Tech-invite3GPPspaceIETFspace
21222324252627282931323334353637384‑5x

Content for  TS 23.288  Word version:  19.3.0

Top   Top   Up   Prev   Next
1…   4…   5…   5A…   6…   6.1.3   6.1.4…   6.1.4.4…   6.1.5…   6.1A…   6.1B…   6.1B.2.3…   6.1C   6.2…   6.2.3…   6.2.6…   6.2.6.2   6.2.6.3…   6.2.6.3.3   6.2.6.3.4   6.2.6.3.5   6.2.6.3.6…   6.2.7…   6.2.8…   6.2.9…   6.2.13…   6.2A…   6.2B…   6.2B.3   6.2B.4…   6.2C…   6.2D…   6.2E…   6.2F…   6.2H…   6.2H.2.2…   6.2H.2.3…   6.2H.2.4…   6.3…   6.4…   6.5…   6.6…   6.7…   6.7.3…   6.7.4…   6.7.5…   6.8…   6.9…   6.10…   6.11…   6.12…   6.13…   6.14…   6.16…   6.17…   6.18…   6.19…   6.20…   6.21…   6.22…   6.23…   7…   7.4…   7.7…   7.9…   8…   9…   10…   11…   12…   A…

 

6.22  Signalling Storm Analytics |R19|p. 312

6.22.1  Generalp. 312

This clause specifies how NWDAF supports analytics for network abnormal behaviours (i.e. signalling storm) mitigation and prevention.
The signalling storm analytics provides analytics information (statistics or predictions) regarding the abnormal signalling rate condition. An abnormal signalling rate condition is when signalling rate is experiencing an abnormal growth. The abnormal signalling growth may indicate a potential signalling storm due to a significant deviations from the signalling level in the normal conditions. The analytics of signalling storm provides the identification of whether the signalling storm is due to massive signalling from NF(s) or from UEs based on the analytics consumer request.
The NWDAF provides statistics and/or prediction analytics to consumer entity (e.g. SCP) or consumer NFs, e.g. AMF, SMF, UDM, PCF, NRF, OAM and AF.
The consumer of these analytics may indicate in the request or subscription:
  • Analytics ID = "Signalling Storm";
  • Target of Analytics Reporting:, a list of NF instance ID(s) or NF Set ID(s) which may suffer signalling storm or any NF if the target is the whole network;
  • Target Cause ID(s): Indicates specific Cause ID(s) as Analytics Output (e.g. signalling storm caused by UEs, signalling storm caused by NF, or all);
  • Analytics Filter Information:
    • NF ID List: instance IDs or NF Set IDs may cause signalling storm to the target NF;
    • a group of UEs or several groups of UEs identified by internal Group ID(s) or a SUPI list which may cause signalling storm to the Target of the Analytics Reporting;
    • Area of Interest (AoI) and/or S-NSSAI which restricts the scope of signalling storm analytics to the specific area and/or slice.
  • Analytics Reporting Information:
    • Expected Report Time: indicates the time limit by which the analytics results need to be received, e.g. 10 seconds, 5 minutes, etc.;
    • An Analytics target period indicates the time period over which the statistics or predictions are requested;
    • Optionally, preferred level of accuracy of the analytics;
    • Signalling frequency threshold: indicates the frequency of the received signalling within the time period;
    • UE number threshold: indicates a threshold of the amount of UEs of which the number of one type of request messages meets the frequency of UE requests threshold. For example, if the number of UEs that initiate registration requests exceeds the pre-set rate threshold (10 times per hour) and the number of such UEs exceeding the pre-set rate threshold exceeds 100 (the UE number threshold is set to 100), the NWDAF will provide the analytics.
Up

