Systems and methods for machine learned network activity profiling of devices
AssigneeTelefonaktiebolaget LM Ericsson (publ)
InventorsSayyed Auwn Muhammad, Ikram Ullah, Loay Abdelrazek
Life of this patent
Estimating the term…
Abstract
A method is performed by a network node for training of machine-learned models for detection of abnormal User Equipment, UE, behavior. The method comprises obtaining training data comprising a plurality of interaction logs for a respective plurality of training UEs and clustering each of the interaction logs of the training data into one or more activity clusters with a machine-learned behavior analysis model to learn one or more activities associated with at least one of the one or more activity clusters.
Claims18
A method performed by a network node for training of machine-learned models for detection of abnormal user equipment (UE) behavior, wherein the method comprises:
- obtaining training data, wherein obtaining the training data comprises obtaining a plurality of interaction logs for a respective plurality of UEs comprising a first UE;
- and
- clustering each of the interaction logs of the training data into one or more activity clusters with a machine-learned behavior analysis model to learn one or more activities associated with at least one of the one or more activity clusters, wherein
- the plurality of interaction logs comprises a first interaction log for the first UE, and
- the first interaction log for the first UE comprises time series data indicating medium access control (MAC) layer messages transmitted by the first UE within a first window of time.
A network node, the network node comprising:
- memory;
- and
- processing circuitry, wherein the network node is configured to perform a method for training of machine-learned models for detection of abnormal user equipment (UE) behavior, the method comprising:
- obtaining training data, wherein obtaining the training data comprises obtaining a plurality of interaction logs for a respective plurality of UEs comprising a first UE;
- and
- clustering each of the interaction logs of the training data into one or more activity clusters with a machine-learned behavior analysis model to learn one or more activities associated with at least one of the one or more activity clusters, wherein
- the plurality of interaction logs comprises a first interaction log for the first UE, and
- the first interaction log for the first UE comprises time series data indicating medium access control (MAC) layer message transmitted by the first UE within a first window of time.
A network node the network node comprising:
- memory;
- and
- processing circuitry, wherein the network node is configured to perform a method for machine-learned detection of abnormal user equipment (UE) behavior, the method comprising:
- obtaining air interface protocol data comprising one or more interaction logs for one or more respective UEs, wherein
- the one or more interaction logs comprises a first interaction log for a first UE, and
- the first interaction log for the first UE comprises time series data indicating medium access control (MAC) layer messages transmitted by the first UE within a first window of time;
- and
- processing the air interface protocol data with a machine-learned behavior analysis model to obtain one or more behavior analysis outputs, wherein the machine-learned behavior analysis model is trained based at least in part on training data descriptive of normal interactions between UEs and the network node.
Dependencies are inferred from the claim text.