WO2022089130A1 - 一种异常终端控制方法及装置 - Google Patents

一种异常终端控制方法及装置 Download PDF

Info

Publication number
WO2022089130A1
WO2022089130A1 PCT/CN2021/121210 CN2021121210W WO2022089130A1 WO 2022089130 A1 WO2022089130 A1 WO 2022089130A1 CN 2021121210 W CN2021121210 W CN 2021121210W WO 2022089130 A1 WO2022089130 A1 WO 2022089130A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
network device
control action
data
abnormal
Prior art date
Application number
PCT/CN2021/121210
Other languages
English (en)
French (fr)
Inventor
周艳
林青春
张博
何承东
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21884860.4A priority Critical patent/EP4236410A4/en
Publication of WO2022089130A1 publication Critical patent/WO2022089130A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method and device for controlling an abnormal terminal.
  • a terminal accesses an IP network through a core network to communicate, it needs to obtain an IP address first.
  • the IP address of the terminal is allocated by the core network.
  • the terminal After the terminal obtains the IP address allocated by the core network, the terminal carries the IP address in the sent service data, and the core network calculates the session policy according to the IP address.
  • terminals that initiate network attacks When the terminal is hijacked, it may launch various network attacks such as network scanning, distributed denial of service attack (DDoS), and virus transmission. Terminals that initiate network attacks often use IP address spoofing in order to hide their identities or break through network protection during attacks. When a terminal that initiates a network attack spoofs its IP address, it will fake a trusted IP address to break through network security measures, or use the IP address of another terminal to hide the attack identity, making it difficult for network devices to accurately trace the source of the attack. .
  • DNS distributed denial of service attack
  • the existing abnormal terminal control method is relatively simple, and cannot effectively control the abnormal terminal.
  • the present application provides a method and device for controlling abnormal terminals, which can effectively control abnormal terminals.
  • an embodiment of the present application provides a method for controlling an abnormal terminal, and the method is applicable to the communication system as shown in FIG. 1 .
  • the method includes:
  • the first network device receives data from the terminal device, the data includes user plane data and/or control plane data; the first network device determines the terminal abnormality information of the terminal device according to the data, and the terminal abnormality information includes at least one of a terminal identifier, a terminal abnormal state, and a terminal abnormal event; the first network device acquires a first control action corresponding to the terminal device according to the terminal abnormality information, and controls the terminal device according to the first control action. Terminal equipment for control and management.
  • the first network device can determine the first control action corresponding to the terminal device according to the obtained terminal abnormality information, and when the terminal device has a network attack behavior, it can timely perform the corresponding control action according to the first control action corresponding to the terminal device.
  • Terminal devices are controlled and managed, thereby improving network security.
  • acquiring, by the first network device, the first control action corresponding to the terminal device according to the terminal abnormality information includes: acquiring, by the first network device, the terminal according to the terminal abnormality information.
  • control strategy further includes part or all of terminal identification, terminal abnormal state and terminal abnormal event.
  • the first network device can obtain the control strategy corresponding to the terminal device, and the control strategy includes the first control action, and can also include some or all of the terminal identifier, the terminal abnormal state and the terminal abnormal event, so as to obtain more A large amount of terminal abnormal information is obtained, thereby realizing accurate control and management of terminal equipment.
  • the terminal abnormal event is a control plane abnormal event
  • the first control action is a control plane control action and/or a data plane control action
  • the terminal abnormal event is a data plane abnormal event
  • the first control action is a control plane control action and/or a data plane control action.
  • the first network device controls and manages the terminal device, it can control and manage the terminal device from the control surface, such as prohibiting the terminal device from accessing the network; or control and manage the terminal device from the data surface, such as discarding the terminal data sent by the device.
  • control and manage the control plane and the data plane of the terminal device at the same time.
  • the first network device determining the terminal abnormality information of the terminal device according to the data sent by the terminal device includes: the first network device obtains, according to the data, the terminal abnormality information of the terminal device. and/or, the first network device performs abnormality detection on the data, and determines a terminal abnormality event and/or a terminal abnormality state of the terminal device.
  • the first network device can determine the terminal identifier according to the data sent by the terminal device, or perform abnormality detection on the data, determine the terminal abnormal event and/or the terminal abnormal state of the terminal device, and then determine various terminal abnormality information, providing a variety of terminal abnormality information.
  • the first network device determines context information associated with the user plane data, and determines a terminal identifier according to the context information.
  • the first network device determines the permanent identifier of the terminal device according to the control plane data, and uses the permanent identifier of the terminal device as the The terminal identification of the terminal equipment; wherein, the control plane data includes the temporary identification or permanent identification of the terminal equipment.
  • the first network device when the terminal identifier in the control plane data is a temporary identifier, the first network device associates the context information of the terminal device according to the temporary identifier of the terminal device; the first network device associates the context information of the terminal device according to the temporary identifier of the terminal device; The network device determines the permanent identity of the terminal device according to the context information of the terminal device.
  • the first network device after receiving the data sent by the terminal device, the first network device can determine the terminal identifier according to the data, so as to determine the first control action corresponding to the terminal device according to the terminal identifier.
  • the embodiments of the present application provide different terminal identification determination methods for different data types (such as control plane data or user plane data) sent by the terminal device, so that the first network device can accurately determine the terminal identification according to the data sent by the terminal device.
  • the terminal abnormality information includes a terminal identifier
  • the first network device is an access management function entity
  • the first network device acquires the first network device corresponding to the terminal device according to the terminal abnormality information.
  • a control action includes: the first network device sends a subscription data request message carrying the terminal identifier to a second network device, where the second network device is a data management function entity; The second network device acquires subscription data of the terminal device, wherein the subscription data includes the first control action.
  • the data management function entity stores the subscription data of the terminal device, and the first network device obtains the terminal device from the second network device.
  • Device subscription data so that the first control action corresponding to the terminal device included in the subscription data can be acquired without sending additional information, which further improves the control efficiency of the abnormal terminal device.
  • the first control action is a control action determined by the fourth network device according to the terminal abnormal event of the terminal device reported by the third network device and delivered to the second network device.
  • the third network device can also perform abnormality detection on the data sent by the terminal device, and report the determined abnormal event of the terminal to the fourth network device, and then the fourth network device will determine the abnormal event of the terminal.
  • the first control action is delivered to the second network device. That is to say, the embodiments of the present application are not limited to the abnormal terminal control method in which the first network device and the second network device interact, and the abnormal terminal control may be implemented by the interaction of multiple network devices.
  • the terminal abnormality information includes a terminal identifier
  • the first network device is an access management function entity or a session management function entity
  • the first network device obtains the terminal abnormality information according to the terminal abnormality information.
  • the control policy corresponding to the terminal device includes: the first network device sends a policy request message carrying the terminal identifier to the second network device; wherein the second network device is a policy control function entity; the first network device A network device receives the first control action returned by the second network device.
  • the first network device when the first network device is an access management function entity or a session management function entity, and the second network device is a policy control function entity, the first network device can, when determining that the terminal device needs to be controlled and managed, report to the third network device.
  • the second network device sends a policy request message to acquire the first control action corresponding to the terminal device, so as to control and manage the terminal device.
  • the first control action is a control action determined by the second network device according to the terminal abnormal event of the terminal device reported by the third network device.
  • the third network device may also perform abnormality detection on the terminal device, and report the determined abnormality event of the terminal to the second network device. That is to say, the embodiments of the present application are not limited to the abnormal terminal control method in which the first network device and the second network device interact, and the abnormal terminal control may be implemented by the interaction of multiple network devices.
  • the first network device is a user plane functional entity, and the first network device acquires the first control action corresponding to the terminal device according to the terminal abnormality information, including: the first control action
  • the network device queries the local device for the first control action corresponding to the terminal device according to the terminal abnormality information.
  • the first network device queries the local device for the first control action corresponding to the terminal device according to the terminal abnormality information, including: the first network device receives a transmission from the second network device.
  • the configuration command includes matching conditions and corresponding control actions, and the matching conditions include at least one of the terminal identifier, terminal abnormal state and terminal abnormal event; the first network device according to the matching
  • the corresponding relationship between the condition and the control action is to determine the control action corresponding to the terminal abnormality information, and use the determined control action as the first control action.
  • the second network device delivers the matching conditions and corresponding control actions to the first network device in advance, and the first network device needs to control and manage the terminal device when , according to the terminal abnormality information, query the control action corresponding to the terminal device in the device, control and manage the terminal device in time, reduce the delay caused by message transmission, and improve the efficiency of abnormal terminal control.
  • the first network device before the first network device acquires the first control action corresponding to the terminal device according to the terminal abnormality information, the first network device performs abnormality detection on the data, and determines the the terminal abnormal event of the terminal device; the first network device reports the terminal abnormal event of the terminal device to the second network device.
  • the first network device can perform abnormality detection on the data sent by the terminal device, determine the terminal abnormality event of the terminal device, and report the terminal abnormality event to the second network device, enabling the second network device to record the terminal abnormality of the terminal device.
  • the terminal device can be controlled and managed when the terminal device accesses it next time, without repeating the abnormality detection many times and wasting network resources.
  • the first network device before the first network device acquires the first control action corresponding to the terminal device according to the terminal abnormality information, the first network device performs abnormality detection on the data, and determines the the terminal abnormal event of the terminal device; the first network device reports the terminal abnormal event of the terminal device to the second network device; the first network device receives from the second network device and the terminal abnormality event The second control action corresponding to the event; the first network device controls and manages the terminal device according to the second control action.
  • the second control action may be the same as the first control action.
  • the first network device performs abnormality detection on the data sent by the terminal device, and after determining the terminal abnormality event of the terminal device, reports the terminal abnormality event to the second network device, and the second network device determines the second control corresponding to the terminal abnormality event. action, and deliver the second control action to the first network device, so that the terminal device with abnormal attack behavior can be controlled and managed in a timely and accurate manner.
  • the first network device reports the terminal abnormal event of the terminal device to the second network device, including:
  • the first network device reports the terminal abnormal event of the terminal device to the second network device through an alarm message; or the first network device reports the terminal of the terminal device to the second network device through a service log an abnormal event; or the first network device reports the terminal abnormal event of the terminal device to the second network device through a message interface.
  • the first network device performs anomaly detection on the data according to the following methods:
  • the first network device determines the terminal abnormal event of the terminal device according to the data sent by the terminal device within the preset time period and a reference value; wherein the reference value is based on historical data of the terminal device. , determined based on the trained statistical analysis model.
  • Manner 2 The first network device determines the terminal abnormal event corresponding to the data based on the trained machine learning model.
  • Manner 3 The first network device determines a terminal abnormal event of the terminal device according to the data based on a preset matching rule.
  • the embodiments of the present application provide a variety of anomaly detection methods, perform anomaly detection on terminal devices through machine learning, rule matching, statistical analysis, etc., improve the accuracy of anomaly detection, and can detect a variety of terminal anomaly events, so as to improve the accuracy of anomaly detection.
  • the corresponding control actions are determined for different terminal abnormal events, and the terminal equipment is controlled and managed in a targeted manner to further improve network security.
  • the first network device controls and manages the terminal device according to the first control action within a preset time period.
  • the first network device controls and manages the terminal device according to the first control action.
  • the terminal device is regarded as a legal terminal and no longer controls and manages.
  • the device no longer conducts network attacks, or the terminal device does not initiate network attack behaviors, normal services of the terminal device are restored.
  • an embodiment of the present application provides a method for controlling an abnormal terminal, and the method is applicable to the communication system as shown in FIG. 1 .
  • the method includes:
  • the second network device receives a request message sent by the first network device; the request message includes terminal abnormality information of the terminal device, and the terminal abnormality information includes at least one of a terminal identifier, a terminal abnormality state, and a terminal abnormality event; the The second network device determines a first control action corresponding to the terminal device, where the first control action corresponds to the terminal abnormality information, and delivers the first control action to the first network device.
  • the second network device determines the first control action corresponding to the terminal device according to the terminal abnormality information, and can specifically determine the first control action corresponding to the abnormal terminal device action.
  • the second network device delivers the first control action corresponding to the terminal device to the first network device, so as to assist the first network device to accurately control and manage the abnormal terminal.
  • determining, by the second network device, the first control action corresponding to the terminal device includes: determining, by the second network device, a control strategy corresponding to the terminal device, where the control strategy includes all the first control action; the delivering the first control action to the first network device includes: the second network device delivering the control policy to the first network device.
  • control strategy further includes some or all of the terminal identification, terminal abnormal status, and terminal abnormal events.
  • the second network device can determine a control strategy including the first control action, and the control strategy can also include terminal identification, terminal abnormal status, terminal abnormal events, etc., so that more abundant terminal abnormal information can be recorded, so as to provide information for the terminal. Provide reference for equipment control and management, and further improve the accuracy of abnormal terminal control.
  • the terminal abnormal event is a control plane abnormal event
  • the first control action is a control plane control action and/or a data plane control action
  • the terminal abnormal event is a data plane abnormal event
  • the first control action is a control plane control action and/or a data plane control action.
  • the second network device is a data management function entity
  • the second network device receiving the request message sent by the first network device includes: the second network device receiving the first network device A subscription data request message sent by a device; the subscription data request message includes the terminal identifier; the first network device is an access management function entity; the first control action is delivered to the first network device
  • the network device includes: the second network device sends subscription data corresponding to the terminal identifier to the first network device, wherein the subscription data includes the first control action.
  • the second network device when the first network device is an access management function entity and the second network device is a data management function entity, the second network device sends the subscription data of the terminal device to the first network device, so that the first network device The first control action corresponding to the terminal device is acquired from the contract data, and the abnormal terminal is controlled and managed in time.
  • the second network device is a policy control function entity
  • the second network device receiving the request message sent by the first network device includes: the second network device receiving the first network device A policy request message carrying the terminal identifier sent by the device; wherein the first network device is an access management function entity or a session management function entity.
  • the first network device when the first network device is an access management function entity or a session management function entity, and the second network device is a policy control function entity, the first network device can request the second network device to correspond to the terminal device through a policy request message.
  • the first control action corresponding to the terminal device can be obtained in time when the terminal device needs to be controlled and managed.
  • the second network device is a network element management function entity
  • the first network device is a user plane function entity
  • the first control action is delivered to the first network device, including: the second network device invokes a configuration command according to the first control action, the configuration command includes a matching condition and a corresponding control action, and the matching condition includes the terminal identifier, the abnormal state of the terminal and the terminal At least one of abnormal events; the second network device will send the configuration command to the first network device.
  • the second network device when the first network device is a user plane functional entity, the second network device sends the matching conditions and corresponding control actions to the first network device through a configuration command, so that the first network device determines that the terminal accesses At this time, the device inquires the control action corresponding to the terminal device according to the matching condition and the corresponding control action, reduces the delay caused by the message transmission between the network devices, and improves the efficiency of abnormal terminal control.
  • the method before the second network device receives the request message from the first network device, the method further includes: receiving, by the second network device, the terminal abnormality of the terminal device reported by the first network device. event; the second network device determines the second control action corresponding to the terminal abnormal event according to the preset correspondence between the terminal abnormal event and the control action; and sends the second control action corresponding to the terminal abnormal event to the the first network device.
  • the second network device before the second network device receives the request message from the first network device, and after receiving the terminal abnormal event reported by the first network device, the second network device determines the second control action corresponding to the terminal device, and determines the second control action corresponding to the terminal device.
  • the generated second control action is sent to the first network device, so as to assist the first network device to control and manage the terminal device with abnormal behavior in a timely manner, thereby improving network security.
  • an embodiment of the present application provides an apparatus for controlling an abnormal terminal, including a unit for executing each step in the above first aspect.
  • an embodiment of the present application provides an apparatus for controlling an abnormal terminal, including a unit for executing each step in the second aspect above.
  • embodiments of the present application provide an abnormal terminal control functional entity, including at least one processing element and at least one storage element, wherein the at least one storage element is used to store programs and data, and the at least one processing element is used to execute The method provided by the above second aspect of the present application.
  • an embodiment of the present application provides a communication system, including the abnormal terminal control apparatus provided in the third aspect, and the abnormal terminal control apparatus provided in the fourth aspect.
  • an embodiment of the present application further provides a computer program, which, when the computer program runs on a computer, causes the computer to execute the method provided in the first aspect or the second aspect.
  • an embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a computer, the computer is made to execute the above-mentioned first A method provided in the aspect or the second aspect.
  • an embodiment of the present application further provides a chip, where the chip is configured to read a computer program stored in a memory, and execute the method provided in the first aspect or the second aspect.
  • an embodiment of the present application further provides a chip system, where the chip system includes a processor for supporting a computer device to implement the method provided in the first aspect or the second aspect.
  • the chip system further includes a memory for storing necessary programs and data of the computer device.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • FIG. 1 is a schematic diagram of the architecture of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a flowchart of a method for controlling an abnormal terminal provided by an embodiment of the present application
  • FIG. 3 is a flowchart of an abnormal terminal control method under a first 5G communication system provided by an embodiment of the present application
  • FIG. 4 is a flowchart of an abnormal terminal control method under a second 5G communication system provided by an embodiment of the present application
  • FIG. 5 is a flowchart of an abnormal terminal control method under a third 5G communication system provided by an embodiment of the present application.
  • FIG. 6 is a flowchart of an abnormal terminal control method under a fourth 5G communication system provided by an embodiment of the present application.
  • FIG. 7 is a flowchart of an abnormal terminal control method under a fifth 5G communication system provided by an embodiment of the present application.
  • FIG. 8 is a flowchart of an abnormal terminal control method provided by an embodiment of the present application where a security management function entity interacts with a CN as an example;
  • FIG. 9 is a schematic structural diagram of a first abnormal terminal control apparatus provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a second abnormal terminal control apparatus provided by an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a first abnormal terminal control functional entity provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a second abnormal terminal control functional entity provided by an embodiment of the present application.
  • a security management functional entity capable of controlling and managing abnormal terminals based on the saved control actions.
  • the control action may be pre-configured by a technician, or generated according to some set policy generation methods.
  • the security management functional entity After receiving the terminal abnormal event reported by other functional entities (such as functional entities in the core network), the security management functional entity can determine the control action to be implemented on the terminal according to the terminal abnormal event, and send the control action to the core network device. In this way, it assists the core network equipment to control and manage abnormal terminals, and effectively prevents network attacks of abnormal terminals.
  • the embodiment of the present application does not limit the representation of the security management function entity, which may be a network edge device or server with a security management function, or a functional entity in the core network (for example, a network element management function entity). or policy control functional entity) and so on.
  • the security management function entity may be a network edge device or server with a security management function, or a functional entity in the core network (for example, a network element management function entity). or policy control functional entity) and so on.
  • IP Internet Protocol
  • TCP/IP Transmission Control Protocol
  • the purpose of designing IP is to improve the scalability of the network: one is to solve the Internet problem and realize the interconnection of large-scale and heterogeneous networks; independent development.
  • IP According to the end-to-end design principle, IP only provides a connectionless, unreliable, best-effort packet transmission service for the host.
  • IP is the core of the entire TCP/IP protocol suite and the foundation of the Internet. IP is located in the network layer of the TCP/IP model, and can carry information of various protocols in the transport layer, such as TCP, UDP, etc.; on the other hand, IP packets can be placed in the link layer, and can be transmitted through Ethernet and token ring networks. and other technologies to transmit.
  • IP stipulates that all devices on the network must have a unique IP address. Since each terminal device in the IP network has a unique address, it ensures that users can efficiently and conveniently access the Select the object you need from the terminal device.
  • Signing information refers to the user access information signed between the terminal equipment and the operator or other companies that build the network. After signing the contract, the terminal device can access the corresponding network according to the network identifier in the contract information, and use the network resources.
  • the subscription information is stored on the core network side and the terminal device side. If there is a change, the core network will initiate a UE configuration update process (UE configuration update) to notify the terminal device side.
  • UE configuration update UE configuration update
  • Integrity protection refers to the protection and transmission of data integrity during the data transmission process, so that the data received by the receiving end is the accurate data sent by the transmitting end, preventing the data from being falsified or forged during the transmission process. IP address.
  • the communication system includes three parts: a terminal device, a mobile communication network, and a data network (DN) .
  • DN data network
  • a terminal device is a device that provides voice and/or data connectivity to a user.
  • a terminal device may also be called a user equipment (user equipment, UE), a mobile station (mobile station, MS), a mobile terminal (mobile terminal, MT), and the like.
  • the terminal device may be a handheld device with a wireless connection function, a vehicle-mounted device, or the like.