6.22.2  Input datap. 312

The NWDAF collects the UE related context data, NF context, AF data, MDAF data and SCP signaling information as listed Table 6.22.2-1, Table 6.22.2-2, Table 6.22.2-3, Table 6.22.2-4, Table 6.22.2-5, Table 6.22.2-6 and Table 6.22.2-7.
The NWDAF can collect UE behavioural information per UE or group of UEs as specified in clause 6.7.5.2.
The NWDAF may use output of abnormal UE behaviour analytics and UE dispersion analytics as specified in clause 6.7.5 and clause 6.10.3 as input data for analytics on signalling storm. This information may be collected from a different NWDAF (e.g. distributed architecture).
The NWDAF may collect a subset of input data based on implementation.
Information Source Description
UE IDIdentifies a single UE.
Signalling feature dataNF procedures containing signalling exchange information related to a particular UE or session from the Connection, Registration, Mobility and Session Managements procedures (NOTE 1).
> Request type and number from UE/RAN (0..max)AMFRequest type of N1 or N2 interface (such as received Initial Registration Request, Mobility and Periodic Registration Request, Service Request, etc.) and the number of requests corresponding to the request type.
>> Time duration from receiving request from UE/RAN to response to UE/RANAMFTime duration between the request from UE/RAN and response to UE/RAN.
>> Number of successful responses of UE/RANAMFNumber of successful responses associated to their initial requests, such as Registration Response, etc.
>> Number of failed responses of UE/RANAMFNumber of failed responses associated to their initial requests, such as Registration Reject, Service Reject, etc.
>> Reason of failed responses of UE/RANAMFReasons of failed responses associated to their initial requests, e.g. reject, no-response, etc.
>> A posterior Request type of UE/RAN (0..max)AMFA posterior Request types triggered from UE/RAN, for NF Service request, or request to UE/RAN (NOTE 3).
> Request type and number from NF (0..max)NFRequest type (i.e. identification of NF service instance) received from NF, e.g. Namf_N1N2Trans, Namf_comm, etc., as well as the number of requests received from NF (NOTE 2) (NOTE 3).
>> Time duration from sending a request to receiving NF to response from the NFNFTime duration between the request from an NF and response to the NF.
>> Number of successful responses from NFNFNumber of successful responses associated to their initial requests (NOTE 2).
>> Number of failed responses from NFNFNumber of failed responses associated to their initial requests (NOTE 2).
>> Reason of failed responses from NFNFReasons of failed responses over the egress interface associated to their initial requests, e.g. reject, no-response, etc.
>> Number of redundant signalling of NFNFNumber of received redundant signalling. The redundant signalling means the signalling which is transmitted multiple times (NOTE 2) (NOTE 3).
>> A posterior Request type of NF (0..max)NFA posterior Request types triggered from NF, for NF Service request (NOTE 3) (NOTE 4).
> Public Warning informationAMFPublic Warning information as defined in the TS 23.041, such as WRITE-REPLACE WARNING REQUEST, etc.
> Frequent Mobility Registration UpdateAMFThe number of Mobility Registration Updates N within a period M may be an indication for abnormal ping-pong behaviour, where N and M are operator's configurable parameters.
> Number of receiving Session Report from UPFsSMFNumber of receive Session Report from UPF triggered by DL packet in case of PDU Session is in 5GCM-idle state.
UE Context in NF
> State transition informationAMF, SMF UE related state transition information such as transition type, frequency of CM state changes, etc.
State transition identifier:
  • "Access Type change to 3GPP access";
  • "Access Type change to non-3GPP access";
  • "RM state change to RM-DEREGISTERED";
  • "RM state change to RM-REGISTERED";
  • "CM state change to CM-IDLE";
  • "CM state change to CM-CONNECTED";
  • "Handover";
  • "Mobility Registration Update"; or
  • "Frequent Mobility Registration Update" (Table 6.7.2.2-1).
Or, PDU Session related state transition information such as transition type, frequency SM state changes, etc.
State transition identifier:
  • "PDU Session Establishment";
  • "PDU Session Release";
  • "Communication failure"; or
  • "PLMN change".
It can be reported for a group of UEs (e.g. the number of total transitions or percentage of the group UEs who have transitions).
> timer informationAMF, SMFTimer information which has been set for the UE, such as timer type, duration.
NOTE 1:
NWDAF can optionally provide transaction dispersion analytic information for MM and SM transactions.
NOTE 2:
This data is provided per time interval that is indicated by the NWDAF.
NOTE 3:
As a centric routing/proxy entity, SCP might be involved with some signalling that may not be visible to the NF sending the SCP's ingress traffic, such a signalling could be associated with actions such as selection & discovery, retransmissions, re-directions, re-selection, throttling, etc.
NOTE 4:
A posterior request is a request sent from NF1 to NF2 (or from NF2 to NF1) that was triggered by a previous request received by NF1. For example, in clause 4.3.2.2 of TS 23.502, the request sent by AMF in step 3 and the request sent by SMF in step 11 are both posterior requests of the request received by the AMF in step 1. These posterior requests can be collected by NF1 (the AMF in this example).
Information Source Description
NF instance IDNF instance ID.
> NF profileNRFNF Profile information such as allowed NF information for the NF and NF Service(s), NF capacity, NF load, NF priority, NF service instance capacity, NF service instance load, NF service instance priority.
