysis and abnormal security event identification, and subscribe to the information of the corresponding network element.
  • the first network element is also responsible for policy determination and coordination of security incidents.
  • FIG. 7 it is a schematic flowchart of a network event processing method provided by an embodiment of this application. The method includes the following steps:
  • Step 701 SMF2 sends UE2's information query request to AMF network element.
  • SMF2 establishes a connection with the AMF network element by illegally obtaining the TLS certificate of SMF1, and sends a query request for the location information of UE2 to the AMF network element through the interface of the event publishing service of the AMF network element.
  • SMF2 illegally obtains the TLS authentication certificate of SMF1.
  • SMF1 was remotely controlled by hackers through the background, or an application injected by hackers through vulnerabilities, and then through the internal network of SMF1 infiltrated, SMF1's TLS certification certificate was obtained.
  • SMF2 can fake the identity of SMF1 and send a user information query request to the AMF network element, thereby illegally obtaining user information.
  • Step 702 The first network element AMF network element sends message interaction behavior information to the NWDAF network element.
  • the AMF network element can use the location information of UE2 sent to SMF2 as message interaction behavior information, and can also use the received query request of UE2 location information sent by SMF2 as message interaction behavior information, and report it to NWDAF periodically or in an event.
  • the message interaction behavior information may include: a query request for location information of UE2 sent by SMF2, IP address IP1 of SMF2, TLS certificate of SMF1, and so on.
  • the AMF network element sends the location information of UE2 to SMF2 according to the information query request of UE2.
  • the AMF network element may use the location information of the UE2 sent to the SMF2 as the message interaction behavior information, and report it to the NWDAF network element periodically or eventually.
  • Step 702a SMF1 sends message interaction behavior information to the NWDAF network element.
  • the NWDAF network element may also receive message interaction behavior information reported by SMF1 to the NWDAF network element, where the message interaction behavior information includes the identifier of SMF1, for example, the IP address IP1 of SMF1.
  • Step 703 The NWDAF network element determines a second network element with an abnormal network security event according to the message exchange behavior information.
  • the NWDAF network element may use the message interaction behavior information sent by the second network element AMF network element, and the message interaction behavior information reported by the SMF1 network element, the IP address of the requester SMF2 of the UE2 information query request, and the SMF1 to the NWDAF
  • the IP address of SMF1 in the message interaction behavior information reported by the network element is different. It can be confirmed that at least one SMF is an abnormal network element.
  • the second network element can be confirmed as SMF1 and SMF2.
  • the NWDAF network element may further compare whether there is inconsistent message interaction behavior information based on the query request sent by SMF2 for the UE and the query request sent by SMF1 for the UE, and then determine the abnormal network element.
  • the NWDAF network element determines that the SMF1 network element only requests the information of UE1 and does not send a query request for the location information of UE2. It can also be determined that the SMF2 network element has a network security abnormal event. The NWDAF network element may further determine that the second network element SMF2 corresponding to IP2 may be fake and the location information of UE2 may be leaked according to the message exchange behavior information reported by other network elements NF.
  • Step 704 The NWDAF network element sends first indication information to the SPF network element, which is used to indicate an abnormal network security event.
  • Step 705 The SPF network element receives the first indication information, and sends the second security policy to the fourth network element according to the first indication information.
  • the SPF network element may send the second security policy to the AMF network element.
  • the second security policy is used to indicate the information leakage of UE2, and instruct the AMF network element to stop or flow control the sending and receiving of messages of UE2.
  • the AMF network element can stop responding to the UE2 information query request according to the second security policy, or it can also be set to stop responding to the UE2 information query request from the abnormal network element request of SMF1 or SMF2, so as to avoid affecting other network elements. Normal business.
  • the fourth network element executes the second security policy according to the received second security policy.
  • the AMF network element stops sending user information of UE2 to SMF2 according to the second security policy, or the AMF network element stops sending location information of UE2 to SMF1 according to the second security policy.
  • the specific implementation mode can be determined according to the determined abnormal network element. For example, if the abnormal network element is determined to be SMF2, it can only stop sending UE2 user information to SMF2, and if it is determined that the abnormal network element is SMF2 or SMF1, it can stop sending to SMF1. Send UE2's user information with SMF2.
  • Step 707 The SPF network element sends the first security policy to the third network element according to the first instruction information.
  • Step 707a The SPF network element may send the first security policy to the SCP network element.
  • the first security policy is used to instruct the SCP network element to stop message forwarding to SMF1 or SMF2.
  • the SCP network element can determine the SMF2 network element according to the IP address carried in the message. For example, if the IP address carried in the message is IP2, it can be confirmed that the sender of the message is SMF2, so as to avoid interference caused by SMF2 carrying the certificate of SMF1 .
  • Step 707b The SPF network element may send the first security policy to the MANO network element of the virtual machine resource management center;
  • the first security policy is used to instruct the MANO network element to release the virtual machine of the SMF2 corresponding to IP2, thereby preventing network penetration and information theft of the second SMF network element SMF2.
  • the first network element executes the first security policy according to the received first security policy.
  • Step 708a The SCP network element stops the message forwarding of SMF1 or SMF2 according to the first security policy.
  • Step 708b The MANO network element releases the virtual machine of the second SMF network element SMF2 corresponding to IP2 according to the first security policy.
  • the first security policy in the first embodiment can also be applied to this embodiment, and the specific selected solution can be determined according to the first security policy of the SPF network element.
  • each network element described above includes hardware structures and/or software modules corresponding to each function.
  • the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered as going beyond the scope of the present invention.
  • the apparatus 800 may exist in the form of software or hardware.
  • the apparatus 800 may include: a processing unit 802 and a communication unit 801.
  • the communication unit 801 may include a receiving unit and a sending unit.
  • the processing unit 802 is used to control and manage the actions of the device 800.
  • the communication unit 801 is used to support communication between the device 800 and other network entities.
  • the processing unit 802 may be a processor or a controller, for example, a general-purpose central processing unit (central processing unit, CPU), a general-purpose processor, a digital signal processing (digital signal processing, DSP), and an application specific integrated circuit (application specific integrated circuit). circuits, ASIC), field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logical blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present application.
  • the processor may also be a combination for realizing computing functions, for example, including a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.
  • the communication unit 801 is an interface circuit of the device for receiving signals from other devices.
  • the communication unit 801 is an interface circuit for the chip to receive signals from other chips or devices, or an interface circuit for the chip to send signals to other chips or devices.
  • the device 800 may be the NWDAF network element or the SPF network element in the above-mentioned embodiment, and may also be a chip used for an NWDAF network element or a chip of an SPF network element.
  • the processing unit 802 may be a processor, for example, and the communication unit 801 may be a transceiver, for example.
  • the transceiver may include a radio frequency circuit, and the storage unit may be, for example, a memory.
  • the processing unit 802 may be, for example, a processor, and the communication unit 801 may be, for example, an input/output interface, a pin or a circuit, etc. .
  • the processing unit 802 can execute computer-executable instructions stored in the storage unit.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit can also be the data analysis network element or a security event processing unit.
  • the storage unit outside the chip in the SPF network element such as read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) )Wait.
  • the device 800 is the NWDAF network element in the foregoing embodiment.
  • the communication unit 801 is configured to obtain message interaction behavior information of K first network elements, and for one first network element among the K first network elements, the signaling interaction behavior information of the first network element It includes the attribute information used to indicate the message transmitted by the first network element; the K is a positive integer; the first indication information is sent to the SPF network element, and the first indication information is used to indicate the occurrence of the second network element The network security abnormal event.
  • the processing unit 802 is configured to determine, according to the message exchange behavior information of the K first network elements, that a network security abnormal event occurs in the second network element;
  • the device 800 is the NWDAF network element in the foregoing embodiment
  • a possible design is for one first network element among the K first network elements
  • the attributes of the message transmitted by the first network element Information includes one or more of the following: the type of the message, the message content of the message, the interface through which the message is transmitted on the first network element, and the interface through which the opposite end corresponding to the message transmits the message .
  • the processing unit 802 is configured to: if it is determined that the first network element receives more messages from the second network element than the first Threshold value, it is determined that there is a DDoS attack event of the second network element to the first network element; the first threshold value is determined according to the frequency of historical messages.
  • the message interaction behavior information of the K first network elements includes: a first message and a second message; the processing unit 802 uses If it is determined that the first identity of the second network element in the first message is inconsistent with the second identity of the second network element in the second message, it is determined that the second network element has network security Abnormal event.
  • the message interaction behavior information of the K first network elements includes: the first UE from the K first network elements
  • the processing unit 802 is configured to determine that the first UE has an abnormal network security event if it is determined that the interactive behavior message of the first UE is inconsistent.
  • the message exchange behavior information of the K first network elements includes: second UEs from the K first network elements And the user information query request of the second UE from the second network element; the processing unit 802 is configured to, if it is determined that the user information query request of the second UE from the second network element, the If the network element identifiers in the second network element are inconsistent, it is determined that at least two network elements corresponding to the inconsistent network element identifiers have a network security abnormal event.
  • the device 800 is the SPF network element in the foregoing embodiment.
  • the communication unit 801 is configured to receive first indication information sent by a NWDAF network element, where the first indication information is used to indicate that a network security abnormal event occurs in the second network element;
  • a third network element of the third network element sends a first security policy corresponding to the third network element to the third network element, and the first security policy corresponding to the third network element includes instructions for instructing the third network element Indicating information for the element to isolate the service corresponding to the second network element.
  • the processing unit 802 is configured to determine, according to the first indication information, N third network elements that have an association relationship with the second network element; for one third network element among the N third network elements , The third network element has the ability to process the service of the second network element.
  • the communication unit 801 is configured to perform one or more of the following:
  • the third network element is an AMF network element, and sends a first security policy corresponding to the AMF network element to the AMF network element, and the first security policy corresponding to the AMF network element includes instructions for instructing the AMF network element Instruction information to stop processing the message of the second network element;
  • the third network element is an SCP network element, and the first security policy corresponding to the SCP network element is sent to the SCP network element, and the SCP network element
  • the first security policy corresponding to the element includes instructions for instructing the SCP network element to stop forwarding messages to the second network element;
  • the third network element is an NRF network element, and sends the NRF network element to the NRF network element.
  • a first security policy corresponding to the element includes instructions for instructing the NRF network element to stop user authorization to the second network element;
  • the third network element is an SDN network element , Sending a first security policy corresponding to the SDN network element to the SDN network element, where the first security policy corresponding to the SDN network element includes instructions for instructing the SDN network element to stop accessing the network of the second network element.
  • the third network element is a MANO network element, and the first security policy corresponding to the MANO network element is sent to the MANO network element, and the first security policy corresponding to the MANO network element includes using Instructing the MANO network element to release the virtual machine corresponding to the second network element;
  • the third network element is an AMF network element, and the first security policy corresponding to the AMF network element is sent to the AMF network element, so The first security policy corresponding to the AMF network element includes instructions for instructing the AMF network element to release the user bound to the second network element.
  • the first indication information is also used to indicate the abnormal service corresponding to the network security abnormal event;
  • the processing unit 802 is configured to The first indication information determines M fourth network elements that have an association relationship with the second network element; for one fourth network element among the M fourth network elements, the fourth network element Have the ability to process the abnormal service; for a fourth network element among the M fourth network elements, the communication unit 801 is configured to send the fourth network element to the fourth network element
  • the second security policy corresponding to the fourth network element includes instruction information for instructing the fourth network element to stop or cancel the processing of the abnormal service.
  • the communication unit 801 is configured to perform at least one of the following:
  • the fourth network element is an AMF network element, and sends a second security policy corresponding to the AMF network element to the AMF network element, and the second security policy corresponding to the AMF network element includes instructions for instructing the fourth network Element to stop executing the abnormal service request;
  • the fourth network element is an AMF network element or a PCF network element, F sends the second security policy corresponding to the AMF network element to the AMF network element, and the AMF network element
  • the corresponding second security policy includes instructions for instructing the AMF network element to release the user corresponding to the abnormal service; or, sending the second security policy corresponding to the PCF network element to the PCF network element, and the PCF network element
  • the corresponding second security policy includes instructions for instructing the PCF network element to release the user corresponding to the abnormal service;
  • the fourth network element is an SCP network element, and the first network element corresponding to the SCP network element is sent to the SCP network element A second security policy.
  • the second security policy corresponding to the SCP network element includes instructions for instructing the SCP network element to stop forwarding messages to the second network element;
  • the fourth network element is an NRF network element, The NRF network element sends a second security policy corresponding to the NRF network element, and the second security policy corresponding to the NRF network element includes instructions for instructing the NRF network element to stop authorizing users of the second network element;
  • the fourth network element is an SDN network element, and sends a second security policy corresponding to the SDN network element to the SDN network element.
  • the second security policy corresponding to the SDN network element includes instructions for instructing the SDN network element to stop Routing and forwarding of the message of the network segment of the second network element.
  • the device may be the NWDAF network element and/or the SPF network element in the foregoing embodiment.
  • the device 900 includes a processor 902 and a communication interface 903.
  • the device 900 may further include a memory 901.
  • the apparatus 900 may further include a communication line 904.
  • the communication interface 903, the processor 902, and the memory 901 may be connected to each other through a communication line 904;
  • the communication line 904 may be a peripheral component interconnection standard (peripheral component interconnect, PCI for short) bus or an extended industry standard architecture (extended industry standard architecture) , Referred to as EISA) bus and so on.
  • the communication line 904 can be divided into an address bus, a data bus, a control bus, and so on. For ease of representation, only one thick line is used in FIG. 9, but it does not mean that there is only one bus or one type of bus.
  • the processor 902 may be a CPU, a microprocessor, an ASIC, or one or more integrated circuits used to control program execution of the solutions of the embodiments of the present application.
  • the processor 902 may be configured to determine, according to the message interaction behavior information of the K first network elements, that a network security abnormal event has occurred in the second network element; the network data analysis function network element sends the first indication information to the SPF network element, The first indication information is used to indicate the occurrence of the network security abnormal event in the second network element; and/or, according to the first indication information, determine N associations with the second network element
  • the third network element for one third network element among the N third network elements, the third network element has the ability to process services of the second network element; for the N third network elements A third network element among the network elements.
  • the communication interface 903 uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), Wired access network, etc.
  • RAN radio access network
  • WLAN wireless local area networks
  • Wired access network etc.
  • the communication interface 903 may be used to obtain message interaction behavior information of K first network elements.
  • the message interaction behavior information of the first network element includes Is used to indicate the attribute information of the message transmitted by the first network element; the K is a positive integer; or, it is used to receive the first indication information sent by the network data analysis function network element, and the first indication information is used to indicate all A network security abnormal event occurs in the second network element; the SPF network element sends the first security policy corresponding to the third network element to the third network element, and the third network element corresponds to The first security policy includes instruction information for instructing the third network element to isolate the service corresponding to the second network element.
  • the memory 901 may be ROM or other types of static storage devices that can store static information and instructions, RAM or other types of dynamic storage devices that can store information and instructions, or may be electrically erasable programmable read-only memory (electrically erasable programmable read-only memory).
  • read-only memory EEPROM
  • compact disc read-only memory, CD-ROM
  • optical disc storage including compact discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.
  • magnetic disks A storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.
  • the memory may exist independently, and is connected to the processor through a communication line 904. The memory can also be integrated with the processor.
  • the memory 901 is used to store computer-executed instructions for executing the solutions of the embodiments of the present application, and the processor 902 controls the execution.
  • the processor 902 is configured to execute computer-executable instructions stored in the memory 901, so as to implement the network event processing method provided in the foregoing embodiments of the embodiments of the present application.
  • the computer-executable instructions in the embodiments of the present application may also be referred to as application program codes, which are not specifically limited in the embodiments of the present application.
  • a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • words such as “first” and “second” are used to distinguish the same or similar items with substantially the same function and effect. Those skilled in the art can understand that words such as “first” and “second” do not limit the quantity and order of execution, and words such as “first” and “second” do not limit the difference.
  • words such as “exemplary” or “for example” are used as examples, illustrations, or illustrations. Any embodiment or design solution described as “exemplary” or “for example” in the embodiments of the present application should not be construed as being more preferable or advantageous than other embodiments or design solutions. To be precise, words such as “exemplary” or “for example” are used to present related concepts in a specific manner to facilitate understanding.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • the various illustrative logic units and circuits described in the embodiments of this application can be implemented by general-purpose processors, digital signal processors, application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, Discrete gates or transistor logic, discrete hardware components, or any combination of the above are designed to implement or operate the described functions.
  • the general-purpose processor may be a microprocessor.
  • the general-purpose processor may also be any traditional processor, controller, microcontroller, or state machine.
  • the processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration. accomplish.
  • the steps of the method or algorithm described in the embodiments of the present application can be directly embedded in hardware, a software unit executed by a processor, or a combination of the two.
  • the software unit can be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM or any other storage medium in the art.
  • the storage medium may be connected to the processor, so that the processor can read information from the storage medium, and can store and write information to the storage medium.
  • the storage medium may also be integrated into the processor.
  • the processor and the storage medium can be arranged in the ASIC.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种网络事件处理方法、装置及可读存储介质，该方法包括：安全事件处理功能网元接收数据分析网元发送的第一指示信息，第一指示信息用于指示第二网元发生网络安全异常事件；安全事件处理功能网元根据第一指示信息，确定出与第二网元具有关联关系的N个第三网元；针对N个第三网元中的一个第三网元，第三网元具有对第二网元的业务进行处理的能力；针对N个第三网元中的一个第三网元，安全事件处理功能网元向第三网元发送第三网元对应的第一安全策略，第三网元对应的第一安全策略中包括用于指示第三网元停止对第二网元的业务进行处理的指示信息。

