CN114363947B - Log analysis method and related device - Google Patents
Log analysis method and related device Download PDFInfo
- Publication number
- CN114363947B CN114363947B CN202111677093.8A CN202111677093A CN114363947B CN 114363947 B CN114363947 B CN 114363947B CN 202111677093 A CN202111677093 A CN 202111677093A CN 114363947 B CN114363947 B CN 114363947B
- Authority
- CN
- China
- Prior art keywords
- signaling
- signaling element
- queue
- kth
- shortest path
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Abstract
The application discloses a log analysis method and a log analysis device, which can analyze signaling in modemog so as to quickly locate abnormal signaling and improve analysis efficiency. The method may include: extracting a first signaling of the layer 3 from log data to be analyzed, generating a first signaling queue according to the first signaling, wherein the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer; determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram, wherein the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1; the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than a first threshold value, and abnormal information is generated, wherein the abnormal information is used for indicating that the signaling corresponding to the (i) signaling element and/or the (i+1) th signaling element is abnormal signaling.
Description
Technical Field
The application relates to the technical field of communication test, in particular to a log analysis method and a related device.
Background
Information and signaling is present in the communication network. The information can be directly transmitted from the sending end to the receiving end through the communication network, while the signaling is usually transmitted between different links of the communication network, and each link is analyzed and processed and forms a series of operations and control through interaction, so that the information is effectively and reliably transmitted. For example, the base station transmits radio resource control (radio resource control, RRC) reconfiguration signaling to a User Equipment (UE), the UE performs measurement according to the RRC reconfiguration signaling and reports a measurement report to the base station, and the relationship between the RRC reconfiguration signaling and the measurement report may be understood as that the measurement report is used to respond to the RRC reconfiguration signaling.
In the test process, in order to find out abnormal signaling in a signaling queue of a modem log (modemog), a manual analysis method is currently adopted. Because the signaling flow of cellular communication is complex, the log data volume in the test process is large, and the manual analysis method is adopted, so that the defect of low analysis efficiency exists.
Disclosure of Invention
The application provides a log analysis method and a related device, which can quickly locate abnormal signaling, thereby improving analysis efficiency.
In a first aspect, the present application provides a log analysis method, which may include: extracting a first signaling of the layer 3 from log data to be analyzed, generating a first signaling queue according to the first signaling, wherein the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer; determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram, wherein the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1; the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than a first threshold value, and abnormal information is generated, wherein the abnormal information is used for indicating that the signaling corresponding to the (i) signaling element and/or the (i+1) th signaling element is abnormal signaling. Wherein the first threshold is 1.
By the method described in the first aspect, according to the signaling conversion diagram, it is determined whether the shortest path length of any two adjacent signaling elements is a first threshold, where the first threshold indicates that signaling corresponding to the two signaling elements is signaling in a normal flow, otherwise indicates that signaling corresponding to the two signaling elements is abnormal, so that abnormal signaling can be quickly located by traversing the signaling queue, and analysis efficiency is improved.
In one possible implementation, determining a shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling transition diagram includes: searching a j-th signaling element corresponding to the i-th signaling element in the signaling conversion diagram, and a j+1th signaling element corresponding to the i+1th signaling element; in the signaling conversion diagram, determining the shortest path length from the jth signaling element to the j+1 signaling element, wherein the shortest path length from the jth signaling element to the j+1 signaling element is the path length from the ith signaling element to the (i+1) signaling element. Any two adjacent signaling elements in the signaling queue are mapped to the signaling conversion diagram so as to determine the shortest path length, thereby being convenient for rapidly and accurately positioning abnormal signaling.
In one possible implementation, determining a shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling transition diagram includes: in the signaling conversion diagram, searching the shortest path from the ith signaling element to the (i+1) th signaling element, and determining the path length of the shortest path. The shortest path from the ith signaling element to the (i+1) th signaling element is directly found in the signaling conversion diagram, so that abnormal signaling can be more quickly positioned.
In one possible implementation, before extracting the first signaling of layer 3 from the log data to be analyzed, the method further includes: and generating a signaling conversion diagram according to the abnormal-free log data. And generating a signaling conversion diagram in advance so as to perform anomaly analysis on the signaling queue to be analyzed by using the signaling conversion diagram.
In one possible implementation, generating a signaling conversion graph from the anomaly-free log data includes: extracting second signaling of the layer 3 from the log data without anomaly, and generating a second signaling queue according to the second signaling, wherein the number of signaling elements of the second signaling queue is L2, and L2 is a positive integer; judging whether a shortest path from a kth signaling element to a kth+1th signaling element exists in the signaling conversion diagram or not, wherein the path length of the shortest path is a first threshold; if not, mapping the shortest paths from the kth signaling element to the (k+1) th signaling element to a signaling conversion diagram; wherein the kth signaling element and the kth+1th signaling element are any two adjacent signaling elements in the second signaling queue; wherein k is a positive integer, and k+1 is less than or equal to L2. If the judgment result is yes, the shortest path from the kth signaling element to the (k+1) signaling element exists in the signaling conversion diagram, and remapping is not needed.
In one possible implementation manner, the method further includes: the shortest path length from the ith signaling element to the (i+1) th signaling element is a first threshold value, and the signaling corresponding to the ith signaling element to the (i+1) th signaling element is determined to be normal signaling.
In one possible implementation manner, the shortest path length from the ith signaling element to the (i+1) th signaling element is the second threshold, and the anomaly information is used for indicating that the signaling corresponding to the ith signaling element to the (i+1) th signaling element is the same signaling. Wherein the second threshold is 0.
In a second aspect, the present application provides a log analysis apparatus including a queue generating unit, a length determining unit, and an abnormality generating unit, wherein: the queue generating unit is used for extracting the first signaling of the layer 3 from log data to be analyzed, generating a first signaling queue according to the first signaling, wherein the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer; the length determining unit is used for determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram, wherein the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1; the abnormal generation unit is used for generating abnormal information when the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than a first threshold value, wherein the abnormal information is used for indicating that the signaling corresponding to the i signaling element and/or the (i+1) th signaling element is abnormal signaling.