> F load informationNRFLoad information indicates the current load of the NF and NF Service(s) (NOTE 1).
NF heart-beat related informationNF, OAMNF heart-beat related information such as responding time, Number of retransmissions, heart-beat intervals.
> Unexpected operational status indicatorNF, OAMThe parameter indicates unexpected operational status occurs. It is an indication of deviation from the normal operations, based on thresholds or rules configured by operator at the NF or OAM (e.g. for energy consumptions, loads, etc.).
NOTE 1:
If this information is not available in the NRF, it can be obtained from the OAM.
Information Source Description
NF instance IDNF instance ID.
> Usage information of UE IP address resourcesSMFUsage information of UE IP address resources (dynamic and static, V4, V6, etc.) for CP or UP allocation, such as number, usage, number of UE IPs, which prohibit allocation during certain time interval, etc. This parameter is valid for SMF only.
> Load information of connected UPFsSMFLoad information of connected UPFs such as using PFCP Load Control Information. This parameter is valid for SMF only.
Information Source Description
Application IDAFIdentifies the application providing this information.
User activation time information (1…max)AFInformation of activation time for the users (e.g. IoT users) per application.
> Number of UEsAFThe total number of UEs.
> Active TimeAFThe time stamp of the users per application switch to active, or the start and end time of the users activity per application.
> Inactive TimeAFThe time stamp of the users per application switch to inactive, or the start and end time of the users inactivity per application, if applicable.
> UE type IDAFIdentifies a group of UEs, e.g. external group ID, or a list of UE IDs.
Information Source Description
NRF IDNRF instance ID.
Number of NF service registration requestsOAMNumber of registration request received at the NRF.
> Number of successful NF service registrationsOAMNumber of successful registrations.
> Number of failed NF service registrations due to encoding error of NF profileOAMNumber of failed registrations.
> Number of failed NF service registrations due to NRF internal errorOAMNumber of failed registrations.
Number of NF service update requestsOAMNumber of update request received at the NRF.
> Number of successful NF service updatesOAMNumber of successful updates.
> Number of failed NF service updates due to encoding error of NF profileOAMNumber of failed updates.
> Number of failed NF service updates due to NRF internal errorOAMNumber of failed updates.
Number of NF discovery requestsOAMNumber of discovery request received at the NRF.
> Number of successful NF discoveriesOAMNumber of successful discovery attempts.
> Number of failed NF service discoveries due to unauthorized NF Service consumerOAMNumber of failed discovery attempts.
> Number of failed NF discoveries due to input errorsOAMNumber of failed discovery attempts.
> Number of failed NF discoveries due to NRF internal errorOAMNumber of failed discovery attempts.
Information Source Description
affectedObjectMDAFIndication of 5GC NFs where congestion issues occurred or potentially may occur.
cPCongestionIssueIDMDAFThis field holds the ID of the control plane congestion issue which is reported.
Information Source Description
failurePredictionObjectMDAFIndication of NFs where the failure related issues occurred or potentially occur.
potentialFailureTypeMDAFThis field holds the ID of the control plane congestion issue which is reported.
eventTimeMDAFThis field holds the time of potential failure predicted.
issueIDMDAFThis filed holds the ID of this failure prediction which is reported.
perceivedSeverityMDAFThis field holds the value to indicate relative level of urgency for operator attention.
Information Source Description
NF instance IDNF instance ID of the service producer or consumer.
> Number of requests to a NF Service instanceSCPNumber of requests received for a NF service instance, such as Nudm-sdm, Namf-loc, etc.
> Number of successful responses of different NF Service of the NF instanceSCPNumber of successful responses from NF service instances, such as Nudm-sdm, Namf-loc, etc.
> Number of total failure responses of different NF Service of the NF instanceSCPNumber of total failure responses of different NF Service, such as Nudm-sdm, Namf-loc, etc.
> Number of failed responses of different NF Service of the NF instanceSCPNumber of failed responses of different NF Service, such as Nudm-sdm, Namf-loc, etc.
> Reason of failed responses of different NF Service of the NF instanceSCPReasons of failed responses of different NF Service, e.g. reject, no-response, etc.
> Number of failure responses SCP generated to the NF instancesSCPNumber of total failure responses generaterd by SCP.
> Reason of failure responses SCP generated to the NF instanceSCPReasons of failed responses of SCP, e.g. target nf not reachable, no-response, etc.
> Number of SCP reselect NF instance that is originally to that NF instanceSCPNumber of SCP reselect NF instance, it happens when e.g. SCP find the original NF instance not reachable.
> Reason of SCP reselection of NF instanceSCPReason of SCP reselect NF instance as defined in clause 6.3.1.0 of TS 23.501.
> Status of the connection to the NF instanceSCPThe connection status (i.e. ACTIVE or INACTIVE) between SCP and NF instance.
> Average time duration from sending request to the NF instance to receiving response from the NF instanceSCPAverage time duration between SCP sending the request to the NF instance and SCP receiving the response from the NF instance.
Up

