| 引用本文： |
-
张伟露,吉立新,刘树新,潘菲,胡鑫鑫.PBNAD：一种基于多维服务性能时间序列的5G核心网网络功能异常检测模型[J].信息安全学报,已采用 [点击复制]
- ZHANG Weilu,JI Lixin,LIU Shuxin,PAN Fei,HU Xinxin.PBNAD: A 5G Core Network Network Function Anomaly Detection Model Based on Multidimensional Service Performance Time Series[J].Journal of Cyber Security,Accept [点击复制]
|
|
| 摘要: |
| 现有基于KPI（Key Performance Indicator）的5G（5th Generation Mobile Communication Technology）核心网异常检测模型较少考虑KPI之间的相关性，且传统的网络软硬件KPI对于虚拟化的网络功能异常检测效果不佳。针对上述问题，提出一种基于多维服务性能时间序列的5G核心网网络功能异常检测模型。首先，该模型考虑到5G核心网服务化架构的背景，构建多维服务性能时间序列作为网络功能异常检测的源数据。其次，基于网络功能身份、服务类型、业务流程、实际时间序列数据等多源信息，采用最大互信息系数度量序列相关性及时间相关性。然后，基于Topk相关性构建序列相关图及时间相关图，运用两个并行的图注意力网络分别融合序列相关特征及时间相关特征。最后，设计预测模型DMIXGU（Deep Mix Gated Unit）及重构模型MIXGU-VAE（Mix Gated Unit Variational Auto-encoder），以特征融合得到的序列相关特征、时间相关特征及原始时间序列为输入，同时对预测模型和重构模型目标函数进行联合优化，并定义联合异常分数以识别异常，从而提升异常检测性能。实验表明，在基于free5GC搭建的实验环境下，所提模型优于对比模型，以F1值为例，相比预测模型GDN提高5.07%，相比重构模型MAD-GAN提高14.38%，相比联合优化模型MTAD-GAT提高13.14%。 |
| 关键词: 5G核心网 时间序列 异常检测 图注意力 联合优化 |
| DOI： |
| 投稿时间：2022-09-01修订日期：2022-12-02 |
| 基金项目:河南省重大科技专项项目（No.221100210100） |
|
| PBNAD: A 5G Core Network Network Function Anomaly Detection Model Based on Multidimensional Service Performance Time Series |
|
ZHANG Weilu1, JI Lixin2,3,4, LIU Shuxin2,3,4, PAN Fei2,3,4, HU Xinxin1
|
| (1.PLA Strategic Support Force Information Engineering University;2.National Digital Switching System Engineering &3.Technological R&4.D Center) |
| Abstract: |
| The existing anomaly detection model of 5G (5th Generation Mobile Communication Technology) core network based on KPI (Key Performance Indicator) rarely considers the correlation between KPIs, and the traditional network software and hardware KPIs are not suitable for anomaly detection of virtualized network functions. In order to solve the above problems, this paper proposes an anomaly detection model of network functions in 5G core network based on multi-dimensional service performance time series. First, considering the background of 5G core network adopting service-oriented architecture, the model constructs the multi-dimensional service performance time series as the source data for anomaly detection of network functions. Secondly, the maximum mutual information coefficient is used to measure sequence correlation and time correlation based on the multi-source information, such as network function identity, service type, business process and actual time series data. Then, the sequence correlation graph and the time correlation graph are constructed based on Topk correlation. Two parallel graph attention networks are used to fuse the sequence correlation features and the time correlation features, respectively. Finally, the prediction model DMIXGU (Deep Mix Gated Unit) and the reconstruction model MIXGU-VAE (Mix Gated Unit Variable Auto-encoder) are designed. With the sequence-related features, time-related features , and original time series obtained from feature fusion as input, the objective function of the designed prediction model and the reconstructed model is jointly optimized, and the joint anomaly score is defined to identify exceptions, to improve the anomaly detection performance. The practical results show that under the experimental environment based on the free5GC project, the detection performance of the proposed model is better than that of several comparison models. When the F1 value is taken as an example, the proposed model is 5.07% higher than the prediction model GDN, 14.38% higher than the reconstruction model MAD-GAN, and 13.14% higher than the combined optimization model MTAD-GAT. |
| Key words: 5G core network time series anomaly detection graph attention joint optimization |