Description

一种网络事件处理方法、装置及可读存储介质
相关申请的交叉引用
本申请要求在2020年01月31日提交中国专利局、申请号为202010077699.7、申请名称为“一种网络事件处理方法、装置及可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及移动通信技术领域，尤其涉及一种网络事件处理方法、装置及可读存储介质。
背景技术
随着第五代移动通信技术(5th generation mobile networks，5G)应用到垂直行业的业务，包括医疗健康、智能家具和智能交通等，5G核心网由于引入的很多IT技术，如虚拟化平台，容器平台，越来越多的开源第三方IT组件的应用，再加上多方供应商的共同参与组网，5G网络承载的业务价值越来越高，将会吸引越来越专业的黑客或国家级网络部队对5G网络发起渗透、潜伏和攻击。
第三代合作伙伴计划(3rd generation partnership project，3GPP)规范，在5G网络架构中的网络数据分析功能(NetWork Data Analysis Function，NWDAF)网元可以进行网络数据分析。网络数据分析功能可以从网络功能网元(network function，NF)网元以及操作管理维护(Operation,Administration,and Maintenance，OAM)系统获取数据，经过分析处理，将结果提供给NF网元、应用功能(application function，AF)使用。
目前通过NWDAF网元进行网络安全的分析只包括对异常用户识别分析服务，例如，NWDAF网元收到第一网元订阅异常用户的识别服务，NWDAF网元可以根据该订阅，向对应的网元，例如，接入与移动性管理功能(access and mobility management function，AMF)网元和会话管理功能(session management function，SMF)网元等，采集用户的会话消息和计费消息等信息，进而NWDAF网元可以根据采集的用户的会话消息和计费消息，确定是否有异常用户。在确定有异常用户时，NWDAF网元可以向订阅异常用户的第一网元发送异常用户的通知消息，进而第一网元可以根据该通知消息对异常用户进行处理。
但是，上述方法中，仅能分析出用户发生异常的事件，且也仅是针对订阅异常用户的网元进行异常用户的通知，可以看出，现有针对网络异常事件的处理方案较为单一，网络安全性较差。
发明内容
本申请实施例提供一种网络事件处理方法、装置及可读存储介质，用以当第二网元发生网络异常事件，则确定第二网元相关的N个第三网元，以使N个第三网元对第二网元对应的业务进行隔离处理，如此，可以对网络异常事件所关联网元均进行处理，从而对网络的安全隐患进行更全面的处理，从而可以提高网络的安全性。
第一方面，本申请实施例提供一种网络事件处理方法，包括：安全事件处理功能网元接收网络数据分析功能网元发送的第一指示信息，所述第一指示信息用于指示所述第二网元发生网络安全异常事件；所述安全事件处理功能网元根据所述第一指示信息，确定出与所述第二网元具有关联关系的N个第三网元；针对所述N个第三网元中的一个第三网元，所述第三网元具有对所述第二网元的业务进行处理的能力；针对所述N个第三网元中的一个第三网元，所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，所述第三网元对应的第一安全策略中包括用于指示所述第三网元对所述第二网元对应的业务进行隔离的指示信息。
通过上述方法，安全事件处理功能网元获取网络数据分析功能网元发送的网络安全异常事件，确认第二网元发送安全异常，进而安全事件处理功能网元根据第二网元，确认与第二网元具有关联关系的第三网元，例如，可以为与第二网元发生信令交互的网元，也可以是为第二网元提供服务的网元，通过向第三网元发送对应的第一安全策略，使得第三网元对第二网元的相关业务进行隔离，相比现有技术仅发送给订阅安全事件的网元的处理方式，可以更加全面的隔离第二网元产生的网络异常事件对网络的影响，进而提高网络的安全性。
在一种可能的实现方式中，所述第三网元为所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，包括所述安全事件处理功能网元向所述AMF网元发送所述接入与移动性管理功能网元对应的第一安全策略，所述接入与移动性管理功能网元对应的第一安全策略包括用于指示所述接入与移动性管理功能网元对所述第二网元对应的业务进行隔离的指示信息。接入与移动性管理功能网元对所述第二网元对应的业务进行隔离具体可以是指接入与移动性管理功能网元不再对第二网元发来的消息进行处理，从而可以避免接入与移动性管理功能网元对发生网络安全异常事件的第二网元的消息进行处理所导致的网络安全事件的发生，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，包括，所述安全事件处理功能网元向消息转发网元发送所述消息转发网元对应的第一安全策略，所述消息转发网元对应的第一安全策略包括用于指示所述消息转发网元停止对所述第二网元的消息转发的指示信息。进而，可以使得消息转发网元不再对第二网元的消息进行转发，从而可以避免消息转发网元对发生网络安全异常事件的第二网元的消息进行转发所导致第二网元的网络安全事件的扩散，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，包括所述安全事件处理功能网元向所述网络仓库功能(network function repository function，NRF)网元发送所述NRF网元对应的第一安全策略，所述NRF网元对应的第一安全策略包括用于指示所述NRF网元不再对所述第二网元的用户授权指示信息，和/或，撤销所述第二网元的用户的授权指示信息；进而，可以使得NRF网元停止或撤销对第二网元的用户授权，从而可以避免第二网元的用户所导致第二网元的网络安全事件的发生，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，包括，所述安全事件处理功能网元向所述路由传输控制器发送所述路由传输控制器对应的第一安全策略，所述路由传输控制器对应的第一安全策略包括 用于指示所述路由传输控制器网元忽略对所述第二网元的网段的消息的路由转发请求的指示信息；进而，可以使得路由传输控制器停止对第二网元的网段的消息的路由转发，从而可以避免路由传输控制器对发生网络安全事件的第二网元的消息的路由转发所导致第二网元的网络安全事件的发生，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，包括所述安全事件处理功能网元向所述虚拟化资源管理网元发送所述虚拟化资源管理网元对应的第一安全策略，所述虚拟化资源管理网元对应的第一安全策略包括用于指示所述虚拟化资源管理网元释放所述第二网元对应的虚拟机的指示信息。进而，可以使得虚拟化资源管理网元释放第二网元对应的虚拟机，从而可以停止第二网元的虚拟机的运行，以避免第二网元的网络安全事件的发生，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，包括所述安全事件处理功能网元向所述接入与移动性管理功能网元发送所述接入与移动性管理功能网元对应的第一安全策略，所述接入与移动性管理功能网元对应的第一安全策略包括用于指示所述接入与移动性管理功能网元释放所述第二网元所绑定的用户的指示信息。进而，可以使得接入与移动性管理功能网元释放第二网元的用户，从而可以避免第二网元的用户所导致第二网元的网络安全事件的发生，可以进一步提高网络安全性。
一种可能的设计，所述第一指示信息还用于指示所述网络安全异常事件对应的异常业务；所述安全事件处理功能网元根据所述第一指示信息，确定出与所述第二网元具有关联关系的M个第四网元；针对所述M个第四网元中的一个第四网元，所述第四网元具有对所述异常业务进行处理的能力；所述安全事件处理功能网元向所述第四网元发送所述第四网元对应的第二安全策略，所述第四网元对应的第二安全策略中包括用于指示所述第四网元停止或撤销对所述异常业务进行处理的指示信息。
上述方法中，通过网络安全异常事件对应的异常业务，确定异常业务涉及的第四网元，进而向第四网元发送对应的第二安全策略，使得第四网元对第二网元涉及的异常业务进行有效隔离，减少异常网元产生的异常业务对网络性能的影响。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第四网元发送所述第四网元对应的第二安全策略，包括所述安全事件处理功能网元向所述接入与移动性管理功能网元发送所述接入与移动性管理功能网元对应的第二安全策略，所述接入与移动性管理功能网元对应的第二安全策略包括用于指示所述第四网元对所述第二网元的异常业务进行隔离的指示信息；如此可以使接入与移动性管理功能网元不再对第二网元的异常业务进行处理，从而可以避免接入与移动性管理功能网元对发生网络安全异常事件的第二网元的异常业务进行处理所导致的网络安全事件的发生，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第四网元发送所述第四网元对应的第二安全策略，包括所述安全事件处理功能网元向所述接入与移动性管理功能网元发送所述接入与移动性管理功能网元对应的第二安全策略，所述接入与移动性管理功能网元对应的第二安全策略包括用于指示所述接入与移动性管理功能网元释放所述异常业务对应的用户的指示信息；如此可以使接入与移动性管理功能网元释放第二网元的异常业务对应的用户，从而可以避免第二网元的异常业务对应的用户所导致的网络安全事件的 发生，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第四网元发送所述第四网元对应的第二安全策略，包括所述安全事件处理功能网元向所述策略控制功能(policy control function，PCF)网元发送所述PCF网元对应的第二安全策略，所述PCF网元对应的第二安全策略包括用于指示所述PCF网元释放所述异常业务对应的用户的指示信息；如此可以使PCF网元释放第二网元的异常业务对应的用户，从而可以避免第二网元的异常业务对应的用户所导致的网络安全事件的发生，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第四网元发送所述第四网元对应的第二安全策略，包括所述安全事件处理功能网元向所述消息转发网元发送所述消息转发网元对应的第二安全策略，所述消息转发网元对应的第二安全策略包括用于指示所述消息转发网元忽略对所述第二网元的异常业务的消息转发请求的指示信息；进而，可以使得消息转发网元忽略对第二网元的异常业务的消息转发请求的指示信息，从而可以避免消息转发网元对发生网络安全事件的第二网元的异常业务的消息的转发所导致异常业务的网络安全事件的发生，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第四网元发送所述第四网元对应的第二安全策略，包括所述安全事件处理功能网元向所述NRF网元发送所述NRF网元对应的第二安全策略，所述NRF网元对应的第二安全策略包括用于指示所述NRF网元停止或撤销对所述第二网元的异常业务的用户授权的指示信息；如此可以使NRF网元停止或释放第二网元的异常业务对应的用户的授权，从而可以避免第二网元的异常业务对应的用户所导致的网络安全事件的发生，可以进一步提高网络安全性。
在一种可能的实现方式中，所述安全事件处理功能网元向所述第四网元发送所述第四网元对应的第二安全策略，包括所述安全事件处理功能网元向所述路由传输控制器发送所述路由传输控制器对应的第二安全策略，所述路由传输控制器对应的第二安全策略包括用于指示所述路由传输控制器忽略对所述第二网元的网段的消息的路由转发请求的指示信息。进而，可以使得路由传输控制器忽略对第二网元的异常业务的消息路由转发请求的指示信息，从而可以避免路由传输控制器对发生网络安全事件的第二网元的异常业务的消息的路由转发所导致异常业务的网络安全事件的发生，可以进一步提高网络安全性。
第二方面，本申请提供一种网络事件处理方法，网络数据分析功能网元获取K个第一网元的消息交互行为信息，针对所述K个第一网元中的一个第一网元，所述第一网元的消息交互行为信息包括用于指示所述第一网元传输的消息的属性信息；所述K为正整数；所述网络数据分析功能网元根据所述K个第一网元的消息交互行为信息，确定出第二网元发生网络安全异常事件；所述网络数据分析功能网元向安全事件处理功能网元发送第一指示信息，所述第一指示信息用于指示所述第二网元发生所述网络安全异常事件。
相比现有技术，通过增加K个第一网元的消息交互行为信息的获取服务，使得NDWAF网元可以获取各网元的消息交互行为信息，进而通过对第一网元传输的消息的属性信息进行分析，确定出第二网元发生网络安全异常事件，相比现有技术中只能识别用户的异常行为，本申请实施例的方法中可以获取网元的网络安全异常事件，进而有效的发现现有技术中无法发现的网络安全异常的情况，以提高网络的安全性。
一种可能的设计，针对所述K个第一网元中的一个第一网元，所述第一网元传输的消息的属性信息，包括以下一项或多项：所述消息的类型、所述消息的消息内容、所述第一 网元上传输所述消息的接口、所述消息对应的对端传输所述消息的接口。进而，第一网元向网络数据分析功能网元传输的消息的属性信息可以包括网元间交互时产生的消息对应的相关信息，进而，网络数据分析功能网元可以根据网元间交互时产生的消息对应的相关信息，对网元间是否发送网络安全异常事件作出判断，以有效的识别出是否发生网络安全异常事件。
一种可能的设计，所述数据分析网元若确定所述第一网元接收到来自第二网元的消息的数量大于第一阈值，则确定存在所述第二网元对所述第一网元的分布式拒绝服务(distributed denial of service,DDoS)攻击事件；所述第一阈值为根据历史消息频率确定的。
通过上述方法，网络数据分析功能网元根据第一网元接收到的第二网元的消息的数量，确定发生异常，进而可以确定出第二网元为异常网元，以及识别出第二网元发生DDoS攻击事件，从而可以指示SPF针对第二网元发生的DDoS攻击的网络安全异常事件进行对应的处理，从而提高网络安全性。
一种可能的设计，所述K个第一网元的消息交互行为信息包括：第一消息和第二消息；所述数据分析网元若确定所述第一消息中的第二网元的第一身份标识与所述第二消息中所述第二网元的第二身份标识不一致，则确定所述第二网元存在网络安全异常事件。进而，网络数据分析功能网元根据不同消息中携带的第二网元的身份标识不一致，可以确定第二网元存在网络安全异常事件，从而可以指示SPF针对第二网元携带的第二网元的身份标识不一致的网络安全异常事件进行对应的处理，从而提高网络安全性。
一种可能的设计，所述K个第一网元的消息交互行为信息包括：来自所述K个第一网元的第一终端设备(user equipment,UE)的交互行为消息；所述数据分析网元若确定来自第二网元的所述第一UE的交互行为消息不一致，则确定来自第二网元的所述第一UE存在网络安全异常事件。进而，网络数据分析功能网元根据不同消息中第一UE相关的交互行为消息中存在无法对应的消息，可以确定第一UE存在网络安全异常事件，另外由于第一UE的交互行为消息来自于第二网元，进而可以确定第二网元存在网络安全异常事件，从而可以指示SPF针对第二网元的第一UE的交互行为消息不一致的网络安全异常事件进行对应的处理，从而提高网络安全性。
一种可能的设计，所述K个第一网元的消息交互行为信息包括：来自所述K个第一网元的第二UE的交互行为消息和来自第二网元的所述第二UE的用户信息查询请求；所述数据分析网元若确定来自第二网元的所述第二UE的用户信息查询请求中，所述第二网元中的网元标识不一致，则确定所述网元标识不一致对应的至少两个网元发生网络安全异常事件。网络数据分析功能网元根据不同消息中相同UE涉及的网元的网元标识不一致，确定涉及的网元存在网络安全异常事件，从而可以指示SPF针对涉及的网元的网元标识不一致的网络安全异常事件进行对应的处理，从而提高网络安全性。
第三方面，提供了一种通信装置用于实现上述各种方法。该通信装置可以为上述第一方面中的安全事件处理功能网元，或者包含上述安全事件处理功能网元的装置；或者，该通信装置可以为上述第二方面中的网络数据分析功能网元，或者包含上述网络数据分析功能网元的装置。该通信装置包括实现上述方法相应的模块、单元、或手段(means)，该模块、单元、或means可以通过硬件实现，软件实现，或者通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块或单元。
第六方面，提供了一种通信装置，包括：处理器和存储器；该存储器用于存储计算机 指令，当该处理器执行该指令时，以使该通信装置执行上述任一方面所述的方法。该通信装置可以为上述第一方面中的安全事件处理功能网元，或者包含上述安全事件处理功能网元的装置；或者，该通信装置可以为上述第二方面中的网络数据分析功能网元，或者包含上述网络数据分析功能网元的装置。
第七方面，提供了一种通信装置，包括：处理器；该处理器用于与存储器耦合，并读取存储器中的指令之后，根据该指令执行如上述任一方面所述的方法。该通信装置可以为上述第一方面中的安全事件处理功能网元，或者包含上述安全事件处理功能网元的装置；或者，该通信装置可以为上述第二方面中的网络数据分析功能网元，或者包含上述网络数据分析功能网元的装置。
第八方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机可以执行上述任一方面所述的方法。
第九方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述任一方面所述的方法。
第十方面，提供了一种通信装置(例如，该通信装置可以是芯片或芯片系统)，该通信装置包括处理器，用于实现上述任一方面中所涉及的功能。在一种可能的设计中，该通信装置还包括存储器，该存储器，用于保存必要的程序指令和数据。该通信装置是芯片系统时，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第五方面至第十方面中任一种设计方式所带来的技术效果可参见上述第一方面或第二方面中不同设计方式所带来的技术效果，此处不再赘述。