  • terminal devices are: mobile phone (mobile phone), tablet computer, notebook computer, PDA, mobile internet device (MID), wearable device, virtual reality (VR) device, augmented Augmented reality (AR) equipment, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, smart grid wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • An abnormal terminal refers to a terminal that performs network attacks after accessing the network, such as a terminal that performs network scanning, DDoS, virus transmission, and other attack behaviors after accessing the network. After an abnormal terminal attacks the network, it may cause security problems such as network inaccessibility and resource leakage. Therefore, timely detection and control of abnormal terminals can effectively maintain network security.
  • the terminal device may be referred to as a terminal for short.
  • a DN also known as a packet data network (PDN)
  • PDN packet data network
  • a variety of services can be deployed on the DN, and services such as data and/or voice can be provided for terminal equipment.
  • the mobile communication network can access at least one DN, and the same DN can also be accessed by at least one mobile communication network.
  • the DN may be a packet data network (PDN), such as the Internet (Internet), an IP Multi-media Service (IMS) network, a data network dedicated to certain applications (such as Tencent Video's data network), Ethernet, IP local network, etc., which are not limited in this application.
  • the mobile communication network provides access services and end-to-end connection services for terminal devices.
  • the terminal equipment can access the DN through the mobile communication network to realize specific services.
  • the mobile communication network may further include an access network (access network, AN) and a core network (core network, CN).
  • access network access network
  • core network core network
  • the AN is mainly responsible for the wireless access function of the terminal equipment.
  • CN is used to access terminal equipment to DN.
  • the AN device provides wireless access services to the terminal.
  • the AN device is a node in the AN, which may also be referred to as a base station, or may also be referred to as a radio access network (radio access network, RAN) node (or device).
  • RAN radio access network
  • access network equipment are: gNB, transmission reception point (TRP), evolved Node B (evolved Node B, eNB), radio network controller (radio network controller, RNC), Node B (Node B, NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved NodeB, or home Node B, HNB), baseband unit (base band unit, BBU), or wireless fidelity (wireless fidelity, Wifi) access point (access point, AP), etc.
  • TRP transmission reception point
  • eNB evolved Node B
  • RNC radio network controller
  • Node B Node B
  • BSC base station controller
  • base transceiver station base transceiver station
  • BTS home base station
  • home base station for example, home evolved NodeB, or home Node B, HNB
  • baseband unit base band unit, BBU
  • wireless fidelity wireless fidelity, Wifi
  • CN is divided according to specific logical functions, and the core network can be divided into control plane (control plane, CP) and user plane (user plane, UP). Then the entities responsible for the control plane functions in the core network may be collectively referred to as control plane function entities, and the entities responsible for the user plane functions may be collectively referred to as user plane function entities.
  • Each functional entity in the core network can also be called a network element, which can be either a network element implemented on dedicated hardware, an instance of software running on dedicated hardware, or an instance of virtualized functions on an appropriate platform.
  • the user plane functional entity is mainly responsible for the forwarding and reception of user plane data of the terminal.
  • the user plane function entity can receive user plane data from the DN and transmit it to the UE through the AN device; the user plane function entity can also receive the user plane data from the UE through the AN device and forward it to the DN.
  • the transmission resources and scheduling functions that provide services for the UE in the user plane functional entity are managed and controlled by the control plane functional entity.
  • Control plane functional entities include: policy control function (PCF) entity, unified data management (UDM) entity, access and mobility management function (AMF) entity, session management function (session management function, SMF) entity, network element management system (network element management system, EMS).
  • PCF policy control function
  • UDM unified data management
  • AMF access and mobility management function
  • SMF session management function
  • SMF session management function
  • EMS network element management system
  • the UPF entity, the AMF entity, the PCF entity, the UDM entity, and the SMF entity are referred to as AMF, PCF, UDM, UPF, and SMF for short.
  • the AMF and the UE can be connected through the N1 interface
  • the AMF and the AN device can be connected through the N2 interface
  • the AN device and the UPF can be connected through the N3 interface
  • the SMF and the UPF can be connected through the N4 interface
  • the UPF and the UPF can be connected through the N4 interface.
  • DNs can be connected through the N6 interface.
  • the interface name is only an example description, which is not specifically limited in this embodiment of the present application. It should be understood that the embodiments of the present application are not limited to the communication system shown in FIG. 1 , and the names of the network elements shown in FIG. 1 are described here only as an example, and are not included in the communication system architecture applicable to the method of the present application.
  • the limitations of the functional entity The functions of each functional entity or device in the CN are described in detail below:
  • AMF can be used to manage the access control and mobility of the UE. In practical applications, it includes the mobility management in the mobility management entity (MME) in the network framework in the long term evolution (LTE). In addition, the access management function is added, which can specifically be responsible for UE registration, mobility management, tracking area update process, reachability detection, session management function network element selection, mobility state transition management, etc. In the communication system as shown in Figure 1, the AMF can provide Namf services.
  • MME mobility management entity
  • LTE long term evolution
  • the AMF can provide Namf services.
  • SMF can be used for session management of the terminal (including session establishment, modification and release), UPF selection and reselection, UE's internet protocol (IP) address allocation, quality of service (QoS) control, etc. .
  • the SMF can provide Nsmf service.
  • PCF can be used to be responsible for policy control decisions, to provide functions such as service data flow and application detection, gate control, QoS, and flow-based charging control.
  • the PCF can provide Npcf service.
  • the UDM can be used to manage subscription data of the UE, registration information related to the terminal, and the like.
  • the UDM may provide Nudm services.
  • EMS can be used to manage one or more telecommunications network elements of a specific type, provide unified operation and maintenance functions in the field of professional networks, and can manage and maintain equipment and networks end-to-end.
  • the communication system shown in FIG. 1 does not constitute a limitation of the communication system to which the embodiments of the present application can be applied, wherein the communication system architecture shown in FIG. 1 is a 5G system architecture.
  • the methods in the embodiments of the present application are also applicable to 2G communication systems, 3G communication systems, 4G communication systems, and various future communication systems, such as 6G or other communication systems.
  • the names of all functional entities in this application are only examples, and may also be referred to as other names in future communications, or the network elements involved in this application may also be identified by other entities or devices with the same function in future communications. Instead, this application does not limit this. A unified description is made here, and will not be repeated in the future.
  • the network element having the functions of the AMF may also be called MME
  • the network elements having the functions of SMF and UPF may also be corresponding to the SGW and the PGW.
  • the terminal performs service communication in the communication system as shown in Figure 1. For example, when the terminal accesses the IP network through the CN to communicate, the CN assigns a unique IP address to the terminal. After the terminal obtains the IP address assigned by the CN, it sends the The IP address is carried in the service data, and the CN performs processing such as calculating the session policy according to the IP address.
  • the terminal when the terminal is hijacked, it may initiate network attacks such as network scanning, DDoS, and virus transmission.
  • the terminal that initiates a network attack often uses IP address spoofing to access the network by spoofing a trusted IP address to initiate a network attack.
  • the terminal disguises its IP address as another source.
  • IP address the data packet sent by the terminal includes a fake source IP address.
  • the service server sends the corresponding data packet to the terminal, these servers cannot determine whether the source IP address is fake or not, and will directly use the fake source IP address. As the destination address, these service servers are easily attacked by abnormal terminals.
  • a common method is to set up a network firewall to allow only terminals that meet the access control rules to access the network, thereby blocking abnormal terminals.
  • the network firewall cannot learn the IP address assigned by the CN to the terminal, so it cannot identify whether the terminal has IP address spoofing, and the access control rules of the firewall become invalid.
  • an embodiment of the present application provides a method for controlling an abnormal terminal, which is used for detecting an abnormal terminal and controlling and managing the abnormal terminal, thereby improving network security.
  • the method can be applied to the communication system as shown in FIG. 1 .
  • the steps of the method will be described in detail below with reference to the flowchart shown in FIG. 2 .
  • the first network device involved in this embodiment may be AMF, SMF, or UPF in the communication system
  • the second network device may be UDM, EMS, or PCF in the communication system.
  • S201 The first network device receives data from the terminal.
  • the first network device after determining that the terminal accesses the CN, acquires data sent by the terminal.
  • the data sent by the terminal includes user plane data and/or control plane data.
  • S202 The first network device determines terminal abnormality information of the terminal according to the data.
  • the terminal abnormality information includes at least one of a terminal identifier, a terminal abnormality state, and a terminal abnormality event.
  • the terminal abnormal state is used to indicate whether the terminal is an abnormal terminal, and a terminal with abnormal behavior such as network attack behavior is an abnormal terminal.
  • the terminal abnormal event is a terminal abnormal event determined after abnormal detection of data sent by the terminal.
  • the first network device obtains the terminal identifier according to the following methods:
  • the first network device After receiving the user plane data, the first network device determines a terminal identifier corresponding to the user plane data.
  • the first network device determines context information associated with the user plane data according to the tunnel identifier of the user plane data, and acquires the terminal identifier from the context information of the terminal.
  • the context information of the terminal is established when the terminal accesses the CN from the control plane.
  • the first network device determines the permanent identification of the terminal according to the control plane data sent by the terminal. Since the control plane data sent by the terminal includes the temporary identification or permanent identification of the terminal, if the control plane data includes the temporary identification of the terminal, the first network device will The temporary identification of the terminal is associated with the context information of the terminal, and the permanent identification of the terminal is obtained from the context information of the terminal.
  • the first network device uses the determined permanent identification of the terminal as the terminal identification.
  • the terminal identifier may also be the terminal's International Mobile Subscriber Identity (IMSI) or a Subscription Permanent Identifier (SUPI), a Mobile Station International ISDN Number (MSISDN) ) or a fixed identifier such as a Generic Public Subscription Identifier (GPSI), an International Mobile Equipment Identity (IMEI) or a Permanent Equipment Identifier (PEI), or a globally unique temporary identifier.
  • IMSI International Mobile Subscriber Identity
  • SUPI Subscriber Identity
  • MSISDN Mobile Station International ISDN Number
  • GPSI Generic Public Subscription Identifier
  • IMEI International Mobile Equipment Identity
  • PEI Permanent Equipment Identifier
  • Temporary identifiers such as Globally Unique Temporary Identifier (GUTI) or Temporary Mobile Subscriber Identity (TMSI) or Tunnel Endpoint Identifier (TEID).
  • the terminal abnormal events include control plane abnormal events and data plane abnormal events.
  • the abnormal events of the control plane are for example: the number of control plane messages sent by the terminal within the preset time period is greater than the preset threshold, the terminal is impersonated as another terminal when accessing the core network, the terminal location is abnormal, and so on.
  • Abnormal events on the data plane such as: the terminal sends IP address spoofing packets, the number of data packets sent by the terminal within a preset time period is greater than the preset threshold, the terminal sends or receives virus traffic, the terminal has Trojan horse behavior, etc.
  • Mode 1 Determine the terminal abnormal event corresponding to the terminal according to the data sent by the terminal within the preset time period and the reference value corresponding to the data type.
  • the first network device preconfigures a reference value corresponding to the data type, where the reference value is determined based on historical data of the terminal and based on a trained statistical analysis model.
  • the trained statistical analysis model inputs the historical data and data type of the terminal into the trained statistical analysis model, and obtain the trained statistical analysis model to output the reference value corresponding to the data type.
  • the terminal abnormal event is a data abnormality:
  • D is the amount of data sent by the terminal within the preset duration
  • R is a reference value corresponding to the data type of the data sent by the terminal within the preset duration
  • b is a preset threshold.
  • the trained statistical analysis model For example, input the historical upstream traffic data of the terminal into the trained statistical analysis model, and obtain the reference value corresponding to the upstream traffic data of the terminal. Acquire uplink traffic data within a preset time period of the terminal, determine the absolute value of the difference between the uplink traffic data and the reference value corresponding to the uplink traffic data, and when the absolute value of the difference is greater than a preset threshold, it is true.
  • the abnormal event of the terminal is abnormal upstream traffic data.
  • the reference value can represent the terminal's behavior in historical services, and the data sent by the terminal within the preset time and the reference value are calculated. After the absolute value of the difference between the two, if the absolute value of the difference is less than the preset threshold, it is determined that the amount of data sent by the terminal within the preset time is within the normal fluctuation range, otherwise, it is determined that the terminal sends the data within the preset time. If the amount of data is too large or too small, there is a data anomaly.
  • Manner 2 Determine the terminal abnormal event corresponding to the data sent by the terminal based on the trained machine learning model.
  • the first network device uses the data sent by the terminal as the input of the trained machine learning model, detects the data sent by the terminal, and obtains abnormal events output by the trained machine learning model, such as virus transmission, network scanning, transmission of abnormal packets Wait.
  • the machine learning model is trained in the following manner:
  • the abnormal events corresponding to the abnormal traffic data are used as the output of the machine learning model, and the machine learning model is trained; the predicted abnormal events output by the machine learning model are calculated based on the loss function.
  • the loss value between the abnormal events corresponding to the abnormal flow data adjust the parameters of the machine learning model according to the loss value, repeat the above steps until the loss value converges in the preset range, and determine that the training of the pair and its learning model is completed.
  • Manner 3 Determine the terminal abnormal event of the terminal according to the data sent by the terminal based on a preset matching rule.
  • the first network device pre-stores an abnormal event matching rule, and determines a corresponding terminal abnormal event according to data sent by the terminal.
  • the first network device acquires the uplink data packet of the terminal, and determines the IP address of the uplink data packet.
  • the first network device determines the IP address assigned to the terminal by the core network according to the terminal identifier, and when determining that the IP address of the uplink data packet does not match the IP address assigned to the terminal by the core network, determines that the terminal abnormal event is sending an IP address spoofing packet .
  • the first network device acquires a first control action corresponding to the terminal according to the terminal abnormality information.
  • the first control action is an action for controlling and managing the terminal, and the control action includes a control plane control action and a data plane control action.
  • the control plane control action may be to prohibit terminal access;
  • the data plane control action may be to discard the information sent by the terminal. data.
  • the terminal abnormality information includes the terminal identifier
  • the first network device may determine the first control action corresponding to the terminal according to method 1 (as shown in steps S2031 to S2034 in FIG. 2 ).
  • the specific process is as follows:
  • the first network device sends a subscription data request message to the second network device.
  • the subscription data request message includes the terminal identifier.
  • the second network device determines the subscription data of the terminal according to the terminal identifier in the subscription data request message.
  • the second network device sends the subscription data of the terminal to the first network device, where the subscription data includes the first control action.
  • the first network device acquires the first control action from the subscription data of the terminal.
  • the first control action in the subscription data of the terminal may be preset in the subscription data, or may be updated into the subscription data by the third network device by invoking a configuration command.
  • the terminal abnormality information includes the terminal identification
  • the first network device may also determine the first control action corresponding to the terminal according to Mode 2 (as shown in steps S2035 to S2037 in FIG. 2 ).
  • the process is as follows:
  • the first network device sends a policy request message to the second network device
  • the policy request message carries the terminal identifier.
  • the second network device determines the first control action corresponding to the terminal according to the terminal identifier in the policy request message.
  • the second network device sends the first control action corresponding to the terminal to the first network device.
  • the first network device may also determine the first control action corresponding to the terminal according to the manner 3 (step S2038 in FIG. 2 ), and the specific process is as follows:
  • the first network device queries the device for the first control action corresponding to the terminal according to the terminal abnormality information.
  • the first network device determines the control action corresponding to the terminal abnormality information according to the corresponding relationship between the matching condition and the control action, and uses the determined control action as the first control action.
  • the corresponding relationship between the matching condition and the control action may be pre-configured in the first network device, or may be configured in the first network device by invoking a configuration command for the second network device.
  • the matching condition includes at least one of a terminal identifier, a terminal abnormal state, and a terminal abnormal event.
  • the terminal abnormality information includes terminal identification, terminal abnormal status and terminal abnormal event, and the matching conditions include terminal identification, terminal abnormal status and terminal abnormal event
  • the terminal identification and matching conditions can be matched first to determine the corresponding
  • the determined control action is used as the first control action; if multiple control actions are determined, the multiple control actions can be screened according to the abnormal state of the terminal and the abnormal event of the terminal and the matching conditions to match, and the determined control action can be determined.
  • the first control action corresponding to the terminal.
  • the first control action corresponding to the terminal may be preferentially determined according to the terminal identifier.
  • the terminal identifier For specific implementation, refer to the above Modes 1 to 3.
  • the method can record abnormal events of the terminal, so that when the terminal accesses again, abnormal detection can be performed on the data sent by the terminal, and the terminal can be directly controlled and managed.
  • the control action in this method corresponds to the terminal identifier of the abnormal terminal in which the abnormal event occurs, so that when there is an abnormal terminal access, the corresponding terminal identifier can be determined according to the terminal identifier. and control and manage the abnormal terminal according to the control action, which not only improves the network security, but also improves the control efficiency of the abnormal terminal.
  • the second network device may determine the first control action corresponding to the terminal according to the following manner:
  • the second network device receives the terminal abnormal event reported by the first network device or the third network device, determines the control action corresponding to the terminal abnormal event according to the preset correspondence between the terminal abnormal event and the control action, and sends the corresponding control action to the terminal abnormal event.
  • the determined control action is used as the first control action corresponding to the terminal.
  • Manner 2 The second network device receives the first control action corresponding to the terminal sent by the fourth network device; wherein the fourth network device may determine the corresponding control action according to the abnormal event of the terminal reported by the first network device or the third network device .
  • the first network device or the third network device performs abnormality detection on the terminal according to the data sent by the terminal, determines the terminal abnormality event of the terminal, and reports the terminal abnormality event to the second network device or the fourth network device.
  • the first network device or the third network device performs abnormality detection on the terminal according to the data sent by the terminal, determines the terminal abnormality event of the terminal, and reports the terminal abnormality event to the second network device or the fourth network device.
  • the first network device or the third network device may report the terminal abnormal event to the second network device or the fourth network device according to the following methods:
  • Mode 1 Report abnormal events of the terminal through an alarm message.
  • Mode 2 Report terminal abnormal events through service logs.
  • Mode 3 Report the terminal abnormal event through the message interface.
  • the message reported by the first network device or the third network device to the second network device or the fourth network device may be an original plaintext message, or may be encrypted to protect user privacy, which is not made in this embodiment of the present application. limited.
  • the first network device or the third network device performs anomaly detection on the data sent by the terminal. This is because when the terminal sends a data packet, if the integrity protection of the sent data is not performed during the transmission process, the data packet sent by the terminal may be tampered with by a third party during the transmission process, resulting in a result that although the terminal is not sent by the terminal Actively initiate network attacks, but control and manage the terminal, affecting the normal business of legitimate terminals. Therefore, the accuracy of anomaly detection can be improved by determining that the data is integrity-protected data before anomaly detection is performed on the data sent by the terminal.
  • the first network device or the third network device determines the context information of the terminal, and when it is determined that the context information of the terminal includes an integrity protection identifier, determines that the data sent by the terminal is subject to integrity protected data.
  • the first network device acquiring the first control action corresponding to the terminal may also be acquiring a control strategy corresponding to the terminal, and the control strategy corresponding to the terminal includes the first control action, and may also include a terminal identifier and an abnormal state of the terminal. and some or all of the terminal exception events.
  • the control strategy may also include an implementation assistance instruction of the control strategy, such as the effective duration of the strategy, the effective time point, and the effective time period.
  • the first network device controls and manages the terminal according to the first control action corresponding to the terminal.
  • the first network device can control and manage the terminal for a preset period of time, so that in the scenario where the terminal is no longer hijacked or the terminal is not actively launching a network attack, after controlling the terminal for a period of time, the terminal can be recovered.
  • the terminal is a legal terminal, so as to avoid affecting the normal services of the legal terminal.
  • a timer can be set when the terminal is controlled and managed, and the terminal can be controlled and managed within the timer. After the timer expires, the terminal is regarded as a legitimate terminal and the normal service of the terminal is restored.
  • an embodiment of the present application also provides a method for controlling an abnormal terminal.
  • the first network device After receiving the data sent by the terminal, the first network device obtains the terminal identifier, and determines that the first control action corresponding to the terminal cannot be determined according to the terminal identifier, indicating that the terminal If the terminal is not identified as an abnormal terminal, abnormal detection is performed on the data sent by the terminal to determine the terminal abnormal event of the terminal; the first network device reports the terminal abnormal event of the terminal to the second network device; the second network device determines that the terminal abnormal event corresponds to The second control action is sent to the first network device, and the first network device controls and manages the terminal according to the second control action. Further, after the second network device sends the second control action to the first network device, the second control action may be stored in the preset storage space as the first control action corresponding to the terminal, that is, the first control action Can be the same as the second control action.
  • the present application also provides some abnormal terminal control examples. Among them, these examples are also applied in the communication system as shown in FIG. 1 . Each example will be described in detail below with reference to FIGS. 3-6 .
  • Example 1 In this example, the first network device is an AMF and the second network device is a UDM for illustration. Referring to FIG. 3 , this example specifically includes the following steps.
  • S301 The terminal accesses the CN.
  • the UPF receives data from the terminal, and acquires the terminal identifier.
  • the terminal initiates a network attack.
  • the UPF performs abnormality detection on the data sent by the terminal, and determines terminal abnormality events of the terminal.
  • the UPF determines a single control action according to the abnormal event of the terminal.
  • the UPF performs single control and management on the terminal according to the single control action.
  • the UPF when the UPF performs anomaly detection on the terminal and determines that the terminal is an abnormal terminal, the UPF can determine the single control action corresponding to the terminal abnormal event of the terminal according to the pre-stored correspondence between the single control strategy and the terminal abnormal event. UPF immediately implements single control and management on the terminal according to the determined single control action, thereby reducing security problems caused by terminal network attacks.
  • the UPF reports the terminal abnormal event to the EMS.
  • the UPF may report terminal abnormal events to the EMS by means of alarm messages, service logs, and message interfaces.
  • the UPF may also notify the SMF of the terminal abnormal event, and the SMF will report the terminal abnormal event to the EMS.
  • the EMS determines a first control action corresponding to the terminal abnormal event according to the preset corresponding relationship between the terminal abnormal event and the control action.
  • the EMS invokes the UDM configuration command to modify the subscription data of the terminal, and modifies the control action in the subscription data of the terminal to the first control action.
  • the terminal requests to access the CN again.
  • the AMF acquires the terminal identifier.
  • the AMF sends a subscription data request message including the terminal identifier to the UDM.
  • the UDM determines the subscription data of the terminal according to the terminal identifier in the subscription data request message.
  • S314 The UDM sends the subscription data of the terminal to the AMF.
  • the AMF controls and manages the terminal according to the first control action in the subscription data of the terminal.
  • Example 2 In this example, the first network device is a UPF and the second network device is an EMS for illustration. Referring to FIG. 4 , this example specifically includes the following steps.
  • the terminal accesses the CN.
  • the UPF receives data from the terminal, and acquires the terminal identifier.
  • the terminal initiates a network attack.
  • the UPF performs abnormality detection on the data sent by the terminal, and determines terminal abnormality events of the terminal.
  • the UPF determines a single control action according to the abnormal event of the terminal.
