CN103458438A - Method and device for processing service wireless side behavioral analysis - Google Patents
Method and device for processing service wireless side behavioral analysis Download PDFInfo
- Publication number
- CN103458438A CN103458438A CN 201310368100 CN201310368100A CN103458438A CN 103458438 A CN103458438 A CN 103458438A CN 201310368100 CN201310368100 CN 201310368100 CN 201310368100 A CN201310368100 A CN 201310368100A CN 103458438 A CN103458438 A CN 103458438A
- Authority
- CN
- China
- Prior art keywords
- message
- user face
- data bag
- rab
- face data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000004458 analytical method Methods 0.000 title claims abstract description 50
- 230000003542 behavioural effect Effects 0.000 title claims abstract description 47
- 238000000034 method Methods 0.000 title claims abstract description 35
- 238000012545 processing Methods 0.000 title claims abstract description 11
- 230000004044 response Effects 0.000 claims description 58
- 230000005540 biological transmission Effects 0.000 claims description 30
- 238000003672 processing method Methods 0.000 claims description 11
- 238000012098 association analyses Methods 0.000 claims description 9
- 238000005457 optimization Methods 0.000 abstract description 5
- 230000002452 interceptive effect Effects 0.000 abstract 1
- 230000011664 signaling Effects 0.000 description 12
- 230000006399 behavior Effects 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 238000012790 confirmation Methods 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000007689 inspection Methods 0.000 description 2
- 238000010295 mobile communication Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
Images
Landscapes
- Mobile Radio Communication Systems (AREA)
Abstract
The invention provides a method and device for processing service wireless side behavioral analysis. The method comprises the steps that a control plane message generated by an RNC and an SGSN in an interactive mode through an Iu-PS interface is identified, user plane data packages sent by the RNC and the SGSN through the Iu-PS interface are analyzed, a control plane data package and the user plane data packages are related according to a preset rule, and service wireless side behavioral analysis is conducted according to the recorded number of sending times, the sending time of each message and the service type. According to the technical scheme, service wireless side behavioral analysis can be conducted in a time-saving, labor-saving and low-cost mode, so that the service optimization efficiency is greatly improved.
Description
Technical field
The present invention relates to processing method and the device of the behavioural analysis of a kind of business wireless side, relate in particular to a kind of method and apparatus that data service wireless side behavior in 3G WCDMA network is analyzed, belong to 3G mobile communication technology field.
Background technology
As everyone knows, 3-G (Generation Three mobile communication system) is just worldwide day by day universal, and WCDMA is the widest the third generation wireless communication system of the current scope of application.Along with the continuous enhancing of network service capabilities and popularizing fast of intelligent terminal, the data service of carrying in 3G WCDMA network at present is of a great variety, as instant messaging, web browsing, FTP download and video etc.
Yet different kinds of business has different Business Stream features, as the Business Stream of instant messaging class business is characterized as periodically short packet; The Business Stream of downloading business is characterized as has for a long time large packet.Just because of the difference of Business Stream feature, cause different kinds of business to produce different carrying behaviors when wireless side is carried.According to ASSOCIATE STATISTICS, the signaling number that instant messaging class business produces accounts for 40% of the whole network, and the flow of generation only accounts for 7% left and right; And the signaling number that downloading business produces accounts for 0.4% of the whole network, and the flow produced accounts for 10% left and right.Dissimilar have different Business Stream features, causes it in wireless side, to produce different carrying behaviors, and the consumption of natural resource situation is also fully different.Therefore, the analysis of WCDMA network data service wireless side behavior not only is beneficial to the resource consumption analysis to the WCDMA existing network, and there is important directive significance to how carrying out resource distribution in the process of construction, optimization, dilatation network.
In the WCDMA network, general data service calls all comprises following several process: terminal UE and radio network controller (RNC) set up RRC connection, terminal UE and core net (CN) by initial direct-sending message (initial direct-sending+initial UE message) connect, RAB RAB connection building process, data traffic transmission, RAB RAB Connection Release flow process, Iu Connection Release flow process and RRC Connection Release flow process, as shown in Figure 1.Prior art, for the analysis of WCDMA network data service wireless side behavior, generally all realizes by associated Gn/Iu-PS interface data and Iu-b interface data.But, in the WCDMA network, the physical interface of Iu-b is more, and Iu-b interface and Gn/Iu-PS interface apart from each other often physically.Therefore, existing technical scheme is more time-consuming, effort, cost are high, also very inconvenient aspect deployment.