In a third aspect, the present application provides a log analysis device comprising a processor, a memory and a transceiver for receiving signals or transmitting signals; the memory is used for storing program codes; the processor is configured to invoke the program code from the memory to perform the method as in the first aspect and any of its possible implementations.
In a fourth aspect, the present application provides a chip, where the chip is configured to extract a first signaling of layer 3 from log data to be analyzed, and generate a first signaling queue according to the first signaling, where the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer; determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram, wherein the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1; the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than a first threshold value, and abnormal information is generated, wherein the abnormal information is used for indicating that the signaling corresponding to the (i) signaling element and/or the (i+1) th signaling element is abnormal signaling.
In a fifth aspect, the present application provides a module apparatus, the module apparatus comprising a communication module, a power module, a storage module, and a chip module, wherein: the power supply module is used for providing electric energy for the module equipment; the storage module is used for storing data and instructions; the communication module is used for carrying out internal communication of the module equipment or carrying out communication between the module equipment and external equipment; the chip module is used for: extracting a first signaling of the layer 3 from log data to be analyzed, generating a first signaling queue according to the first signaling, wherein the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer; determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram, wherein the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1; the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than a first threshold value, and abnormal information is generated, wherein the abnormal information is used for indicating that the signaling corresponding to the (i) signaling element and/or the (i+1) th signaling element is abnormal signaling.
In a sixth aspect, the present application provides a computer readable storage medium having stored therein computer readable instructions which, when run on a communication device, cause the communication device to perform the method of the first aspect and any one of its possible implementations.
In a seventh aspect, the application provides a computer program or computer program product comprising code or instructions which, when run on a computer, cause the computer to perform the method as in the first aspect and any one of its possible implementations.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a schematic diagram of the architecture of a communication system to which embodiments of the present application are applied;
fig. 2 is an initial access procedure and a measurement reporting procedure;
FIG. 3 is an exemplary diagram of a directed graph;
fig. 4 is a schematic flow chart of generating a signaling conversion diagram according to an embodiment of the present application;
FIG. 5 is a schematic flow chart of a log analysis method according to an embodiment of the present application;
FIG. 6 is another representation corresponding to FIG. 5;
fig. 7 is a schematic structural diagram of a log analysis device according to an embodiment of the present application;
FIG. 8 is a schematic diagram of a log analysis device according to another embodiment of the present application;
fig. 9 is a schematic structural diagram of a module device according to an embodiment of the present application.
Detailed Description
The terminology used in the following embodiments of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the specification of the present application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates to the contrary. It should also be understood that the term "and/or" as used in this disclosure refers to and encompasses any or all possible combinations of one or more of the listed items.
It should be noted that, in the description and claims of the present application and in the above figures, the terms "first," "second," "third," etc. are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the application described herein may be implemented in other sequences than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or server that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed or inherent to such process, method, article, or apparatus.
The embodiment of the application can be applied to fifth generation (5 th -generation, 5G) system, which may also be referred to as new radio, NR, system; or can also be applied to the sixth generation (6 th -generation, 6G) system, or seventh generation (7 th -generation, 7G) system, or other communication systems in the future. Or the application is also applicable to long term evolution (long term evolution, LTE) systems, optionally, to second generation (2 nd Generation, 2G) or third generation (3 rd -generation, 3G) system.
Referring to fig. 1, fig. 1 is a schematic diagram of a communication system according to an embodiment of the present application. The communication system may include, but is not limited to, a network device and a terminal device, and the number and form of devices shown in fig. 1 are not limited to the embodiments of the present application, and may include two or more network devices and two or more terminal devices in practical applications. The communication system shown in fig. 1 is exemplified as including a network device 101 and a terminal device 102.
In the embodiment of the present application, the terminal device is a device with a wireless transceiver function, which may also be referred to as a terminal (terminal), UE, mobile Station (MS), mobile Terminal (MT), access terminal device, vehicle-mounted terminal device, industrial control terminal device, UE unit, UE station, mobile station, remote terminal device, mobile device, UE terminal device, wireless communication device, UE proxy, or UE apparatus. The terminal device may be fixed or mobile. In some embodiments, the terminal device may also be a device with a transceiver function, such as a chip module. The chip module may include a chip and may further include other discrete devices. The embodiment of the application does not limit the specific technology and the specific equipment form adopted by the terminal equipment.
In the embodiment of the present application, the network device is a device that provides a wireless communication function for the terminal device, and may also be referred to as AN Access Network (AN) device or a radio access network (radio access network, RAN) device. By way of example, network devices include, but are not limited to: next generation base stations (gnbs), evolved node bs (enbs), radio network controllers (radio network controller, RNCs), node bs (node bs, NB), base station controllers (base station controller, BSC), base transceiver stations (basetransceiver station, BTS), home base stations (e.g., home evolved node B, or home node B, HNB), baseband units (BBUs), transceiving points (transmitting and receiving point, TRPs), transmitting points (transmitting point, TP), mobile switching centers, and the like in a fifth generation mobile communication system (5 th-generation, 5G). In some embodiments, the network device may also be a device, such as a chip module, with the functionality to provide wireless communication for the terminal device. By way of example, the chip module may include a chip, and may include other discrete devices. The embodiment of the application does not limit the specific technology and the specific equipment form adopted by the network equipment.
It may be understood that, the communication system described in the embodiment of the present application is for more clearly describing the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided by the embodiment of the present application, and those skilled in the art can know that, with the evolution of the system architecture and the appearance of a new service scenario, the technical solution provided by the embodiment of the present application is equally applicable to similar technical problems.
In order to quickly locate abnormal signaling and improve analysis efficiency, the embodiment of the application provides a log analysis method and a related device, which are used for analyzing log (log) data based on graph theory (such as directed graph), in particular to analyzing modem log (modemog). A modem may be understood as a "cat" for surfing the internet, and a modem log may be understood as a log generated during communication between a terminal device and a network device, and various signaling transmitted between the two, for example, signaling of layer 3 is recorded. Layer 3 signaling such as RRC signaling or non-access stratum (NAS) signaling, etc.