6.22.3  Output analyticsp. 318

The output analytics of signalling storm provided by NWDAF is defined in Table 6.22.3-1, and Table 6.22.3-2. The Table 6.22.3-3 gives examples of NF/SCP actions for solving each risk. The final mitigation or prevention operations are based on operator's policy/configuration and NF/SCP implementation.
The statistics and predictions are provided with a Validity Period, as defined in clause 6.1.3.
Information Description
Report (1..max)List of observed signalling storm statistics.
> Target NF ID/SCP IDA list of impacted NFs/SCPs of signalling storm detected by NWDAF.
> Cause ID of the signalling stormThe potential cause of abnormal level of signalling (i.e. massive signalling from UE or NF abnormal signalling).
> Source UE/NFa UE or a group of UEs or several groups of UEs identified by internal Group ID or SUPI or SUPI range, or a list of NFs which cause the signalling storm.
> OPTIONAL Time slot entry (1..max)List of time slots during the Analytics target period.
>> Time slot startTime slot start within the Analytics target period.
>> DurationDuration of the time slot. If a Temporal granularity size was provided in the request or subscription, the Duration is greater than or equal to the Temporal granularity size.
>> Received Signalling AnalyticsInformation of signalling received by the target NF(s).
>>> Total number of received signallingIndicates the statistics on the number of signalling messages received by the target NF(s) in the time slot.
>>> Growth rate of received signallingDifference between the number of signalling messages received by the NF in the time slot and the number of signalling messages received by the target NF(s) in the previous time slot.
>>> Signalling analytics of UEIndicates the statistics on the number of signalling messages received from UEs within the time slot (NOTE 1).
> OPTIONAL Timer ListThe list of timer information per source UE(s) (NOTE 1).
>> Type of timerThe type of timer which has been set.
>> Timer durationThe timer duration that has be selected for the source UE(s).
NOTE 1:
Only available when Cause ID of signalling storm is massive signalling from UEs, and there exists Source UE(s).
Information Description
Report (1..max)List of predicted signalling storm analytics.
> Target NF ID/SCP IDA list of impacted NFs/SCPs signalling storm predicted by NWDAF.
> Cause ID of the signalling stormThe potential cause of abnormal level of signalling (i.e. massive signalling from UE or NF abnormal signalling).
> Source UE/NFa UE or a group of UEs or several groups of UEs identified by internal Group ID or SUPI or SUPI range, or a list of NFs which cause the signalling storm.
> OPTIONAL Time slot entry (1..max)List of time slots during the Analytics target period.
>> Time slot startTime slot start within the Analytics target period.
>> DurationDuration of the time slot. If a Temporal granularity size was provided in the request or subscription, the Duration is greater than or equal to the Temporal granularity size.
>> Reference pointThe information of the reference point impacted. (e.g. N1, N2)
>> Service operation(s)The information of the service operation(s) impacted. (e.g. Namf_Communication(UEContextTransfer), Nsmf_PDUSession(UpdateSMContext)).
>> Received Signalling AnalyticsInformation of signalling received by the target NF(s).
>>> Received number of signallingReceived number of signalling of the specific signalling type.
>>> Growth rate of received signallingDifference between the number of signalling messages received by the NF in the time slot and the number of signalling messages received by the target NF(s) in the previous time slot.
>>> Signalling analytics of UEIndicates the statistics on the number of signalling messages received from UEs within the time slot (NOTE 1).
> OPTIONAL Timer ListThe list of timer information per Source UE(s) (NOTE 1).
>> Type of timerThe type of timer.
>> Timer durationThe timer duration that commonly is selected for the Source UE(s).
> PriorityPriority (relative to other NFs of the same type) of candidate NFs as defined in the TS 29.510.
> CapacityCandidate NF capacity information, expressed as a weight relative to other NF instances of the same type as defined in the TS 29.510.
> ConfidenceConfidence of this prediction.
NOTE 1:
Only available when Cause ID of signalling storm is massive signalling from UEs, and there exists Source UE(s).
Cause of the signalling storm Example actions of NFs
massive signalling from UEAMF sets MM NAS related timer (e.g. back-off, T3512) for a selected set of UEs.
massive signalling from UESMF sets SM NAS related timer (e.g. back-off) for a selected set of Sessions.
massive signalling from UEAMF/SMF sets suggested N1/N2 interface related ingress/egress threshold, or AMF triggers RAN to initiate overload control for a selected set of UEs in specific slice or priority as defined in clause 8.7.7 of TS 38.413 to start overload control. The AMF may assign a specific slice to the UEs under signalling storm conditions and initiate overload control for the slice under signalling storm conditions.
NF abnormal signallingNRF configures the local policy (e.g. to prevent the source NF with abnormal signalling from being discovered or discovering others, to update the NF profile(s)(e.g. Priority, Capacity) of NF(s) based on the signalling storm statistics and/or predictions and send the updated NF profiles(s) to NF service consumer(s) of the NF(s)(e.g. subscriber of the NF profile as defined in clause 4.17.7 of TS 23.502)).
NF abnormal signallingSource NF configures to (re)select other NFs instead of NF with abnormal signalling and may unsubscribes the NF with abnormal signalling.
NF abnormal signallingSource NF configures to deprioritize the NFs/Services with abnormal signalling from being selected.
NF abnormal signallingSource NF triggers UE Reregistration and/or Session Reestablishments to avoid NF with abnormal signalling.
NF abnormal signallingSCP blocks or throttles messages originating from an NF/service with abnormal signalling.
NF abnormal signallingSCP redirects requests towards an NF service producer with abnormal signalling towards another service producer.
NF abnormal signallingSCP notifies communication peers of an NF that the NF may suffer signalling storm.
Up