Summary of the invention
For the defect of prior art, the invention provides a kind of processing method and the device that only by analyzing Iu-PS interface user's face and chain of command data, just can realize the behavioural analysis of business wireless side.
First aspect, the embodiment of the present invention provides the processing method of a kind of business wireless side behavioural analysis, comprising:
The chain of command message that identification RNC and SGSN are mutual by Iu-PS interface, described chain of command message comprise RRC connect set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, and record described RRC and connect and set up transmission times and the transmitting time that acknowledge message and described IU Connection Release complete message;
The user face data bag that RNC and SGSN are sent by Iu-PS interface is resolved, and obtains TEID, source IP address, purpose IP address and type of service that described user face data bag is corresponding;
Carry out the associated of chain of command and user face data bag according to preset rules, and, according to transmission times, transmitting time and the described type of service of each recorded message, carry out the behavioural analysis of business wireless side.
In the first, in possible implementation, described preset rules comprises:
Downlink user face packet ownership correlation rule comprises:
RRC with identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB request message and RAB response message, belongs to same session;
TEID in user face data bag packet header is identical with the TEID carried in the RAB response message;
The source IP address that the user face data bag is corresponding is identical with the IP address of SGSN, and the purpose IP address that the user face data bag is corresponding is identical with the IP address of RNC;
Connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message the time of advent of user face data bag between RRC;
Up user face data bag ownership correlation rule comprises:
RRC with identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, belongs to same session;
TEID in user face data bag packet header is identical with the TEID carried in the RAB request message;
The source IP address that the user face data bag is corresponding is identical with the IP address of RNC, and the purpose IP address that the user face data bag is corresponding is identical with the IP address of SGSN;
Connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message the time of advent of user face data bag between RRC.
In the first, in possible implementation, the described transmission times according to each recorded message, transmitting time and described type of service, carry out the behavioural analysis of business wireless side, comprising:
Connect and set up the transmission times that acknowledge message and described IU Connection Release complete message according to described RRC, obtain the connection number of times of each type of service; And connect and set up the transmitting time that acknowledge message and described IU Connection Release complete message according to described RRC, obtain the connection duration of each type of service;
According to the connection number of times of each type of service be connected duration, carry out the behavioural analysis of business wireless side.
In the possible implementation of the first, the described user face data bag that RNC and SGSN are sent by Iu-PS interface is resolved, and comprising:
Application deep packet identification DPI method, the user face data bag that RNC and SGSN are sent by Iu-PS interface is resolved.
Second aspect, the embodiment of the present invention provides the processing unit of a kind of business wireless side behavioural analysis, comprising:
Identification module, for identifying RNC and the SGSN chain of command message mutual by Iu-PS interface, described chain of command message comprise RRC connect set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, and record described RRC and connect and set up transmission times and the transmitting time that acknowledge message and described IU Connection Release complete message;
Parsing module, resolved for the user face data bag that RNC and SGSN are sent by Iu-PS interface, obtains TEID, source IP address, purpose IP address and type of service that described user face data bag is corresponding;
The association analysis module, for carry out the associated of chain of command and user face data bag according to preset rules, and, according to transmission times, transmitting time and the described type of service of each recorded message, carry out the behavioural analysis of business wireless side.
In the first, in possible implementation, the preset rules of the processing unit of described business wireless side behavioural analysis comprises:
Downlink user face packet ownership correlation rule comprises:
RRC with identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB request message and RAB response message, belongs to same session;
TEID in user face data bag packet header is identical with the TEID carried in the RAB response message;
The source IP address that the user face data bag is corresponding is identical with the IP address of SGSN, and the purpose IP address that the user face data bag is corresponding is identical with the IP address of RNC;
Connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message the time of advent of user face data bag between RRC;
Up user face data bag ownership correlation rule comprises:
RRC with identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, belongs to same session;
TEID in user face data bag packet header is identical with the TEID carried in the RAB request message;
The source IP address that the user face data bag is corresponding is identical with the IP address of RNC, and the purpose IP address that the user face data bag is corresponding is identical with the IP address of SGSN;
Connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message the time of advent of user face data bag between RRC.