The log analysis method provided by the embodiment of the application is an automatic test or analysis method, and can test the signaling received and transmitted by the terminal equipment side or the network equipment side. If the signaling received and sent by the terminal equipment is tested at the terminal equipment side, the log analysis device can be positioned in the terminal equipment or used together with the terminal equipment; if the signaling received and transmitted by the network device is tested at the network device side, the log analysis device may be located in the network device or used together with the network device. The application is explained by taking the example that the log analysis device is positioned in the terminal equipment, namely the log analysis method provided by the application is explained by taking the terminal equipment as an execution example.
Before explaining the method provided by the embodiment of the application, related technologies or names related to the embodiment of the application are explained.
1. Layer 3 signaling
Layer 3 refers to higher layers (upper layers), such as application layer or upper layer protocols, etc. Layer 3 signaling may be understood as application layer signaling. Generally, the signaling of the air interface is layer 3 signaling.
The layer 3 signaling to which embodiments of the present application relate refers to RRC signaling and/or NSA signaling in the third generation partnership project (the 3rd generation partner project,3GPP) standard. The RRC signaling may include, for example, RRC connection signaling, RRC reconfiguration signaling, etc., and the NSA signaling may include, for example, system message block (system information block, SIB) signaling, random access signaling, etc.
For example, referring to the initial access flow and the measurement reporting flow shown in fig. 2, fig. 2 may be a signaling transmission flow between the terminal device and the primary base station in the secondary base station adding flow, and the network device in fig. 2 is the primary base station. The signaling shown at 201 through 210 in fig. 2 is layer 3 signaling. 201 to 203 are signaling in the random access process, 204 to 205 are signaling in the UE capability inquiry and reporting process, and 209 to 210 are signaling in the measurement reporting process.
2. Directed graph, signaling transition graph
Directed graph, refers to a graph with one direction per edge. The direction is the direction as the name implies. A simple directed graph is shown in fig. 3, where the edge of any two nodes in fig. 3 has one direction. In fig. 3, a to C have two paths, which may be denoted as a- > C, a- > B- > C, respectively. Wherein, the path length of A- > C is 1, the path length of A- > B- > C is 2, then the shortest path length of A to C is 1, and the shortest path is A- > C.
The embodiment of the application provides a signaling conversion diagram which is used for testing or analyzing signaling of a layer 3 in log data to be analyzed so as to locate abnormal signaling. In a communication network, a certain relationship exists between any two adjacent signaling, namely, a certain relationship exists between signaling m and signaling n, which can be understood that the signaling m can be converted into the signaling n under a certain external condition. With this relation, the next signaling, i.e. signaling n, can be obtained through signaling m and/or the signaling queue preceding signaling m. For example, f (t) =f (t-1) +a×h (t), where f (t) represents signaling at time t, i.e., signaling n; f (t-1) represents signaling at time t-1, namely signaling m; h (t) represents the current environment; a represents an environmental coefficient, an environmental parameter, or the like. Assuming that the signaling m can be converted to the signaling n by a state transition, it can be expressed as (V (Dm), a (Dn), ψd), where ψd represents an association function, to implement the state transition of the signaling m to the signaling n; dm represents signaling m; dn denotes signaling n. Directed graph G may be represented as (V (D), a (D), ψd), an association function ψd such that each element in a (D) corresponds to an ordered pair of elements in V (D). And mapping all the signaling m and the signaling n with the state conversion relation into the directed graph G one by one, thereby obtaining a signaling conversion graph.
For example, the signaling m is an RRC reconfiguration signaling sent by the network device to the terminal device, the signaling n is a measurement report sent by the terminal device to the network device, and the correlation function is that the terminal device performs measurement according to the RRC reconfiguration signaling to obtain the measurement report. It can be seen that the shortest path length from signaling m to signaling n is 1, and the shortest path from signaling m to signaling n is mapped into the signaling conversion diagram.
It should be noted that the signaling conversion chart is a directed chart, and is applied in the embodiment of the present application, to implement state conversion between signaling, so as to perform testing or analysis based thereon. The name signaling transfer diagram is used for example and is not meant to limit embodiments of the present application.
Referring to fig. 4, a flow chart of generating a signaling conversion chart according to an embodiment of the present application may include, but is not limited to, the following steps:
401, loading exception-free log data.
The log analysis device loads log data without exception, the log data without exception can be manually analyzed and processed, and the log data without exception signaling is not existed. The tester may transmit the anomaly-free log data to the log analysis device for loading by the log analysis device. The anomaly-free log data may be anomaly-free modem log data, i.e., log data generated during communication between the terminal device and the network device, and may include a plurality of modemog.
And 402, extracting the second signaling of the layer 3 from the non-abnormal log data, and generating a second signaling queue according to the second signaling.
The log analysis means extracts the second signaling of layer 3, i.e. the signaling of layer 3, from the log data without anomaly, the second signaling being for distinguishing from the signaling of layer 3 in the log data to be analyzed. The number of second signaling is L2. Wherein L2 is a positive integer. And sequencing the L2 second signaling according to the time sequence, and generating a second signaling queue according to the sequenced L2 second signaling. The second signaling queue includes L2 signaling elements, one signaling element corresponding to each second signaling. For example, the flow shown in fig. 2 includes 10 signaling, and then the second signaling queue includes 10 signaling elements, 201 in fig. 2, the rrc connection request signaling is the 1 st signaling element in the second signaling queue, and may be labeled as 1, (1) or (1), and so on.
403，k＝k+1。
Let k=0 and then execute k=k+1 before executing 403, then 405 extracts the 1 st and 2 nd signaling elements from the second signaling queue. k=k+1 is a programming language, and after executing a flow corresponding to a k value, k+1 is assigned k, and then the flow corresponding to the k value is executed. For example, after the process corresponding to 1 is executed, k is assigned to 2, and then the process corresponding to 2 is executed. Before execution 403, the signaling conversion diagram does not include any elements.
404, judging whether k is greater than or equal to L2, and ending when k is greater than or equal to L2.
k is greater than L2, which means that the queue length of the second signaling queue is exceeded, that is, all k values have executed the corresponding flow, and the flow of generating the signaling conversion graph can be ended. K is equal to L2, so that the (k+1) th signaling element does not exist in the second signaling queue, and thus the process of generating the signaling transition diagram may be ended.