  • the UPF performs single control and management on the terminal according to the single control action.
  • the UPF reports the abnormal event of the terminal to the EMS.
  • the UPF may report terminal abnormal events to the EMS by means of alarm messages, service logs, and message interfaces.
  • the UPF may also notify the SMF of the terminal abnormal event, and the SMF will report the terminal abnormal event to the EMS.
  • the EMS determines a first control action corresponding to the terminal abnormal event according to the preset corresponding relationship between the terminal abnormal event and the control action.
  • the EMS invokes the UPF configuration command to configure the matching conditions and corresponding control actions to the UPF.
  • the EMS may also call the SMF configuration command to configure the matching conditions and corresponding control actions to the SMF, and then the SMF sends the matching conditions and corresponding control actions to the UPF.
  • the terminal requests to access the CN again.
  • the UPF acquires terminal abnormality information.
  • the UPF searches the device for the first control action corresponding to the terminal according to the terminal abnormality information.
  • the UPF controls and manages the terminal according to the first control action corresponding to the terminal.
  • Example 3 In this example, the first network device is an AMF and the second network device is a PCF for illustration. Referring to FIG. 5 , this example specifically includes the following steps.
  • the terminal accesses the CN.
  • the UPF receives data from the terminal, and acquires the terminal identifier.
  • the terminal initiates a network attack.
  • the UPF performs abnormality detection on the data sent by the terminal, and determines terminal abnormality events of the terminal.
  • the UPF determines a single control action according to the abnormal event of the terminal.
  • the UPF performs single control and management on the terminal according to the single control action.
  • the UPF sends the terminal abnormal event to the SMF.
  • the SMF reports the abnormal event of the terminal to the PCF.
  • the UPF may also directly report terminal abnormal events to the PCF through a message interface or other means.
  • the PCF stores the terminal identifier and the terminal abnormal event.
  • the terminal requests to access the CN again.
  • the AMF acquires the terminal identifier.
  • the AMF sends a policy request message to the PCF.
  • the PCF queries the stored terminal identifier and terminal abnormal event according to the terminal identifier in the policy request message, and determines the first control action corresponding to the terminal abnormal event according to the preset correspondence between the terminal abnormal event and the control action.
  • the PCF sends the first control action to the AMF.
  • the AMF controls and manages the terminal according to the first control action.
  • Example 4 In this example, the first network device is an SMF and the second network device is a PCF for illustration. Referring to FIG. 6 , this example specifically includes the following steps.
  • the terminal accesses the CN.
  • the AMF receives data from the terminal, and obtains the terminal identifier.
  • the terminal initiates a network attack.
  • the AMF performs abnormality detection on the data sent by the terminal, and determines terminal abnormality events of the terminal.
  • the AMF determines a single control action according to the abnormal event of the terminal.
  • the AMF performs single control and management on the terminal according to the single control action.
  • the AMF reports the abnormal event of the terminal to the PCF.
  • the AMF may report terminal abnormal events to the PCF through a message interface or the like.
  • the PCF stores the terminal identifier and the terminal abnormal event.
  • the terminal requests to access the CN again.
  • the AMF acquires the terminal identifier.
  • the AMF notifies the SMF that the terminal requests to access the CN.
  • the SMF sends a policy request message to the PCF.
  • the PCF queries the stored terminal identifier and terminal abnormal event according to the terminal identifier in the policy request message, and determines the first control action corresponding to the terminal abnormal event according to the preset correspondence between the terminal abnormal event and the control action.
  • the PCF sends the first control action to the SMF.
  • the SMF sends the first control action to the UPF.
  • the PCF may also directly deliver the first control action to the UPF without requiring the SMF to forward it.
  • the UPF controls and manages the terminal according to the first control action.
  • Example 5 In this example, the first network device is a UPF and the second network device is a PCF for illustration. Referring to FIG. 7 , this example specifically includes the following steps.
  • the terminal accesses the CN.
  • the UPF receives data from the terminal, and acquires the terminal identifier.
  • the terminal initiates a network attack.
  • the UPF performs abnormality detection on the data sent by the terminal, and determines terminal abnormality events of the terminal.
  • the UPF determines a single control action according to the abnormal event of the terminal.
  • the UPF performs single control and management on the terminal according to the single control action.
  • the UPF sends the terminal abnormal event to the SMF.
  • the SMF reports the abnormal event of the terminal to the PCF.
  • the UPF can also directly report terminal abnormal events to the PCF.
  • the PCF determines a second control action corresponding to the terminal abnormal event according to the preset corresponding relationship between the terminal abnormal event and the control action.
  • the PCF sends the second control action to the SMF.
  • the SMF sends the second control action to the UPF.
  • the PCF may also directly deliver the second control action to the UPF without requiring the SMF to forward it.
  • the UPF determines that the terminal currently accesses the CN, and controls and manages the terminal according to the second control action corresponding to the terminal.
  • the above examples 1 to 5 are the abnormal terminal control methods taking the communication system as a 5G system as an example.
  • the abnormal terminal control method provided in this application is also applicable to 2G, 3G or 4G systems.
  • the functions performed by the UPF in the core network of the 5G system in the embodiment may be implemented by the GGSN in the 2G and 3G systems or the PGW in the 4G system, and the functions performed by the AMF in the core network of the 5G system in the embodiments of the present application may be performed by the 2G and 3G systems.
  • the specific implementation process can refer to the above-mentioned embodiment, and the repetition will not be repeated.
  • the present application also provides a method for controlling abnormal terminals, which can be applied to the communication system shown in FIG. 1 and can implement the methods provided by the above embodiments or examples.
  • the security management function entity involved in the method is used to realize the control and management of abnormal terminals.
  • the security management function entity may be an independent device with security management function, or may be a function in CN Entity such as EMS or PCF.
  • the security management function entity realizes the control and management of the abnormal terminal by interacting with the CN. The method will be described below with reference to the method flowchart shown in FIG. 8 .
  • S801 The terminal accesses the core network according to the 3GPP standard procedure.
  • the CN receives data from the terminal, and obtains the terminal identifier.
  • the terminal initiates a network attack.
  • the network attack behavior initiated by the terminal may be sending IP address spoofing packets, network scanning, DDoS behavior, spreading viruses, and so on.
  • the IP address spoofing message means that when the terminal sends a message, it impersonates other IP addresses without using the IP address assigned to the terminal by the core network device.
  • the CN performs abnormality detection on the data sent by the terminal, and determines terminal abnormality events of the terminal.
  • the CN reports the abnormal event of the terminal to the security management function entity.
  • the security management function entity is indeed in an abnormal state of the terminal being abnormal. And according to the preset correspondence between the terminal abnormal event and the control action, the control action corresponding to the terminal abnormal event is determined.
  • the security management function entity stores the determined control action in the device.
  • the security management function entity sends the determined control action to the CN.
  • An optional implementation manner is that, after receiving the policy request message sent by the CN, the security management function entity may issue the control policy corresponding to the terminal identifier in the policy request message to the CN.
  • the CN determines whether the terminal is online; if so, executes S813; otherwise, executes S810.
  • the terminal requests to access the CN again.
  • the CN acquires the terminal identifier, and determines the control action corresponding to the terminal according to the terminal identifier.
  • the CN controls and manages the terminal according to the control action corresponding to the terminal.
  • the present application also provides an abnormal terminal control apparatus 900 , the structure of which is shown in FIG. 9 , including a first communication unit 901 and a first processing unit 902 .
  • the abnormal terminal control apparatus 900 can be applied to the first network device shown in FIG. 2 to FIG. 7 , and can implement the abnormal terminal control method provided by the above embodiments.
  • the function of each unit of the abnormal terminal control device 900 will be introduced below.
  • the first communication unit 901 is configured to receive data from a terminal device, and the data includes user plane data and/or control plane data;
  • the first processing unit 902 is configured to determine terminal abnormality information of the terminal device according to the data, where the terminal abnormality information includes at least one of a terminal identification, a terminal abnormality state and a terminal abnormality event; according to the terminal abnormality information
  • the first control action corresponding to the terminal device is acquired, and the terminal device is controlled and managed according to the first control action.
  • the first processing unit 902 is specifically configured to: acquire the terminal identifier of the terminal device according to the data; and/or perform abnormality detection on the data to determine that the terminal of the terminal device is abnormal Event and/or terminal exception status.
  • the terminal abnormality information includes a terminal identifier
  • the first network device is an access management function entity
  • the first processing unit 902 is specifically configured to: send the second communication unit 901 to the second The network device sends a subscription data request message carrying the terminal identifier, wherein the second network device is a data management function entity; obtains the subscription of the terminal device from the second network device through the first communication unit 901 data, wherein the contract data includes the first control action.
  • the terminal abnormality information includes a terminal identifier
  • the first network device is an access management function entity or a session management function entity
  • the first processing unit 902 is specifically configured to:
  • the communication unit 901 sends a policy request message carrying the terminal identifier to the second network device; wherein, the second network device is a policy control function entity; the first communication unit 901 receives the second network device The returned first control action.
  • the first network device is a user plane functional entity
  • the first processing unit 902 is specifically configured to: query the local device for the first control device corresponding to the terminal device according to the terminal abnormality information action.
  • the first processing unit 902 is specifically configured to: receive a configuration command sent by the second network device through the first communication unit 901, where the configuration command includes a matching condition and a corresponding control action,
  • the matching condition includes at least one of the terminal identifier, the terminal abnormal state and the terminal abnormal event; according to the corresponding relationship between the matching condition and the control action, the control action corresponding to the terminal abnormality information is determined, and the determined control action is determined.
  • a control action is used as the first control action.
  • the first processing unit 902 is further configured to: before acquiring the first control action corresponding to the terminal device according to the terminal abnormality information, perform abnormality detection on the data, and determine the terminal The terminal abnormal event of the device, and the terminal abnormal event of the terminal device is reported to the second network device through the first communication unit.
  • the first processing unit 902 is further configured to: before acquiring the first control action corresponding to the terminal device according to the terminal abnormality information, perform abnormality detection on the data, and determine the terminal terminal abnormal event of the device; reporting the terminal abnormal event of the terminal device to the second network device through the first communication unit; and receiving information from the second network device through the first communication unit with the terminal The second control action corresponding to the abnormal event; the terminal device is controlled and managed according to the second control action.
  • the first processing unit 902 is specifically configured to: determine the terminal abnormal event of the terminal device according to the data and the reference value sent by the terminal device within a preset time period; wherein, the reference The value is determined based on the historical data of the terminal device based on the trained statistical analysis model; or based on the trained machine learning model, the terminal abnormal event corresponding to the data is determined; or based on the preset matching rules, according to the The data determines the terminal abnormal event of the terminal device.
  • the first processing unit 902 is specifically configured to: control and manage the terminal device according to the first control action within a preset time period.
  • the present application also provides an abnormal terminal control apparatus 1000 , the structure of which is shown in FIG. 10 , including a second communication unit 1001 and a second processing unit 1002 .
  • the abnormal terminal control function entity 1000 can be applied to the second network device shown in FIG. 2 to FIG. 7 , and can implement the abnormal terminal control method provided by the above embodiments.
  • the function of each unit of the abnormal terminal control apparatus 1000 will be introduced below.
  • the second communication unit 1001 is configured to receive a request message sent by the first network device; the request message includes terminal abnormality information of the terminal, and the terminal abnormality information includes at least one of a terminal identifier, a terminal abnormality state, and a terminal abnormality event. one; and after the second processing unit 1002 determines the first control action, sends the first control action to the first network device;
  • the second processing unit 1002 is configured to determine a first control action corresponding to the terminal device, where the first control action corresponds to the terminal abnormality information.
  • the second network device is a data management function entity
  • the second communication unit 1001 is specifically configured to: receive a subscription data request message sent by the first network device; the subscription data request message contains the terminal identifier; the first network device is an access management function entity; sends subscription data corresponding to the terminal identifier to the first network device, wherein the subscription data includes the first Control action.
  • the second network device is a policy control function entity
  • the second communication unit 1001 is specifically configured to: receive a policy request message carrying the terminal identifier sent by the first network device; wherein , the first network device is an access management function entity or a session management function entity.
  • the second network device is a network element management function entity, and the first network device is a user plane function entity; the second processing unit 1002 is specifically configured to: according to the first control action Invoke a configuration command, where the configuration command includes matching conditions and corresponding control actions, and the matching conditions include at least one of the terminal identifier, terminal abnormal state and terminal abnormal event; The first network device sends the configuration command.
  • the second processing unit 1002 is further configured to: before receiving the request message from the first network device, receive the terminal device reported by the first network device through the second communication unit 1001 the terminal abnormal event; determine the second control action corresponding to the terminal abnormal event according to the preset corresponding relationship between the terminal abnormal event and the control action; and send the second control action to the terminal through the second communication unit the first network device.
  • the present application also provides an abnormal terminal control functional entity 1100.
  • the structure of the functional entity is shown in FIG. 11 , and the abnormal terminal control functional entity 1100 can be applied as shown in FIG. 2 to FIG. 7 .
  • the first network device can implement the abnormal terminal control method provided in the above embodiment.
  • the abnormal terminal control functional entity 1100 includes: a communication module 1101 , a processor 1102 and a memory 1103 . Wherein, the communication module 1101, the processor 1102 and the memory 1103 are connected to each other.
  • the communication module 1101 , the processor 1102 and the memory 1103 are connected to each other through a bus 1104 .
  • the bus 1104 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus or the like.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is used in FIG. 11, but it does not mean that there is only one bus or one type of bus.
  • the communication module 1101 is used for receiving and sending data to realize communication interaction with other devices.
  • the communication module 1101 may be implemented through a physical interface, a communication module, a communication interface, and an input/output interface.
  • the processor 1102 is configured to receive data from the terminal device through the communication module 1101, and the data includes user plane data and/or control plane data; determine the terminal abnormality information of the terminal device according to the data, and the terminal
  • the abnormality information includes at least one of a terminal identifier, a terminal abnormality state and a terminal abnormality event; the first control action corresponding to the terminal device is acquired according to the terminal abnormality information, and a first control action is performed on the terminal device according to the first control action. Control management.
  • the processor 1102 is specifically configured to: acquire the terminal identifier of the terminal device according to the data; and/or perform abnormality detection on the data, and determine the terminal abnormality event and the terminal abnormality of the terminal device. / or terminal abnormal state.
  • the terminal abnormality information includes a terminal identifier
  • the first network device is an access management function entity
  • the processor 1102 is specifically configured to: send to the second network device through the communication module 1101 a subscription data request message carrying the terminal identifier, wherein the second network device is a data management function entity; and acquiring the terminal and the subscription data from the second network device through the communication module 1101, wherein,
  • the contract data includes the first control action.
  • the terminal abnormality information includes a terminal identifier
  • the first network device is an access management function entity or a session management function entity
  • the processor 1102 is specifically configured to: send the communication module 1101 to the The second network device sends a policy request message carrying the terminal identifier; wherein, the second network device is a policy control function entity; and the communication module 1101 receives the first returned by the second network device A control action.
  • the first network device is a user plane functional entity
  • the processor 1102 is specifically configured to: query the local device for a first control action corresponding to the terminal device according to the terminal abnormality information.
  • the processor 1102 specifically: receives a configuration command sent by the second network device through the communication module 1101, where the configuration command includes a matching condition and a corresponding control action, and the matching condition includes at least one of the terminal identifier, the terminal abnormal state and the terminal abnormal event; according to the corresponding relationship between the matching condition and the control action, determine the control action corresponding to the terminal abnormality information, and use the determined control action as the The first control action.
  • the processor 1102 is further configured to: before acquiring the first control action corresponding to the terminal device according to the terminal abnormality information, perform abnormality detection on the data, and determine the abnormality of the terminal device. Terminal abnormal event; reporting the terminal abnormal event of the terminal device to the second network device through the communication module 1101 .
  • the processor 1102 is further configured to: before acquiring the first control action corresponding to the terminal device according to the terminal abnormality information, perform abnormality detection on the data, and determine the abnormality of the terminal device. terminal abnormal event; report the terminal abnormal event of the terminal device to the second network device through the communication module 1101; receive the first terminal abnormal event corresponding to the terminal abnormal event from the second network device through the communication module 1101 Two control actions; control and manage the terminal device according to the second control action.
  • the processor 1102 is specifically configured to: determine the terminal abnormal event of the terminal device according to the data and the reference value sent by the terminal device within a preset time period; wherein the reference value is According to the historical data of the terminal device, it is determined based on the trained statistical analysis model; or based on the trained machine learning model, the terminal abnormal event corresponding to the data is determined; or based on the preset matching rules, according to the data A terminal abnormal event of the terminal device is determined.
  • the processor 1102 is specifically configured to: control and manage the terminal device according to the first control action within a preset time period.
  • the memory 1103 is used to store program instructions and data.
  • the program instructions may include program code, and the program code includes computer operation instructions.
  • the memory 1103 may include random access memory (RAM), and may also include non-volatile memory (non-volatile memory), such as at least one disk storage.
  • the processor 1102 executes the program instructions stored in the memory 1103 and uses the data stored in the memory 1103 to implement the above functions, thereby implementing the abnormal terminal control method provided by the above embodiments.
  • the memory 1103 in FIG. 11 of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically programmable read-only memory (Erasable PROM, EPROM). Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be Random Access Memory (RAM), which acts as an external cache.
  • RAM Static RAM
  • DRAM Dynamic RAM
  • SDRAM Synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Rate SDRAM DDR SDRAM
  • enhanced SDRAM ESDRAM
  • synchronous link dynamic random access memory Synchlink DRAM, SLDRAM
  • Direct Rambus RAM Direct Rambus RAM
  • the present application also provides an abnormal terminal control functional entity 1200.
  • the structure of the functional entity is shown in FIG. 12 , and the abnormal terminal control functional entity 1200 can be applied to those shown in FIG. 2 to FIG. 7 .
  • the second network device can implement the abnormal terminal control method provided by the above embodiment.
  • the abnormal terminal control functional entity 1200 includes: a communication module 1201 , a processor 1202 and a memory 1203 . Wherein, the communication module 1201, the processor 1202 and the memory 1203 are connected to each other.
  • the communication module 1201 , the processor 1202 and the memory 1203 are connected to each other through a bus 1204 .
  • the bus 1204 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus or the like.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of presentation, only one thick line is shown in Figure 12, but it does not mean that there is only one bus or one type of bus.
  • the communication module 1201 is used for receiving and sending data to realize communication interaction with other devices.
  • the communication module 1201 may be implemented through a physical interface, a communication module, a communication interface, and an input/output interface.
  • the processor 1202 is configured to receive a request message sent by the first network device through the communication module 1201; the request message includes terminal abnormality information of the terminal device, and the terminal abnormality information includes a terminal identifier, a terminal abnormality state and a terminal abnormality information. at least one of the abnormal events; determine the first control action corresponding to the terminal device, and the first control action corresponds to the terminal abnormality information; send the first control action to the terminal device through the communication module 1201 the first network device.
  • the second network device is a data management function entity
  • the processor 1202 is specifically configured to: receive a subscription data request message sent by the first network device through the communication module 1201;
  • the subscription data request message includes the terminal identifier;
  • the first network device is an access management function entity;
  • the communication module 1201 sends the subscription data corresponding to the terminal identifier to the first network device, wherein,
  • the contract data includes the first control action.
  • the second network device is a policy control functional entity
  • the processor 1202 is specifically configured to: receive, through the communication module 1201, a policy that carries the terminal identifier sent by the first network device A request message; wherein, the first network device is an access management function entity or a session management function entity.
  • the second network device is a network element management function entity
  • the first network device is a user plane function entity
  • the processor 1202 is specifically configured to: use the communication module 1201 according to the The first control action invokes a configuration command, the configuration command includes a matching condition and a corresponding control action, and the matching condition includes at least one of the terminal identification, terminal abnormal state and terminal abnormal event; through the communication module 1201 Send the configuration command to the first network device.
  • the processor 1202 before receiving the request message from the first network device, is further configured to: receive, through the communication module 1201, the terminal abnormal event of the terminal device reported by the first network device ; Determine the second control action corresponding to the terminal abnormal event according to the preset correspondence between the terminal abnormal event and the control action; and send the second control action to the first network device through the communication module 1201 .
  • the memory 1203 is used to store program instructions and data.
  • the program instructions may include program code, and the program code includes computer operation instructions.
  • the memory 1203 may include random access memory (RAM), and may also include non-volatile memory (non-volatile memory), such as at least one disk storage.
  • the processor 1202 executes the program instructions stored in the memory 1203, and uses the data stored in the memory 1203 to implement the above functions, thereby implementing the abnormal terminal control method provided by the above embodiments.
  • the memory 1203 in FIG. 12 of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically programmable read-only memory (Erasable PROM, EPROM). Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • Volatile memory may be Random Access Memory (RAM), which acts as an external cache.
  • RAM Static RAM
  • DRAM Dynamic RAM
  • SDRAM Synchronous DRAM
  • SDRAM double data rate synchronous dynamic random access memory
  • Double Data Rate SDRAM DDR SDRAM
  • enhanced SDRAM ESDRAM
  • synchronous link dynamic random access memory Synchlink DRAM, SLDRAM
  • Direct Rambus RAM Direct Rambus RAM
  • an embodiment of the present application further provides a communication system, including the abnormal terminal control apparatus 900 shown in FIG. 9 and the abnormal terminal control apparatus 1000 shown in FIG. 10 .
  • embodiments of the present application further provide a computer program, when the computer program runs on a computer, the computer causes the computer to execute the abnormal terminal control method provided by the above embodiments.
  • the embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a computer, the computer executes the exception provided by the above embodiment. Terminal control method.
  • the storage medium may be any available medium that the computer can access.
  • computer readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or be capable of carrying or storing instructions or data structures in the form of desired program code and any other medium that can be accessed by a computer.
  • the embodiments of the present application further provide a chip, which is used to read a computer program stored in a memory and implement the abnormal terminal control method provided by the above embodiments.
  • the embodiments of the present application provide a chip system, where the chip system includes a processor for supporting a computer device to implement the functions involved in the service equipment, forwarding equipment, or site equipment in the above embodiments.
  • the chip system further includes a memory for storing necessary programs and data of the computer device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
  • the apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请提供一种异常终端控制方法及装置，实现对异常终端的有效控制。在该方案中，第一网络设备从终端设备接收数据，并根据所述数据确定终端设备的终端异常信息，其中，终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个。第一网络设备根据终端异常信息获取终端设备对应的第一控制动作，并根据第一控制动作对终端设备进行控制管理。通过该方法，第一网络设备能够根据获取到的终端异常信息确定终端设备对应的第一控制动作，在该终端设备存在网络攻击行为时，能够及时根据该终端设备对应的第一控制动作对该终端设备进行控制管理，从而可以提升网络安全性。