In the first, in possible implementation, the described association analysis module of described device comprises:
Associative cell, for carry out the associated of chain of command and user face data bag according to preset rules, and according to transmission times, transmitting time and the described type of service of each recorded message;
Analytic unit, the transmission times of each message recorded according to associative cell, transmitting time and described type of service, carry out the behavioural analysis of business wireless side.
In the first in possible implementation, described parsing module specifically for:
Application deep packet identification DPI method, the user face data bag that RNC and SGSN are sent by Iu-PS interface is resolved.
As shown from the above technical solution, processing method and the device of business wireless side provided by the invention behavioural analysis, pass through the mutual chain of command message of Iu-PS interface by identification RNC and SGSN, and the user face data bag that RNC and SGSN send by Iu-PS interface is resolved, carry out the associated of chain of command and user face data bag according to preset rules again, and according to transmission times, transmitting time and the described type of service of each recorded message, to carry out the behavioural analysis of business wireless side; By technical scheme provided by the invention can save time, laborsaving, carry out the behavioural analysis of business wireless side at low cost, greatly improve the efficiency of service optimization.
The accompanying drawing explanation
In order to be illustrated more clearly in the embodiment of the present invention or technical scheme of the prior art, below will do one to the accompanying drawing of required use in embodiment or description of the Prior Art introduces simply, apparently, accompanying drawing in the following describes is some embodiments of the present invention, for those of ordinary skills, under the prerequisite of not paying creative work, can also obtain according to these accompanying drawings other accompanying drawing.
The call flow diagram that Fig. 1 is data service in the WCDMA network;
The processing method embodiment schematic flow sheet that Fig. 2 is business wireless side of the present invention behavioural analysis;
Fig. 3 is business wireless side behavioral statistics analysis embodiment schematic flow sheet of the present invention;
The processing unit example structure schematic diagram that Fig. 4 is business wireless side of the present invention behavioural analysis;
The structural representation of another embodiment of processing unit that Fig. 5 is business wireless side of the present invention behavioural analysis.
Embodiment
For the purpose, technical scheme and the advantage that make the embodiment of the present invention clearer, below in conjunction with the accompanying drawing in the embodiment of the present invention, technical scheme in the embodiment of the present invention is clearly and completely described, obviously, described embodiment is the present invention's part embodiment, rather than whole embodiment.Embodiment based in the present invention, those of ordinary skills, not making under the creative work prerequisite the every other embodiment obtained, belong to the scope of protection of the invention.
The processing method embodiment schematic flow sheet that Fig. 2 is business wireless side of the present invention behavioural analysis, in conjunction with the call flow diagram of WCDMA network data service in Fig. 1, the processing method of business wireless side of the present invention behavioural analysis comprises the steps: as shown in Figure 2
Step 201, identification radio network controller (Radio Network Controller, be called for short RNC) and GPRS serving GPRS support node (Serving GPRS SUPPORT NODE, be called for short SGSN) by the mutual chain of command message of Iu-PS interface, described chain of command message comprise RRC connect set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, and record described RRC and connect and set up transmission times and the transmitting time that acknowledge message and described IU Connection Release complete message.
Can be obtained and be identified RNC and the SGSN message mutual by Iu-PS interface by third party's network entity in the embodiment of the present invention.Particularly, identify RNC and SGSN by the mutual chain of command message of Iu-PS interface, described chain of command message comprises that acknowledge message is set up in the RRC connection, the IU Connection Release completes message, RAB RAB request message and RAB response message, and connect and set up acknowledge message and IU Connection Release and complete message authentication and belong to same RRC and be connected by RRC, confirm to belong to same RAB carrying by RAB request message and RAB response message.
Wherein, by identification Internal call control protocol (Signaling Connection Control Protocol, be called for short SCCP) in RRC(Radio Resource Control) connect and set up acknowledge message (Connect_Confirm) (step 5) in Fig. 1 identifies RRC and connects to set up and confirm, the value that type of message " SCCP Message Type " attribute in Internal call control protocol (SCCP) corresponding to confirmation (Connect_Confirm) message set up in this connections is 0x02.Record its transmitting time simultaneously and connect the time of setting up as RRC, and included SLR and the DLR of record " Connect_Confirm " message.