405, k is smaller than L2, the kth signaling element and the kth+1th signaling element are extracted from the second signaling queue.
k is smaller than L2, which indicates that all k values have not yet executed the corresponding flow. First, the 1 st signaling element and the 2 nd signaling element are extracted from the second signaling queue.
406, determining whether there is a shortest path from the kth signaling element to the kth+1th signaling element, where the path length of the shortest path is 1. If yes, execution 403 is executed 406; if the determination result of 406 is no, 407 is executed.
Judging whether the shortest path from the kth signaling element to the kth+1th signaling element exists in the current signaling conversion diagram, namely judging whether the kth signaling element, the kth+1th signaling element and the shortest path from the kth signaling element to the kth+1th signaling element exist. In performing the flow shown in fig. 4, the shortest path from the kth signaling element to the (k+1) th signaling element may have been mapped in the signaling conversion diagram, and then no re-mapping is required. Alternatively, the shortest path from the p-th signaling element to the p+1th signaling element may be mapped in the signaling conversion diagram, the p-th signaling and the kth signaling are the same signaling, and the carried information elements (information element, IE) may be different, so that re-mapping is not needed. I.e., 406, if the determination is yes, 403 is performed.
Aiming at the situation that the same signaling carries different IEs, the embodiment of the application regards the same signaling. For example, taking the terminal device side as an example, assume that A0 and A0' are the same signaling sent by the network device carrying different UEs. Since the IEs carried by A0 and A0 'are different, the terminal device will perform different actions A1 and A1' in response to the signaling A0 and A0', so that in the process of generating the signaling transfer diagram, two different paths P1 (pointing from A0 to A1) and P2 (pointing from A0 to A1') will be generated. If the signaling A0 and A0 'are regarded as the same signaling a, the paths become P1 (a points to A1) and P2 (a points to A1') with the shortest path length being 1, and the analysis result is not affected. In addition, the same signaling carrying different IEs is not distinguished, so that decoding time consumption can be reduced, and the running efficiency is improved.
407, mapping the shortest path from the kth signaling element to the kth+1th signaling element to the signaling conversion graph.
And if the judgment result of 406 is no, mapping the shortest paths from the kth signaling element to the kth+1th signaling element to the signaling conversion diagram, namely mapping the kth signaling element, the kth+1th signaling element and the shortest paths from the kth signaling element to the kth+1th signaling element to the signaling conversion diagram. For example, the 1 st signaling element, the 2 nd signaling element, and the shortest paths of the 1 st signaling element to the 2 nd signaling element are mapped to the signaling conversion map.
In the flow shown in fig. 4, a signaling conversion chart may be generated based on the anomaly-free log data, and the signaling conversion chart may be understood as a test model.
The log analysis method provided by the embodiment of the application is explained below.
Referring to fig. 5, a flow chart of a log analysis method according to an embodiment of the application may include, but is not limited to, the following steps:
501, extracting the first signaling of the layer 3 from the log data to be analyzed, and generating a first signaling queue according to the first signaling.
Prior to execution 501, the log analysis device loads log data and signaling conversion graphs to be analyzed. The signaling conversion chart is generated through the flow of fig. 4. The log data to be analyzed can be log data generated in the process of communication between the terminal equipment and the network equipment in the test process, and the log data can be modemolog data. The log data to be analyzed can also be that a tester is transmitted to the log analysis device for detecting whether abnormal signaling exists in the modemog data.
The log analysis means extracts the first signaling of layer 3, i.e. the signaling of layer 3, from the log data to be analyzed, the first signaling being for distinguishing from the signaling of layer 3 in the log data without anomalies. The number of first signaling is L1. Wherein L1 is a positive integer. And sequencing the L1 first signaling according to the time sequence, and generating a second signaling queue according to the sequenced L1 first signaling. The first signaling queue includes L1 signaling elements, one signaling element corresponding to each first signaling. It should be noted that the queue length of the first signaling queue may be the same as or different from the queue length of the second signaling queue, as the case may be.
502, determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram.
The ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, and i+1 is less than or equal to L1.
In one implementation, the log analysis device searches the shortest path from the ith signaling element to the (i+1) th signaling element directly in the signaling conversion diagram, and determines the path length of the path. For example, there is the q signaling element in the signaling conversion diagram, where the q signaling and the i signaling are the same signaling and carry different IEs, and the shortest path length from the q signaling element to the q+1th signaling element may be used as the shortest path length from the i signaling element to the i+1th signaling element. In this way, abnormal signaling can be located more quickly.
In another implementation manner, the log analysis device searches a jth signaling element corresponding to the ith signaling element in the signaling conversion diagram, and the jth+1th signaling element corresponding to the (i+1th) signaling element; in the signaling conversion diagram, determining the shortest path length from the jth signaling element to the j+1 signaling element, wherein the shortest path length from the jth signaling element to the j+1 signaling element is the path length from the ith signaling element to the (i+1) signaling element. In the mode, any two adjacent signaling elements in the signaling queue are mapped to the signaling conversion diagram so as to determine the shortest path length, thereby being convenient for rapidly and accurately positioning abnormal signaling.
Searching a j-th signaling element corresponding to the i-th signaling element, and searching the j-th signaling element in a signaling conversion diagram according to the association function of the i-th signaling when searching the j-th signaling element and the j-th signaling element corresponding to the i-th signaling element and the j-1-th signaling element; according to the association function of the (i+1) th signaling, searching the (j+1) th signaling element in the signaling conversion diagram.
In the signaling conversion diagram, when determining the shortest path length from the jth signaling element to the j+1 signaling element, a Dijkstra algorithm is adopted to search the shortest path from the jth signaling element to the j+1 signaling element, and the path length of the path is determined. The Dikk Tesla algorithm is used for calculating the shortest distance from the starting point to each node in the absence of non-negative weights. The diels tesla algorithm is used for example, and other algorithms may be used to find the shortest path from the jth signaling element to the j+1 signaling element.
503, the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than a first threshold value, and abnormal information is generated. Wherein the first threshold is 1.
