Methods and devices of detection of misbehaving UEs using data analysis
New methods are proposed to detect misbehaving UEs based on 5GS. The methods allow the network to react accurately and efficiently to deal with misbehaving UE(s).
1. A Network Data Analytic Function, NWDAF, node, comprising:
a memory storing instructions; and
one or more processors configured to execute the instructions to:
receive, from a first network function node in a core network, an equipment identifier of user equipment, UE, and a rejected cause in a case where the first network function node sends, to the UE, a reject message in response to a request from the UE;
analyzing-analyse the equipment identifier and rejected cause to determine whether the UE is a misbehaving UE or not; and
send to a second network function node in the core network node, the equipment identifier in a case where the UE is determined to the misbehaving UE.
2. The NWDAF node according to claim 1 , wherein
the one or more processors are configured to
analyze the equipment identifier and rejected cause to determine a pattern of the misbehaving UE, and
send, to the second network function node, the equipment identifier and the pattern of the misbehaving UE in a case where the UE is determined to the misbehaving UE.
3. The NWDAF node according to claim 1 , wherein
the one or more processors are configured to
receive, from the first network function node, a backoff timer which is disregarded by the UE, and
analyze, the equipment identifier, the rejected cause and the backoff timer to determine whether the UE is a misbehaving UE or not.
4. The NWDAF node according to claim 1 , wherein
the one or more processors are configured to
receive, from a plurality of first network function nodes in the core network, a respective equipment identifiers of UEs, and related rejected causes, and
analyze the equipment identifiers and the rejected causes to determine whether there is a misbehaving UE or there is a group of misbehaving UEs.
5. The NWDAF node according to claim 1 , wherein
the one or more processors are configured to
receive, from the first network function node, the equipment identifier of the UE, the rejected cause, and a cell identity which the UE is camping on in a case where the first network function node sends, to the UE, the reject message in response to the request from the UE, and
analyze a location distribution pattern of the misbehaving UE.
6. A controlling method for a Network Data Analytic Function, NWDAF, node, the controlling method comprising:
receiving, from a first network function node in a core network, an equipment identifier of user equipment, UE, and a rejected cause in a case where the first network function node sends, to the UE, a reject message in response to a request from the UE;
analyzing the equipment identifier and rejected cause to determine whether the UE is a misbehaving UE or not; and
sending, to a second network function node in the core network node, the equipment identifier in a case where the UE is determined to the misbehaving UE.
7. The controlling method according to claim 6 , wherein
the analyzing includes analyzing the equipment identifier and rejected cause to determine a pattern of the misbehaving UE, and
the sending includes sending, to the second network function node, the equipment identifier and the pattern of the misbehaving UE in a case where the UE is determined to the misbehaving UE.
8. The controlling method according to claim 6 , wherein
the receiving includes receiving, from the first network function node, a backoff timer which is disregarded by the UE, and
the analyzing includes analyzing, the equipment identifier, the rejected cause and the backoff timer to determine whether the UE is a misbehaving UE or not.
9. The controlling method according to claim 6 , wherein
the receiving includes receiving, from a plurality of first network function nodes in the core network, a respective equipment identifiers of UEs, and related rejected causes,
the analyzing includes analyzing the equipment identifiers and the rejected causes to determine whether there is a misbehaving UE or there is a group of misbehaving UEs.
10. The controlling method according to claim 6 wherein
the receiving includes receiving, from the first network function node, the equipment identifier of the UE, the rejected cause, and a cell identity which the UE is camping on in a case where the first network function node sends, to the UE, the reject message in response to the request from the UE, and
the analyzing includes analyzing a location distribution pattern of the misbehaving UE.
11. The controlling method according to claim 6 , wherein
the equipment identifier includes at least one of an International Mobile Equipment Identity Software Version and a Permanent Equipment Identifier.
12. The controlling method according to claim 6 , wherein
the first network function node includes at least one of a core network node for mobility management and a core network node for session management.
13. The controlling method according to claim 6 , wherein
the second network function node includes at least one of a core network node for a unified data management node, an equipment identity register, an operations, administration and maintenance system, an application function node and a core network node for policy control.
14. A controlling method for a second network function node in a core network, the controlling method comprising:
receiving, from a Network Data Analytic Function, NWDAF, node, an equipment identifier; and
taking action against user equipment, UE, indicated by the equipment identifier, wherein
the UE is determined by the NWDAF node, as a misbehaving UE by analyzing the equipment identifier and rejected cause which are sent from a first network function node in the core network to the NWDAF node and sent from the first network function node to the UE.
15. The controlling method according to claim 14 , wherein
the receiving includes receiving, from the NWDAF node, the equipment identifier and pattern of the misbehaving UE, and
the taking action includes taking action against the UE based on the pattern of the misbehaving UE.
16. The controlling method according to claim 14 , wherein
the receiving includes receiving, from the NWDAF node, the equipment identifier and a risk with a scale of the risk, and
the taking action includes taking action against the UE based on the risk with the scale of the risk.
17. The controlling method according to claim 14 , wherein
the receiving includes receiving, from the NWDAF node, the equipment identifier and a recommendation for taking action, and
the taking action includes taking action against the UE based on the recommendation.
18. The controlling method according to claim 14 , wherein
the equipment identifier includes at least one of an International Mobile Equipment Identity Software Version and a Permanent Equipment Identifier.
19. The controlling method according to claim 14 , wherein
the first network function node includes at least one of a core network node for mobility management and a core network node for session management.
20. The controlling method according to claim 14 , wherein
the second network function node includes at least one of a core network node for a unified data management node, an equipment identity register, an operations, administration and maintenance system, an application function node and a core network node for policy control.