6.22.4  Proceduresp. 321

The NWDAF can provide information on network signalling storm as follows (Figure 6.22.4-1).
Reproduction of 3GPP TS 23.288, Fig. 6.22.4-1: Procedure for NWDAF-assisted Network Signalling Storm Mitigation and Prevention
Up
Step 1.
The consumer NF (SCP included) or other entities subscribes to or sends a request to NWDAF for the signalling storm analytics using either Nnwdaf_AnalyticsSubscription_Subscribe or Nnwdaf_AnalyticsInfo_Request service operation. The request additionally includes thresholds such as confidence level and accuracy of detection:
  • The Analytics ID is set to "Signalling Storm analytics". The target for analytics reporting is set to be any NF/SCP or any UE. Analytic filters may be provided as shown in clause 6.22.1.
  • The consumer NF can request statistics or/and predictions for a given Analytics target period.
  • The consumer NF may also subscribe to "NF load analytics" as depicted in clause 6.5 and trigger the signalling storm analytics based on output of the NF load analytics, e.g. CPU usage is over 80%.
  • The consumer NF may also subscribe to "Abnormal behaviour" analytics as depicted in clause 6.7.5 and trigger the signalling storm analytics based on the suspicion of DDoS attack.
  • The consumer NF may also subscribe to "Dispersion Analytics" analytics as depicted in clause 6.10 and trigger the signalling storm analytics when the transaction dispersion is above the expected transaction dispersion configurable threshold.
Step 2.
The NWDAF retrieves Input data from NFs, AFs and SCPs, using Nnf_EventExposure_Subscribe, or from NRF using Nnrf_NFManagement_NFStatusSubscribe service operation, such as UE and/or NF as depicted in Table 6.22.2-1 and Table 6.22.2-2, NF specific data as depicted in Table 6.22.2-3, application data as depicted in Table 6.22.2-4, and collects input data from OAM and MDAF as depicted in Table 6.22.2-5, Table 6.22.2-6 and Table 6.22.2-7 to derive the required analytics as depicted in clause 6.22.2. The NWDAF may optionally request additional data aligned with the analysis target identified in step 1.
If the NWDAF has subscribed to receive analysis data from MDAF, NWDAF uses the analysis output from MDAF to determine source NFs to retrieve input data for generating signalling storm analytics.
The NWDAF may optionally subscribe the abnormal UE behaviour analytics and UE dispersion analytics as specified in clause 6.7.5 and 6.10.3 as input data from other NWDAFs, using Nnwdaf_AnalyticsSubscription_Subscribe or Nnwdaf_AnalyticsInfo_Request service operation.
Step 3.
The NWDAF derives the required analytics with the collected data described in clause 6.22.2.
Step 4.
The NWDAF invokes Nnwdaf_AnalyticsSubscription_Notify or Nnwdaf_AnalyticsInfo_Request response or response to the consumer NF/SCP for the Output data analytics as depicted in clause 6.22.3.
Step 5.
The consumer upon receiving the detection and/or prediction and/or mitigation may execute based on the example mechanisms as depicted in clause 6.22.3.
Up

Up   Top   ToC