The exception information is used for indicating that the i signaling element and/or the signaling corresponding to the i+1th signaling element is an exception signaling, that is, the i signaling may be abnormal, the i+1th signaling may be abnormal, or both the i and 1th signaling may be abnormal.
If the ith signaling and the (i+1) th signaling are the same signaling and carry different IEs, the shortest path length from the ith signaling element to the (i+1) th signaling element is a second threshold, namely 0, which indicates that the same signaling may be sent or received. Or, the same two signaling elements are mapped to the same element point in the signaling conversion graph, so that the shortest path length of the two signaling elements is 0.
Optionally, the log analysis device may also output abnormal information, for example, output in a pop-up window, mail or short message, so as to remind the tester of which signaling is abnormal. The abnormality information may be output when abnormality is detected, or may be output after detection of log data to be analyzed is completed.
504, the shortest path length from the ith signaling element to the (i+1) th signaling element is a first threshold, and the signaling corresponding to the ith signaling element and the (i+1) th signaling element is determined to be normal signaling.
The shortest path length from the ith signaling element to the (i+1) th signaling element is a first threshold, which indicates that the signaling corresponding to the ith signaling element and the (i+1) th signaling element is normal signaling, and no abnormal information is required to be generated.
For the situation that a plurality of signaling flows exist in the real network environment of the same service flow, different paths are generated to represent different signaling flows in the generation process of the signaling conversion diagram. Assuming that a certain signaling queue appears as a normal queue, but some signaling in the normal queue is misjudged as error signaling, the misjudged signaling queue is manually corrected in the later model optimization. It will be appreciated that for some cases where the normal queue is misjudged, the tester checks and corrects the abnormal results to optimize the model.
In the flow shown in fig. 5, according to the signaling conversion diagram, it is determined whether the shortest path length of any two adjacent signaling elements is a first threshold, where the first threshold indicates that signaling corresponding to the two signaling elements is signaling in a normal flow, otherwise indicates that signaling corresponding to the two signaling elements is abnormal, so that abnormal signaling can be quickly located through traversing the signaling queue, and analysis efficiency is improved.
The analysis of fig. 4 and 5 based on signaling elements can save time compared to the analysis based on signaling.
Please refer to fig. 6, which is another representation corresponding to fig. 5, and the same or similar parts of the process as fig. 5 are omitted for brevity. The flow shown in fig. 6 may include, but is not limited to:
601, loading log data to be analyzed and a signaling conversion chart.
And 602, extracting the first signaling of the layer 3 from the log data to be analyzed, and generating a first signaling queue according to the first signaling.
603，i＝i+1。
Let i=0 before execution 603, and execute i=i+1 again.
604, judging whether i is greater than or equal to L1, and ending when i is greater than or equal to L1.
605, i is smaller than L1, and judging whether a shortest path from the ith signaling element to the (i+1) th signaling element exists according to the signaling conversion diagram, wherein the path length of the shortest path is 1. If the judgment result of 605 is yes, 603 is executed; if the determination result of 605 is no, 606 is executed.
At 606, anomaly information is generated.
In the flow shown in fig. 6, according to the signaling conversion diagram, it is determined whether the shortest path length of any two adjacent signaling elements is 1, and a 1 indicates that the signaling corresponding to the two signaling elements is the signaling in the normal flow, otherwise indicates that the signaling corresponding to the two signaling elements is abnormal, so that the abnormal signaling can be quickly located by traversing the signaling queue, and the analysis efficiency is improved.
Referring to fig. 7, fig. 7 is a schematic structural diagram of a log analysis device according to an embodiment of the application. As shown in fig. 7, the log analysis device 70 includes a queue generating unit 701, a length determining unit 702, and an abnormality generating unit 703.
A queue generating unit 701, configured to extract a first signaling of layer 3 from log data to be analyzed, and generate a first signaling queue according to the first signaling, where the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer;
a length determining unit 702, configured to determine, according to the signaling conversion diagram, a shortest path length from an ith signaling element to an (i+1) th signaling element, where the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1;
An anomaly generating unit 703, configured to generate anomaly information when the shortest path length from the i-th signaling element to the i+1th signaling element is greater than or less than a first threshold, where the anomaly information is used to indicate that the signaling corresponding to the i-th signaling element and/or the i+1th signaling element is anomaly signaling.
Optionally, the length determining unit 702 is specifically configured to search, in the signaling conversion diagram, a jth signaling element corresponding to the ith signaling element, and a jth+1th signaling element corresponding to the (i+1th) signaling element; in the signaling conversion diagram, determining the shortest path length from the jth signaling element to the j+1 signaling element, wherein the shortest path length from the jth signaling element to the j+1 signaling element is the path length from the ith signaling element to the (i+1) signaling element.
Optionally, the log analysis device 70 further includes a graph generating unit, configured to generate a signaling conversion graph according to the log data without anomaly.
Optionally, the graph generating unit is specifically configured to extract a second signaling of the layer 3 from the log data without exception, and generate a second signaling queue according to the second signaling, where the number of signaling elements of the second signaling queue is L2, and L2 is a positive integer; judging whether the shortest path from the kth signaling element to the (k+1) th signaling element exists in the signaling conversion diagram; the path length of the shortest path from the kth signaling element to the kth+1th signaling element is a first threshold; if not, mapping the shortest paths from the kth signaling element to the (k+1) th signaling element to a signaling conversion diagram;
The kth signaling element and the (k+1) th signaling element are any two adjacent signaling elements in the second signaling queue; wherein k is a positive integer, and k+1 is less than or equal to L2.
Optionally, the log analysis device 70 further includes a signaling determining unit, configured to determine, for a first threshold, a shortest path length from the ith signaling element to the (i+1) th signaling element, and determine that signaling corresponding to the (i) th signaling element and the (i+1) th signaling element is normal signaling.
Optionally, the shortest path length from the ith signaling element to the (i+1) th signaling element is a second threshold, and the anomaly information is used for indicating that the signaling corresponding to the i signaling element and the signaling corresponding to the (i+1) th signaling element are the same signaling.
