Abnormal mobility pattern detection for misbehaving devices
The disclosed technology teaches detecting abnormal behavior of a UE mobile device, including a network data analytics function component, in communication with core network components of a cellular network, subscribing to location change-related events that report a change event for a UE device connection to and/or drop or handover from a cell. Included is analyzing location change-related events to detect abnormal handover behavior when the UE device changes its selection of a base station or cell more than N times in not more than M minutes, and reporting the detected abnormal handover behavior with an identifier of the UE mobile device involved and the involved cell's ID. The technology also applies to a group of UE devices selected for analysis, by device, geography or custom-defined affinity, with selection changes among a set of base stations or neighboring cells, each selected at least twice by the UE device in M minutes.
1. A method of detecting abnormal ping-ponging behavior of a user equipment (UE) mobile device, including:
a network data analytics function (NWDAF) component, in communication with core network components of a cellular network, subscribing to location change-related events from the core network components that report at least a change event for a UE mobile device connection to or drop or handover from a cell;
analyzing the location change-related events to detect abnormal ping-ponging handover (HO) behavior when the UE mobile device updates its selection of a base station or cell more than N times in a period of M minutes, wherein N and M are configurable analytical parameters; and
reporting the detected abnormal HO behavior with an identifier of the UE mobile device involved.
2. The method of claim 1 , wherein the UE mobile device is analyzed in a test environment and signals from at least two base stations or cells are supplied to the UE mobile device by a channel emulator in the test environment.
3. The method of claim 1 , wherein the UE mobile device is analyzed in a live network environment and the UE mobile device belongs to a customer of an operator of the live network.
4. The method of claim 1 , further applied to a group of UE mobile devices selected for analysis, that is one of device based, geographically based or custom-defined affinity based selected by a user or network operator.
5. The method of claim 4 , further including assigning UE mobile devices in the group to classes and reporting analytics on group behavior for the classes.
6. The method of claim 4 , wherein the change in selection criteria is based on changes in selection among a set of two or more base stations or cells, each of which is selected at least twice by the UE mobile device in the group in the M minutes.
7. The method of claim 1 , further including the NWDAF subscribing to location change-related events within a tracking area.
8. The method of claim 1 , wherein the change in selection criteria is based on changes in selection among a set of two or more base stations or cells, each of which is selected at least twice by the UE mobile device in the M minutes.
9. The method of claim 8 , wherein the set of two or more base stations or cells are within the same registration area.
10. The method of claim 1 , further including the NWDAF subscribing to location change-related events within an area of interest.
11. The method of claim 1 , further including the NWDAF subscribing to location change-related events across tracking areas (TA) or areas of interest or registration areas (RAs).
12. The method of claim 1 , wherein the reporting of the detected abnormal HO behavior happens periodically in batches.
13. The method of claim 1 , wherein the reporting of the detected abnormal HO behavior happens in near real time.
14. The method of claim 1 , further including assigning the UE mobile device to a class based on its rate of motion and analyzing collective behavior of UEs belonging to the class.
15. The method of claim 1 , further including configuring the UE mobile device as a stationary device, and assigning the UE mobile device to a class based on the device being stationary and analyzing collective behavior of UEs belonging to the class.
16. A tangible non-transitory computer readable storage media, loaded with program instructions that, when executed on processors, cause the processors to implement method of detecting abnormal behavior of a user equipment (UE) mobile device, including:
a network data analytics function (NWDAF) component, in communication with core network components of a cellular network, subscribing to location change-related events from the core network components that report at least a change event for a UE mobile device connection to or drop or handover from a cell;
analyzing the location change-related events to detect abnormal ping-ponging handover (HO) behavior when the UE mobile device updates its selection of a base station or cell more than N times in a period of M minutes, wherein N and M are configurable analytical parameters; and
reporting the detected abnormal HO behavior with an identifier of the UE mobile device involved and the involved cell's ID.
17. The tangible non-transitory computer readable storage media of claim 16 , further applied to a group of UE mobile devices selected for analysis, that can be device based, geographically based or custom-defined affinity based, selected by a user or network operator.
18. The tangible non-transitory computer readable storage media of claim 17 , wherein the change in selection criteria is based on changes in selection among a set of two or more base stations, each of which is selected at least twice by the UE mobile device, in the group, in the M minutes.
19. The tangible non-transitory computer readable storage media of claim 16 , wherein the change in selection criteria is based on changes in selection among a set of two or more base stations or cells, each of which is selected at least twice by the UE mobile device in the M minutes.
20. The tangible non-transitory computer readable storage media of claim 19 , wherein the set of two or more base stations or cells are within the same registration area.
21. The tangible non-transitory computer readable storage media of claim 16 , further including the NWDAF subscribing to location change-related events within a tracking area.
22. The tangible non-transitory computer readable storage media of claim 16 , further including the NWDAF subscribing to location change-related events within an area of interest.
23. The tangible non-transitory computer readable storage media of claim 16 , wherein the reporting of the detected abnormal HO behavior happens periodically in batches.
24. The tangible non-transitory computer readable storage media of claim 16 , further including the NWDAF subscribing to location change-related events across tracking areas (TA) or areas of interest or registration areas (RAs).
25. A system for detecting abnormal behavior of a user equipment (UE) mobile device, the system including a processor, memory coupled to the processor and computer instructions from the non-transitory computer readable storage media of claim 16 loaded into the memory.