Device behavior detection method, blocking processing method, medium, and electronic device

A non-transitory computer-readable medium, storing a computer program, the computer program, when executed by a processor, implementing:

• detecting an interactive behavior between a user equipment and a network-side device in the wireless communication network, the network-side device including at least a base station and a core network device, the base station being an access network device corresponding to the user equipment, and the core network device including at least one of device mobility management entity (MME) or an access and mobility function (AMF) entity;
• determining whether the user equipment is a rogue device according to the interactive behavior, comprising:
• determining whether the user equipment has been repeatedly initiating a random access request according to a control plane protocol behavior between the user equipment and the base station;
• determining whether the user equipment has been repeatedly initiating a Radio Resource Control (RRC) connection request according to the control plane protocol behavior;
• determining whether the user equipment has been the user equipment repeatedly initiating a connection establishment completion message according to the control plane protocol behavior;
• and
• determining that the user equipment is a rogue device when control plane protocol signaling of the user equipment indicates at least one of:
• the user equipment repeatedly initiating the random access request, the user equipment repeatedly initiating the Radio Resource Control (RRC) connection request, and the user equipment repeatedly initiating the connection establishment completion message;
• and
• transmitting identification information of the determined rogue device to the network-side device, for the network-side device to perform blocking processing on the rogue device.

An electronic device, comprising:

• one or more processors;
• and
• a storage medium, configured to store one or more computer programs, the one or more computer programs, when executed by the one or more processors, causing the electronic device to implement:
• detecting an interactive behavior between a user equipment and a network-side device in the wireless communication network, the network-side device including at least a base station and a core network device, the base station being an access network device corresponding to the user equipment, and the core network device including at least one of device mobility management entity (MME) or an access and mobility function (AMF) entity;
• determining whether the user equipment is a rogue device according to the interactive behavior, comprising:
• determining whether the user equipment has been repeatedly initiating a random access request according to a control plane protocol behavior between the user equipment and the base station;
• determining whether the user equipment has been repeatedly initiating a Radio Resource Control (RRC) connection request according to the control plane protocol behavior;
• determining whether the user equipment has been the user equipment repeatedly initiating a connection establishment completion message according to the control plane protocol behavior;
• and
• determining that the user equipment is a rogue device when control plane protocol signaling of the user equipment indicates at least one of:
• the user equipment repeatedly initiating the random access request, the user equipment repeatedly initiating the Radio Resource Control (RRC) connection request, and the user equipment repeatedly initiating the connection establishment completion message;
• and
• transmitting identification information of the determined rogue device to the network-side device, for the network-side device to perform blocking processing on the rogue device.