Referring to fig. 8, fig. 8 shows another log analysis device 80 according to an embodiment of the application. Can be used to implement the functionality of the log analysis device in the method embodiments described above. The log analysis device 80 may include a transceiver 801 and a processor 802. Optionally, the beam determining means may further comprise a memory 803. Wherein the transceiver 801, the processor 802, the memory 803 may be connected by a bus 804 or other means. The bus is shown in bold lines in fig. 8, and the manner in which other components are connected is merely illustrative and not limiting. The buses may be divided into address buses, data buses, control buses, etc. For ease of illustration, only one thick line is shown in fig. 8, but not only one bus or one type of bus.
The coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units, or modules, which may be in electrical, mechanical, or other forms for information interaction between the devices, units, or modules. The specific connection medium between the transceiver 801, the processor 802, and the memory 803 is not limited in the embodiment of the present application.
Memory 803 may include read only memory and random access memory, and provide instructions and data to processor 802. A portion of memory 803 may also include non-volatile random access memory.
The processor 802 may be a central processing unit (Central Processing Unit, CPU), and the processor 802 may also be other general purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), field-programmable gate arrays (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or the like. A general purpose processor may be a microprocessor, but in the alternative, the processor 802 may be any conventional processor or the like.
In an alternative embodiment, memory 803 is used to store program instructions; a processor 802 for calling program instructions stored in the memory 803 for executing steps executed by the log analyzing apparatus in the corresponding embodiment of fig. 4-6.
In the embodiments of the present application, the methods provided by the embodiments of the present application can be implemented by running a computer program (including program code) capable of executing the steps involved in the above-described methods on a general-purpose computing device such as a computer, including a processing element such as a CPU, a random access storage medium (Random Access Memory, RAM), a Read-Only Memory (ROM), or the like, and a storage element. The computer program may be recorded on, for example, a computer-readable recording medium, and loaded into and run in the above-described computing device through the computer-readable recording medium.
Based on the same inventive concept, the principle and beneficial effects of the log analyzer 80 in the embodiment of the present application for solving the problems are similar to those of the log analyzer in the embodiment of the method of the present application, and may refer to the principle and beneficial effects of the implementation of the method, and are not described herein for brevity.
The log analysis device may be, for example: a chip, or a chip module.
The embodiment of the application also provides a chip which can execute the related steps of the log analysis device in the embodiment of the method.
The chip is used for: extracting a first signaling of the layer 3 from log data to be analyzed, generating a first signaling queue according to the first signaling, wherein the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer; determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram, wherein the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1; the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than a first threshold value, and abnormal information is generated, wherein the abnormal information is used for indicating that the signaling corresponding to the (i) signaling element and/or the (i+1) th signaling element is abnormal signaling.
Referring to fig. 9, fig. 9 is a schematic structural diagram of a chip module according to an embodiment of the application. The chip module 90 may perform the steps related to the log analyzer in the foregoing method embodiment, and the chip module 90 includes: a communication interface 901 and a chip 902.
The communication interface is used for carrying out internal communication of the chip module or carrying out communication between the chip module and external equipment; the chip is used for realizing the functions of the log analysis device in the embodiment of the application, and particularly, the chip is referred to as a corresponding embodiment in fig. 4-6. Optionally, the chip module 90 may further include a storage module 903 and a power module 904. The storage module 903 is used for storing data and instructions. The power module 904 is configured to provide power to the chip module.
For each device and product applied to or integrated in the chip module, each module included in the device and product may be implemented by hardware such as a circuit, and different modules may be located in the same component (e.g. a chip, a circuit module, etc.) of the chip module or different components, or at least some modules may be implemented by using a software program, where the software program runs on a processor integrated in the chip module, and the remaining (if any) modules may be implemented by hardware such as a circuit.
Embodiments of the present application also provide a computer readable storage medium having one or more instructions stored therein, the one or more instructions being adapted to be loaded by a processor and to perform the method provided by the above-described method embodiments.
The present application also provides a computer program product comprising a computer program or instructions which, when run on a computer, cause the computer to perform the method provided by the method embodiments described above.
With respect to each of the apparatuses and each of the modules/units included in the products described in the above embodiments, it may be a software module/unit, a hardware module/unit, or a software module/unit, and a hardware module/unit. For example, for each device or product applied to or integrated on a chip, each module/unit included in the device or product may be implemented in hardware such as a circuit, or at least part of the modules/units may be implemented in software program, where the software program runs on a processor integrated inside the chip, and the rest (if any) of the modules/units may be implemented in hardware such as a circuit; for each device and product applied to or integrated in the chip module, each module/unit contained in the device and product can be realized in a hardware manner such as a circuit, different modules/units can be located in the same component (such as a chip, a circuit module and the like) or different components of the chip module, or at least part of the modules/units can be realized in a software program, the software program runs on a processor integrated in the chip module, and the rest (if any) of the modules/units can be realized in a hardware manner such as a circuit; for each device, product, or application to or integrated with the terminal, each module/unit included in the device, product, or application may be implemented by using hardware such as a circuit, different modules/units may be located in the same component (for example, a chip, a circuit module, or the like) or different components in the terminal, or at least part of the modules/units may be implemented by using a software program, where the software program runs on a processor integrated inside the terminal, and the remaining (if any) part of the modules/units may be implemented by using hardware such as a circuit.
It should be noted that, for simplicity of description, the foregoing method embodiments are all expressed as a series of action combinations, but it should be understood by those skilled in the art that the present application is not limited by the order of action described, as some steps may be performed in other order or simultaneously according to the present application. Further, those skilled in the art will also appreciate that the embodiments described in the specification are all preferred embodiments, and that the acts and modules referred to are not necessarily required for the present application.
The steps in the method of the embodiment of the application can be sequentially adjusted, combined and deleted according to actual needs.
The modules in the device of the embodiment of the application can be combined, divided and deleted according to actual needs.
Those of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be implemented by a program to instruct related hardware, the program may be stored in a computer readable storage medium, and the readable storage medium may include: flash disk, ROM, RAM, magnetic or optical disk, etc.
The foregoing disclosure is merely a preferred embodiment of the present application, but is not intended to limit the scope of the claims.