Description

一种异常终端控制方法及装置
相关申请的交叉引用
本申请要求在2020年10月30日提交中国专利局、申请号为202011194022.8、申请名称为“一种异常终端控制方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种异常终端控制方法及装置。
背景技术
在通信网络中，终端通过核心网接入IP网络进行通信时，需要先获取IP地址。通常终端的IP地址由核心网进行分配，终端在得到核心网分配的IP地址后，终端在发出的业务数据中携带该IP地址，核心网根据该IP地址进行计算会话策略等处理。
终端在被劫持等情况下，可能会发起网络扫描、分布式拒绝服务攻击(distributed denial of service attack，DDoS)、传播病毒等各种网络攻击行为。发起网络攻击的终端为了在攻击时隐藏身份或突破网络防护，常会采用IP地址欺骗的手段。发起网络攻击的终端在进行IP地址欺骗时，会仿冒一个受信任的IP地址以突破网络安全措施，或使用其它终端的IP地址以隐藏攻击身份，从而导致网络设备难以准确地对攻击行为进行溯源。
现有技术中，为提高网络安全性，常采用设置网络防火墙方式，仅允许满足访问控制规则的终端访问网络，从而拦截终端攻击网络的异常事件。但当终端仿冒访问控制规则允许的IP地址时，则会导致网络防火墙的访问控制规则失效而达成攻击目的。
因此，现有的异常终端控制方式较为单一，无法对异常终端实施有效控制。
发明内容
本申请提供一种异常终端控制方法及装置，实现对异常终端的有效控制。
第一方面，本申请实施例提供一种异常终端控制方法，该方法可适用于如图1所示的通信***中。该方法包括：
第一网络设备从终端设备接收数据，所述数据包括用户面数据和/或控制面数据；所述第一网络设备根据所述数据确定所述终端设备的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作，并根据所述第一控制动作对所述终端设备进行控制管理。
通过该方法，第一网络设备能够根据获取到的终端异常信息确定终端设备对应的第一控制动作，在该终端设备存在网络攻击行为时，能够及时根据该终端设备对应的第一控制动作对该终端设备进行控制管理，从而可以提升网络安全性。
在一种可能的设计中，所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作，包括：所述第一网络设备根据所述终端异常信息获取所述终端设备对 应的控制策略，所述控制策略包括所述第一控制动作。
在一种可能的设计中，所述控制策略还包括终端标识、终端异常状态和终端异常事件中的部分或全部。
通过以上设计，第一网络设备可以获取终端设备对应的控制策略，控制策略中包括第一控制动作，还可以包括终端标识、终端异常状态和终端异常事件中的部分或全部，从而能够获取到更多的终端异常信息，进而实现对终端设备进行准确的控制管理。
在一种可能的设计中，所述终端异常事件为控制面异常事件，所述第一控制动作为控制面控制动作和/或数据面控制动作；或者所述终端异常事件为数据面异常事件，所述第一控制动作为控制面控制动作和/或数据面控制动作。
通过该设计，第一网络设备在对终端设备进行控制管理时，能够从控制面对终端设备进行控制管理，如禁止终端设备接入网络；或从数据面对终端设备进行控制管理，如丢弃终端设备发送的数据。当然也可以同时对终端设备进行控制面和数据面的控制管理。
在一种可能的设计中，所述第一网络设备根据所述终端设备发送的数据确定所述终端设备的终端异常信息，包括：所述第一网络设备根据所述数据获取所述终端设备的终端标识；和/或，所述第一网络设备对所述数据进行异常检测，确定所述终端设备的终端异常事件和/或终端异常状态。
通过该设计，第一网络设备能够根据终端设备发送的数据确定终端标识，或对数据进行异常检测，确定终端设备的终端异常事件和/或终端异常状态，进而确定多种终端异常信息，提供多种确定终端设备对应的第一控制动作的方式，实现对异常终端设备的灵活控制。
在一种可能的设计中，所述数据为用户面数据时，所述第一网络设备确定与所述用户面数据关联的上下文信息，根据所述上下文信息确定终端标识。
在一种可能的设计中，所述数据为控制面数据时，所述第一网络设备根据所述控制面数据确定所述终端设备的永久标识，并将所述终端设备的永久标识作为所述终端设备的终端标识；其中，所述控制面数据中包含终端设备的临时标识或永久标识。
在一种可能的设计中，当所述控制面数据中的终端标识为临时标识时，所述第一网络设备根据所述终端设备的临时标识关联所述终端设备的上下文信息；所述第一网络设备根据所述终端设备的上下文信息确定所述终端设备的永久标识。
通过以上设计，第一网络设备在接收到终端设备发送的数据后，能够根据该数据确定终端标识，从而能够根据终端标识确定终端设备对应的第一控制动作。本申请实施例针对终端设备发送的不同数据类型(如控制面数据或用户面数据)，提供了不同的终端标识确定方式，以使第一网络设备能够根据终端设备发送的数据准确确定终端标识。
在一种可能的设计中，所述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体，所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作，包括：所述第一网络设备向第二网络设备发送携带所述终端标识的签约数据请求消息，其中，所述第二网络设备为数据管理功能实体；所述第一网络设备从所述第二网络设备获取所述终端设备的签约数据，其中，所述签约数据中包含所述第一控制动作。
通过该设计，当第一网络设备为接入管理功能实体，第二网络设备为数据管理功能实体时，数据管理功能实体中存储终端设备的签约数据，第一网络设备向第二网络设备获取终端设备签约数据，从而能够获取到签约数据中包含的终端设备对应的第一控制动作，而不需要发送另外的信息，进一步提高异常终端设备的控制效率。
在一种可能的设计中，所述第一控制动作为第四网络设备根据第三网络设备上报的所述终端设备的终端异常事件确定并下发到所述第二网络设备的控制动作。
通过该设计，本申请实施例中还可以由第三网络设备对终端设备发送的数据进行异常检测，并将确定出的终端异常事件上报给第四网络设备，再由第四网络设备将确定出的第一控制动作下发到第二网络设备。也就是说，本申请实施例并不限于第一网络设备和第二网络设备交互的异常终端控制方式，可以由多个网络设备交互实现异常终端控制。
在一种可能的设计中，所述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体或会话管理功能实体，所述第一网络设备根据所述终端异常信息获取所述终端设备对应的控制策略，包括：所述第一网络设备向所述第二网络设备发送携带所述终端标识的策略请求消息；其中，所述第二网络设备为策略控制功能实体；所述第一网络设备接收所述第二网络设备返回的所述第一控制动作。
通过该设计，当第一网络设备为接入管理功能实体或会话管理功能实体，第二网络设备为策略控制功能实体时，第一网络设备能够在确定需要对终端设备进行控制管理时，向第二网络设备发送策略请求消息，获取终端设备对应的第一控制动作，以对终端设备进行控制管理。
在一种可能的设计中，所述第一控制动作为所述第二网络设备根据第三网络设备上报的所述终端设备的终端异常事件确定的控制动作。
通过该设计，本申请实施例中还可以由第三网络设备对终端设备进行异常检测，并将确定出的终端异常事件上报给第二网络设备。也就是说，本申请实施例并不限于第一网络设备和第二网络设备交互的异常终端控制方式，可以由多个网络设备交互实现异常终端控制。
在一种可能的设计中，所述第一网络设备为用户面功能实体，所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作，包括：所述第一网络设备根据所述终端异常信息在本设备中查询所述终端设备对应的第一控制动作。
在一种可能的设计中，所述第一网络设备根据所述终端异常信息在本设备中查询所述终端设备对应的第一控制动作，包括：所述第一网络设备接收第二网络设备发送的配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；所述第一网络设备根据所述匹配条件和控制动作的对应关系，确定所述终端异常信息对应的控制动作，并将确定出的控制动作作为所述第一控制动作。
通过该设计，当第一网络设备为用户面功能实体时，第二网络设备将匹配条件及对应的控制动作提前下发到第一网络设备，第一网络设备在需要对终端设备进行控制管理时，根据终端异常信息在本设备中查询终端设备对应的控制动作，及时对终端设备进行控制管理，减少消息传递带来的时延，提升异常终端控制的效率。
在一种可能的设计中，在所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，所述第一网络设备对所述数据进行异常检测，确定所述终端设备的终端异常事件；所述第一网络设备向第二网络设备上报所述终端设备的终端异常事件。
通过该设计，第一网络设备能够对终端设备发送的数据进行异常检测，确定终端设备的终端异常事件，并向第二网络设备上报终端异常事件，能够使第二网络设备记录终端设备的终端异常事件，在终端设备下次接入时即可对终端设备进行控制管理，而无需多次重 复异常检测，浪费网络资源。
在一种可能的设计中，在所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，所述第一网络设备对所述数据进行异常检测，确定所述终端设备的终端异常事件；所述第一网络设备向所述第二网络设备上报所述终端设备的终端异常事件；所述第一网络设备从所述第二网络设备接收与所述终端异常事件对应的第二控制动作；所述第一网络设备根据所述第二控制动作对所述终端设备进行控制管理。其中，第二控制动作可以与第一控制动作相同。
通过该设计，第一网络设备对终端设备发送的数据进行异常检测，确定终端设备的终端异常事件后，向第二网络设备上报终端异常事件，第二网络设备确定终端异常事件对应的第二控制动作，并将第二控制动作下发给第一网络设备，从而能够及时准确地对存在异常攻击行为的终端设备进行控制管理。
在一种可能的设计中，所述第一网络设备向所述第二网络设备上报所述终端设备的终端异常事件，包括：
所述第一网络设备通过告警消息向所述第二网络设备上报所述终端设备的终端异常事件；或者所述第一网络设备通过业务日志向所述第二网络设备上报所述终端设备的终端异常事件；或者所述第一网络设备通过消息接口向所述第二网络设备上报所述终端设备的终端异常事件。
在一种可能的设计中，所述第一网络设备根据下列方式对所述数据进行异常检测：
方式1、所述第一网络设备根据所述终端设备预设时长内发送的数据与参考值，确定所述终端设备的终端异常事件；其中，所述参考值为根据所述终端设备的历史数据，基于已训练的统计分析模型确定的。
方式2、所述第一网络设备基于已训练的机器学习模型，确定所述数据对应的终端异常事件。
方式3、所述第一网络设备基于预设的匹配规则，根据所述数据确定所述终端设备的终端异常事件。
通过该设计，本申请实施例提供多种异常检测方法，通过机器学习、规则匹配、统计分析等方式对终端设备进行异常检测，提高异常检测的准确率，并能够检测多种终端异常事件，以对不同终端异常事件确定对应的控制动作，对终端设备进行针对性的控制管理，进一步提高网络安全性。
在一种可能的设计中，所述第一网络设备在预设时长内根据所述第一控制动作对所述终端设备进行控制管理。
通过以上设计，在预设时长内，第一网络设备根据第一控制动作对终端设备进行控制管理，超出预设时常后，将终端设备作为合法终端，不再进行控制管理，从而在被劫持终端设备不再进行网络攻击行为，或不是由终端设备主动发起网络攻击行为场景下，恢复终端设备的正常业务。
第二方面，本申请实施例提供一种异常终端控制方法，该方法可适用于如图1所示的通信***中。该方法包括：
第二网络设备接收第一网络设备发送的请求消息；所述请求消息中包含终端设备的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；所述第二网络设备确定所述终端设备对应的第一控制动作，所述第一控制动作与所述 终端异常信息对应，并将所述第一控制动作下发到所述第一网络设备。
通过该设计，第二网络设备在接收到第一网络设备发送的请求消息后，根据终端异常信息确定终端设备对应的第一控制动作，能够有针对性的确定异常的终端设备对应的第一控制动作。第二网络设备将终端设备对应的第一控制动作下发到第一网络设备，以辅助第一网络设备对异常终端进行准确的控制管理。
在一种可能的设计中，所述第二网络设备确定所述终端设备对应的第一控制动作，包括：所述第二网络设备确定所述终端设备对应的控制策略，所述控制策略包括所述第一控制动作；所述将所述第一控制动作下发到所述第一网络设备，包括：所述第二网络设备将所述控制策略下发到所述第一网络设备。
在一种可能的设计中，所述控制策略还包括所述终端标识、终端异常状态、终端异常事件中的部分或全部。
通过以上设计，第二网络设备可以确定包括第一控制动作的控制策略，控制策略中还可以包括终端标识、终端异常状态、终端异常事件等，从而能够记录更加丰富的终端异常信息，为对终端设备进行控制管理提供参考，进一步提高异常终端控制的准确性。
在一种可能的设计中，所述终端异常事件为控制面异常事件，所述第一控制动作为控制面控制动作和/或数据面控制动作；或者所述终端异常事件为数据面异常事件，所述第一控制动作为控制面控制动作和/或数据面控制动作。
在一种可能的设计中，所述第二网络设备为数据管理功能实体，所述第二网络设备接收第一网络设备发送的请求消息，包括：所述第二网络设备接收所述第一网络设备发送的签约数据请求消息；所述签约数据请求消息中包含所述终端标识；所述第一网络设备为接入管理功能实体；所述将所述第一控制动作下发到所述第一网络设备，包括：所述第二网络设备将所述终端标识对应的签约数据发送到所述第一网络设备，其中，所述签约数据中包含所述第一控制动作。
通过该设计，当第一网络设备为接入管理功能实体，第二网络设备为数据管理功能实体时，第二网络设备将终端设备的签约数据发送给第一网络设备，以使第一网络设备从签约数据中获取终端设备对应的第一控制动作，及时对异常终端进行控制管理。
在一种可能的设计中，所述第二网络设备为策略控制功能实体，所述第二网络设备接收第一网络设备发送的请求消息，包括：所述第二网络设备接收所述第一网络设备发送的携带所述终端标识的策略请求消息；其中，所述第一网络设备为接入管理功能实体或会话管理功能实体。
通过该设计，当第一网络设备为接入管理功能实体或会话管理功能实体，第二网络设备为策略控制功能实体时，第一网络设备可以通过策略请求消息向第二网络设备请求终端设备对应的第一控制动作，进而能够在需要对终端设备进行控制管理时，及时获取终端设备对应的第一控制动作。
在一种可能的设计中，所述第二网络设备为网元管理功能实体，所述第一网络设备为用户面功能实体；所述将所述第一控制动作下发到所述第一网络设备，包括：所述第二网络设备根据所述第一控制动作调用配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；所述第二网络设备向所述第一网络设备将发送所述配置命令。
通过该设计，当第一网络设备为用户面功能实体时，第二网络设备通过配置命令将匹 配条件及对应的控制动作下发到第一网络设备，以使第一网络设备在确定终端接入时，在本设备中根据匹配条件及对应的控制动作查询终端设备对应的控制动作，减少网络设备之间传递消息带来的时延，提高异常终端控制的效率。
在一种可能的设计中，在所述第二网络设备接收第一网络设备的请求消息之前，还包括：所述第二网络设备接收所述第一网络设备上报的所述终端设备的终端异常事件；所述第二网络设备根据预设的终端异常事件与控制动作的对应关系，确定所述终端异常事件对应的第二控制动作；将所述终端异常事件对应的第二控制动作发送给所述第一网络设备。
通过该设计，在所述第二网络设备接收第一网络设备的请求消息之前，第二网络设备接收第一网络设备上报的终端异常事件后，确定终端设备对应的第二控制动作，并将确定出的第二控制动作发送给第一网络设备，以辅助第一网络设备对存在异常行为的终端设备及时进行控制管理，提升网络安全。
第三方面，本申请实施例提供了一种异常终端控制装置，包括用于执行以上第一方面中各个步骤的单元。
第四方面，本申请实施例提供了一种异常终端控制装置，包括用于执行以上第二方面中各个步骤的单元。
第五方面，本申请实施例提供了一种异常终端控制功能实体，包括至少一个处理元件和至少一个存储元件，其中该至少一个存储元件用于存储程序和数据，该至少一个处理元件用于执行本申请以上第一方面提供的方法。
第六方面，本申请实施例提供了一种异常终端控制功能实体，包括至少一个处理元件和至少一个存储元件，其中该至少一个存储元件用于存储程序和数据，该至少一个处理元件用于执行本申请以上第二方面提供的方法。
第七方面，本申请实施例提供了一种通信***，包括如第三方面提供的异常终端控制装置，以及如第四方面提供的异常终端控制装置。
第八方面，本申请实施例还提供了一种计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述第一方面或第二方面中提供的方法。
第九方面，本申请实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，当所述计算机程序被计算机执行时，使得所述计算机执行上述第一方面或第二方面中提供的方法。
第十方面，本申请实施例还提供了一种芯片，所述芯片用于读取存储器中存储的计算机程序，执行上述第一方面或第二方面中提供的方法。
第十一方面，本申请实施例还提供了一种芯片***，该芯片***包括处理器，用于支持计算机装置实现上述第一方面或第二方面中提供的方法。在一种可能的设计中，所述芯片***还包括存储器，所述存储器用于保存该计算机装置必要的程序和数据。该芯片***可以由芯片构成，也可以包含芯片和其他分立器件。
附图说明
图1为本申请实施例提供的一种通信***的架构示意图；
图2为本申请实施例提供的一种异常终端控制方法流程图；
图3为本申请实施例提供的第一种5G通信***下的异常终端控制方法流程图；
图4为本申请实施例提供的第二种5G通信***下的异常终端控制方法流程图；
图5为本申请实施例提供的第三种5G通信***下的异常终端控制方法流程图；
图6为本申请实施例提供的第四种5G通信***下的异常终端控制方法流程图；
图7为本申请实施例提供的第五种5G通信***下的异常终端控制方法流程图；
图8为本申请实施例提供的安全管理功能实体与CN交互为例的异常终端控制方法流程图；
图9为本申请实施例提供的第一种异常终端控制装置的结构示意图；
图10为本申请实施例提供的第二种异常终端控制装置的结构示意图；
图11为本申请实施例提供的第一种异常终端控制功能实体的结构示意图；
图12为本申请实施例提供的第二种异常终端控制功能实体的结构示意图。
具体实施方式
为了方便理解本申请实施例，下面介绍与本申请实施例相关的术语。
1、安全管理功能实体，能够基于保存的控制动作对异常终端进行控制管理。其中，该控制动作可以为由技术人员预先配置的，或者为根据一些设定的策略生成方法生成的。安全管理功能实体在接收到其它功能实体(如核心网中功能实体)上报的终端异常事件后，能够根据终端异常事件确定对该终端实施的控制动作，并将该控制动作下发到核心网设备中，从而辅助核心网设备对异常终端进行控制管理，有效防止异常终端的网络攻击行为。
可选的，本申请实施例不对所述安全管理功能实体的表现形式进行限定，其可以为具有安全管理功能的网络边缘设备、服务器，或者为核心网中的功能实体(例如网元管理功能实体或策略控制功能实体)等。
2、因特网协议(Internet Protocol，IP)，是TCP/IP体系中的网络层协议。设计IP的目的是提高网络的可扩展性：一是解决互联网问题，实现大规模、异构网络的互联互通；二是分割顶层网络应用和底层网络技术之间的耦合关系，以利于两者的独立发展。根据端到端的设计原则，IP只为主机提供一种无连接、不可靠的、尽力而为的数据包传输服务。
IP是整个TCP/IP协议族的核心，也是构成互联网的基础。IP位于TCP/IP模型的网络层，对上可载送传输层各种协议的信息，例如TCP、UDP等；对下可将IP信息包放到链路层，通过以太网、令牌环网络等各种技术来传送。
IP规定网络上所有的设备都必须有一个独一无二的IP地址，由于IP网络中每个终端设备具有唯一的地址，保证了用户在终端设备上操作时，能够高效而且方便地从千千万万台终端设备中选出自己所需的对象来。
3、签约信息，指的是终端设备跟运营商或者其它搭建网络的公司签订的用户准入信息。如果终端设备签约后，就可以根据签约信息里网络标识访问相应的网络，使用该网络资源。该签约信息存储在核心网侧和终端设备侧，如发生变动，就会由核心网发起UE配置更新流程(UE configuration update)通知终端设备侧。
4、完整性保护，是指在数据传输过程中对数据实施完整性的保护传输，从而使得接收端接收到的数据为发送端发送的准确的数据，防止数据在传输过程中被纂改或伪造IP地址。
需要说明的是，随着技术的不断发展，本申请实施例的术语有可能发生变化，但都在本申请的保护范围之内。
为了使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作进一步地详细描述。
本申请实施例提供的异常终端控制方法适用的一种可能的通信***的架构，如图1所示，所述通信***包括三部分：终端设备、移动通信网络和数据网络(data network，DN)。下面参考附图分别对每个部分的功能和实体进行详细介绍。
终端设备，是一种向用户提供语音和/或数据连通性的设备。终端设备又可以称为用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端(mobile terminal，MT)等。例如，终端设备可以为具有无线连接功能的手持式设备、车载设备等。目前，一些终端设备的举例为：手机(mobile phone)、平板电脑、笔记本电脑、掌上电脑、移动互联网设备(mobile internet device，MID)、可穿戴设备，虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程手术(remote medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。
异常终端，为在接入网络后进行网络攻击行为的终端，如在接入网络后，进行网络扫描、DDoS、传播病毒等攻击行为的终端。异常终端在对网络攻击后，可能会造成网络无法访问、资源泄露等安全问题，因此，及时检测并控制异常终端可以有效维护网络安全。
为了方便说明，在本申请后续描述以及各图中，可以将终端设备简称为终端。