第十一方面，提供了一种通信系统，该通信系统包括：安全事件处理功能网元接收网络数据分析功能网元发送的第一指示信息，所述第一指示信息用于指示所述第二网元发生网络安全异常事件；所述安全事件处理功能网元根据所述第一指示信息，确定出与所述第二网元具有关联关系的N个第三网元；针对所述N个第三网元中的一个第三网元，所述第三网元具有对所述第二网元的业务进行处理的能力；针对所述N个第三网元中的一个第三网元，所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，所述第三网元对应的第一安全策略中包括用于指示所述第三网元对所述第二网元对应的业务进行隔离的指示信息。网络数据分析功能网元获取K个第一网元的消息交互行为信息，针对所述K个第一网元中的一个第一网元，所述第一网元的消息交互行为信息包括用于指示所述第一网元传输的消息的属性信息；所述K为正整数；所述网络数据分析功能网元根据所述K个第一网元的消息交互行为信息，确定出第二网元发生网络安全异常事件；所述网络数据分析功能网元向安全事件处理功能网元发送第一指示信息，所述第一指示信息用于指示所述第二网元发生所述网络安全异常事件。其中，第十一方面所带来的技术效果可参见上述第一方面或第二方面中所带来的技术效果，此处不再赘述。
附图说明
图1为本申请提供的一种网络架构示意图；
图2为基于服务化架构的5G网络架构示意图；
图3为基于点对点接口的5G网络架构示意图；
图4为本申请提供的一种网络事件处理方法流程示意图；
图5为本申请提供的一种网络事件处理方法流程示意图；
图6为本申请提供的一种网络事件处理方法流程示意图；
图7为本申请提供的一种网络事件处理方法流程示意图；
图8为本申请提供的一种网络事件处理装置示意图；
图9为本申请提供的一种网络事件处理装置示意图。
具体实施方式
图1示例性示出了本申请实施例提供的一种通信系统10。如图1所示，该通信系统10包括网络数据分析功能网元101和安全事件处理功能网元102。该网络数据分析功能网元101和安全事件处理功能(security policy function,SPF)网元102之间可以直接通信，也可以通过其他设备的转发进行通信，本申请实施例对此不做具体限定。
如图1所示，网络数据分析功能网元101，用于获取K个第一网元的消息交互行为信息，针对所述K个第一网元中的一个第一网元，所述第一网元的消息交互行为信息包括用于指示所述第一网元传输的消息的属性信息；所述K为正整数；所述网络数据分析功能网元根据所述K个第一网元的消息交互行为信息，确定出第二网元发生网络安全异常事件；所述网络数据分析功能网元向SPF网元发送第一指示信息，所述第一指示信息用于指示所述第二网元发生所述网络安全异常事件。
安全事件处理功能网元102，用于接收网络数据分析功能网元发送的第一指示信息，所述第一指示信息用于指示所述第二网元发生网络安全异常事件；所述SPF网元根据所述第一指示信息，确定出与所述第二网元具有关联关系的N个第三网元；针对所述N个第三网元中的一个第三网元，所述第三网元具有对所述第二网元的业务进行处理的能力；针对所述N个第三网元中的一个第三网元，所述SPF网元向所述第三网元发送所述第三网元对应的第一安全策略，所述第三网元对应的第一安全策略中包括用于指示所述第三网元对所述第二网元对应的业务进行隔离的指示信息。
其中，上述方案的具体实现将在后续方法实施例中详细阐述，在此不予赘述。
基于本申请实施例提供的通信系统，相比现有技术，通过增加K个第一网元的消息交互行为信息的获取服务，使得网络数据分析功能网元可以获取各网元的消息交互行为信息，进而通过对第一网元传输的消息的属性信息进行分析，确定出第二网元发生网络安全异常事件，相比现有技术中只能识别用户的异常行为，本申请实施例的方法中可以获取网元的网络安全异常事件，进而有效的发现现有技术中无法发现的网络安全异常的情况，安全事件处理功能网元获取网络数据分析功能网元101发送的网络安全异常事件，确认第二网元发送安全异常，进而安全事件处理功能网元根据第二网元，确认与第二网元具有关联关系的第三网元，例如，可以为与第二网元发生信令交互的网元，也可以是为第二网元提供服务的网元，通过向第三网元发送对应的第一安全策略，使得第三网元对第二网元的相关业务进行隔离，相比现有技术仅发送给订阅安全事件的网元的处理方式，可以更加全面的隔离第二网元产生的网络异常事件对网络的影响，进而提高网络的安全性。
本申请实施例的系统架构可以应用于5G网络架构，图2和图3示例性示出了本申请实施例的通信系统10应用于5G网络架构的示意图。下面结合图2和图3，对系统架构中的相关网元进行介绍。
终端设备，可以是用于实现无线通信功能的设备，例如终端或者可用于终端中的芯片等。其中，终端可以是5G网络或者未来演进的PLMN中的用户设备(user equipment，UE)、 接入终端、终端单元、终端站、移动站、移动台、远方站、远程终端、移动设备、无线通信设备、终端代理或终端装置等。接入终端可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备或可穿戴设备，虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。终端可以是移动的，也可以是固定的。
上述终端设备可通过运营商网络提供的接口(例如N1等)与运营商网络建立连接，使用运营商网络提供的数据和/或语音等服务。终端设备还可通过运营商网络访问DN，使用DN上部署的运营商业务，和/或第三方提供的业务。其中，上述第三方可为运营商网络和终端设备之外的服务方，可为终端设备提供他数据和/或语音等服务。其中，上述第三方的具体表现形式，具体可根据实际应用场景确定，在此不做限制。
RAN是运营商网络的子网络，是运营商网络中业务节点与终端设备之间的实施系统。终端设备要接入运营商网络，首先是经过RAN，进而可通过RAN与运营商网络的业务节点连接。本申请中的RAN设备，是一种为终端设备提供无线通信功能的设备，RAN设备也称为接入网设备。本申请中的RAN设备包括但不限于：5G中的下一代基站(gnodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。为方便说明，本申请中将RAN设备简称为RAN。
可选的，本申请实施例中的RAN设备指的是接入核心网的设备，例如可以是基站，宽带网络业务网关(broadband network gateway，BNG)，汇聚交换机，非第三代合作伙伴计划(3rd generation partnership project，3GPP)接入设备等。基站可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。
AMF网元，接入和移动性管理功能，主要支持终端的注册管理、连接性管理以及移动性管理等功能，是由运营商网络提供的控制面网元，负责终端设备接入运营商网络的接入控制和移动性管理，例如包括移动状态管理，分配用户临时身份标识，认证和授权用户等功能。
SMF网元，会话管理功能，主要支持会话建立，修改和释放等功能，此外还负责UE IP地址分配和管理、UPF选择和控制、UPF和AN节点之间的隧道维护业务和会话连续性(Service and Session Continuity，SSC)模式选择、漫游等会话相关的功能。是由运营商网络提供的控制面网元，负责管理终端设备的协议数据单元(protocol data unit，PDU)会话。PDU会话是一个用于传输PDU的通道，终端设备需要通过PDU会话与DN互相传送PDU。PDU会话由SMF网元负责建立、维护和删除等。
UPF网元，用户平面功能，主要负责数据报文的分组路由和转发。是由运营商提供的网关，是运营商网络与DN通信的网关。UPF网元包括数据包路由和传输、包检测、业务 用量上报、服务质量(Quality of Service,QoS)处理、合法监听、上行包检测、下行数据包存储等用户面相关的功能。
DN，也可以称为分组数据网络(packet data network，PDN)，是位于运营商网络之外的网络，运营商网络可以接入多个DN，DN上可部署多种业务，可为终端设备提供数据和/或语音等服务。例如，DN是某智能工厂的私有网络，智能工厂安装在车间的传感器可为终端设备，DN中部署了传感器的控制服务器，控制服务器可为传感器提供服务。传感器可与控制服务器通信，获取控制服务器的指令，根据指令将采集的传感器数据传送给控制服务器等。又例如，DN是某公司的内部办公网络，该公司员工的手机或者电脑可为终端设备，员工的手机或者电脑可以访问公司内部办公网络上的信息、数据资源等。
UDM网元，是由运营商提供的控制面网元，负责存储运营商网络中签约用户的用户永久标识符(subscriber permanent identifier，SUPI)、信任状(credential)、安全上下文(security context)、签约数据等信息。UDM网元所存储的这些信息可用于终端设备接入运营商网络的认证和授权。其中，上述运营商网络的签约用户具体可为使用运营商网络提供的业务的用户，例如使用中国电信的手机芯卡的用户，或者使用中国移动的手机芯卡的用户等。上述签约用户的永久签约标识(Subscription Permanent Identifier，SUPI)可为该手机芯卡的号码等。上述签约用户的信任状、安全上下文可为该手机芯卡的加密密钥或者跟该手机芯卡加密相关的信息等存储的小文件，用于认证和/或授权。上述安全上下文可为存储在用户本地终端(例如手机)上的数据(cookie)或者令牌(token)等。上述签约用户的签约数据可为该手机芯卡的配套业务，例如该手机芯卡的流量套餐或者使用网络等。需要说明的是，永久标识符、信任状、安全上下文、认证数据(cookie)、以及令牌等同认证、授权相关的信息，在本发明本申请文件中，为了描述方便起见不做区分、限制。如果不做特殊说明，本申请实施例将以用安全上下文为例进行来描述，但本申请实施例同样适用于其他表述方式的认证、和/或授权信息。
AUSF网元，认证服务器功能，支持用户的接入认证。是由运营商提供的控制面网元，通常可用于一级认证，即终端设备(签约用户)与运营商网络之间的认证。AUSF网元接收到签约用户发起的认证请求之后，可通过UDM网元中存储的认证信息和/或授权信息对签约用户进行认证和/或授权，或者通过UDM网元生成签约用户的认证和/或授权信息。AUSF网元可向签约用户反馈认证信息和/或授权信息。
NEF网元，是由运营商提供控制面网元。NEF网元以安全的方式对第三方开放运营商网络的对外接口。在SMF网元需要与第三方的网元通信时，NEF网元可作为SMF网元与第三方的网元通信的中继。NEF网元作为中继时，可作为签约用户的标识信息的翻译，以及第三方的网元的标识信息的翻译。比如，NEF将签约用户的SUPI从运营商网络发送到第三方时，可以将SUPI翻译成其对应的外部身份标识(identity，ID)。反之，NEF网元将外部ID(第三方的网元ID)发送到运营商网络时，可将其翻译成SUPI。
应用功能(Application Function，AF)网元，主要提供应用层服务，还支持与5G核心网交互来提供服务，例如影响数据路由决策，策略控制功能或者向网络侧提供第三方的一些服务。在具体应用中，AF网元一般是指第三方服务器或应用服务器。
PCF网元，策略控制功能，支持统一的策略框架来管理网络行为。
是由运营商提供的控制面功能，用于向网络网元提供策略。作为一种实现方式，策略可以包括接入控制策略、移动性管理策略、计费相关策略、QoS相关策略和授权相关策略 等。
NRF网元，可用于提供网元发现功能，基于其他网元的请求，提供网元类型对应的网元信息，如地址信息和/或标识信息等。NRF网元还提供网元管理服务，如网元注册、更新、去注册以及网元状态订阅和推送等。
CHF网元，用于提供计费功能，支持用户的离线和在线计费功能。
NWDAF网元，用于网络数据分析功能。负责安全数据的分析和异常安全事件识别。
SPF网元，用于安全策略功能，支持网络级安全策略控制，负责安全事件的策略确定和协同。
图1中的网络数据分析功能网元101对应的网元或者实体可以为该5G网络架构中的NWDAF网元，图1中的安全事件处理功能网元102所对应的网元或者实体可以为该5G网络架构中的SPF网元。本申请实施例中以网络数据分析功能网元101为NWDAF网元，安全事件处理功能网元102为SPF网元为例进行阐述。
本申请实施例中的网络数据分析功能网元或安全事件处理功能网元也可以称之为通信装置，其可以是一个通用设备或者是一个专用设备，本申请实施例对此不做具体限定。本申请实施例中的网络数据分析功能网元或安全事件处理功能网元的相关功能可以由一个设备实现，也可以由多个设备共同实现，还可以是由一个设备内的一个或多个功能模块实现，本申请实施例对此不做具体限定。可以理解的是，上述功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是硬件与软件的结合，或者是平台(例如，云平台)上实例化的虚拟化功能。本申请中，网络数据分析功能网元是指具备数据收集和分析以及获取数据分析结果功能的网元，其可以是图1或图2中的NWDAF网元，也可以是管理数据分析服务(Management data analysis service，MDAS)网元或者其他具备类似功能的网元。为方便说明，本申请后续以网络数据分析功能网元为5G中的NWDAF网元为例进行说明，且可以将网络数据分析功能网元简称为NWDAF网元。本申请实施例中，NWDAF网元也可以称为网络分析功能、或网络分析功能网元，其具有相同的含义，这里做统一说明。
本申请实施例提供一种NWDAF网元的部署方式。其中，NWDAF可以为分布式实现，分布式实体可以部署在5GC NF侧、RAN侧(图中以RAN设备为gNB为例)、UE内部。部署在5GC NF/gNB侧时，可以作为一个软件模块内置在5GC NF/gNB内部。NWDAF的各分布式实体间存在交互接口。为在实际部署中，AMF网元侧和SMF侧的NWDAF部署可以为独立的物理设备、或独立的虚拟设备、或部署在AMF网元/SMF中的软件模块、或者在物理位置或网络位置上接近AMF网元或SMF部署的独立的软件模块。NWDAF可以与5GC NF、gNB、OAM交互获取信息、以及从UE获取信息，将分析结果提供给AF，包括中心侧的AF、以及部署在各边缘移动边缘计算(Mobile Edge Computing,MEC)的分布式AF实体。NWDAF网元可以从NF网元(如图2或图3所示的SMF、PCF网元、RAN、UPF等)、AF、数据仓库或OAM中的一个或多个获取待分析的数据，然后进行分析并获得数据分析结果。其中，NWDAF网元进行数据分析可以是基于某个消费者网元(比如，消费者网元可以是NF网元、RAN设备、终端设备等)发送的数据分析请求或订阅消息而触发的，或者是数据分析网元根据其他条件触发的，比如周期性地触发、初始事件触发等。数据分析网元在获得数据分析结果之后，可以向请求获取数据分析结果的消费者网元发送数据分析结果，或者将数据分析结果存储于数据仓库，或者存储于数据分析网元中。
此外，如图2所示，为基于服务化架构的5G网络架构示意图。其中，该5G网络架构中还可以包括以下网元中的一个或多个：网络开放功能(network exposure function，NEF)网元、PCF网元、统一数据管理(unified data management，UDM)网元、NRF网元、AF网元、NWDAF网元、认证服务器功能(authentication server function，AUSF)网元、AMF网元、SMF网元、(无线)接入网((radio)access network，(R)AN)以及用户面功能(user plane function，UPF)网元等，本申请实施例对此不做具体限定。上述5G网络架构中，除(无线)接入网部分之外的部分可以称为核心网络部分。为方便说明，后续以(R)AN称为RAN为例进行说明。
其中，终端设备通过下一代网络(next generation，N)1接口(简称N1)与AMF网元通信，RAN设备通过N2接口(简称N2)与AMF网元通信，RAN设备通过N3接口(简称N3)与UPF网元通信，UPF网元通过N6接口(简称N6)与DN通信，AMF网元通过N11接口(简称N11)与SMF网元通信，AMF网元通过N8接口(简称N8)与UDM网元通信，AMF网元通过N12接口(简称N12)与AUSF网元通信，AMF网元通过N15接口(简称N15)与PCF网元通信，SMF网元通过N7接口(简称N7)与PCF网元通信，SMF网元通过N4接口(简称N4)与UPF网元通信，SMF网元通过N10接口(简称N10)与UDM网元通信，UDM网元通过N13接口(简称N13)与AUSF网元通信，PCF网元通过N5接口(简称N5)与AF网元通信。
此外，需要说明的是，图2所示的5G网络架构中的AMF网元、SMF网元、UDM网元、AUSF网元、PCF网元、LSMF网元或者AF网元等控制面网元也可以采用服务化接口进行交互。比如，如图2所示，AMF网元对外提供的服务化接口可以为Namf；SMF网元对外提供的服务化接口可以为Nsmf；UDM网元对外提供的服务化接口可以为Nudm；PCF网元对外提供的服务化接口可以为Npcf，AUSF网元对外提供的服务化接口可以为Nausf，AF网元对外提供的服务化接口可以为Naf。相关描述可以参考23501标准中的5G系统架构(5G system architecture)，在此不予赘述。本申请实施例提供一种SPF网元的部署方式。SPF网元的部署方式可以有多种，其中，SPF网元可以为分布式实现，分布式实体可以部署在5GC NF侧、RAN侧(图中以RAN设备为gNB为例)、UE内部。如图2所示，表示新增NF SPF网元的可能的部署方式，SPF网元可以作为5G心网的标准NF，通过SBA接口和标准定义的5G核心网NF直接进行对接。
如图3所示，为基于点对点接口的5G网络架构示意图，其中的网元的功能的介绍可以参考图2中对应的网元的功能的介绍，不再赘述。图3与图2的主要区别在于：图2中的各个网元之间的接口是点对点的接口，而不是服务化的接口。
在图3所示的架构中，终端设备通过N1接口(简称N1)与AMF网元通信，RAN设备通过N2接口(简称N2)与AMF网元通信，RAN设备通过N3接口(简称N3)与UPF网元通信，UPF网元通过N6接口(简称N6)与DN通信，AMF网元通过N11接口(简称N11)与SMF网元通信，AMF网元通过N8接口(简称N8)与UDM网元通信，AMF网元通过N12接口(简称N12)与AUSF网元通信，AMF网元通过N15接口(简称N15)与vPCF网元通信；SMF网元通过N7接口(简称N7)与vPCF网元通信，vPCF网元通过N24接口(简称N24)与hPCF网元通信，vPCF网元通过N5接口(简称N5)与AF网元通信，SMF网元通过N4接口(简称N4)与UPF网元通信，SMF网元通过N10接口(简称N10)与UDM网元通信，UDM网元通过N13接口(简称N13)与AUSF网元通 信。