Claims (8)
1. A method of log analysis, the method comprising:
extracting second signaling of the layer 3 from the log data without anomaly, sequencing L2 second signaling according to time sequence, generating a second signaling queue according to the sequenced L2 second signaling, wherein the number of signaling elements of the second signaling queue is L2, and L2 is a positive integer;
judging whether the shortest path from the kth signaling element to the (k+1) th signaling element exists or not; the path length of the shortest path from the kth signaling element to the kth+1th signaling element is a first threshold; wherein the kth signaling element and the kth+1th signaling element are any two adjacent signaling elements in the second signaling queue; wherein k is a positive integer, and k+1 is less than or equal to L2;
if not, mapping the shortest paths from the kth signaling element to the (k+1) th signaling element to a signaling conversion diagram;
extracting first signaling of a layer 3 from log data to be analyzed, sequencing L1 first signaling according to time sequence, and generating a first signaling queue according to the sequenced L1 first signaling, wherein the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer;
Determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram, wherein the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1;
and generating exception information, wherein the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than the first threshold value, and the exception information is used for indicating that the signaling corresponding to the i signaling element and/or the (i+1) th signaling element is an exception signaling.
2. The method according to claim 1, wherein determining a shortest path length from an i-th signaling element to an i+1-th signaling element according to a signaling transition diagram comprises:
searching a j-th signaling element corresponding to the i-th signaling element in the signaling conversion diagram, and a j+1th signaling element corresponding to the i+1th signaling element;
in the signaling conversion diagram, determining the shortest path length from the jth signaling element to the j+1 signaling element, wherein the shortest path length from the jth signaling element to the j+1 signaling element is the path length from the ith signaling element to the (i+1) signaling element.
3. The method according to claim 1 or 2, characterized in that the method further comprises:
and determining that the signaling corresponding to the ith signaling element and the (i+1) th signaling element is normal signaling by taking the shortest path length from the ith signaling element to the (i+1) th signaling element as the first threshold value.
4. The method according to claim 1 or 2, wherein the shortest path length from the i-th signaling element to the i+1th signaling element is a second threshold, and the anomaly information is used to indicate that the signaling corresponding to the i-th signaling element and the signaling corresponding to the i+1th signaling element are the same signaling.
5. A log analysis device, characterized in that the log analysis device comprises:
the diagram generating unit is used for extracting second signaling of the layer 3 from the log data without anomaly, sequencing L2 second signaling according to time sequence, and generating a second signaling queue according to the sequenced L2 second signaling, wherein the number of signaling elements of the second signaling queue is L2, and L2 is a positive integer;
judging whether the shortest path from the kth signaling element to the (k+1) th signaling element exists or not; the path length of the shortest path from the kth signaling element to the kth+1th signaling element is a first threshold; wherein the kth signaling element and the kth+1th signaling element are any two adjacent signaling elements in the second signaling queue; wherein k is a positive integer, and k+1 is less than or equal to L2;
If not, mapping the shortest paths from the kth signaling element to the (k+1) th signaling element to a signaling conversion diagram;
the queue generating unit is used for extracting first signaling of the layer 3 from log data to be analyzed, sequencing L1 first signaling according to time sequence, generating a first signaling queue according to the sequenced L1 first signaling, wherein the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer;
a length determining unit, configured to determine a shortest path length from an ith signaling element to an (i+1) th signaling element according to the signaling conversion diagram, where the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1;
the exception generation unit is configured to generate exception information when a shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than the first threshold, where the exception information is used to indicate that signaling corresponding to the i signaling element and/or the (i+1) th signaling element is an exception signaling.
6. The chip is characterized by comprising a transceiver and a processor, wherein the processor is used for extracting second signaling of the layer 3 from the log data without exception, sequencing L2 second signaling according to time sequence, generating a second signaling queue according to the sequenced L2 second signaling, wherein the number of signaling elements of the second signaling queue is L2, and L2 is a positive integer; judging whether the shortest path from the kth signaling element to the (k+1) th signaling element exists or not; the path length of the shortest path from the kth signaling element to the kth+1th signaling element is a first threshold; wherein the kth signaling element and the kth+1th signaling element are any two adjacent signaling elements in the second signaling queue; wherein k is a positive integer, and k+1 is less than or equal to L2; if not, mapping the shortest paths from the kth signaling element to the (k+1) th signaling element to a signaling conversion diagram; extracting first signaling of a layer 3 from log data to be analyzed, sequencing L1 first signaling according to time sequence, and generating a first signaling queue according to the sequenced L1 first signaling, wherein the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer; determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram, wherein the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1; and generating exception information, wherein the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than the first threshold value, and the exception information is used for indicating that the signaling corresponding to the i signaling element and/or the (i+1) th signaling element is an exception signaling.
7. The utility model provides a module equipment, its characterized in that, module equipment includes communication module, power module, storage module and chip module, wherein:
the power supply module is used for providing electric energy for the module equipment;
the storage module is used for storing data and instructions;
the communication module is used for carrying out internal communication of module equipment or carrying out communication between the module equipment and external equipment;
the chip module is used for: extracting second signaling of the layer 3 from the log data without anomaly, sequencing L2 second signaling according to time sequence, generating a second signaling queue according to the sequenced L2 second signaling, wherein the number of signaling elements of the second signaling queue is L2, and L2 is a positive integer; judging whether the shortest path from the kth signaling element to the (k+1) th signaling element exists or not; the path length of the shortest path from the kth signaling element to the kth+1th signaling element is a first threshold; wherein the kth signaling element and the kth+1th signaling element are any two adjacent signaling elements in the second signaling queue; wherein k is a positive integer, and k+1 is less than or equal to L2; if not, mapping the shortest paths from the kth signaling element to the (k+1) th signaling element to a signaling conversion diagram; extracting first signaling of a layer 3 from log data to be analyzed, sequencing L1 first signaling according to time sequence, and generating a first signaling queue according to the sequenced L1 first signaling, wherein the number of signaling elements of the first signaling queue is L1, and L1 is a positive integer; determining the shortest path length from the ith signaling element to the (i+1) th signaling element according to the signaling conversion diagram, wherein the ith signaling element and the (i+1) th signaling element are any two adjacent signaling elements in the first signaling queue; wherein i is a positive integer, i+1 is less than or equal to L1; and generating exception information, wherein the shortest path length from the ith signaling element to the (i+1) th signaling element is greater than or less than the first threshold value, and the exception information is used for indicating that the signaling corresponding to the i signaling element and/or the (i+1) th signaling element is an exception signaling.