DN，也可以称为分组数据网络(packet data network，PDN)，是位于移动通信网络之外的网络。DN上可部署多种业务，可为终端设备提供数据和/或语音等服务。其中，移动通信网络可以接入至少一个DN，同一个DN也可以被至少一个移动通信网络接入。例如，所述DN可以是分组数据网络(packet data network，PDN)，如因特网(Internet)、IP多媒体业务(IP Multi-media Service，IMS)网络、某些应用专用的数据网络(例如腾讯视频的数据网络)、以太网、IP本地网络等，本申请对此不作限定。
移动通信网络，为终端设备提供接入服务和端到端的连接服务。终端设备可以通过移动通信网络访问DN，实现具体业务。其中，所述移动通信网络又可以包括接入网(access network，AN)和核心网(core network，CN)两部分。其中，AN主要负责终端设备的无线接入功能。CN用于将终端设备接入到DN。
AN设备向所述终端提供无线接入服务。所述AN设备为AN中的节点，又可以称为基站，还可以称为无线接入网(radio access network，RAN)节点(或设备)。目前，一些接入网设备的举例为：gNB、传输接收点(transmission reception point，TRP)、演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station,BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(base band unit，BBU)，或无线保真(wireless fidelity，Wifi)接入点(access point，AP)等。
CN按照具体的逻辑功能划分，核心网又可以分为控制面(control plane，CP)和用户面(user plane，UP)。那么核心网中负责控制面功能的实体可以统称为控制面功能实体，负责用户面功能的实体可以统称为用户面功能实体。核心网中各个功能实体也可以称为网元，既可以是在专用硬件上实现的网络元件，也可以是在专用硬件上运行的软件实例，或 者是在适当平台上虚拟化功能的实例。
下面分别对核心网中的主要功能实体的功能进行具体介绍。
用户面功能实体，主要负责终端的用户面数据的转发和接收。用户面功能实体可以从DN接收用户面数据，通过AN设备传输给UE；用户面功能实体还可以通过AN设备从UE接收用户面数据，转发到DN。其中，用户面功能实体中为UE提供服务的传输资源和调度功能是由控制面功能实体管理控制的。
控制面功能实体包括：策略控制功能(policy control function，PCF)实体、数据管理(unified data management，UDM)实体、接入和移动性管理功能(access and mobility management function，AMF)实体、会话管理功能(session management function，SMF)实体、网元管理***(network element management system，EMS)。
为了便于描述，以下将UPF实体，AMF实体、PCF实体、UDM实体，SMF实体，简称为AMF、PCF、UDM、UPF、SMF。
其中，AMF与UE之间可以通过N1接口相连，AMF与AN设备之间可以通过N2接口相连，AN设备与UPF之间可以通过N3接口相连，SMF与UPF之间可以通过N4接口相连，UPF与DN之间可以通过N6接口相连。接口名称只是一个示例说明，本申请实施例对此不作具体限定。应理解，本申请实施例并不限于图1所示通信***，图1中所示的网元的名称在这里仅作为一种示例说明，并不作为对本申请的方法适用的通信***架构中包括的功能实体的限定。下面对所述CN中的各个功能实体或设备的功能进行详细描述：
AMF可用于对UE的接入控制和移动性进行管理，在实际应用中，其包括了长期演进(long term evolution，LTE)中网络框架中移动管理实体(mobility management entity，MME)里的移动性管理功能，并加入了接入管理功能，具体可以负责UE的注册、移动性管理、跟踪区更新流程、可达性检测、会话管理功能网元的选择、移动状态转换管理等。在如图1所示的通信***中，所述AMF可以提供Namf服务。
SMF可用于负责终端的会话管理(包括会话的建立、修改和释放)，UPF的选择和重选、UE的互联网协议(internet protocol，IP)地址分配、服务质量(quality of service，QoS)控制等。在如图1所示的通信***中，所述SMF可以提供Nsmf服务。
PCF可用于负责策略控制决策、提供基于业务数据流和应用检测、门控、QoS和基于流的计费控制等功能等。在如图1所示的通信***中，所述PCF可以提供Npcf服务。
UDM可用于管理UE的签约数据、与终端相关的注册信息等。在如图1所示的通信***中，所述UDM可以提供Nudm服务。
EMS可用于管理特定类型的一个或多个电信网络单元，在专业网领域内提供统一的操作维护功能，能够端到端管理维护设备和网络。
需要说明的是，图1所示的通信***并不构成本申请实施例能够适用的通信***的限定，其中，图1所示的通信***架构为5G***架构。可选的，本申请实施例的方法还适用于2G通信***、3G通信***、4G通信***以及未来的各种通信***，例如6G或者其他通信***等。应理解，本申请中所有功能实体的名称仅仅作为示例，在未来通信中还可以称为其它名称，或者在未来通信中本申请涉及的网元还可以通过其它具有相同功能的实体或者设备等来替代，本申请对此均不作限定。这里做统一说明，后续不再赘述。例如，在4G通信***中，具有所述AMF的功能的网元还可以称为MME，具有SMF和UPF的功能的网元还可以对应为SGW和PGW。
终端在如图1所示的通信***中进行业务通信，例如，终端通过CN接入IP网络进行通信时，CN为终端分配唯一的IP地址，终端在得到CN分配的IP地址后，在发出的业务数据中携带该IP地址，CN根据该IP地址进行计算会话策略等处理。
但终端在被劫持等情况下，可能会发起网络扫描、DDoS、传播病毒等网络攻击行为。发起网络攻击的终端为了在攻击时隐藏身份或突破网络防护，常会采用IP地址欺骗的手段，通过仿冒一个受信任的IP地址访问网络以发起网络攻击，如终端将自己的IP地址伪装为其它源IP地址，则终端发送的数据包中包括假的源IP地址，业务服务器在向该终端发送相应的数据包时，这些服务器无法判断源IP地址是否为假，都会直接使用该假的源IP地址作为目的地址，导致这些业务服务器容易被异常终端攻击。
为提高网络安全性，常用的手段为设置网络防火墙，仅允许满足访问控制规则的终端访问网络，进而拦截异常终端，但若终端将自己的IP地址伪装为满足访问控制规则的IP地址时，由于网络防火墙无法获知CN为终端分配的IP地址，从而无法识别终端是否存在IP地址欺骗，导致防火墙的访问控制规则失效。
为了解决上述问题，本申请实施例提供一种异常终端控制方法，用于检测异常终端并对异常终端进行控制管理，从而提高网络安全性。该方法可以应用于如图1所示的通信***中。下面参考图2所示的流程图对该方法的步骤进行详细描述。其中，本实施例中涉及的第一网络设备可以为通信***中的AMF、SMF或UPF，第二网络设备可以为通信***中的UDM、EMS或PCF。
S201：第一网络设备从终端接收数据。
具体实施中，第一网络设备在确定终端接入CN后，获取终端发送的数据。终端发送的数据包括用户面数据和/或控制面数据。
S202：第一网络设备根据所述数据确定终端的终端异常信息。
可选的，终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个。其中，终端异常状态用于表示终端是否属于异常终端，存在网络攻击行为等异常行为的终端为异常终端。终端异常事件为对终端发送的数据进行异常检测后确定的终端异常事件。
一种可选的实施方式中，针对终端发送用户面数据和控制面数据的不同情况，第一网络设备分别根据下列方式获取终端标识：
(1)在终端发送的数据为用户面数据的场景下
第一网络设备接收到用户面数据后，确定用户面数据对应的终端标识。
具体实施中，第一网络设备根据用户面数据的隧道标识确定所述用户面数据关联的上下文信息，并从终端的上下文信息中获取终端标识。其中，所述终端的上下文信息是终端在从控制面接入CN时建立的。
(2)在终端发送的数据为控制面数据的场景下
第一网络设备根据终端发送的控制面数据确定终端的永久标识，由于终端发送的控制面数据中包括终端的临时标识或永久标识，若控制面数据中包括终端的临时标识，第一网络设备根据终端的临时标识关联终端的上下文信息，从终端的上下文信息中获取终端的永久标识。
第一网络设备将确定出的终端的永久标识作为终端标识。
需要说明的是，终端标识还可以为终端的国际移动用户识别码(International Mobile  Subscriber Identity，IMSI)或签约永久标识(Subscription Permanent Identifier，SUPI)、移动台国际ISDN号码(Mobile Station International ISDN Number，MSISDN)或一般公共订阅标识符(Generic Public Subscription Identifier，GPSI)、国际移动设备标识(International Mobile Equipment Identity，IMEI)或永久设备标识(Permanent Equipment Identifier，PEI)等固定标识，也可以为全局唯一的临时标识(Globally Unique Temporary Identifier，GUTI)或临时移动台标识(Temporary Mobile Subscriber Identity，TMSI)或隧道端点标识(Tunnel Endpoint Identifier，TEID)等临时标识。
可选的，终端异常事件包括控制面异常事件和数据面异常事件。其中，控制面异常事件例如：终端在预设时长内发送控制面消息数量大于预设阈值、终端在接入核心网时仿冒为其它终端、终端位置异常等。数据面异常事件例如：终端发送IP地址欺骗报文、终端在预设时长内发送的数据报文数量大于预设阈值、终端发送或接收病毒流量、终端存在木马行为等。下面对本申请实施例提供的异常检测方式进行介绍：
方式1、根据终端预设时长内发送的数据与该数据类型对应的参考值，确定终端对应的终端异常事件。
第一网络设备预先配置数据类型对应的参考值，其中，该参考值为根据终端的历史数据，基于已训练的统计分析模型确定的。
进一步的，将终端的历史数据及数据类型输入到已训练的统计分析模型中，获取已训练的统计分析模型输出该数据类型对应的参考值。在获取到数据类型对应的参考值后，确定终端预设时长内发送的数据数量与所述参考值之间差值的绝对值，在确定所述差值的绝对值大于预设阈值时，确定终端异常事件为数据异常。
具体实施中，在满足下列公式时，确定终端异常事件为数据异常：
|D-R|>b
其中，D为终端预设时长内发送的数据数量，R为终端预设时长内发送的数据的数据类型对应的参考值，b为预设阈值。
举例来说，将终端的历史上行流量数据输入到已训练的统计分析模型中，获取该终端的上行流量数据对应的参考值。获取终端预设时长内的上行流量数据，确定所述上行流量数据与所述上行流量数据对应的参考值之间差值的绝对值，在所述差值的绝对值大于预设阈值时，确实终端异常事件为上行流量数据异常。
由于该实施方式中，采用统计分析模型根据终端的历史数据确定数据类型对应的参考值，该参考值能够表示终端在历史业务中的行为习惯，在计算终端预设时间内发送的数据与参考值之间差值的绝对值后，若所述差值的绝对值小于预设阈值，则确定终端在预设时间内发送数据数量在正常的波动范围内，否则，确定终端在预设时间内发送数据数量过多或过少，即存在数据异常。
方式2、基于已训练的机器学习模型，确定终端发送的数据对应的终端异常事件。
第一网络设备将终端发送的数据作为已训练的机器学习模型的输入，对终端发送的数据进行检测，获取已训练的机器学习模型输出的异常事件，如传播病毒、网络扫描、传输异常报文等。
在一种可选的实施方式中，根据下列方式对机器学习模型进行训练：
根据训练数据集中的异常流量数据作为机器学习模型的输入，将异常流量数据对应的异常事件作为机器学习模型的输出，对机器学习模型进行训练；基于损失函数计算机器学 习模型输出的预测异常事件与异常流量数据对应的异常事件之间的损失值，根据损失值调整机器学习模型参数，重复以上步骤直至损失值收敛在预设范围中，确定对及其学习模型训练完成。
方式3、基于预设的匹配规则，根据所述终端发送的数据确定所述终端的终端异常事件。
第一网络设备预先存储异常事件匹配规则，根据终端发送的数据确定对应的终端异常事件。
举例来说，第一网络设备获取终端的上行数据报文，确定上行数据报文的IP地址。第一网络设备根据终端标识确定核心网分配给终端的IP地址，在确定上行数据报文的IP地址与核心网分配给终端的IP地址不符合时，确定终端异常事件为发送IP地址欺骗报文。
S203：第一网络设备根据终端异常信息获取终端对应的第一控制动作。
第一控制动作为用于对终端进行控制管理的动作，控制动作包括控制面控制动作和数据面控制动作，例如控制面控制动作可以为禁止终端接入；数据面控制动作可以为丢弃终端发送的数据。
在第一种实施方式中，终端异常信息中包含终端标识，所述第一网络设备可以根据方式1(如图2中的步骤S2031～S2034所示)确定终端对应的第一控制动作，具体过程如下：
S2031：第一网络设备向第二网络设备发送签约数据请求消息。
其中，签约数据请求消息中包含终端标识。
S2032：第二网络设备根据签约数据请求消息中的终端标识确定终端的签约数据。
S2033：第二网络设备将终端的签约数据发送给第一网络设备，其中，签约数据中包含第一控制动作。
S2034：第一网络设备从终端的签约数据中获取第一控制动作。
需要说明的是，终端的签约数据中的第一控制动作可以为预先设置在签约数据中的，也可以是第三网络设备通过调用配置命令更新到签约数据中的。
在第二种实施方式中，终端异常信息中包含终端标识，所述第一网络设备还可以根据方式2(如图2中的步骤S2035～S2037所示)确定终端对应的第一控制动作，具体过程如下：
S2035：第一网络设备向第二网络设备发送策略请求消息；
其中，策略请求消息中携带终端标识。
S2036、第二网络设备根据策略请求消息中的终端标识确定终端对应的第一控制动作。
S2037、第二网络设备将终端对应的第一控制动作发送给第一网络设备。
在第三种实施方式中，第一网络设备还可以根据方式3(如图2中步骤S2038)确定终端对应的第一控制动作，具体过程如下：
S2038、第一网络设备根据终端异常信息在本设备中查询终端对应的第一控制动作。
具体实施中，第一网络设备根据匹配条件和控制动作的对应关系，确定终端异常信息对应的控制动作，并将确定出的控制动作作为第一控制动作。其中，匹配条件和控制动作的对应关系可以为预先配置在第一网络设备中的，也可以为第二网络设备调用配置命令配置到第一网络设备中的。可选的，匹配条件包括终端标识、终端异常状态和终端异常事件中的至少一个。
举例来说，若终端异常信息中包括终端标识、终端异常状态和终端异常事件，且匹配 条件包括终端标识、终端异常状态和终端异常事件，则可以先根据终端标识与匹配条件进行匹配，确定对应的控制动作，并将确定出的控制动作作为第一控制动作；若确定出多个控制动作，可以根据终端异常状态和终端异常事件与匹配条件进行匹配，对多个控制动作进行筛选，确定出终端对应的第一控制动作。
需要说明的是，若终端异常信息中包括终端标识，则可以优先根据终端标识确定终端对应的第一控制动作，具体实施可以参见以上方式1～方式3，由于本申请实施例提供的异常终端控制方法能够记录终端的异常事件，从而在终端再次接入时可以不对终端发送的数据进行异常检测，而直接对终端进行控制管理。相比于每次都对终端发送的数据进行异常检测的方案，该方法中的控制动作对应出现异常事件的异常终端的终端标识，从而在有异常终端接入时即可根据该终端标识确定相应的控制动作，并根据该控制动作对该异常终端进行控制管理，在提升网络安全性的同时，还提高了对异常终端控制的效率。
一种可选的实施方式中，第二网络设备可以根据下列方式确定终端对应的第一控制动作：
方式一、第二网络设备接收第一网络设备或第三网络设备上报的终端异常事件，根据预设的终端异常事件与控制动作之间的对应关系，确定终端异常事件对应的控制动作，并将确定出的控制动作作为终端对应的第一控制动作。
方式二、第二网络设备接收第四网络设备下发的终端对应的第一控制动作；其中，第四网络设备可以根据第一网络设备或第三网络设备上报的终端异常事件确定对应的控制动作。
实施中，第一网络设备或第三网络设备根据接收到终端发送的数据对终端进行异常检测，确定终端的终端异常事件，并将所述终端异常事件上报到第二网络设备或第四网络设备。具体的异常检测方法可以参见上述异常检测方式介绍，此处不再赘述。
可选的，第一网络设备或第三网络设备在确定终端的终端异常事件后，可以根据下列方式向第二网络设备或第四网络设备上报所述终端异常事件：
方式1、通过告警消息上报终端异常事件。
方式2、通过业务日志上报终端异常事件。
方式3、通过消息接口上报终端异常事件。
需要说明的是，第一网络设备或第三网络设备向第二网络设备或第四网络设备上报的消息可以为原始的明文消息，也可以进行加密以保护用户隐私，本申请实施例对此不作限定。
在一种实施方式中，第一网络设备或第三网络设备在确定所述终端发送的数据为被完整性保护的数据后，对终端发送的数据进行异常检测。这是由于终端发送数据报文时，若在传输过程中未对发送的数据进行完整性保护，则终端发送的数据报文在传输过程中可能会被第三方篡改，从而导致虽然并非是由终端主动发起的网络攻击行为，但对该终端进行控制管理，影响合法终端的正常业务。因此，可以通过在对终端发送的数据进行异常检测之前，确定该数据为被完整性保护的数据，提高异常检测的准确性。具体地，第一网络设备或第三网络设备在接收到终端发送的数据后，确定终端的上下文信息，在确定终端的上下文信息中包括完整性保护标识时，确定终端发送的数据为受完整性保护的数据。
在本申请实施例中，第一网络设备获取终端对应的第一控制动作还可以为获取终端对 应的控制策略，终端对应的控制策略中包括第一控制动作，还可以包括终端标识、终端异常状态以及终端异常事件中的部分或全部。另外，控制策略中还可以包括策略有效时长、生效时间点、生效时间段等控制策略的实施辅助指示。
S204、第一网络设备根据终端对应的第一控制动作对终端进行控制管理。
具体实施中，第一网络设备可以在预设时长内对终端进行控制管理，从而在终端不再被劫持或并不是由终端主动发起网络攻击的场景下，对终端进行一段时间的控制后，恢复终端为合法终端，从而避免影响合法终端的正常业务。
进一步的，可以在对终端进行控制管理时，设置一个定时器，在该定时器内对终端进行控制管理，定时器过期后，将该终端作为合法终端，恢复终端的正常业务。
另外，本申请实施例还提供一种异常终端控制方法，第一网络设备在接收到终端发送的数据之后，获取终端标识，确定根据终端标识未能确定终端对应的第一控制动作，表示该终端并未被标识为异常终端，则对终端发送的数据进行异常检测，确定终端的终端异常事件；第一网络设备向第二网络设备上报终端的终端异常事件；第二网络设备确定终端异常事件对应的第二控制动作，将第二控制动作发送给第一网络设备，第一网络设备根据第二控制动作对终端进行控制管理。进一步地，第二网络设备将第二控制动作发送给第一网络设备后，可以将第二控制动作作为终端对应的第一控制动作存储到预设存储空间中，也就是说，第一控制动作与第二控制动作可以相同。
基于以上实施例，本申请还提供一些异常终端控制实例。其中，这些实例也应用于如图1所示的通信***中。下面结合图3-图6对每个实例进行详细说明。
实例一：本实例以第一网络设备为AMF，第二网络设备为UDM为例进行说明，参阅图3所示，该实例具体包括以下步骤。
S301：终端接入CN。
S302、UPF从终端接收数据，并获取终端标识。
S303、终端发起网络攻击行为。
S304、UPF对终端发送的数据进行异常检测，确定终端的终端异常事件。
S305、UPF根据终端异常事件确定单次控制动作。
S306、UPF根据单次控制动作对终端进行单次控制管理。
需要说明的是，UPF在对终端进行异常检测确定终端为异常终端时，UPF可以根据预先存储的单次控制策略与终端异常事件的对应关系，确定终端的终端异常事件对应的单次控制动作，UPF根据确定出的单次控制动作对终端立即实施单次控制管理，从而减少终端的网络攻击行为带来的安全问题。
S307、UPF将终端异常事件上报到EMS。
具体实施中，UPF可以通过告警消息、业务日志、消息接口等方式将终端异常事件上报到EMS。
可选的，UPF还可以将终端异常事件通知给SMF，由SMF将终端异常事件上报到EMS。
S308、EMS根据预设的终端异常事件与控制动作的对应关系，确定终端异常事件对应的第一控制动作。
S309、EMS调用UDM配置命令修改终端的签约数据，将终端的签约数据中的控制动作修改为第一控制动作。
S310、终端再次请求接入CN。
S311、AMF获取终端标识。
S312、AMF向UDM发送包含终端标识的签约数据请求消息。
S313、UDM根据签约数据请求消息中的终端标识确定终端的签约数据。
S314、UDM将终端的签约数据发送给AMF。
S315、AMF根据终端的签约数据中的第一控制动作对终端进行控制管理。
实例二：本实例以第一网络设备为UPF、第二网络设备为EMS为例进行说明，参阅图4所示，该实例具体包括以下步骤。
S401、终端接入CN。
S402、UPF从终端接收数据，并获取终端标识。
S403、终端发起网络攻击行为。
S404、UPF对终端发送的数据进行异常检测，确定终端的终端异常事件。
S405、UPF根据终端异常事件确定单次控制动作。
S406、UPF根据单次控制动作对终端进行单次控制管理。
S407、UPF将终端异常事件上报到EMS。
具体实施中，UPF可以通过告警消息、业务日志、消息接口等方式将终端异常事件上报到EMS。
可选的，UPF还可以将终端异常事件通知给SMF，由SMF将终端异常事件上报到EMS。
S408、EMS根据预设的终端异常事件与控制动作的对应关系，确定终端异常事件对应的第一控制动作。
S409、EMS调用UPF配置命令将匹配条件及对应的控制动作配置到UPF。
一种可选的实施方式中，EMS还可以调用SMF配置命令，将匹配条件及对应的控制动作配置到SMF，再由SMF将匹配条件及对应的控制动作下发到UPF。
S410、终端再次请求接入CN。
S411、UPF获取终端异常信息。
S412、UPF根据终端异常信息在本设备中查询终端对应的第一控制动作。
S413、UPF根据终端对应的第一控制动作对终端进行控制管理。
实例三：本实例以第一网络设备为AMF，第二网络设备为PCF为例进行说明，参阅图5所示，该实例具体包括以下步骤。
S501、终端接入CN。
S502、UPF从终端接收数据，并获取终端标识。
S503、终端发起网络攻击行为。
S504、UPF对终端发送的数据进行异常检测，确定终端的终端异常事件。
S505、UPF根据终端异常事件确定单次控制动作。
S506、UPF根据单次控制动作对终端进行单次控制管理。
S507、UPF将终端异常事件发送到SMF。
S508、SMF将终端异常事件上报到PCF。
可选的，UPF还可以通过消息接口等方式将终端异常事件直接上报到PCF。
S509、PCF存储终端标识以及终端异常事件。
S510、终端再次请求接入CN。
S511、AMF获取终端标识。
S512、AMF向PCF发送策略请求消息。
S513、PCF根据策略请求消息中的终端标识查询存储的终端标识以及终端异常事件，并根据预设的终端异常事件与控制动作的对应关系，确定终端异常事件对应的第一控制动作。
S514、PCF将第一控制动作发送给AMF。
S515、AMF根据第一控制动作对终端进行控制管理。
实例四：本实例以第一网络设备为SMF、第二网络设备为PCF为例进行说明，参阅图6所示，该实例具体包括以下步骤。
S601、终端接入CN。
S602、AMF从终端接收数据，获取终端标识。
S603、终端发起网络攻击行为。
S604、AMF对终端发送的数据进行异常检测，确定终端的终端异常事件。
S605、AMF根据终端异常事件确定单次控制动作。
S606、AMF根据单次控制动作对终端进行单次控制管理。
S607、AMF将终端异常事件上报到PCF。
具体实施中，AMF可以通过消息接口等方式将终端异常事件上报到PCF。
S608、PCF存储终端标识以及终端异常事件。
S609、终端再次请求接入CN。
S610、AMF获取终端标识。
S611、AMF通知SMF终端请求接入CN。
S612、SMF向PCF发送策略请求消息。
S613、PCF根据策略请求消息中的终端标识查询存储的终端标识以及终端异常事件，并根据预设的终端异常事件与控制动作的对应关系，确定终端异常事件对应的第一控制动作。
S614、PCF将第一控制动作发送给SMF。
S615、SMF将第一控制动作发送给UPF。
可选的，PCF还可以将第一控制动作直接下发给UPF，而不需要SMF进行转发。
S616、UPF根据第一控制动作对终端进行控制管理。
实例五：本实例以第一网络设备为UPF、第二网络设备为PCF为例进行说明，参阅图7所示，该实例具体包括以下步骤。
S701、终端接入CN。
S702、UPF从终端接收数据，并获取终端标识。
S703、终端发起网络攻击行为。
S704、UPF对终端发送的数据进行异常检测，确定终端的终端异常事件。
S705、UPF根据终端异常事件确定单次控制动作。
S706、UPF根据单次控制动作对终端进行单次控制管理。
S707、UPF将终端异常事件发送到SMF。
S708、SMF将终端异常事件上报到PCF。
可选的，UPF还可以将终端异常事件直接上报到PCF。
S709、PCF根据预设的终端异常事件与控制动作的对应关系，确定终端异常事件对应的第二控制动作。
S710、PCF将第二控制动作发送给SMF。
S711、SMF将第二控制动作发送给UPF。
可选的，PCF还可以将第二控制动作直接下发给UPF，而不需要SMF进行转发。
S712、UPF确定终端当前接入CN，根据终端对应的第二控制动作对终端进行控制管理。
需要说明的是，以上实例1～5为以通信***为5G***为例的异常终端控制方法，具体实施中，本申请提供的异常终端控制方法也适用于2G、3G或4G***，如本申请实施例中5G***核心网中的UPF执行的功能可以由2G和3G***中的GGSN或4G***中的PGW实现，本申请实施例中5G***核心网中的AMF执行的功能可以由2G和3G***中的SGSN或4G***中的MME实现，具体实施过程可以参见上述实施例，重复之处不再赘述。
基于以上实施例和实例，本申请还提供了一种异常终端控制方法，该方法可以应用于图1所示的通信***中，能够实现以上实施例或实例提供的方法。其中，本方法中涉及的安全管理功能实体，用于实现对异常终端的控制管理，在具体实施中，所述安全管理功能实体可以为具有安全管理功能的独立设备，也可以为CN中的功能实体，如EMS或PCF。安全管理功能实体通过与CN交互，实现对异常终端的控制管理。下面参阅图8所示的方法流程图，对该方法进行说明。
S801：终端按照3GPP标准流程接入核心网。
S802、CN从终端接收数据，并获取终端标识。
S803、终端发起网络攻击行为。
具体的，终端发起的网络攻击行为可能为发送IP地址欺骗报文、网络扫描、DDoS行为、传播病毒等。其中，IP地址欺骗报文为终端在发送报文时，仿冒其它IP地址而不使用核心网设备为该终端分配的IP地址。
S804、CN对终端发送的数据进行异常检测，确定终端的终端异常事件。
具体实施中，CN对终端进行异常检测的方式可以参见上述实施例中的异常检测方法，重复之处不再赘述。
S805、CN将终端异常事件上报安全管理功能实体。
S806、安全管理功能实体确实终端异常状态为异常。并根据预设的终端异常事件与控制动作的对应关系，确定终端异常事件对应的控制动作。
S807、安全管理功能实体将确定出的控制动作存储到本设备中。
S808、安全管理功能实体将确定出的控制动作下发到CN。
一种可选的实施方式为，安全管理功能实体还可以在接收到CN发送的策略请求消息后，再将策略请求消息中的终端标识对应的控制策略下发到CN。
S809、CN判断终端是否在线；若是，执行S813，否则，执行S810。
S810、CN将接收到的控制动作保存到本设备中。
S811、终端再次请求接入CN。
S812、CN获取终端标识，并根据终端标识确定终端对应的控制动作。
S813、CN根据终端对应的控制动作对终端进行控制管理。
基于相同的技术构思，本申请还提供了一种异常终端控制装置900，该装置的结构如图9所示，包括第一通信单元901和第一处理单元902。所述异常终端控制装置900可以应用于图2～图7所示的第一网络设备，并可以实现上述实施例提供的异常终端控制方法。下面对所述异常终端控制装置900的各个单元的功能进行介绍。
所述第一通信单元901用于从终端设备接收数据，所述数据包括用户面数据和/或控制面数据；
所述第一处理单元902用于根据所述数据确定所述终端设备的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；根据所述终端异常信息获取所述终端设备对应的第一控制动作，并根据所述第一控制动作对所述终端设备进行控制管理。
在一种实施方式中，所述第一处理单元902具体用于：根据所述数据获取所述终端设备的终端标识；和/或对所述数据进行异常检测，确定所述终端设备的终端异常事件和/或终端异常状态。
在一种实施方式中，述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体，所述第一处理单元902具体用于：通过所述第一通信单元901向第二网络设备发送携带所述终端标识的签约数据请求消息，其中，所述第二网络设备为数据管理功能实体；通过所述第一通信单元901从所述第二网络设备获取所述终端设备的签约数据，其中，所述签约数据中包含所述第一控制动作。
在一种实施方式中，所述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体或会话管理功能实体，所述第一处理单元902具体用于：通过所述第一通信单元901向所述第二网络设备发送携带所述终端标识的策略请求消息；其中，所述第二网络设备为策略控制功能实体；通过所述第一通信单元901接收所述第二网络设备返回的所述第一控制动作。
在一种实施方式中，所述第一网络设备为用户面功能实体，所述第一处理单元902具体用于：根据所述终端异常信息在本设备中查询所述终端设备对应的第一控制动作。
在一种实施方式中，所述第一处理单元902具体用于：通过所述第一通信单元901接收第二网络设备发送的配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；根据所述匹配条件和控制动作的对应关系，确定所述终端异常信息对应的控制动作，并将确定出的控制动作作为所述第一控制动作。
在一种实施方式中，所述第一处理单元902还用于：在根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，对所述数据进行异常检测，确定所述终端设备的终端异常事件，以及通过所述第一通信单元向所述第二网络设备上报所述终端设备的终端异常事件。
在一种实施方式中，所述第一处理单元902还用于：在根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，对所述数据进行异常检测，确定所述终端设备的终端异常事件；通过所述第一通信单元向所述第二网络设备上报所述终端设备的终端异常事件；以及通过所述第一通信单元从所述第二网络设备接收与所述终端异常事件对应的第二控制动作；根据所述第二控制动作对所述终端设备进行控制管理。
在一种实施方式中，所述第一处理单元902具体用于：根据所述终端设备在预设时长内发送的数据与参考值，确定所述终端设备的终端异常事件；其中，所述参考值为根据所述终端设备的历史数据，基于已训练的统计分析模型确定的；或者基于已训练的机器学习模型，确定所述数据对应的终端异常事件；或者基于预设的匹配规则，根据所述数据确定所述终端设备的终端异常事件。
在一种实施方式中，所述第一处理单元902具体用于：在预设时长内根据所述第一控制动作对所述终端设备进行控制管理。
基于相同的技术构思，本申请还提供了一种异常终端控制装置1000，该装置的结构如图10所示，包括第二通信单元1001和第二处理单元1002。所述异常终端控制功能实体1000可以应用于图2～图7所示的第二网络设备，并可以实现上述实施例提供的异常终端控制方法。下面对所述异常终端控制装置1000的各个单元的功能进行介绍。
所述第二通信单元1001用于接收第一网络设备发送的请求消息；所述请求消息中包含终端的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；并在第二处理单元1002确定出第一控制动作后，将所述第一控制动作下发到所述第一网络设备；
所述第二处理单元1002用于确定所述终端设备对应的第一控制动作，所述第一控制动作与所述终端异常信息对应。
在一种实施方式中，所述第二网络设备为数据管理功能实体，所述第二通信单元1001具体用于：接收所述第一网络设备发送的签约数据请求消息；所述签约数据请求消息中包含所述终端标识；所述第一网络设备为接入管理功能实体；将所述终端标识对应的签约数据发送到所述第一网络设备，其中，所述签约数据中包含所述第一控制动作。
在一种实施方式中，所述第二网络设备为策略控制功能实体，所述第二通信单元1001具体用于：接收所述第一网络设备发送的携带所述终端标识的策略请求消息；其中，所述第一网络设备为接入管理功能实体或会话管理功能实体。
在一种实施方式中，所述第二网络设备为网元管理功能实体，所述第一网络设备为用户面功能实体；所述第二处理单元1002具体用于：根据所述第一控制动作调用配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；通过所述第二通信单元1001向所述第一网络设备发送所述配置命令。
在一种实施方式中，所述第二处理单元1002还用于：在接收第一网络设备的请求消息之前，通过所述第二通信单元1001接收所述第一网络设备上报的所述终端设备的终端异常事件；根据预设的终端异常事件与控制动作的对应关系，确定所述终端异常事件对应的第二控制动作；以及通过所述第二通信单元将所述第二控制动作发送给所述第一网络设备。
基于相同的技术构思，本申请还提供了一种异常终端控制功能实体1100，该功能实体的结构如图11所示，所述异常终端控制功能实体1100可以应用于如图2～图7所示的第一网络设备，可以实现以上实施例提供的异常终端控制方法，参阅图11，所述异常终端控制功能实体1100包括：通信模块1101、处理器1102以及存储器1103。其中，所述通信模块1101、所述处理器1102以及所述存储器1103之间相互连接。
可选的，所述通信模块1101、所述处理器1102以及所述存储器1103之间通过总线1104相互连接。所述总线1104可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图11中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
所述通信模块1101，用于接收和发送数据，实现与其他设备之间的通信交互。例如，当所述异常终端控制功能实体1100应用于图2所示的第一网络设备时，所述通信模块1101可以通过物理接口、通信模块、通信接口、输入输出接口实现。
所述处理器1102用于通过所述通信模块1101从终端设备接收数据，所述数据包括用户面数据和/或控制面数据；根据所述数据确定所述终端设备的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；根据所述终端异常信息获取所述终端设备对应的第一控制动作，并根据所述第一控制动作对所述终端设备进行控制管理。
在一种实施方式中，所述处理器1102具体用于：根据所述数据获取所述终端设备的终端标识；和/或对所述数据进行异常检测，确定所述终端设备的终端异常事件和/或终端异常状态。
在一种实施方式中，所述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体，所述处理器1102具体用于：通过所述通信模块1101向第二网络设备发送携带所述终端标识的签约数据请求消息，其中，所述第二网络设备为数据管理功能实体；以及通过所述通信模块1101从所述第二网络设备获取所述终端以及的签约数据，其中，所述签约数据中包含所述第一控制动作。
在一种实施方式中，所述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体或会话管理功能实体，所述处理器1102具体用于：通过所述通信模块1101向所述第二网络设备发送携带所述终端标识的策略请求消息；其中，所述第二网络设备为策略控制功能实体；以及通过所述通信模块1101接收所述第二网络设备返回的所述第一控制动作。
在一种实施方式中，所述第一网络设备为用户面功能实体，所述处理器1102具体用于：根据所述终端异常信息在本设备中查询所述终端设备对应的第一控制动作。
在一种实施方式中，所述处理器1102具体于：通过所述通信模块1101接收第二网络设备发送的配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；根据所述匹配条件和控制动作的对应关系，确定所述终端异常信息对应的控制动作，并将确定出的控制动作作为所述第一控制动作。
在一种实施方式中，所述处理器1102还用于：在根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，对所述数据进行异常检测，确定所述终端设备的终端异常 事件；通过所述通信模块1101向所述第二网络设备上报所述终端设备的终端异常事件。
在一种实施方式中，所述处理器1102还用于：在根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，对所述数据进行异常检测，确定所述终端设备的终端异常事件；通过所述通信模块1101向所述第二网络设备上报所述终端设备的终端异常事件；通过所述通信模块1101从所述第二网络设备接收与所述终端异常事件对应的第二控制动作；根据所述第二控制动作对所述终端设备进行控制管理。
在一种实施方式中，所述处理器1102具体用于：根据所述终端设备在预设时长内发送的数据与参考值，确定所述终端设备的终端异常事件；其中，所述参考值为根据所述终端设备的历史数据，基于已训练的统计分析模型确定的；或者基于已训练的机器学习模型，确定所述数据对应的终端异常事件；或者基于预设的匹配规则，根据所述数据确定所述终端设备的终端异常事件。
在一种实施方式中，所述处理器1102具体用于：在预设时长内根据所述第一控制动作对所述终端设备进行控制管理。
所述存储器1103，用于存放程序指令和数据等。具体地，程序指令可以包括程序代码，该程序代码包括计算机操作指令。存储器1103可能包含随机存取存储器(random access memory，RAM)，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。处理器1102执行存储器1103所存放的程序指令，并使用所述存储器1103中存储的数据，实现上述功能，从而实现上述实施例提供的异常终端控制方法。
可以理解，本申请图11中的存储器1103可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的***和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
基于相同的技术构思，本申请还提供了一种异常终端控制功能实体1200，该功能实体的结构如图12所示，所述异常终端控制功能实体1200可以应用于如图2～图7所示的第二网络设备，可以实现以上实施例提供的异常终端控制方法，参阅图12，所述异常终端控制功能实体1200包括：通信模块1201、处理器1202以及存储器1203。其中，所述通信模块1201、所述处理器1202以及所述存储器1203之间相互连接。
可选的，所述通信模块1201、所述处理器1202以及所述存储器1203之间通过总线1204相互连接。所述总线1204可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图12中仅用一条粗 线表示，但并不表示仅有一根总线或一种类型的总线。
所述通信模块1201，用于接收和发送数据，实现与其他设备之间的通信交互。例如，当所述异常终端控制功能实体1200应用于图2所示的第二网络设备时，所述通信模块1201可以通过物理接口、通信模块、通信接口、输入输出接口实现。
所述处理器1202用于通过所述通信模块1201接收第一网络设备发送的请求消息；所述请求消息中包含终端设备的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；确定所述终端设备对应的第一控制动作，所述第一控制动作与所述终端异常信息对应；通过所述通信模块1201将所述第一控制动作下发到所述第一网络设备。
在一种实施方式中，所述第二网络设备为数据管理功能实体，所述处理器1202具体用于：通过所述通信模块1201接收所述第一网络设备发送的签约数据请求消息；所述签约数据请求消息中包含所述终端标识；所述第一网络设备为接入管理功能实体；通过所述通信模块1201将所述终端标识对应的签约数据发送到所述第一网络设备，其中，所述签约数据中包含所述第一控制动作。
在一种实施方式中，所述第二网络设备为策略控制功能实体，所述处理器1202具体用于：通过所述通信模块1201接收所述第一网络设备发送的携带所述终端标识的策略请求消息；其中，所述第一网络设备为接入管理功能实体或会话管理功能实体。
在一种实施方式中，所述第二网络设备为网元管理功能实体，所述第一网络设备为用户面功能实体；所述处理器1202具体用于：通过所述通信模块1201根据所述第一控制动作调用配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；通过所述通信模块1201向所述第一网络设备发送所述配置命令。
在一种实施方式中，在接收第一网络设备的请求消息之前，所述处理器1202还用于：通过所述通信模块1201接收所述第一网络设备上报的所述终端设备的终端异常事件；根据预设的终端异常事件与控制动作的对应关系，确定所述终端异常事件对应的第二控制动作；以及通过所述通信模块1201将所述第二控制动作发送给所述第一网络设备。
所述存储器1203，用于存放程序指令和数据等。具体地，程序指令可以包括程序代码，该程序代码包括计算机操作指令。存储器1203可能包含随机存取存储器(random access memory，RAM)，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。处理器1202执行存储器1203所存放的程序指令，并使用所述存储器1203中存储的数据，实现上述功能，从而实现上述实施例提供的异常终端控制方法。
可以理解，本申请图12中的存储器1203可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器 (Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的***和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
基于以上实施例，本申请实施例还提供了一种通信***，包括如图9所示的异常终端控制装置900以及如图10所示的异常终端控制装置1000。
基于以上实施例，本申请实施例还提供了一种计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行以上实施例提供的异常终端控制方法。
基于以上实施例，本申请实施例还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序，所述计算机程序被计算机执行时，使得计算机执行以上实施例提供的异常终端控制方法。
其中，存储介质可以是计算机能够存取的任何可用介质。以此为例但不限于：计算机可读介质可以包括RAM、ROM、EEPROM、CD-ROM或其他光盘存储、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质。
基于以上实施例，本申请实施例还提供了一种芯片，所述芯片用于读取存储器中存储的计算机程序，实现以上实施例提供的异常终端控制方法。
基于以上实施例，本申请实施例提供了一种芯片***，该芯片***包括处理器，用于支持计算机装置实现以上实施例中业务设备、转发设备或站点设备所涉及的功能。在一种可能的设计中，所述芯片***还包括存储器，所述存储器用于保存该计算机装置必要的程序和数据。该芯片***，可以由芯片构成，也可以包含芯片和其他分立器件。
本领域内的技术人员应明白，本申请的实施例可提供为方法、***、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的保护范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (31)