本申请实施例还提供一种SPF网元的部署方式，如图3所示，SPF网元可以作为管理面功能，通过管理面接口，间接和5G核心网NF进行对接。如图3所示，与安全策略SPF网元之对接的NF可以有很多，随着网络功能的演进可以扩展。举例来说，与安全策略SPF网元之对接的NF可以包括：处理UE信令相关的AMF网元/SMF网元；处理UE策略和签约数据相关的PCF网元/UDM；处理核心网NF间通讯的NRF网元/SCF网元；还可以和核心网NF网元外的相关功能领域对接入如虚拟化资源管理网元和路由传输控制器(software defined network,SDN)网元，从而在更广的功能领域中对安全事件进行响应。下面以图3的逻辑连接图进行举例说明，在具体实施过程中，SPF网元可以是图3通过SBA接口直接对接，也可以为图3通过管理面接口间接对接，在此不做限定。需要说明的是，该图仅给出了一种实现方式，实际应用中也可以有其他部署方式，比如部署一个NWDAF网元和一个SPF网元，或者，将SPF网元部署在NWDAF网元中(比如部署在中心位置)。
本申请中的NF网元可以是图2或图3中的核心网网元，即5G核心网(5G Core Network，5GC)NFs，或者还可以是未来通信系统，如第六代(6th generation，6G)中的核心网网元，即6GC NFs。为方便说明，本申请实施例以NF为5GC NFs为例进行说明。需要说明的是，本申请实施例后续描述时，可以将NF称为5GC NF，当有多个NF时，也可以描述为5GC NFs，或者简称为NFs。
NWDAF网元是5G新引入的网络功能，为5G核心网其他网络功能提供数据分析服务，分析的信息可以过去事件的统计信息，也可以是预测信息。根据当前3GPP协议23.288-g10，NWDAF网元已经支持了一些分析用例：如切片负载，业务体验，网络性能、用户相关行为等分析。其中用户相关的行为分析中涉及非正常的用户行为分析，用于识别被劫持或滥用的用户终端，从而防止用户终端被盗用，或被用于向网络发起攻击等事件。网络功能可以直接或间接的向NWDAF网元订阅安全相关的数据分析服务，例如，处于5G核心网内部的可信的消费网络功能(consumer NF)可以直接向NWDAF网元订阅用户识别分析服务，例如，订阅的用户识别分析服务可以为NWDAF网元分析订阅服务(Nnwdaf_Analytics Subscription_Subscribe)，用于网络功能向NWDAF网元订阅异常用户识别分析服务。外部的应用功能可以向网络能力开放功能(network exposure function，NEF)发送订阅请求；进而，NEF向NWDAF网元转发该订阅请求，以使AF向NWDAF网元订阅用户识别分析服务。NWDAF网元根据分析和运营商的策略，确定用户行为分析结果为AF订阅的用户识别分析服务对应的订阅消息，向订阅该用户行为分析服务的NEF发送用户行为分析结果，以使NEF向AF发送用户行为分析结果。或者，NWDAF网元根据分析和运营商的策略，确定用户行为分析结果为消费者NF网元订阅的用户识别分析服务对应的订阅消息，则可以向订阅该用户行为分析服务的消费者NF发送用户行为分析结果。订阅异常用户识别分析服务的网元对用户行为分析结果进行相应的处理，如释放对应的终端。但是，NWDAF网元只分析UE行为信息，对核心网网络功能的行为没有分析。而5G核心网由于引入的很多IT技术，如虚拟化平台，容器平台，越来越多的开源第三方IT组件的应用，再加上多方供应商的共同参与组网，直接对5G核心网网络功能进行攻击、渗透和劫持等安全异常行为，通过上述方案，NWDAF网元是无法确定出核心网网络功能进行攻击、渗透和劫持等安全异常行为，导致核心网存在安全隐患。另外，由于用户行为分析服务仅能通过向NWDAF网元订阅，来获取NWDAF网元对用户行为分析的结果，而在很多场景下，安全 异常行为涉及到多个网络功能的参与，一个安全异常行为可能会影响多个网络功能的正常运行，而上述用户行为分析服务的订阅方式，使得用户行为分析结果只会发送给订阅用户行为分析服务的网元，而真的该安全异常行为涉及到的其他网络功能无法获取到该用户行为分析结果，也无法针对涉及到的安全异常行为进行处理，也导致了核心网的网元的安全性不高。
基于上述内容，本申请实施例提供一种网络事件处理方法，如图4所示，为本申请实施例提供的网络性能数据分析方法流程示意图，包括以下步骤：
步骤401：NWDAF网元获取K个第一网元的消息交互行为信息。
其中，所述消息交互行为信息可以与所述核心网网元的功能对应。例如，核心网网元可以为上述实施例中的任一种网元。K个第一网元的消息交互行为信息可以为NWDAF网元订阅的第一网元的消息交互行为信息，也可以为NWDAF网元订阅的第一网元获取的其他核心网网元的消息交互行为信息。针对所述K个第一网元中的一个第一网元，所述第一网元的消息交互行为信息包括用于指示所述第一网元传输的消息的属性信息；所述K为正整数。其中，所述第一网元传输的消息的属性信息，可以包括：所述消息的类型，类型具体可以根据第一网元传输的消息的接口确定)；所述消息的消息内容(例如，UE标识，网元的IP地址，网元的标识，网元的证书，请求的内容等)、所述第一网元上传输所述消息的接口(可以根据第一网元确定，例如，NWDAF网元分析订阅服务接口，事件分析服务(Nnwdaf_AnalyticsInfo)接口，NWDAF网元分析通知(Nnwdaf_AnalyticsInfo_Notif)，AMF网元通信接口(Namf_Communication)，AMF网元事件开放服务接口，SMF事件开放服务接口，SPF网元安全策略接口，安全日志(Nnf_SecurityLog)接口等)；所述消息对应的对端传输所述消息的接口(可以根据第一网元的对端的网元确定，例如，NWDAF网元分析订阅服务接口，AMF网元事件开放服务接口，SMF事件开放服务接口，SPF网元安全策略接口等)。
在步骤401中，一种可能的方式，NWDAF网元可以向K个第一网元发送消息交互行为信息订阅请求，用于订阅K个第一网元的消息交互行为信息；其中，第一网元的消息交互行为信息可以为第一网元生成的消息交互行为信息，也可以为第一网元获取的其他核心网网元的消息交互行为信息。
举例来说，NWDAF网元订阅的第一网元可以为AMF网元，进而AMF网元可以将终端设备接入运营商网络的接入信息和移动性信息，例如包括移动状态信息，分配给用户的临时身份标识，认证信息和授权用户信息等上报至NWDAF网元。AMF网元也可以将SMF发送给AMF网元的会话建立，会话修改和会话释放、UE的IP地址、选择的UPF等会话相关的信息作为消息交互行为信息上报至NWDAF网元。
另一种举例，NWDAF网元通过AMF网元的开放接口，向AMF网元发送用户行为订阅请求，用于订阅AMF网元事件开放服务(Namf_EventExposure)，以获取终端的接入移动性等UE行为信息。AMF网元可以以周期性的方式，向NWDAF网元发送UE行为消息；UE行为信息可以包括：UE的位置信息(可以包括UE所在的跟踪区标识TAI或小区标识Cell ID)，UE的接入技术类型，UE移入或移出兴趣区，UE注册状态变更等。AMF网元可以通过订阅或者AMF网元可以以事件的方式，向NWDAF网元发送UE行为消息。
再比如，NWDAF网元可以通过订阅SMF的开放服务接口，例如，SMF事件开放服务(Nsmf_EventExposure)，以获取UE会话管理等UE行为信息。SMF也可以周期性或事 件性的向NWDAF网元上报UE会话消息。其中，UE会话消息可以包括一下UE行为信息：UE的IP地址变更，PDU会话释放，用户面路径变更等通话信息或计费信息等。
步骤402：NWDAF网元根据所述K个第一网元的消息交互行为信息，确定出第二网元发生网络安全异常事件。
下面以K个第一网元为1个第一网元，消息交互行为信息包括第一网元接收到来自第二网元的消息为例进行说明。当然，消息交互行为信息也可以为第一网元直接发送的，也可以为通过其他网元发送给第一网元的信令消息等方式获取的，在此不做限定。
在步骤402中，一种可能的实现方式，NWDAF网元可以根据消息交互行为信息发送的消息频率，确定是否存在网络安全异常事件。例如，若确定所述第一网元接收到来自第二网元的消息的数量大于第一阈值，则确定存在所述第二网元对所述第一网元的DDoS攻击事件；所述第一阈值为根据历史消息频率确定的。
另一种可能的实现方式，NWDAF网元可以根据消息交互行为信息确定出第一网元的第一消息与第二网元的第二消息存在不一致，则确定可能存在网络安全异常事件。
在上述步骤402中，NWDAF网元确定出第二网元发生网络安全异常事件可以有多种可能地实施方式，下面通过实施方式a1、实施方式a2和实施方式a3对此进行介绍。
实施方式a1，数据分析网元根据K个第一网元的消息交互行为信息包括的第一消息和第二消息确定可能存在网络安全异常事件。若确定所述第一消息中的第二网元的第一身份标识与所述第二消息中所述第二网元的第二身份标识不一致，则确定所述第二网元存在网络安全异常事件。
以所述第一网元为计费功能网元CHF，会话管理功能网元SMF为例。所述第一消息为来自SMF的第一UE标识的第一计费请求；所述第二消息为AMF网元针对UE标识的注册信息；此时，所述数据分析网元若确定所述UE标识的注册信息中不包括第一UE标识的注册信息；则可以确定第一计费请求中的第一UE标识为非法注册信息，因此，第一网元可能存在篡改事件。
实施方式a2，数据分析网元根据K个第一网元的消息交互行为信息包括的来自所述K个第一网元的第一UE的交互行为消息，确定所述第一UE是否存在网络安全异常事件。此时，若确定所述第一UE的交互行为消息不一致，则确定所述第一UE存在网络安全异常事件。
举例来说，以所述第一网元为计费功能网元CHF和AMF网元为例。所述第一消息为第一UE标识的第一计费请求；所述第二消息为AMF网元针对UE标识的注册信息；此时，所述数据分析网元若确定所述UE标识的注册信息中不包括第一UE标识的注册信息；则可以确定第一计费请求中的第一UE标识为非法注册信息，可以确定第一UE可能存在被篡改的网络安全异常事件。
再比如，NWDAF网元可以根据AMF网元和SMF上报的UE行为消息，进行用户行为分析。具体的，NWDAF网元可以根据内部数据分析算法，对AMF网元和SMF上报的用户行为信息进行分析，对被误用或被劫持的用户和用户行为进行识别。例如，可以识别异常的UE位置，异常长时间的数据流，异常频繁接入等，进而确定第一UE存在网络安全异常事件。
实施方式a3，数据分析网元根据K个第一网元的消息交互行为信息包括的述K个第 一网元的第二UE的交互行为消息和来自第二网元的所述第二UE的用户信息查询请求，确定网元可能存在网络安全异常事件。数据分析网元若确定来自第二网元的所述第二UE的用户信息查询请求中，所述第二网元中的网元标识不一致，则确定所述网元标识不一致对应的至少两个网元发生网络安全异常事件。
以第一网元可以为SMF1，第二网元为SMF2，第二网元非法获取SMF1的证书向AMF网元发送第二UE的用户信息查询请求，以非法窃取第二UE的用户信息为例。所述用户信息查询请求包括第一网元的证书和第二网元的网元标识，例如，第二网元的IP地址或端口；SMF1向AMF网元发送第二消息，第二消息可以是SMF1与AMF网元交互的任一消息或多个消息的集合；其中，第二消息包括：第一网元的网元标识，例如，第一网元的证书，第一网元的IP地址或端口等。此时，所述数据分析网元可以根据第二UE的用户信息查询请求与第二消息，确定第二UE的用户信息查询请求中的网元的证书与第二消息对应网元的证书一致，但是，第二UE的用户信息查询请求对应的网元的IP地址与第二消息中的网元的IP地址不一致，判定第二UE的用户信息查询请求对应的网元，与第二消息中对应的网元发生网络安全异常事件。
步骤403：NWDAF网元向SPF网元发送第一指示信息。
其中，所述第一指示信息用于指示所述第二网元发生所述网络安全异常事件。
实施方式b1，一种可能的设计，网络安全异常事件可以包括：第一网元受到DDoS攻击事件。例如，根据消息交互行为信息，确定第二网元对第一网元发起DDoS攻击，则可以确定第二网元和/或第一网元存在网络安全异常事件。
实施方式b2，网络安全异常事件可以包括：第二网元和/或第一网元的安全异常事件；第二网元和/或第一网元的安全异常事件可以存在多种异常。例如，第一网元或第二网元可能存在被冒用的风险，一种可能的场景中，第二网元和/或第一网元的安全异常事件可以表示为：第一网元的第一消息与第二网元的第二消息存在不一致的网络安全异常事件，第一消息与第二消息中存在相同的标识信息；此时，可以认为第一网元和/或第二网元可能存在被冒用的风险，进一步的，NWDAF网元还可以根据与第一消息相关的其他消息，或者与第二消息相关的其他消息进行比较，确定第一网元的第一消息与第二网元的第二消息不一致的原因，进而确定被冒用或被篡改的网元，进而，确定该网络安全异常事件为第一网元和/或第二网元被冒用或被篡改。
实施方式b3，第二网元和/或第一网元可能存在窃取用户信息的网络安全异常事件，一种可能的场景中，第二网元和/或第一网元的安全异常事件可以表示为：第一网元的第一身份标识与第一网元的第二身份标识不一致，且第一网元向第二网元发送用户信息的查询请求，此时，第一网元可能存在窃取用户信息的安全异常事件。
实施方式b4，网络安全异常事件还可以包括：用户的网络安全异常事件；例如，一种可能的场景中，用户的安全异常事件可以表示为：第一网元发送的第一消息中携带的第一用户标识，与第二网元发送的第二消息中携带的第一用户标识相同，且第一消息与第二消息不一致，也可以确定为第一用户标识对应的用户存在网络安全异常事件。
实施方式b5，网络安全异常事件还可以包括：异常业务的网络安全异常事件。例如，所述K个第一网元的消息交互行为信息包括：来自所述K个第一网元的第二UE的交互行为消息和来自第二网元的所述第二UE的用户信息查询请求；所述数据分析网元若确定来自第二网元的所述第二UE的用户信息查询请求中，所述第二网元中的网元标识不一致， 则可以确定第二UE的用户信息查询请求为异常业务，并且确定所述网元标识不一致对应的至少两个网元存在异常业务的网络安全异常事件。
通过增加各5G核心网网元的消息交互信息的服务接口，使得NDWAF可以获取各网元的消息交互行为信息，进而通过对个网元的消息交互行为信息的分析，提升网络功能异常行为检测能力，进而有效提升对网络功能的安全入侵事件的识别率和识别的准确度。
步骤404：SPF网元接收NWDAF网元发送的第一指示信息。
在具体实施过程中，SPF网元可以向NWDAF网元发送网络安全异常事件订阅请求，以获取来自NWDAF网元的网络安全异常事件的第一指示信息，当然还可以向NWDAF网元发送网络安全异常事件的查询请求，以接收NWDAF网元发送的第一指示信息，在此不做限定。
步骤405：SPF网元根据所述第一指示信息，确定出与所述第二网元具有关联关系的N个第三网元。
其中，针对所述N个第三网元中的一个第三网元，所述第三网元具有对所述第二网元的业务进行处理的能力。
步骤406：针对所述N个第三网元中的一个第三网元，SPF网元向所述第三网元发送所述第三网元对应的第一安全策略。
其中，所述第三网元对应的第一安全策略中包括用于指示所述第三网元停止对所述第二网元的相关业务进行处理的指示信息。
实施方式c1，SPF网元可以根据不同的网络安全异常事件的类型，确定不同的安全策略。例如，可以根据网络安全异常事件所关联的第三网元，设置对各第三网元的隔离策略，还可以根据网络安全异常事件所关联的用户，设置对各用户的隔离策略，当然，也可以根据网络安全异常事件所关联的用户，设置对各用户所涉及的第三网元的隔离策略。
例如，网络安全异常事件为第二网元对所述第一网元的DDoS攻击事件；此时，第三网元可以为第二网元和/或第二网元相关的网元，可以根据DDoS攻击事件，确定对第三网元的隔离策略。例如，SPF网元根据所述DDoS攻击事件，确定对所述第三网元的相关业务进行隔离，并释放所述第三网元上对应用户。
示例c1，第三网元可以为AMF网元，所述SPF网元向所述AMF网元发送所述AMF网元对应的第一安全策略，所述AMF网元对应的第一安全策略包括用于指示所述AMF网元停止对所述第二网元的消息的处理的指示信息；所述AMF网元对应的第一安全策略包括用于指示所述AMF网元释放所述第二网元所绑定的用户。再比如，SPF网元可以指示AMF网元停止建立和/或释放与第二网元相关的用户会话；具体的实施过程可以包括：SPF网元向AMF网元发送第一安全策略消息；所述第一安全策略消息用于指示所述AMF网元释放所述第二网元建立的用户会话。
示例c2，第三网元可以为消息转发网元，因此，SPF网元可以指示消息转发(service communication proxy,SCP)网元停止对来自所述第二网元的消息的转发，具体的实施过程可以包括：SPF网元向消息转发网元SCP网元发送第一安全策略消息；所述第一安全策略消息包括所述第二网元的NF标识或IP地址；所述第一安全策略消息用于指示所述SCP网元停止对来自所述第二网元的消息的转发。
示例c3，第三网元可以为网络中的任一可能与第二网元建立通信连接的网元。因此，SPF网元可以指示第三网元停止与第二网元建立通信连接，具体的实施过程可以包括：SPF 网元向第三网元发送第二安全策略消息；所述第一安全策略消息包括所述第二网元的NF标识；所述第二安全策略消息用于所述第三网元忽略与所述第二网元建立连接。
举例来说，所述第三网元为NRF网元，所述SPF网元向所述NRF网元发送所述NRF网元对应的第一安全策略，所述NRF网元对应的第一安全策略包括用于指示所述NRF网元停止对所述第二网元的用户授权；
举例来说，第三网元可以为路由传输控制器SDN网元，SPF网元可以指示SDN网元阻止所述第二网元对应的网段的消息的路由转发。具体的实施过程可以包括：SPF网元向路由传输控制器SDN网元，发送第一安全策略消息；所述第一安全策略消息用于指示所述SDN网元阻止所述第二网元对应的网段的消息的路由转发。
举例来说，所述第三网元为虚拟化资源管理(network functions virtualisation management and orchestration，MANO)网元，所述SPF网元向所述MANO网元发送所述MANO网元对应的第一安全策略，所述MANO网元对应的第一安全策略包括用于指示所述MANO网元释放所述第二网元对应的虚拟机。
实施方式d1，所述第一指示信息还可以用于指示所述网络安全异常事件对应的异常业务。SPF网元可以根据异常业务，确定出需执行第二安全策略的第四网元。具体的，SPF网元可以根据所述第一指示信息，确定出与所述第二网元具有关联关系的M个第四网元；针对所述M个第四网元中的一个第四网元，所述第四网元具有对所述异常业务进行处理的能力；针对所述M个第四网元中的一个第四网元，SPF网元可以向所述第四网元发送所述第四网元对应的第二安全策略，所述第四网元对应的第二安全策略中包括用于指示所述第四网元停止或撤销对所述异常业务进行处理的指示信息。
在实施方式d1下可以有多种应用场景，下面通过下述场景1和场景2进行示例。
场景1，所述第一网元传输的消息包括第一消息和第二消息，所述第一消息中的第一UE的交互行为消息与所述第二消息中第一UE的交互行为消息不一致，其可能的原因是，第一消息中的第一UE的交互行为消息存在篡改，也可能为第二消息中的第一UE的交互行为消息存在篡改，NWDAF网元可以根据K个第一网元传输的消息中，涉及的第一UE的其他交互行为消息，确定存在篡改的为第一消息还是第二消息。此处，以第一消息中的第一UE标识存在篡改为例进行说明。其他第一UE的交互行为消息存在篡改确定的第二安全策略可以参考第一消息中的第一UE标识存在篡改的实施例，在此不再赘述。
在场景1下，针对第一消息中的第一UE标识存在篡改问题，下面通过示例d1-d5进行介绍。
示例d1，第四网元可以为SMF网元，此时，SPF网元可以对SMF网元发起的第一UE的业务进行隔离，即，可以指示SMF网元停止执行第一UE对应的操作。例如，停止执行所述SMF网元生成的所述第一UE的业务请求，并释放所述第一UE与所述SMF网元的会话。在具体实施过程中，可以包括：SPF网元生成第二安全策略请求；所述第二安全策略请求用于停止执行所述SMF网元生成的所述第一UE的业务请求；并释放所述第一UE与所述SMF网元的会话。
示例d2，所述第四网元为AMF网元，所述SPF网元向所述AMF网元发送所述AMF网元对应的第二安全策略，所述AMF网元对应的第二安全策略包括用于指示所述AMF网元停止执行所述异常业务的请求；例如，异常业务可以为第一网元相关的第一UE的会话， AMF网元可以释放所述第一UE的会话。具体可以包括：SPF网元向所述AMF网元发送异常用户的安全策略请求；所述异常用户的安全策略请求用于指示所述AMF网元释放所述第一UE的会话。进一步的，所述SPF网元还可以向所述AMF网元发送所述AMF网元对应的第二安全策略，所述AMF网元对应的第二安全策略包括用于指示所述AMF网元释放所述异常业务对应的用户，例如，第一UE。
示例d3，所述第四网元为AMF网元，若SPF网元确定SMF网元存在被冒用的风险，SPF网元还可以对AMF网元中与SMF网元的业务进行隔离。例如，可以指示SMF网元相关的AMF网元，释放与所述SMF网元向AMF网元发起的请求中涉及的第一UE标识的UE的会话。此时，由于可能涉及存在被冒用的风险的网元可能包括多个网元，可以对由SMF网元发起的业务请求全部或部分进行隔离。例如，若SPF网元可以确定被冒用的网元和冒用的网元，则可以将冒用的网元作为隔离的网元，对冒用的网元发起的业务进行隔离。若SPF网元无法确定被冒用的网元和冒用的网元，只能确定网元存在被冒用的风险，则可以将存在被冒用的风险的网元发起的业务都进行隔离。在具体实施过程中，可以包括：SPF网元向所述AMF网元发送异常用户的安全策略请求；所述异常用户的安全策略请求用于指示所述AMF网元释放所述SMF网元相关的UE的会话。
示例d4，所述第四网元为PCF网元，所述SPF网元向所述PCF网元发送所述PCF网元对应的第二安全策略，所述PCF网元对应的第二安全策略包括用于指示所述PCF网元释放所述异常业务对应的用户，以使PCF网元对涉及第一UE标识的用户进行隔离。在具体实施过程中，可以包括：SPF网元向PCF网元发送异常用户的安全策略请求；所述异常用户的安全策略请求用于指示所述PCF网元释放所述第一UE标识的会话及网络。
示例d5，SPF网元若确定所述第一UE标识的篡改对象为第二网元，则可以认为第二网元存在被冒用的风险，进而，可以向第四网元发起针对第二网元的异常业务的隔离的第二安全策略。具体的，SPF网元可以向所述第四网元发送第二安全策略请求；所述第二安全策略请求用于指示对所述第二网元的异常业务进行隔离。例如，所述第四网元为SCP网元，所述SPF网元向所述SCP网元发送所述SCP网元对应的第二安全策略，所述SCP网元对应的第二安全策略包括用于指示所述SCP网元停止对所述第二网元的异常业务的消息转发；或者，所述第四网元为NRF网元，所述SPF网元向所述NRF网元发送所述NRF网元对应的第二安全策略，所述NRF网元对应的第二安全策略包括用于指示所述NRF网元停止对所述第二网元的异常业务的用户授权；或者，所述第四网元为SDN网元，所述SPF网元向所述SDN网元发送所述SDN网元对应的第二安全策略，所述SDN网元对应的第二安全策略包括用于指示所述SDN网元停止对所述第二网元的异常业务的网段的消息的路由转发。
场景2，以窃取用户隐私消息的场景为例进行说明。此时，NWDAF网元或SPF网元可以通过存在网元查询用户信息的方式，确定可能存在窃取用户隐私消息的网络安全事件，NWDAF网元或SPF网元通过所述第一消息中的第二网元的第一身份标识与所述第二消息中所述第二网元的第二身份标识不一致，确定窃取用户隐私消息的对象为第二网元，则可以确定第二网元存在被冒用的风险。当然，NWDAF网元或SPF网元还可以根据其他交互行为消息的不一致，确定存在窃取用户隐私消息的对象，在此不再赘述。
在具体的场景中，以第二网元为第一SMF，第一网元为AMF网元为例；第一消息可 以包括：所述第二网元向所述第一网元发送的第三UE信息的查询请求；查询请求包括所述第一网元的第一身份标识；第二消息包括：所述第一网元的第二身份标识。NWDAF网元若根据所述第二网元的第一身份标识与所述第二网元的第二身份标识不一致，且所述第一身份标识存在网络安全异常事件，则可以确定与所述第一身份标识对应的第二网元为异常网元。此时，安全异常事件中可以包括：指示第一SMF为异常网元。再比如，SPF网元根据所述第二网元的第一身份标识与所述第二网元的第二身份标识不一致，且所述第一身份标识存在网络安全异常事件，则可以确定与所述第一身份标识对应第一SMF为异常网元。
例如，第一身份标识可以为第一SMF网元对应的IP地址IP1，若第二网元窃取了第二SMF的TSL证书，用于向第一网元发送第三UE信息的查询请求的验证，此时，NWDAF网元可以接收到来自AMF网元的第一消息，第一消息中包括：第一SMF网元的IP1，第二SMF网元的TSL证书，第三UE信息的查询请求。NWDAF网元还可以接收到第二SMF网元发送的第二消息，第二消息中包括：第二SMF网元的IP2，第二SMF网元的TSL证书。
进而，NWDAF网元根据第一消息和第二消息，可以确定第一SMF网元发送的第三UE信息的查询请求存在网络安全异常。进一步的，NWDAF网元还可以根据第二SMF网元发送的包括有TSL证书的其他UE信息的查询请求，及第二SMF网元的第二身份标识(第二SMF网元对应的IP地址IP2)，确认第一SMF网元为异常网元。
进而，SPF网元根据NWDAF网元的网络安全异常事件，确定第二安全策略。第二安全策略可以为针对第二网元的会话或网络的隔离，和/或第二网元涉及的用户的会话或网络的隔离。具体的，可以包括：SPF网元根据所述异常网元，生成第二安全策略，对所述异常网元的业务进行隔离，和/或释放所述异常网元上对应用户；SPF网元向第四网元发送第二安全策略；第二安全策略用于指示所述第四网元停止向所述异常网元发送用户的相关信息。
通过上述方法，当NWDAF网元检测到安全异常事件后，还可以向新增的安全事件处理功能SPF网元通知网络安全异常事件，进而，由SPF网元通过和各领域的新增安全策略接口，协同和联合多功能领域，对网络安全事件进行响应，有效提升对安全异常事件的处理，有效提高网络安全性能。可以有效控制安全异常对网络的影响。
下面对本申请实施例提供的网络事件处理方法进行具体描述。一种具体的实现方法，包含两个主要网络功能，一个是NWDAF网元，负责安全数据的分析和异常安全事件识别，NWDAF用于订阅其对应的网元的消息交互信息。一个是新增的安全策略网元SPF网元，负责网络安全事件的策略确定和网络安全异常事件的处理。如图5所示，为本申请实施例提供的网络性能数据分析方法流程示意图。以NF(例如，第二网元)被劫持，恶意对其他NF(例如，第一网元)进行DDoS攻击，影响第一网元涉及的其他网元NF的可用性为例进行说明。该方法包括以下步骤：
步骤501：NWDAF网元接收第一网元的消息交互行为信息。
一种可能的方式，获取第一网元的消息交互行为信息的方式可以通过第一网元对应的数据开放接口，如AMF网元可以通过扩展的事件开放服务(Namf_EventExposure)接口获取的，SMF可以通过扩展的事件开放服务(Nsmf_EventExposure)接口获取的。在具体 实施过程中，消息交互行为信息接口还可以为扩展后的事件分析服务(Nnwdaf_AnalyticsInfo)接口，用于增加消息交互行为信息的分析类型，例如，NF行为异常，用户行为异常等。此外还可以通过携带NF筛选参数，对需要分析NF范围进行限制或筛选，以节省NWDAF网元分析的数据量，提高网络数据分析的效率。例如，NF筛选参数可以包括以下至少一项：NF类型，NF标识或NF列表，NF所属的切片等参数。
另一种可能的方式，步骤501a中，NWDAF网元向NF发送NF的消息交互信息的订阅请求，以获得NF发送的消息交互行为信息。NWDAF网元获取NF的消息交互行为信息可以为NF与其他NF信令交互的消息交互行为信息，也可以通过新增的信令，例如，NF安全日志(Nnf_SecurityLog)，向NF订阅NF消息交互行为信息。订阅的NF的消息交互行为信息，可以包括NF所有发送和接受的接口消息类型，所有消息发生的事件和接口消息的内容等。其中，接口消息的内容可以包括：接口消息的完整数据，摘要，关键信息等。具体NF对应支持的接口可以参见上述实施例，在此不再赘述。
假如第二网元被外部用户恶意渗透控制，通过向周边NF频繁发送第一消息，例如，SMF1通过AMF网元通信接口(Namf_Communication)向AMF网元1短时间发送多个第一消息，导致AMF网元1处理资源和接口带宽资源占用，处理正常业务能力下降。此时，AMF网元1根据NWDAF网元消息交互行为信息的收集要求，周期性或事件性上报第二网元向第一网元发送的消息，作为第一网元的消息交互行为信息。
步骤502：NWDAF网元对AMF网元1的交互事件进行分类判断，确定网络安全异常事件。
其中，网络安全异常事件为第一网元受到第二网元的DDoS攻击。
一种可能的实现方式，NWDAF网元根据内部算法，例如，根据指定规则判断，如AMF网元1的历史流量模型，确定在指定时间内接收第二网元NF的消息升超过预设阈值，则确定AMF网元1的交互事件过程发生业务突发飙，可能存在DDoS攻击。另一种可能的实现方式，根据机器学习或人工智能(artificial intelligence，AI)算法，根据历史异常或正常业务信令交互数据训练后的模型，对第一网元AMF网元1的交互事件过程进行分类判断是否存在DDoS攻击。本申请实施例不限定具体算法，NWDAF网元可以根据具体采用的算法判断第一网元NF可能被DDos攻击。
步骤503：NWDAF网元向SPF网元发送第一指示信息。
其中，第一指示信息可以为NWDAF网元分析通知(Nnwdaf_AnalyticsInfo_Notif)消息，包括：第一网元AMF网元1可能受到第二网元SMF1的DDos攻击。
在一种可能的实现方式，SPF网元可以通过NWDAF网元的分析服务(Nnwdaf_AnalyticsInfo)接口，向NWDAF网元发送网络安全异常事件的订阅请求，进而NWDAF网元可以根据网络安全异常事件的订阅请求，确定需要向SPF网元上报第一网元AMF网元1可能受到第二网元SMF1的DDos攻击。
步骤504：SPF网元根据第一指示信息，确定第一安全策略。
具体的，安全策略可以为本地或后台配置的安全策略，进而，SPF网元根据NF类型，确定第二网元SMF可能被入侵，并根据DDoS攻击等其他NF对应的安全策略的条件判断，确定对第二网元执行的安全策略。
例如，SPF网元确定第二网元发起DDoS攻击，可以确定第二网元需进行业务和网络隔离，另外，由于第二网元为SMF1，因此，还需要对SMF涉及的用户的会话进行隔离， 释放SMF1上对应用户。业务和网络的隔离可以有多种处理手段。例如，SPF网元可以将安全策略指令发送至业务或网络对应的控制中心的网元，进而使得业务或网络对应的控制中心的网元执行对应第二网元的安全策略消息。
SPF网元向第三网元发送第一安全策略。
在步骤504a中，第三网元为SCP网元，SPF网元可以向SCP网元发送第一安全策略，指示SCP网元停止转发第二网元的消息，其中第一安全策略消息可以携带第二网元SMF1的网元标识NF ID或IP地址。
在步骤504b中，第三网元为NRF网元，根据第一安全策略，SPF网元可以向NRF网元发送第一安全策略，指示NRF网元隔离NF和SMF1之间的相互发现，避免SMF1和NF之间建立连接。消息中可以携带SMF1对应的NF标识。
在步骤504c中，第三网元为PCF网元或AMF网元，SPF网元可以向PCF网元或AMF网元发送第一安全策略，用于指示释放对应的第二网元的用户会话。
具体的，对于第二网元SMF1上可能现有的业务，SPF网元可以通过向PCF网元或直接向对应的AMF网元发送第二网元的安全策略消息，用于指示释放对应SMF1的用户。或者，SPF网元可以通过直接向对应的AMF网元发送第二网元的安全策略消息，用于指示释放对应SMF1的用户。
在步骤504d中，第三网元为SDN网元，SPF网元还可以向SDN网元发送第一安全策略，用于指示SDN网元在路由层面隔离SMF1对应的网段，以使SPF网元实现在5G核心网NF范围外的网元对SMF1的隔离。
第三网元接收到第一安全策略，执行第一安全策略。
在步骤505a中，SCP网元接收第一安全策略，根据指示的第一安全策略，停止对应SMF1的消息转发，对于已经接收到的第二网元SMF1发出的消息，可以进行丢包处理。
在步骤505b中，NRF网元接收第一安全策略后，根据指示的第一安全策略，拒绝所有该SMF1发起的对其他NF的发现请求，同时不返回SMF1作为其他NF对SMF的发现请求，从而隔离了SMF1和其他NF之间的连接发起。
在步骤505c中，AMF网元接受SPF网元的第一安全策略后，对SMF1建立的用户会话，发起连接释放。
在步骤505d中，SDN网元接收第一安全策略后，向对应的路由器发送配置，拒绝对应SMF1的原地址网段或目标地址网段的路由转发。
下面一种具体的实现方法，包含两个主要网络功能，可以部署在一个网元上，也可以单独部署，在此不做限定。以部署在一个网元上为例，即第一网元包括NWDAF，NWDAF网元，安全策略网元SPF网元的功能，第一网元负责安全数据的分析和异常安全事件识别，并订阅网元的消息交互行为信息，第一网元还负责安全事件的安全策略的确定和安全异常事件的处理协同。SPF网元可以不作为单独的NF部署，作为功能嵌入NWDAF网元中。
一种可能的场景中，当NF发送的消息被恶意篡改，例如，第二网元为SMF，SMF发出的计费请求被恶意篡改，将盗打用户的UE ID中的UE1改为UE2，从而导致恶意盗打，非法获利的场景。如图6所示，为本申请实施例提供的一种网络事件处理方法流程示意图，该方法包括以下步骤：
步骤601：AMF网元向NWDAF网元发送消息交互行为信息。
其中，消息交互行为信息可以为UE1完成注册的消息，也可以为UE发起的UE1的业务消息。AMF网元可以通过事件发布服务接口或安全日志接口将UE1已注册的消息交互行为信息上报给NWDAF网元，指示UE1已注册。
步骤602：第二网元向第一网元发送第一消息。
其中，第二网元为被篡改的网元，向第一网元发送业务请求。例如，以第二网元为SMF1，SMF1中的用户标识UE1被篡改为用户标识UE2。具体的篡改方式可以为，被篡改的第一网元SMF1中，可能存在计费消息的处理模块被篡改，例如，第一网元SMF1的处理模块被注入恶意程序，可以将盗打用户的用户标识UE1产生的计费账单中的用户标识修改为UE2。以第一网元为CHF网元为例，第一消息为SMF1发送的计费请求消息(Nchf_ConvergedCharging)，计费请求携带被篡改的用户标识(UE2)。
步骤603：CHF向NWDAF网元发送消息交互行为信息。
例如，CHF可以将第二网元发送的第一消息作为消息交互行为信息发送给NWDAF网元。
进一步的，CHF可以根据第二网元发送的计费请求，为用户UE2产生一条计费账单。此时，CHF可以将计费账单，及第一消息作为消息交互行为信息，发送给NWDAF网元。也可以将计费账单作为一个消息交互行为信息，发送给NWDAF网元，用于指示第一网元SMF1请求对UE2产生一条计费的网络行为。
步骤604：NWDAF网元/SPF网元确定网络安全异常事件，并向PSF发送第一指示信息。
一种可能的实现方式，NWDAF网元可以根据UE2计费消息的完整性，判断是否出现恶意盗打的网络安全异常事件。一种可能的场景中，SMF1可能被劫持，导致NWDAF网元可能无法根据计费消息的完整性，判断是否出现恶意盗打的问题，因此，NWDAF网元可以根据多个网元涉及到的同一用户的会话的相关交互的消息，比较是否存在不一致的消息，进而确定被篡改的对象。例如，第一消息可以为涉及SMF1处理UE2的计费消息，第二消息可以为涉及SMF1处理UE2的会话消息，或者，第二消息可以为涉及其他网元处理UE2的会话消息，则NWDAF网元可以根据第一消息是否与第二消息不一致，判断是否存在网络安全异常事件。例如，若确定第一网元并没有上报SMF1处理UE2的会话业务的第二消息，则NWDAF网元可以确定SMF1没有处理UE2的业务，即可以确定SMF1请求对UE2产生一条计费请求的网络行为存在网络安全异常，且UE2对应的会话并不是第一网元处理的，因此，SMF1发送给CHF的请求时错误的，SMF1的关键模块可能被入侵，使得第一网元的关键业务数据账单数据被篡改。具体的，NWDAF网元可以根据规则异常判断，或使用其他如大数据的AI算法等，确定异常的计费账单，进而确定网络安全异常事件。
步骤605：SPF网元根据网络安全事件，确定第二安全策略，并向第四网元发送第二安全策略。
在步骤605a中，SPF网元发送第二安全策略给AMF网元，第二安全策略用于指示SMF1的UE1用户异常，建议AMF网元停止对异常用户UE1的计费，并释放对应的用户UE1。
若SPF网元设置在NWDAF网元上，第二安全策略的消息格式可以为NWDAF网元的分析服务消息(nwdaf_AnalyticsInfo)，或者SPF网元的安全策略消息(SecPolicy)。
步骤605b：SPF网元发送第二安全策略给CHF，通知SMF1发送的UE2的计费消息为异常计费消息。
步骤605c：SPF网元发送第二安全策略给PCF网元，通知UE1异常，用于指示停止UE1的用户使用网络，或者停止UE1对指定会话的使用。
第四网元接收第二安全策略，并执行第二安全策略。
步骤606a：AMF网元根据第二安全策略，可以对UE1发起释放消息。
步骤606b：CHF根据第二安全策略，停止SMF1发起的UE2的计费账单产生。
步骤606c：PCF网元根据第二安全策略，可以停止UE1的用户使用网络，或者停止UE1对指定会话的使用。
步骤607：SPF网元根据网络安全事件，确定第一安全策略，并向第三网元发送第一安全策略。
步骤607a：SPF网元向NRF网元发送第一安全策略。
其中，第一安全策略用于指示第一网元SMF1异常，需对第一网元SMF1进行隔离。
步骤607：第三网元根据第一安全策略，执行第一安全策略。
步骤608a：NRF网元根据安全策略消息，可以停止SMF1和其他网元NF之间的相互发现。
此外实施例一中第一安全策略也都可以应用到本实施例，具体选择的方案可以根据SPF网元的第一安全策略确定。
下面一种具体的实现方法，包含两个主要网络功能，可以部署在一个网元上，即第一网元包括NWDAF，NWDAF网元，安全策略网元SPF网元的功能，第一网元负责安全数据的分析和异常安全事件识别，并订阅其对应的网元的信息。第一网元还负责安全事件的策略确定和协同。在该实例中，假设NF的身份信息被盗取，导致盗取身份信息的网元可以冒用该身份信息，进而非法获取用户信息，造成关键信息泄露。如图7所示，为本申请实施例提供的一种网络事件处理方法流程示意图，该方法包括以下步骤：
步骤701：SMF2向AMF网元发送UE2的信息查询请求。
其中，SMF2通过非法获取SMF1的TLS证书与AMF网元建立连接，并通过AMF网元的事件发布服务的接口向AMF网元发送UE2的位置信息的查询请求。一种可能的方式，SMF2非法获取SMF1的TLS认证证书。SMF1被黑客通过后台远程控制，或是黑客通过漏洞注入的一个应用，进而通过对SMF1的内部网络渗透，获取了SMF1的TLS认证证书。进而，SMF2可以假冒SMF1的身份，向AMF网元发送用户信息的查询请求，进而非法获取用户的信息。
步骤702：第一网元AMF网元向NWDAF网元发送消息交互行为信息。
AMF网元可以将向SMF2发送的UE2的位置信息作为消息交互行为信息，还可以将接收到的SMF2发送的UE2的位置信息的查询请求作为消息交互行为信息，周期性或事件性的上报到NWDAF网元。例如，消息交互行为信息可以包括：SMF2发送的UE2的位置信息的查询请求，SMF2的IP地址IP1，SMF1的TLS证书等。
进一步的，AMF网元根据UE2的信息查询请求，向SMF2发送UE2的位置信息。此时，AMF网元可以将向SMF2发送的UE2的位置信息作为消息交互行为信息，周期性或事件性的上报到NWDAF网元。
步骤702a：SMF1向NWDAF网元发送消息交互行为信息。
进而，NWDAF网元还可能接收到SMF1向NWDAF网元上报的消息交互行为信息，其中，消息交互行为信息包括SMF1的标识，例如，SMF1的IP地址IP1。
步骤703：NWDAF网元根据消息交互行为信息，确定存在网络安全异常事件的第二网元。
具体的，NWDAF网元可以根据第二网元AMF网元发送的消息交互行为信息，及SMF1网元上报的消息交互行为信息，UE2的信息查询请求的请求方SMF2的IP地址，与SMF1向NWDAF网元上报的消息交互行为信息中的SMF1的IP地址不同，可以确认，至少有1个SMF为异常网元，此时可以将第二网元确认为SMF1和SMF2。进一步的，NWDAF网元还可以根据SMF2针对UE发送的查询请求，及SMF1针对UE发送的查询请求，进一步比较是否存在不一致的消息交互行为信息，进而确定异常网元。例如，NWDAF网元确定SMF1网元只请求了UE1的信息，并未发送对UE2的位置信息的查询请求。也可以确定，SMF2网元存在网络安全异常事件。NWDAF网元可以进一步根据其他网元NF上报的消息交互行为信息，确定IP2对应的第二网元SMF2可能是假冒的，UE2的位置信息可能被泄露。
步骤704：NWDAF网元向SPF网元发送第一指示信息，用于指示网络安全异常事件。
步骤705：SPF网元接收第一指示信息，并根据第一指示信息，向第四网元发送第二安全策略。
在步骤705a中，SPF网元可以向AMF网元发送第二安全策略。
其中，第二安全策略用于指示UE2的信息泄露，并指示AMF网元停止或流控UE2的消息的发送和接收。例如，AMF网元可以根据第二安全策略，停止响应UE2信息的查询请求，或者，还可以设置为停止响应来自SMF1或SMF2的异常网元请求的UE2的信息的查询请求，避免影响其他网元的正常业务。
第四网元根据接收到的第二安全策略，执行第二安全策略。
在步骤706a中，AMF网元根据第二安全策略，停止向SMF2发送UE2的用户信息，或者，AMF网元根据第二安全策略，停止向SMF1发送UE2的位置信息。具体的实施方式可以根据确定的异常网元确定，例如，若确定异常网元为SMF2，则可以只停止向SMF2发送UE2的用户信息，若确定异常网元为SMF2或SMF1，则可以停止向SMF1和SMF2发送UE2的用户信息。
步骤707：SPF网元根据第一指示信息，向第三网元发送第一安全策略。
步骤707a：SPF网元可以向SCP网元发送第一安全策略。
其中，第一安全策略用于指示SCP网元停止对SMF1或SMF2的消息转发。其中，SCP网元可以根据消息中携带的IP地址确定SMF2网元，例如，消息中携带的IP地址为IP2，则可以确认该消息的发送方为SMF2，避免SMF2携带SMF1的证书所产生的干扰。
步骤707b：SPF网元可以向虚拟机资源管理中心MANO网元发送第一安全策略；
其中，第一安全策略用于指示MANO网元释放IP2对应的SMF2的虚拟机，进而阻止第二SMF网元SMF2的网络渗透和信息窃取。
第一网元根据接收到的第一安全策略，执行第一安全策略。
步骤708a：SCP网元根据第一安全策略，停止对SMF1或SMF2的消息转发。
步骤708b：MANO网元根据第一安全策略，释放IP2对应的第二SMF网元SMF2 的虚拟机。
此外实施例一中第一安全策略也可以应用到本实施例，具体选择的方案可以根据SPF网元的第一安全策略确定。
上述主要从各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，上述实现各网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
如图8所示，为本申请实施例所涉及的网络事件处理装置的一种可能的示例性框图，该装置800可以以软件或硬件的形式存在。装置800可以包括：处理单元802和通信单元801。作为一种实现方式，该通信单元801可以包括接收单元和发送单元。处理单元802用于对装置800的动作进行控制管理。通信单元801用于支持装置800与其他网络实体的通信。
其中，处理单元802可以是处理器或控制器，例如可以是通用中央处理器(central processing unit，CPU)，通用处理器，数字信号处理(digital signal processing，DSP)，专用集成电路(application specific integrated circuits，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请实施例公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包括一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元801是一种该装置的接口电路，用于从其它装置接收信号。例如，当该装置以芯片的方式实现时，该通信单元801是该芯片用于从其它芯片或装置接收信号的接口电路，或者，是该芯片用于向其它芯片或装置发送信号的接口电路。
该装置800可以为上述实施例中的NWDAF网元或SPF网元，还可以为用于NWDAF网元的芯片或SPF网元的芯片。例如，当装置800为NWDAF网元或SPF网元时，该处理单元802例如可以是处理器，该通信单元801例如可以是收发器。可选的，该收发器可以包括射频电路，该存储单元例如可以是存储器。例如，当装置800为用于数据分析网元或安全事件处理SPF网元的芯片时，该处理单元802例如可以是处理器，该通信单元801例如可以是输入/输出接口、管脚或电路等。该处理单元802可执行存储单元存储的计算机执行指令，可选地，该存储单元为该芯片内的存储单元，如寄存器、缓存等，该存储单元还可以是该数据分析网元或安全事件处理SPF网元内的位于该芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。
在一种实施例中，该装置800为上述实施例中的NWDAF网元。所述通信单元801，用于获取K个第一网元的消息交互行为信息，针对所述K个第一网元中的一个第一网元，所述第一网元的信令交互行为信息包括用于指示所述第一网元传输的消息的属性信息；所述K为正整数；向SPF网元发送第一指示信息，所述第一指示信息用于指示所述第二网元 发生所述网络安全异常事件。处理单元802，用于根据所述K个第一网元的消息交互行为信息，确定出第二网元发生网络安全异常事件；
该装置800为上述实施例中的NWDAF网元的情况下，一种可能的设计，针对所述K个第一网元中的一个第一网元，所述第一网元传输的消息的属性信息，包括以下一项或多项：所述消息的类型、所述消息的消息内容、所述第一网元上传输所述消息的接口、所述消息对应的对端传输所述消息的接口。
该装置800为上述实施例中的NWDAF网元的情况下，一种可能的设计，处理单元802，用于若确定所述第一网元接收到来自第二网元的消息的数量大于第一阈值，则确定存在所述第二网元对所述第一网元的DDoS攻击事件；所述第一阈值为根据历史消息频率确定的。
该装置800为上述实施例中的NWDAF网元的情况下，一种可能的设计，所述K个第一网元的消息交互行为信息包括：第一消息和第二消息；处理单元802，用于若确定所述第一消息中的第二网元的第一身份标识与所述第二消息中所述第二网元的第二身份标识不一致，则确定所述第二网元存在网络安全异常事件。
该装置800为上述实施例中的NWDAF网元的情况下，一种可能的设计，所述K个第一网元的消息交互行为信息包括：来自所述K个第一网元的第一UE的交互行为消息；处理单元802，用于若确定所述第一UE的交互行为消息不一致，则确定所述第一UE存在网络安全异常事件。
该装置800为上述实施例中的NWDAF网元的情况下，一种可能的设计，所述K个第一网元的消息交互行为信息包括：来自所述K个第一网元的第二UE的交互行为消息和来自第二网元的所述第二UE的用户信息查询请求；处理单元802，用于若确定来自第二网元的所述第二UE的用户信息查询请求中，所述第二网元中的网元标识不一致，则确定所述网元标识不一致对应的至少两个网元发生网络安全异常事件。
可以理解的是，该装置用于上述网络事件处理方法时的具体实现过程以及相应的有益效果，可以参考前述方法实施例中的相关描述，这里不再赘述。
在另一种实施例中，该装置800为上述实施例中的SPF网元。所述通信单元801，用于接收NWDAF网元发送的第一指示信息，所述第一指示信息用于指示所述第二网元发生网络安全异常事件；针对所述N个第三网元中的一个第三网元，向所述第三网元发送所述第三网元对应的第一安全策略，所述第三网元对应的第一安全策略中包括用于指示所述第三网元对所述第二网元对应的业务进行隔离的指示信息。处理单元802，用于根据所述第一指示信息，确定出与所述第二网元具有关联关系的N个第三网元；针对所述N个第三网元中的一个第三网元，所述第三网元具有对所述第二网元的业务进行处理的能力。
该装置800为上述实施例中的SPF网元的情况下，一种可能的设计，通信单元801，用于执行以下一项或多项：
所述第三网元为AMF网元，向所述AMF网元发送所述AMF网元对应的第一安全策略，所述AMF网元对应的第一安全策略包括用于指示所述AMF网元停止对所述第二网元的消息的处理的指示信息；所述第三网元为SCP网元，向所述SCP网元发送所述SCP网元对应的第一安全策略，所述SCP网元对应的第一安全策略包括用于指示所述SCP网元停止对所述第二网元的消息转发；所述第三网元为NRF网元，向所述NRF网元发送所述NRF网元对应的第一安全策略，所述NRF网元对应的第一安全策略包括用于指示所述NRF网元停止对所述第二网元的用户授权；所述第三网元为SDN网元，向所述SDN网元发送 所述SDN网元对应的第一安全策略，所述SDN网元对应的第一安全策略包括用于指示所述SDN网元停止对所述第二网元的网段的消息的路由转发；所述第三网元为MANO网元，向所述MANO网元发送所述MANO网元对应的第一安全策略，所述MANO网元对应的第一安全策略包括用于指示所述MANO网元释放所述第二网元对应的虚拟机；所述第三网元为AMF网元，向所述AMF网元发送所述AMF网元对应的第一安全策略，所述AMF网元对应的第一安全策略包括用于指示所述AMF网元释放所述第二网元所绑定的用户。
该装置800为上述实施例中的SPF网元的情况下，一种可能的设计，所述第一指示信息还用于指示所述网络安全异常事件对应的异常业务；处理单元802，用于根据所述第一指示信息，确定出与所述第二网元具有关联关系的M个第四网元；针对所述M个第四网元中的一个第四网元，所述第四网元具有对所述异常业务进行处理的能力；针对所述M个第四网元中的一个第四网元，所述通信单元801，用于向所述第四网元发送所述第四网元对应的第二安全策略，所述第四网元对应的第二安全策略中包括用于指示所述第四网元停止或撤销对所述异常业务进行处理的指示信息。
该装置800为上述实施例中的SPF网元的情况下，一种可能的设计，通信单元801，用于执行以下至少一项：
所述第四网元为AMF网元，向所述AMF网元发送所述AMF网元对应的第二安全策略，所述AMF网元对应的第二安全策略包括用于指示所述第四网元停止执行所述异常业务的请求；所述第四网元为AMF网元或PCF网元，F向所述AMF网元发送所述AMF网元对应的第二安全策略，所述AMF网元对应的第二安全策略包括用于指示所述AMF网元释放所述异常业务对应的用户；或者，向所述PCF网元发送所述PCF网元对应的第二安全策略，所述PCF网元对应的第二安全策略包括用于指示所述PCF网元释放所述异常业务对应的用户；所述第四网元为SCP网元，向所述SCP网元发送所述SCP网元对应的第二安全策略，所述SCP网元对应的第二安全策略包括用于指示所述SCP网元停止对所述第二网元的消息转发；所述第四网元为NRF网元，向所述NRF网元发送所述NRF网元对应的第二安全策略，所述NRF网元对应的第二安全策略包括用于指示所述NRF网元停止对所述第二网元的用户授权；所述第四网元为SDN网元，向所述SDN网元发送所述SDN网元对应的第二安全策略，所述SDN网元对应的第二安全策略包括用于指示所述SDN网元停止对所述第二网元的网段的消息的路由转发。
如图9所示，为本申请实施例提供的一种网络事件处理装置示意图，该装置可以是上述实施例中的NWDAF网元和/或SPF网元。该装置900包括：处理器902和通信接口903，可选的，装置900还可以包括存储器901。可选的，装置900还可以包括通信线路904。其中，通信接口903、处理器902以及存储器901可以通过通信线路904相互连接；通信线路904可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。所述通信线路904可以分为地址总线、数据总线、控制总线等。为便于表示，图9中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
处理器902可以是一个CPU，微处理器，ASIC，或一个或多个用于控制本申请实施例方案程序执行的集成电路。
处理器902，可以用于根据K个第一网元的消息交互行为信息，确定出第二网元发生 网络安全异常事件；所述网络数据分析功能网元向SPF网元发送第一指示信息，所述第一指示信息用于指示所述第二网元发生所述网络安全异常事件；和/或，根据所述第一指示信息，确定出与所述第二网元具有关联关系的N个第三网元；针对所述N个第三网元中的一个第三网元，所述第三网元具有对所述第二网元的业务进行处理的能力；针对所述N个第三网元中的一个第三网元。
通信接口903，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)，有线接入网等。
通信接口903，可以用于获取K个第一网元的消息交互行为信息，针对所述K个第一网元中的一个第一网元，所述第一网元的消息交互行为信息包括用于指示所述第一网元传输的消息的属性信息；所述K为正整数；或者，用于接收网络数据分析功能网元发送的第一指示信息，所述第一指示信息用于指示所述第二网元发生网络安全异常事件；所述SPF网元所述SPF网元向所述第三网元发送所述第三网元对应的第一安全策略，所述第三网元对应的第一安全策略中包括用于指示所述第三网元对所述第二网元对应的业务进行隔离的指示信息。
其中，上述方案的具体实现将在后续方法实施例中详细阐述，在此不予赘述。
存储器901可以是ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路904与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器901用于存储执行本申请实施例方案的计算机执行指令，并由处理器902来控制执行。处理器902用于执行存储器901中存储的计算机执行指令，从而实现本申请实施例上述实施例提供的网络事件处理方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
在本申请的描述中，除非另有说明，“/”表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。同时，在本申请实施例中，“示例性的”或者 “例如”等词用于表示作例子、例证或说明。本申请实施例中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念，便于理解。
此外，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包括一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
本申请实施例中所描述的各种说明性的逻辑单元和电路可以通过通用处理器，数字信号处理器，专用集成电路(ASIC)，现场可编程门阵列(FPGA)或其它可编程逻辑装置，离散门或晶体管逻辑，离散硬件部件，或上述任何组合的设计来实现或操作所描述的功能。通用处理器可以为微处理器，可选地，该通用处理器也可以为任何传统的处理器、控制器、微控制器或状态机。处理器也可以通过计算装置的组合来实现，例如数字信号处理器和微处理器，多个微处理器，一个或多个微处理器联合一个数字信号处理器核，或任何其它类似的配置来实现。
本申请实施例中所描述的方法或算法的步骤可以直接嵌入硬件、处理器执行的软件单元、或者这两者的结合。软件单元可以存储于RAM存储器、闪存、ROM存储器、EPROM存储器、EEPROM存储器、寄存器、硬盘、可移动磁盘、CD-ROM或本领域中其它任意形式的存储媒介中。示例性地，存储媒介可以与处理器连接，以使得处理器可以从存储媒介中读取信息，并可以向存储媒介存写信息。可选地，存储媒介还可以集成到处理器中。处理器和存储媒介可以设置于ASIC中。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、 变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (22)