8. A computer readable storage medium, characterized in that the computer readable storage medium has stored therein a computer program which, when run on a communication device, causes the communication device to perform the method of any of claims 1-4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111677093.8A CN114363947B (en) | 2021-12-31 | 2021-12-31 | Log analysis method and related device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111677093.8A CN114363947B (en) | 2021-12-31 | 2021-12-31 | Log analysis method and related device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114363947A CN114363947A (en) | 2022-04-15 |
| CN114363947B true CN114363947B (en) | 2023-09-22 |
Family
ID=81104401
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111677093.8A Active CN114363947B (en) | 2021-12-31 | 2021-12-31 | Log analysis method and related device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114363947B (en) |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110321371A (en) * | 2019-07-01 | 2019-10-11 | 腾讯科技（深圳）有限公司 | Daily record data method for detecting abnormality, device, terminal and medium |
| CN110932910A (en) * | 2019-12-05 | 2020-03-27 | 锐捷网络股份有限公司 | Method and device for recording logs of software faults |
| CN112448894A (en) * | 2019-09-03 | 2021-03-05 | 华为技术有限公司 | Method, device, equipment and storage medium for blocking signaling storm |
| CN112838943A (en) * | 2019-11-25 | 2021-05-25 | 华为技术有限公司 | Signaling analysis method and related device |
| CN113298345A (en) * | 2021-04-06 | 2021-08-24 | 杭州未名信科科技有限公司 | Abnormal behavior detection method, abnormal behavior detection device, electronic device and medium |
| CN113641632A (en) * | 2021-07-14 | 2021-11-12 | 广州市玄武无线科技股份有限公司 | Method for converting command line extraction log data into graphic display |
| CN113742116A (en) * | 2020-11-27 | 2021-12-03 | 北京沃东天骏信息技术有限公司 | Abnormity positioning method, abnormity positioning device, abnormity positioning equipment and storage medium |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10756949B2 (en) * | 2017-12-07 | 2020-08-25 | Cisco Technology, Inc. | Log file processing for root cause analysis of a network fabric |
-
2021
- 2021-12-31 CN CN202111677093.8A patent/CN114363947B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110321371A (en) * | 2019-07-01 | 2019-10-11 | 腾讯科技（深圳）有限公司 | Daily record data method for detecting abnormality, device, terminal and medium |
| CN112448894A (en) * | 2019-09-03 | 2021-03-05 | 华为技术有限公司 | Method, device, equipment and storage medium for blocking signaling storm |
| CN112838943A (en) * | 2019-11-25 | 2021-05-25 | 华为技术有限公司 | Signaling analysis method and related device |
| WO2021103589A1 (en) * | 2019-11-25 | 2021-06-03 | 华为技术有限公司 | Signaling analysis method and related apparatus |
| CN110932910A (en) * | 2019-12-05 | 2020-03-27 | 锐捷网络股份有限公司 | Method and device for recording logs of software faults |
| CN113742116A (en) * | 2020-11-27 | 2021-12-03 | 北京沃东天骏信息技术有限公司 | Abnormity positioning method, abnormity positioning device, abnormity positioning equipment and storage medium |
| CN113298345A (en) * | 2021-04-06 | 2021-08-24 | 杭州未名信科科技有限公司 | Abnormal behavior detection method, abnormal behavior detection device, electronic device and medium |
| CN113641632A (en) * | 2021-07-14 | 2021-11-12 | 广州市玄武无线科技股份有限公司 | Method for converting command line extraction log data into graphic display |
Non-Patent Citations (2)
| Title |
|---|
| 基于优先队列的时变网络最短路径算法;杨传印;黄玮;薛少聪;王劲松;;计算机应用研究(第05期);全文 * |
| 杨传印 ; 黄玮 ; 薛少聪 ; 王劲松 ; .基于优先队列的时变网络最短路径算法.计算机应用研究.2018,(第05期),全文. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114363947A (en) | 2022-04-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109067617B (en) | V2X protocol consistency test method, device and system | |
| JP6273011B2 (en) | User equipment (UE), program, and computer-readable recording medium | |
| US11711154B2 (en) | Method of reporting RSSI measurements in an unlicensed band and related apparatus | |
| US20230345271A1 (en) | Evaluation and control of predictive machine learning models in mobile networks | |
| CN110493720B (en) | Terminal positioning method and device and storage medium | |
| CN104735685A (en) | Information processing method, device and system | |
| CN106304325A (en) | A kind of localization method, device and location terminal | |
| US20230354060A1 (en) | Measurement method and device, communication node, and storage medium | |
| US9161332B2 (en) | Location estimation device and location estimation method for estimating location of interference source | |
| CN106714189B (en) | Method and device for analyzing cell over coverage | |
| US11569935B2 (en) | Concept for the analysis of a radio communication system | |
| JP6025692B2 (en) | Area quality degradation estimation apparatus and method | |
| CN104125636A (en) | Base station positioning method and device | |
| CN113207146B (en) | Wireless communication network quality monitoring system and method | |
| CN114363947B (en) | Log analysis method and related device | |
| US20120071183A1 (en) | Radio base station, control apparatus, and abnormality detection method | |
| US20090325569A1 (en) | System and method for device-assisted measurement of neighboring wireless environment | |
| CN108957260A (en) | Partial discharge detecting system and method, storage medium, processor | |
| CN112533233B (en) | Wireless network detection method, device and system based on user interaction | |
| EP2988463B1 (en) | Ensuring the performance of normal performance carriers | |
| JP6516392B2 (en) | User equipment (UE), program, method, and computer readable recording medium | |
| CN104756595B (en) | WLAN finds method, equipment and system | |
| WO2016003333A1 (en) | Methods, nodes and user equipments for finding neighboring user equipments with which a first user equipment may be able to communicate directly | |
| CN103220698B (en) | Asynchronization process method, Apparatus and system between a kind of node based on wireless network | |
| CN113905325B (en) | Interference checking method, device, equipment and readable medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |