Content for  TS 23.288  Word version:  19.0.0

This clause defines how to identify a group of UEs or a specific UE with abnormal behaviour, e.g. being misused or hijacked, with the help of NWDAF. The consumer of this analytics could be a 5GC NF. The 5GC NF subscribes analytics on abnormal behaviour from a NWDAF based on the UE subscription, network configuration or application layer request. The NWDAF performs data analytics on abnormal behaviour if there is a related subscription and returns exception reports that result from the analysis of the correlations between behavioural variables. The exception reports contain an Exception Level expressed in the form of a scalar value, possibly supplemented by additional measurements. The consumer of this analytics shall indicate in the request:

• Analytics ID = "Abnormal behaviour";
• Target of Analytics Reporting as defined in clause 6.1.3;
• An Analytics target period indicates the time period over which the statistics or predictions are requested;
• Analytics Filter Information optionally including:
  • expected UE behaviour parameters;
  • expected analytics type or list of Exception IDs with associated thresholds for the Exception Level, where the expected analytics type can be mobility related, communication related or both;
  • Area of interest;
  • Application ID;
  • DNN;
  • S-NSSAI.
• Optionally, maximum number of objects and maximum number of SUPIs;
• In a subscription, the Notification Correlation Id and the Notification Target Address are included.

If the Target of Analytics Reporting is any UE, then the Analytics Filter should at least include:

• Area of Interest or S-NSSAI, if the expected analytics type or the list of Exception IDs is mobility related.
• Area of Interest, application ID, DNN or S-NSSAI, if the expected analytics type or the list of Exception IDs is communication related.

If the Target of Analytics Reporting is any UE, the consumer of this analytics shall request either mobility related only or communication related only abnormal behaviour analytics, but not both at the same time. The expected UE behaviour parameters that the consumer can indicate in the request when known depend on the Exception ID that the consumer expects. They may encompass UE behaviour parameters as defined in clause 4.15.6.3 of TS 23.502 and other parameters. Table 6.7.5.1-2 shows the mapping between each Exception ID and UE behaviour parameters.

When the NWDAF detects those UEs that deviate from the expected UE behaviour, e.g. unexpected UE location, abnormal traffic pattern, unexpected transaction dispersion amount, wrong destination address, etc. the NWDAF shall notify the result of the analytics to the consumer as specified in clause 6.7.5.3.

The Exceptions information from AF is as specified in Table 6.7.5.2-1. On request of the service consumer, the NWDAF shall collect and analyse UE behavioural information from the 5GC NFs (SMF, AMF, AF), or OAM as specified in clauses 6.7.2.2 and 6.7.3.2 and/or expected UE behavioural parameters from UDM as defined in clause 4.15.6.3 of TS 23.502, depending on Exception IDs.

Corresponding to the "abnormal behaviour" Analytics ID, the analytics result provided by the NWDAF is defined in Table 6.7.5.3-1 and Table 6.7.5.3-2. When the level of an exception trespasses above or below the threshold, the NWDAF shall notify the consumer with the exception ID associated with the exception if the exception ID is within the list of exception IDs indicated by the consumer or matches the expected analytics type indicated by the consumer. The NWDAF shall provide the Exception Level and determine which of the other information elements to provide, depending on the observed exception. Abnormal behaviour statistics information is defined in Table 6.7.5.3-1.

Abnormal behaviour predictions information is defined in Table 6.7.5.3-2.

The predictions are provided with a Validity Period, as defined in clause 6.1.3. The UE characteristics may provide a set of features common to all UEs affected with the exception. The number of exceptions and the length of the SUPI list shall respectively be lower than the parameters maximum number of objects and Maximum number of SUPIs provided as part of Analytics Reporting Information. If PCF subscribes to notifications on "Abnormal behaviour", the NWDAF shall send the PCF notifications about the risk, which may trigger the PCF to update the AM/SM policies. The NWDAF also sends the notification directly to the AMF or SMF, if the AMF or SMF subscribes to the notification, so that the AMF or SMF may, based on operator local policies defined on a per S-NSSAI basis (for AMF) or on a per S-NSSAI, per DNN, or per (DNN,S-NSSAI) basis (for SMF), take actions for risk solving. If the AF subscribes to notifications on "Abnormal behaviour", the NWDAF sends the notifications to the AF so that the AF may take actions for risk solving. The following Table 6.7.5.3-3 gives examples of additional measurement provided by the NWDAF and examples of NF actions for solving each risk.