  1. 一种异常终端控制方法，其特征在于，该方法包括：
    第一网络设备从终端设备接收数据，所述数据包括用户面数据和/或控制面数据；
    所述第一网络设备根据所述数据确定所述终端设备的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；
    所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作，并根据所述第一控制动作对所述终端设备进行控制管理。
  2. 如权利要求1所述的方法，其特征在于，所述第一网络设备根据所述数据确定所述终端设备的终端异常信息，包括：
    所述第一网络设备根据所述数据获取所述终端设备的终端标识；和/或
    所述第一网络设备对所述数据进行异常检测，确定所述终端设备的终端异常事件和/或终端异常状态。
  3. 如权利要求1或2所述的方法，其特征在于，所述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体，所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作，包括：
    所述第一网络设备向第二网络设备发送携带所述终端标识的签约数据请求消息，其中，所述第二网络设备为数据管理功能实体；
    所述第一网络设备从所述第二网络设备获取所述终端设备的签约数据，其中，所述签约数据中包含所述第一控制动作。
  4. 如权利要求1或2所述的方法，其特征在于，所述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体或会话管理功能实体，所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作，包括：
    所述第一网络设备向所述第二网络设备发送携带所述终端标识的策略请求消息；其中，所述第二网络设备为策略控制功能实体；
    所述第一网络设备接收所述第二网络设备返回的所述第一控制动作。
  5. 如权利要求1或2所述的方法，其特征在于，所述第一网络设备为用户面功能实体，所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作，包括：
    所述第一网络设备根据所述终端异常信息在本设备中查询所述终端设备对应的第一控制动作。
  6. 如权利要求5所述的方法，其特征在于，所述第一网络设备根据所述终端异常信息在本设备中查询所述终端设备对应的第一控制动作，包括：
    所述第一网络设备接收第二网络设备发送的配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；
    所述第一网络设备根据所述匹配条件和控制动作的对应关系，确定所述终端异常信息对应的控制动作，并将确定出的控制动作作为所述第一控制动作。
  7. 如权利要求1至6任一项所述的方法，其特征在于，在所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，还包括：
    所述第一网络设备对所述数据进行异常检测，确定所述终端设备的终端异常事件；
    所述第一网络设备向第二网络设备上报所述终端设备的终端异常事件。
  8. 如权利要求1至6任一项所述的方法，其特征在于，在所述第一网络设备根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，还包括：
    所述第一网络设备对所述数据进行异常检测，确定所述终端设备的终端异常事件；
    所述第一网络设备向所述第二网络设备上报所述终端设备的终端异常事件；
    所述第一网络设备从所述第二网络设备接收与所述终端异常事件对应的第二控制动作；
    所述第一网络设备根据所述第二控制动作对所述终端设备进行控制管理。
  9. 如权利要求2、7、8任一项所述的方法，其特征在于，所述第一网络设备对所述数据进行异常检测，确定所述终端设备的终端异常事件，包括：
    所述第一网络设备根据所述终端设备在预设时长内发送的数据与参考值，确定所述终端设备的终端异常事件；其中，所述参考值为根据所述终端设备的历史数据，基于已训练的统计分析模型确定的；或者
    所述第一网络设备基于已训练的机器学习模型，确定所述数据对应的终端异常事件；或者
    所述第一网络设备基于预设的匹配规则，根据所述数据确定所述终端设备的终端异常事件。
  10. 如权利要求1至9任一项所述的方法，其特征在于，所述第一网络设备根据所述第一控制动作对所述终端设备进行控制管理，包括：
    所述第一网络设备在预设时长内根据所述第一控制动作对所述终端设备进行控制管理。
  11. 一种异常终端控制方法，其特征在于，该方法包括：
    第二网络设备接收第一网络设备发送的请求消息；所述请求消息中包含终端设备的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；
    所述第二网络设备确定所述终端设备对应的第一控制动作，所述第一控制动作与所述终端异常信息对应，并将所述第一控制动作下发到所述第一网络设备。
  12. 如权利要求11所述的方法，其特征在于，所述第二网络设备为数据管理功能实体，所述第二网络设备接收第一网络设备发送的请求消息，包括：
    所述第二网络设备接收所述第一网络设备发送的签约数据请求消息；所述签约数据请求消息中包含所述终端标识；所述第一网络设备为接入管理功能实体；
    所述将所述第一控制动作下发到所述第一网络设备，包括：
    所述第二网络设备将所述终端标识对应的签约数据发送到所述第一网络设备，其中，所述签约数据中包含所述第一控制动作。
  13. 如权利要求11所述的方法，其特征在于，所述第二网络设备为策略控制功能实体，所述第二网络设备接收第一网络设备发送的请求消息，包括：
    所述第二网络设备接收所述第一网络设备发送的携带所述终端标识的策略请求消息；其中，所述第一网络设备为接入管理功能实体或会话管理功能实体。
  14. 如权利要求11所述的方法，其特征在于，所述第二网络设备为网元管理功能实体， 所述第一网络设备为用户面功能实体；所述将所述第一控制动作下发到所述第一网络设备，包括：
    所述第二网络设备根据所述第一控制动作调用配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；
    所述第二网络设备向所述第一网络设备发送所述配置命令。
  15. 如权利要求11至14任一项所述的方法，其特征在于，在所述第二网络设备接收第一网络设备的请求消息之前，还包括：
    所述第二网络设备接收所述第一网络设备上报的所述终端设备的终端异常事件；
    所述第二网络设备根据预设的终端异常事件与控制动作的对应关系，确定所述终端异常事件对应的第二控制动作；
    所述第二网络设备将所述第二控制动作发送给所述第一网络设备。
  16. 一种异常终端控制装置，应用于第一网络设备，其特征在于，包括：
    第一通信单元，用于从终端设备接收数据，所述数据包括用户面数据和/或控制面数据；
    第一处理单元，用于根据所述数据确定所述终端设备的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；根据所述终端异常信息获取所述终端设备对应的第一控制动作，并根据所述第一控制动作对所述终端设备进行控制管理。
  17. 如权利要求16所述的装置，其特征在于，所述第一处理单元具体用于：
    根据所述数据获取所述终端设备的终端标识；和/或
    对所述数据进行异常检测，确定所述终端设备的终端异常事件和/或终端异常状态。
  18. 如权利要求16或17所述的装置，其特征在于，所述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体，所述第一处理单元具体用于：
    通过所述第一通信单元向第二网络设备发送携带所述终端标识的签约数据请求消息，其中，所述第二网络设备为数据管理功能实体；以及通过所述第一通信单元从所述第二网络设备获取所述终端设备的签约数据，其中，所述签约数据中包含所述第一控制动作。
  19. 如权利要求16或17所述的装置，其特征在于，所述终端异常信息包括终端标识，所述第一网络设备为接入管理功能实体或会话管理功能实体，所述第一处理单元具体用于：
    通过所述第一通信单元向所述第二网络设备发送携带所述终端标识的策略请求消息；其中，所述第二网络设备为策略控制功能实体；以及通过所述第一通信单元接收所述第二网络设备返回的所述第一控制动作。
  20. 如权利要求16或17所述的装置，其特征在于，所述第一网络设备为用户面功能实体，所述第一处理单元具体用于：
    根据所述终端异常信息在本设备中查询所述终端设备对应的第一控制动作。
  21. 如权利要求20所述的装置，其特征在于，所述第一处理单元具体用于：通过所述第一通信单元接收第二网络设备发送的配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；
    根据所述匹配条件和控制动作的对应关系，确定所述终端异常信息对应的控制动作，并将确定出的控制动作作为所述第一控制动作。
  22. 如权利要求16至21任一项所述的装置，其特征在于，所述第一处理单元还用于： 在根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，对所述数据进行异常检测，确定所述终端设备的终端异常事件，以及通过所述第一通信单元向所述第二网络设备上报所述终端设备的终端异常事件。
  23. 如权利要求16至21任一项所述的装置，其特征在于，所述第一处理单元还用于：在根据所述终端异常信息获取所述终端设备对应的第一控制动作之前，对所述数据进行异常检测，确定所述终端设备的终端异常事件；通过所述第一通信单元向所述第二网络设备上报所述终端设备的终端异常事件；以及通过所述第一通信单元从所述第二网络设备接收与所述终端异常事件对应的第二控制动作；
    根据所述第二控制动作对所述终端设备进行控制管理。
  24. 如权利要求17、22、23任一项所述的装置，其特征在于，所述第一处理单元具体用于：
    根据所述终端设备在预设时长内发送的数据与参考值，确定所述终端设备的终端异常事件；其中，所述参考值为根据所述终端设备的历史数据，基于已训练的统计分析模型确定的；或者
    基于已训练的机器学习模型，确定所述数据对应的终端异常事件；或者
    基于预设的匹配规则，根据所述数据确定所述终端设备的终端异常事件。
  25. 如权利要求16至24任一项所述的装置，其特征在于，所述第一处理单元具体用于：
    在预设时长内根据所述第一控制动作对所述终端设备进行控制管理。
  26. 一种异常终端控制装置，其特征在于，包括：
    第二通信单元，用于接收第一网络设备发送的请求消息；所述请求消息中包含终端设备的终端异常信息，所述终端异常信息包括终端标识、终端异常状态和终端异常事件中的至少一个；并在第二处理单元确定出第一控制动作后，将所述第一控制动作下发到所述第一网络设备；
    第二处理单元，用于确定所述终端设备对应的第一控制动作，所述第一控制动作与所述终端异常信息对应。
  27. 如权利要求26所述的装置，其特征在于，所述第二网络设备为数据管理功能实体，所述第二通信单元具体用于：
    接收所述第一网络设备发送的签约数据请求消息；所述签约数据请求消息中包含所述终端标识；所述第一网络设备为接入管理功能实体；
    将所述终端标识对应的签约数据发送到所述第一网络设备，其中，所述签约数据中包含所述第一控制动作。
  28. 如权利要求26所述的装置，其特征在于，所述第二网络设备为策略控制功能实体，所述第二通信单元具体用于：
    接收所述第一网络设备发送的携带所述终端标识的策略请求消息；其中，所述第一网络设备为接入管理功能实体或会话管理功能实体。
  29. 如权利要求26所述的装置，其特征在于，所述第二网络设备为网元管理功能实体，所述第一网络设备为用户面功能实体；所述第二处理单元具体用于：
    根据所述第一控制动作调用配置命令，所述配置命令中包括匹配条件及对应的控制动作，所述匹配条件包括所述终端标识、终端异常状态和终端异常事件中的至少一个；通过所述第二通信单元向所述第一网络设备发送所述配置命令。
  30. 如权利要求26至29任一项所述的装置，其特征在于，所述第二处理单元还用于：在接收第一网络设备的请求消息之前，通过所述第二通信单元接收所述第一网络设备上报的所述终端设备的终端异常事件；根据预设的终端异常事件与控制动作的对应关系，确定所述终端异常事件对应的第二控制动作；以及通过所述第二通信单元将所述第二控制动作发送给所述第一网络设备。
  31. 一种计算机可读存储介质，所述存储介质存储有计算机程序，当所述计算机程序被计算机执行时，使得所述计算机执行权利要求1至10中任一项所述的方法，或执行权利要求11至15中任一项所述的方法。
PCT/CN2021/121210 2020-10-30 2021-09-28 一种异常终端控制方法及装置 WO2022089130A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP21884860.4A EP4236410A4 (en) 2020-10-30 2021-09-28 METHOD AND DEVICE FOR CONTROLLING AN ABNORMAL TERMINAL