  1. 一种网络事件处理方法，其特征在于，包括：
    安全事件处理功能网元接收网络数据分析功能网元发送的第一指示信息，所述第一指示信息用于指示所述第二网元发生网络安全异常事件；
    所述安全事件处理功能网元根据所述第一指示信息，确定出与所述第二网元具有关联关系的N个第三网元；针对所述N个第三网元中的一个第三网元，所述第三网元具有对所述第二网元的业务进行处理的能力；N为正整数；
    针对所述N个第三网元中的一个第三网元，所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，所述第三网元对应的第一安全策略中包括用于指示所述第三网元对所述第二网元对应的业务进行隔离的指示信息。
  2. 如权利要求1所述的方法，其特征在于，所述安全事件处理功能网元向所述第三网元发送所述第三网元对应的第一安全策略，包括以下一项或多项：
    所述第三网元为接入和移动性管理功能网元，所述安全事件处理功能网元向所述接入和移动性管理功能网元发送所述接入和移动性管理功能网元对应的第一安全策略，所述接入和移动性管理功能网元对应的第一安全策略包括用于指示所述接入和移动性管理功能网元对所述第二网元对应的业务进行隔离的指示信息；
    所述第三网元为消息转发网元，所述安全事件处理功能网元向所述消息转发网元发送所述消息转发网元对应的第一安全策略，所述消息转发网元对应的第一安全策略包括用于指示所述消息转发网元忽略对所述第二网元的消息转发请求的指示信息；
    所述第三网元为网元发现功能网元，所述安全事件处理功能网元向所述网元发现功能网元发送所述网元发现功能网元对应的第一安全策略，所述网元发现功能网元对应的第一安全策略包括用于指示所述网元发现功能网元不再对所述第二网元的用户授权的指示信息，和/或，撤销所述第二网元的用户的授权的指示信息；
    所述第三网元为网络路由管理网元，所述安全事件处理功能网元向所述网络路由管理网元发送所述网络路由管理网元对应的第一安全策略，所述网络路由管理网元对应的第一安全策略包括用于指示所述网络路由管理网元忽略对所述第二网元的网段的消息的路由转发请求的指示信息；
    所述第三网元为虚拟化资源管理网元，所述安全事件处理功能网元向所述虚拟化资源管理网元发送所述虚拟化资源管理网元对应的第一安全策略，所述虚拟化资源管理网元对应的第一安全策略包括用于指示所述虚拟化资源管理网元释放所述第二网元对应的虚拟机的指示信息；
    所述第三网元为接入和移动性管理功能网元，所述安全事件处理功能网元向所述接入和移动性管理功能网元发送所述接入和移动性管理功能网元对应的第一安全策略，所述接入和移动性管理功能网元对应的第一安全策略包括用于指示所述接入和移动性管理功能网元释放所述第二网元所绑定的用户的指示信息。
  3. 如权利要求1所述的方法，其特征在于，所述第一指示信息还用于指示所述网络安全异常事件对应的异常业务；所述安全事件处理功能网元接收网络数据分析功能网元发送的第一指示信息之后，还包括：
    所述安全事件处理功能网元根据所述第一指示信息，确定出与所述第二网元具有关联 关系的M个第四网元；针对所述M个第四网元中的一个第四网元，所述第四网元具有对所述异常业务进行处理的能力；M为正整数；
    针对所述M个第四网元中的一个第四网元，所述安全事件处理功能网元向所述第四网元发送所述第四网元对应的第二安全策略，所述第四网元对应的第二安全策略中包括用于指示所述第四网元撤销对所述异常业务进行处理的指示信息，或者包括用于指示所述第四网元不再对所述异常业务进行处理的指示信息。
  4. 如权利要求3所述的方法，其特征在于，所述安全事件处理功能网元向所述第四网元发送所述第四网元对应的第二安全策略，包括以下至少一项：
    所述第四网元为接入和移动性管理功能网元，所述安全事件处理功能网元向所述接入和移动性管理功能网元发送所述接入和移动性管理功能网元对应的第二安全策略，所述接入和移动性管理功能网元对应的第二安全策略包括用于指示所述第四网元忽略所述异常业务的请求的指示信息；
    所述第四网元为接入和移动性管理功能网元或策略控制功能网元，所述安全事件处理功能网元向所述接入和移动性管理功能网元发送所述接入和移动性管理功能网元对应的第二安全策略，所述接入和移动性管理功能网元对应的第二安全策略包括用于指示所述接入和移动性管理功能网元释放所述异常业务对应的用户；或者，所述安全事件处理功能网元向所述策略控制功能网元发送所述策略控制功能网元对应的第二安全策略，所述策略控制功能网元对应的第二安全策略包括用于指示所述策略控制功能网元释放所述异常业务对应的用户的指示信息；
    所述第四网元为消息转发网元，所述安全事件处理功能网元向所述消息转发网元发送所述消息转发网元对应的第二安全策略，所述消息转发网元对应的第二安全策略包括用于指示所述消息转发网元忽略对所述第二网元的异常业务的消息转发请求的指示信息；
    所述第四网元为网元发现功能网元，所述安全事件处理功能网元向所述网元发现功能网元发送所述网元发现功能网元对应的第二安全策略，所述网元发现功能网元对应的第二安全策略包括用于指示所述网元发现功能网元不再对所述第二网元的异常业务的用户授权的指示信息，或者，撤销对所述第二网元的异常业务的用户的授权的指示信息；
    所述第四网元为网络路由管理网元，所述安全事件处理功能网元向所述网络路由管理网元发送所述网络路由管理网元对应的第二安全策略，所述网络路由管理网元对应的第二安全策略包括用于指示所述网络路由管理网元忽略对所述第二网元的异常业务的网段的消息的路由转发请求的指示信息。
  5. 一种网络事件处理方法，其特征在于，包括：
    网络数据分析功能网元获取K个第一网元的消息交互行为信息，针对所述K个第一网元中的一个第一网元，所述第一网元的消息交互行为信息包括用于指示所述第一网元传输的消息的属性信息；所述K为正整数；
    所述网络数据分析功能网元根据所述K个第一网元的消息交互行为信息，确定出第二网元发生网络安全异常事件；
    所述网络数据分析功能网元向安全事件处理功能网元发送第一指示信息，所述第一指示信息用于指示所述第二网元发生所述网络安全异常事件。
  6. 如权利要求5所述的方法，其特征在于，针对所述K个第一网元中的一个第一网元，所述第一网元传输的消息的属性信息，包括以下一项或多项：
    所述消息的类型、所述消息的消息内容、所述第一网元上传输所述消息的接口、所述消息对应的对端传输所述消息的接口。
  7. 如权利要求5所述的方法，其特征在于，所述网络数据分析功能网元根据所述K个第一网元的消息交互行为信息，确定出网络安全异常事件，包括：
    所述网络数据分析功能网元若确定所述第一网元接收到来自第二网元的消息的数量大于第一阈值，则确定存在所述第二网元对所述第一网元的分布式拒绝服务攻击事件；所述第一阈值为根据历史消息频率确定的。
  8. 如权利要求5所述的方法，其特征在于，所述K个第一网元的消息交互行为信息包括：第一消息和第二消息；所述网络数据分析功能网元根据所述K个第一网元的消息交互行为信息，确定出网络安全异常事件，包括：
    所述网络数据分析功能网元若确定所述第一消息中的第二网元的第一身份标识与所述第二消息中所述第二网元的第二身份标识不一致，则确定所述第二网元存在网络安全异常事件。
  9. 如权利要求5所述的方法，其特征在于，所述K个第一网元的消息交互行为信息包括：来自所述K个第一网元的第一终端设备的交互行为消息；所述网络数据分析功能网元根据所述K个第一网元的消息交互行为信息，确定出网络安全异常事件，包括：
    所述网络数据分析功能网元若确定所述第一终端设备的交互行为消息不一致，则确定所述第一终端设备存在网络安全异常事件。
  10. 如权利要求5所述的方法，其特征在于，所述K个第一网元的消息交互行为信息包括：来自所述K个第一网元的第二终端设备的交互行为消息和来自第二网元的所述第二终端设备的用户信息查询请求；所述网络数据分析功能网元根据所述K个第一网元的消息交互行为信息，确定出网络安全异常事件，包括：
    所述网络数据分析功能网元若确定来自第二网元的所述第二终端设备的用户信息查询请求中，所述第二网元中的网元标识不一致，则确定所述网元标识不一致对应的至少两个网元发生网络安全异常事件。
  11. 一种网络事件处理装置，其特征在于，包括：
    收发器，用于接收网络数据分析功能网元发送的第一指示信息；向N个第三网元中的第三网元发送所述第三网元对应的第一安全策略，所述第一指示信息用于指示所述第二网元发生网络安全异常事件；针对所述N个第三网元中的一个第三网元，所述第三网元对应的第一安全策略中包括用于指示所述第三网元对所述第二网元对应的业务进行隔离的指示信息；
    处理器，用于根据所述第一指示信息，确定出与所述第二网元具有关联关系的N个第三网元；针对所述N个第三网元中的一个第三网元，所述第三网元具有对所述第二网元的业务进行处理的能力。
  12. 如权利要求11所述的装置，其特征在于，所述收发器，用于执行以下一项或多项：
    若所述第三网元为接入和移动性管理功能网元，则向所述接入和移动性管理功能网元发送所述接入和移动性管理功能网元对应的第一安全策略，所述接入和移动性管理功能网元对应的第一安全策略包括用于指示所述接入和移动性管理功能网元对所述第二网元对应的业务进行隔离的指示信息；
    若所述第三网元为消息转发网元，则向所述消息转发网元发送所述消息转发网元对应 的第一安全策略，所述消息转发网元对应的第一安全策略包括用于指示所述消息转发网元忽略对所述第二网元的消息转发请求的指示信息；
    若所述第三网元为网元发现功能网元，则向所述网元发现功能网元发送所述网元发现功能网元对应的第一安全策略，所述网元发现功能网元对应的第一安全策略包括用于指示所述网元发现功能网元不再对所述第二网元的用户授权的指示信息，和/或，撤销所述第二网元的用户的授权的指示信息；
    若所述第三网元为网络路由管理网元，则向所述网络路由管理网元发送所述网络路由管理网元对应的第一安全策略，所述网络路由管理网元对应的第一安全策略包括用于指示所述网络路由管理网元忽略对所述第二网元的网段的消息的路由转发请求的指示信息；
    若所述第三网元为虚拟化资源管理网元，则向所述虚拟化资源管理网元发送所述虚拟化资源管理网元对应的第一安全策略，所述虚拟化资源管理网元对应的第一安全策略包括用于指示所述虚拟化资源管理网元释放所述第二网元对应的虚拟机的指示信息；
    若所述第三网元为接入和移动性管理功能网元，则向所述接入和移动性管理功能网元发送所述接入和移动性管理功能网元对应的第一安全策略，所述接入和移动性管理功能网元对应的第一安全策略包括用于指示所述接入和移动性管理功能网元释放所述第二网元所绑定的用户的指示信息。
  13. 如权利要求11所述的装置，其特征在于，所述第一指示信息还用于指示所述网络安全异常事件对应的异常业务；所述处理器，具体用于根据所述第一指示信息，确定出与所述第二网元具有关联关系的M个第四网元；针对所述M个第四网元中的一个第四网元，所述第四网元具有对所述异常业务进行处理的能力；
    针对所述M个第四网元中的一个第四网元，所述收发器，用于向所述第四网元发送所述第四网元对应的第二安全策略，所述第四网元对应的第二安全策略中包括用于指示所述第四网元忽略或撤销对所述异常业务进行处理的指示信息。
  14. 如权利要求13所述的装置，其特征在于，所述收发器，用于执行以下至少一项：
    所述第四网元为接入和移动性管理功能网元，向所述接入和移动性管理功能网元发送所述接入和移动性管理功能网元对应的第二安全策略，所述接入和移动性管理功能网元对应的第二安全策略包括用于指示所述第四网元忽略所述异常业务的请求的指示信息；
    所述第四网元为接入和移动性管理功能网元或策略控制功能网元，向所述接入和移动性管理功能网元发送所述接入和移动性管理功能网元对应的第二安全策略，所述接入和移动性管理功能网元对应的第二安全策略包括用于指示所述接入和移动性管理功能网元释放所述异常业务对应的用户的指示信息；或者，向所述策略控制功能网元发送所述策略控制功能网元对应的第二安全策略，所述策略控制功能网元对应的第二安全策略包括用于指示所述策略控制功能网元释放所述异常业务对应的用户的指示信息；
    所述第四网元为消息转发网元，向所述消息转发网元发送所述消息转发网元对应的第二安全策略，所述消息转发网元对应的第二安全策略包括用于指示所述消息转发网元忽略对所述第二网元的异常业务对应的消息转发请求的指示信息；
    所述第四网元为网元发现功能网元，向所述网元发现功能网元发送所述网元发现功能网元对应的第二安全策略，所述网元发现功能网元对应的第二安全策略包括用于指示所述网元发现功能网元忽略对所述第二网元的异常业务对应的消息的路由转发请求的指示信息；
    所述第四网元为网络路由管理网元，向所述网络路由管理网元发送所述网络路由管理网元对应的第二安全策略，所述网络路由管理网元对应的第二安全策略包括用于指示所述网络路由管理网元忽略对所述第二网元的异常业务对应的消息的路由转发请求的指示信息。
  15. 一种网络事件处理装置，其特征在于，包括：
    收发器，用于获取K个第一网元的消息交互行为信息，向安全事件处理功能SPF网元发送第一指示信息，针对所述K个第一网元中的一个第一网元，所述第一网元的信令交互行为信息包括用于指示所述第一网元传输的消息的属性信息；所述K为正整数；所述第一指示信息用于指示所述第二网元发生所述网络安全异常事件；
    处理器，用于根据所述K个第一网元的消息交互行为信息，确定出第二网元发生网络安全异常事件。
  16. 如权利要求15所述的装置，其特征在于，针对所述K个第一网元中的一个第一网元，所述第一网元传输的消息的属性信息，包括以下一项或多项：
    所述消息的类型、所述消息的消息内容、所述第一网元上传输所述消息的接口、所述消息对应的对端传输所述消息的接口。
  17. 如权利要求15所述的装置，其特征在于，所述处理器，具体用于：若确定所述第一网元接收到来自第二网元的消息的数量大于第一阈值，则确定存在所述第二网元对所述第一网元的分布式拒绝服务攻击事件；所述第一阈值为根据历史消息频率确定的。
  18. 如权利要求15所述的装置，其特征在于，所述K个第一网元的消息交互行为信息包括：第一消息和第二消息；所述处理器，具体用于：若确定所述第一消息中的第二网元的第一身份标识与所述第二消息中所述第二网元的第二身份标识不一致，则确定所述第二网元存在网络安全异常事件。
  19. 如权利要求15所述的装置，其特征在于，所述K个第一网元的消息交互行为信息包括：来自所述K个第一网元的第一终端设备的交互行为消息；所述处理器，具体用于：若确定所述第一终端设备的交互行为消息不一致，则确定所述第一终端设备存在网络安全异常事件。
  20. 如权利要求15所述的装置，其特征在于，所述K个第一网元的消息交互行为信息包括：来自所述K个第一网元的第二终端设备的交互行为消息和来自第二网元的所述第二终端设备的用户信息查询请求；
    所述处理器，具体用于：若确定来自第二网元的所述第二终端设备的用户信息查询请求中，所述第二网元中的网元标识不一致，则确定所述网元标识不一致对应的至少两个网元发生网络安全异常事件。
  21. 一种通信装置，其特征在于，所述装置包括处理器和通信接口，
    所述通信接口，用于输入和/或输出信息；
    所述处理器，用于执行计算机程序或指令，使得权利要求1-10中任一项所述的方法被执行。
  22. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令在被计算机调用时，使所述计算机执行如权利要求1至10任一项所述的方法。
PCT/CN2020/124932 2020-01-31 2020-10-29 一种网络事件处理方法、装置及可读存储介质 WO2021151335A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010077699.7A CN113206814B (zh) 2020-01-31 2020-01-31 一种网络事件处理方法、装置及可读存储介质
CN202010077699.7 2020-01-31

