Data analysis method and apparatus

Patent metadata

Field	Value
Publication number	US-12506746-B2
Application number	US-202318187929-A
Country	US
Kind code	B2
Filing date	Mar 22, 2023
Priority date	Sep 24, 2020
Publication date	Dec 23, 2025
Grant date	Dec 23, 2025

Abstract

This application discloses a data analysis method and an apparatus. In the method, a data analysis network element sends a first request message to a security network element, where the first request message is used to request to perform security detection on first data, and the first data is data for which the data analysis network element performs data analysis on a specified data analysis type. The data analysis network element generates or updates, based on a security detection result, a data analysis result corresponding to the data analysis type. The security network element performs security detection on the first data, and separate abnormal data from the first data, so that the data analysis network element can establish a model based on data other than the abnormal data, to improve accuracy of the model and accuracy of the data analysis result.

First claim

What is claimed is:

1 . A data analysis method, comprising:
generating, by a data analysis network element based on a first data, a first analysis result corresponding to a data analysis type; sending, by the data analysis network element, the first analysis result and a first threshold to a subscription network element, wherein the first threshold is used by the subscription network element to determine that accuracy of the first analysis result is lower than the first threshold; receiving, by the data analysis network element, a notification message sent by the subscription network element when the accuracy of the first analysis result is lower than the first threshold; sending, by the data analysis network element, a first request message to a security network element, wherein the first request message is used to request to perform security detection on the first data, and the first data is data for which the data analysis network element performs data analysis on the data analysis type; receiving, by the data analysis network element, a security detection result fed back by the security network element; and generating or updating, by the data analysis network element based on the security detection result, a data analysis result corresponding to the data analysis type.

2 . The method according to claim 1 , wherein before the sending, by the data analysis network element, the first request message to a first network element, the method further comprises:
generating, by the data analysis network element based on the first data, the first analysis result corresponding to the data analysis type; and determining, by the data analysis network element, that accuracy of the first analysis result is lower than the first threshold.

3 . The method according to claim 1 , wherein
the sending, by the data analysis network element, the first request message to the security network element comprises: sending, by the data analysis network element, the first request message to the security network element based on the notification message.

4 . The method according to claim 1 , wherein before the sending, by the data analysis network element, the first request message to a security network element, the method further comprises:
receiving, by the data analysis network element, a data analysis request message sent by a subscription network element, wherein the data analysis request message is used to request the data analysis result corresponding to the data analysis type; and determining, by the data analysis network element, a data analysis result, corresponding to a specified range, that is requested by the data analysis request message.

5 . The method according to claim 4 , wherein the specified range comprises a range corresponding to at least one of the following information: specified time information, specified area information, specified slice information, specified user information, or specified service type information.

6 . The method according to claim 1 , wherein the first request message comprises at least one of the following information: information about the first data, a first model, or a first algorithm; and
the first model is a model established by the data analysis network element based on the first data or a model determined by the data analysis network element in advance for the data analysis type, and the first algorithm comprises at least one algorithm used when the data analysis network element establishes the first model.

7 . The method according to claim 1 , wherein the security detection is abnormal data detection; and the first request message comprises an abnormal data proportion, and the abnormal data proportion indicates a proportion of a data volume of abnormal data to a data volume of the first data.

8 . The method according to claim 1 , wherein the security detection result comprises at least one of the following information: information about the abnormal data, information about second data, or a second algorithm; and
the second data is data other than the abnormal data in the first data, and the second algorithm is a detection algorithm used by the security network element to obtain the abnormal data or the second data.

9 . The method according to claim 1 , wherein the security detection result comprises a second model, and the second model is a model established by the first network element based on the second data; and
the generating or updating, by the data analysis network element based on the security detection result, a data analysis result corresponding to the data analysis type comprises: generating or updating, by the data analysis network element based on the second model, the data analysis result corresponding to the data analysis type.

10 . The method according to claim 1 , wherein the generating or updating, by the data analysis network element based on the security detection result, a data analysis result corresponding to the data analysis type comprises:
obtaining, by the data analysis network element, the second data based on the security detection result, wherein the second data is data other than the abnormal data in the first data; and training, by the data analysis network element, the second data to obtain a third model, and generating or updating, based on the third model, the data analysis result corresponding to the data analysis type.

11 . The method according to claim 10 , wherein when the security detection result comprises the second algorithm, the training, by the data analysis network element, the second data to obtain a third model comprises:
training, by the data analysis network element, the second data by using the second algorithm to obtain the third model.

12 . A data analysis method, comprising:
generating, by a data analysis network element based on a first data, a first analysis result corresponding to a data analysis type; sending, by the data analysis network element, the first analysis result and a first threshold to a subscription network element, wherein the first threshold is used by the subscription network element to determine that accuracy of the first analysis result is lower than the first threshold; receiving, by the data analysis network element, a notification message sent by the subscription network element when the accuracy of the first analysis result is lower than the first threshold; sending, by the data analysis network element, the first analysis result and the first threshold to a subscription network element, wherein the first threshold is used by the subscription network element to determine that accuracy of the first analysis result is lower than the first threshold; receiving, by a security network element, a first request message sent by the data analysis network element, wherein the first request message is used to request to perform security detection on the first data, and the first data is a dataset for which the data analysis network element performs data analysis on the data analysis type; performing, by the security network element, security detection on the first data to obtain a security detection result; and sending, by the security network element, the security detection result to the data analysis network element.

13 . The method according to claim 12 , wherein the first request message comprises at least one of the following information: information about the first data, a first model, or a first algorithm; and
the first model is a model established by the data analysis network element based on the first data or a model determined by the data analysis network element in advance for the data analysis typ

Assignees

• Huawei Tech Co Ltd

Inventors

• Chong Weiwei
• Xin Yang
• Wu Xiaobo

Classifications

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04W8/18

  Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04W12/106 Primary

  Packet or message integrity · CPC title