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011194022.8 2020-10-30
CN202011194022.8A CN114531681A (zh) 2020-10-30 2020-10-30 一种异常终端控制方法及装置

Publications (1)

Publication Number Publication Date
WO2022089130A1 true WO2022089130A1 (zh) 2022-05-05

Family

ID=81383602

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/121210 WO2022089130A1 (zh) 2020-10-30 2021-09-28 一种异常终端控制方法及装置

Country Status (3)

Country Link
EP (1) EP4236410A4 (zh)
CN (1) CN114531681A (zh)
WO (1) WO2022089130A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114884749B (zh) * 2022-07-06 2022-09-16 智联信通科技股份有限公司 一种基于人工智能的网络安全态势感知方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140157405A1 (en) * 2012-12-04 2014-06-05 Bill Joll Cyber Behavior Analysis and Detection Method, System and Architecture
CN110535808A (zh) * 2018-05-24 2019-12-03 华为技术有限公司 一种设备监控、去注册方法及装置
CN110602735A (zh) * 2018-06-13 2019-12-20 华为技术有限公司 一种受限服务的提供方法及通信设备
CN110830422A (zh) * 2018-08-10 2020-02-21 ***通信有限公司研究院 一种终端行为数据处理方法及设备

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109698760B (zh) * 2017-10-23 2021-05-04 华为技术有限公司 一种流量处理方法和用户面装置以及终端设备
CN110602697B (zh) * 2018-06-13 2021-08-31 华为技术有限公司 一种限制终端设备接入的方法及装置
CN110650034B (zh) * 2018-06-26 2021-08-31 华为技术有限公司 一种信息处理方法及装置
WO2020001336A1 (zh) * 2018-06-26 2020-01-02 华为技术有限公司 一种信息处理方法及装置
CN111770490B (zh) * 2019-04-02 2022-08-05 大唐移动通信设备有限公司 一种确定终端行为分析的方法和设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140157405A1 (en) * 2012-12-04 2014-06-05 Bill Joll Cyber Behavior Analysis and Detection Method, System and Architecture
CN110535808A (zh) * 2018-05-24 2019-12-03 华为技术有限公司 一种设备监控、去注册方法及装置
CN110602735A (zh) * 2018-06-13 2019-12-20 华为技术有限公司 一种受限服务的提供方法及通信设备
CN110830422A (zh) * 2018-08-10 2020-02-21 ***通信有限公司研究院 一种终端行为数据处理方法及设备

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
CATT, ERICSSON: "Update to Abnormal behaviour related network data analytics", 3GPP DRAFT; S2-1902083_ABNORMAL BEHAVIOUR RELATED NETWORK DATA ANALYTICS, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Santa Cruz, Tenerife, Spain; 20190225 - 20190301, 19 February 2019 (2019-02-19), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051610645 *
KPN: "Abnormal behaviour analytics suspicious devices", 3GPP DRAFT; S2-1911807, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Reno, USA; 20191118 - 20191122, 8 November 2019 (2019-11-08), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051821882 *
See also references of EP4236410A4 *

Also Published As

Publication number Publication date
EP4236410A4 (en) 2023-12-06
EP4236410A1 (en) 2023-08-30
CN114531681A (zh) 2022-05-24

Similar Documents

Publication Publication Date Title
US20230354447A1 (en) Establishing a Session or Cellular Internet of Things Packet Transmission
US11206710B2 (en) Network initiated release assistance indication
US11425202B2 (en) Session processing method and device
US10869192B2 (en) System and method of counter management and security key update for device-to-device group communication
EP3780682B1 (en) Method and device for subscribing to service
TW201644238A (zh) 用於服務－使用者平面方法的使用網路符記的高效策略實施
US11444873B2 (en) Message routing to devices with non-routable addresses
EP3534562B1 (en) Data transmission method, apparatus, and system, and storage medium
WO2017156706A1 (zh) 用于处理数据包的方法及设备
US11336472B2 (en) Data packet processing method and apparatus
WO2018161802A1 (zh) 一种业务流的控制方法及装置
US11418951B2 (en) Method for identifying encrypted data stream, device, storage medium and system
US20200229263A1 (en) Method of securing unicast message communication in 3gpp based wireless networks
WO2022206252A1 (zh) 一种网络攻击的处理方法、装置、设备、计算机可读存储介质及计算机程序产品
WO2022089130A1 (zh) 一种异常终端控制方法及装置
JP6924884B2 (ja) 次世代ファイアウォールを用いたトランスポート層の信号安全性
WO2022174802A1 (zh) 密钥更新的方法和装置
CN101605373B (zh) 一种用户设备接入apn的控制方法及***
WO2023011263A1 (zh) 消息传输方法及通信装置
JP2018538706A (ja) モバイル無線通信ネットワーク及び通信ネットワークデバイスへのモバイル端末の接続を確立するための方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21884860

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021884860

Country of ref document: EP

Effective date: 20230523

NENP Non-entry into the national phase

Ref country code: DE