Publications (1)

Publication Number Publication Date
WO2021151335A1 true WO2021151335A1 (zh) 2021-08-05

Family

ID=77024787

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/124932 WO2021151335A1 (zh) 2020-01-31 2020-10-29 一种网络事件处理方法、装置及可读存储介质

Country Status (2)

Country Link
CN (1) CN113206814B (zh)
WO (1) WO2021151335A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113872959A (zh) * 2021-09-24 2021-12-31 绿盟科技集团股份有限公司 一种风险资产等级判定和动态降级方法和装置及设备

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113872802B (zh) * 2021-09-17 2024-01-19 支付宝(杭州)信息技术有限公司 检测网元的方法和装置
CN114189885B (zh) * 2021-09-27 2024-01-12 阿里巴巴达摩院(杭州)科技有限公司 网元信息处理方法、设备及存储介质
CN116208306A (zh) * 2021-11-30 2023-06-02 中兴通讯股份有限公司 异常信令的管控方法、装置、电子设备和存储介质
WO2024011430A1 (en) * 2022-07-12 2024-01-18 Telefonaktiebolaget Lm Ericsson (Publ) Methods and apparatuses for network traffic control
CN117675505A (zh) * 2022-09-08 2024-03-08 华为技术有限公司 事件处理方法、装置及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109698760A (zh) * 2017-10-23 2019-04-30 华为技术有限公司 一种流量处理方法和用户面装置以及终端设备
US20190222489A1 (en) * 2018-04-09 2019-07-18 Intel Corporation NETWORK DATA ANALYTICS FUNCTION (NWDAF) INFLUENCING FIFTH GENERATION (5G) QUALITY OF SERVICE (QoS) CONFIGURATION AND ADJUSTMENT
CN110351229A (zh) * 2018-04-04 2019-10-18 电信科学技术研究院有限公司 一种终端ue管控方法及装置
CN110602735A (zh) * 2018-06-13 2019-12-20 华为技术有限公司 一种受限服务的提供方法及通信设备
WO2020025009A1 (en) * 2018-08-03 2020-02-06 Huawei Technologies Co., Ltd. Methods and functions of network performance monitoring and service assurance

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110312279B (zh) * 2018-03-27 2021-03-05 电信科学技术研究院有限公司 一种网络数据的监测方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109698760A (zh) * 2017-10-23 2019-04-30 华为技术有限公司 一种流量处理方法和用户面装置以及终端设备
CN110351229A (zh) * 2018-04-04 2019-10-18 电信科学技术研究院有限公司 一种终端ue管控方法及装置
US20190222489A1 (en) * 2018-04-09 2019-07-18 Intel Corporation NETWORK DATA ANALYTICS FUNCTION (NWDAF) INFLUENCING FIFTH GENERATION (5G) QUALITY OF SERVICE (QoS) CONFIGURATION AND ADJUSTMENT
CN110602735A (zh) * 2018-06-13 2019-12-20 华为技术有限公司 一种受限服务的提供方法及通信设备
WO2020025009A1 (en) * 2018-08-03 2020-02-06 Huawei Technologies Co., Ltd. Methods and functions of network performance monitoring and service assurance

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113872959A (zh) * 2021-09-24 2021-12-31 绿盟科技集团股份有限公司 一种风险资产等级判定和动态降级方法和装置及设备
CN113872959B (zh) * 2021-09-24 2023-05-16 绿盟科技集团股份有限公司 一种风险资产等级判定和动态降级方法和装置及设备

Also Published As

Publication number Publication date
CN113206814B (zh) 2022-11-18
CN113206814A (zh) 2021-08-03

Similar Documents

Publication Publication Date Title
WO2021151335A1 (zh) 一种网络事件处理方法、装置及可读存储介质
Thantharate et al. Secure5G: A deep learning framework towards a secure network slicing in 5G and beyond
Kim 5G core network security issues and attack classification from network protocol perspective.
US11582589B2 (en) Wireless network policy manager for a service mesh
US11985111B2 (en) Method for message filtering in an edge node based on data analytics
EP3863317B1 (en) Method and device for determining category information
WO2021017550A1 (zh) 一种事件报告的发送方法、装置及系统
CN108605264B (zh) 用于网络管理的方法和设备
US20220256396A1 (en) Congestion control method and apparatus
EP3815412B1 (en) Apparatus for a service based architecture
US12022576B2 (en) Cloud-based interworking gateway service
Tabiban et al. Signaling Storm in O-RAN: Challenges and Research Opportunities
WO2023041054A1 (zh) 网络验证的方法和装置
US20220311747A1 (en) Method and system for securing connections to iot devices
US20230007018A1 (en) Dynamic multi-network security controls
WO2022012490A1 (zh) 一种可信通信方法以及相关装置
US11539741B2 (en) Systems and methods for preventing, through machine learning and access filtering, distributed denial of service (“DDoS”) attacks originating from IoT devices
Benfarhi et al. Evaluation of Authentication and Key Agreement Approaches of 5G Networks
WO2023041056A1 (zh) 网络验证的方法和装置
KR102678476B1 (ko) 이동통신망 단말의 제어평면 메시지 기반 핑거프린트를 사용한 심박스 차단 방법 및 장치
WO2024207998A1 (zh) 通信方法和通信装置
Benfarhi et al. Check for updates Evaluation of Authentication and Key Agreement Approaches of 5G Networks
Lopez Giron Analysis of Machine Learning Techniques to Secure 5G Networks
WO2024069597A1 (en) Suspicious behavior reporting
CN118118907A (zh) 一种多园区的无线专网安全防护方法、装置和中心节点

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20917059

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20917059

Country of ref document: EP

Kind code of ref document: A1