By identification Radio Access Network Application Part (Radio Access Network Application Part, being called for short RANAP) IU Connection Release in agreement completes message (step 14 in figure) IU Connection Release and completes message and identify the RRC Connection Release, it is " Iu_Release_Complete " that this Iu Connection Release completes " Procedure Name " attribute corresponding to message in RANAP, record the IU Connection Release simultaneously and complete the time of the transmitting time of message as the RRC Connection Release, and record Iu_Release_Complete " included SLR and the DLR of message.
SLR is the local reference code (Source Local Reference) of source, DLR is the local reference code (Destination Local Reference) of purpose, in SCCP, the message of transmitting during one time SCCP connects all has identical SLR and DLR, therefore can realize message relating by SCCP connection reference number SLR and the DLR analyzed in signaling message, judge whether to belong to a same SCCP according to the SLR carried in the message of receiving and DLR and be connected.
Also will record RRC in the embodiment of the present invention connects and to set up the transmission times that acknowledge message and IU Connection Release complete message.
RAB request message (step 8) in Fig. 1 and the RAB response message (step 11) in Fig. 1 in the identification RANAP, " Procedure Name " attribute corresponding to these two message is respectively " RAB_Assignment Request " and " RAB_Assignment Response " in RANAP, record the IP address and Tunnel End Point Identifier (the Tunnel Endpoint Identifier that carry in RAB RAB request message, be called for short TEID) as Iu-PS user's face in this conversation procedure at the identifier of SGSN side, and included SLR and the DLR of record " RAB_Assignment Request " message, record the IP address of carrying in the RAB response message and TEID as Iu-PS user's face in this conversation procedure at the identifier of RNC side, and included SLR and the DLR of record " RAB_Assignment Response " message.
It should be noted that: the IP address of carrying in the RAB request message is a field in message, the IP address that its information of carrying is SGSN, and the IP address of carrying in the RAB response message is a field in message, the IP address that its information of carrying is RNC.The TEID carried in the RAB request message is the TEID of GPRS Tunnel Protocol (GPRS Tunnel Protocol is called for short GTP) tunnel in the SGSN side, and the TEID carried in the RAB response message is the TEID of GTP tunnel in the RNC side.
User's face GTP packet that RNC and SGSN are sent by Iu-PS interface is resolved, apply particularly deep packet identification DPI (Deep Packet Inspection) detection method, user's face GTP packet that RNC and SGSN are sent by Iu-PS interface is resolved, and obtains TEID value, source IP address, purpose IP address and the type of service that in described user's face GTP packet packet header, the TEID attribute is corresponding (as micro-letter, FTP download and web page browsing etc.).
Further, described preset rules comprises: downlink user face GTP packet ownership correlation rule and up user's face GTP packet ownership correlation rule.
Wherein, downlink user face GTP packet is the GTP packet that SGSN sends to RNC, and up user's face GTP packet is the GTP packet that RNC sends to SGSN.
Described downlink user face GTP packet ownership correlation rule comprises:
(1) RRC that there is identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB request message and RAB response message, belongs to same session.
Because there is identical SLR and DLR with the RANAP signaling in a SCCP session, SCCP message with carrying RANAP signaling in a connection procedure has identical SLR and DLR, therefore connect when setting up acknowledge message, IU Connection Release and completing message and there is identical SLR and DLR value as RRC, can be judged as that acknowledge message is set up in this RRC connection, the IU Connection Release completes message and belongs to same SCCP session; When RAB request message and RAB response message have identical SLR and DLR value, can be judged as this RAB request message and RAB response message and belong to same SCCP session; When RRC connects when setting up acknowledge message, IU Connection Release and completing message, RAB request message and RAB response message and have identical SLR and DLR value simultaneously, can be judged as that acknowledge message is set up in the RRC connection, the IU Connection Release completes message, RAB request message and RAB response message and belongs to same SCCP session.
(2) TEID in user's face GTP packet packet header is identical with the Tunnel End Point Identifier (TEID) carried in the RAB response message.
TEID in downlink user face GTP packet packet header is a field in message, and its information of carrying is the TEID of RNC side.The TEID carried in the RAB response message is the TEID of GTP tunnel in the RNC side.
(3) source IP address that user's face GTP packet is corresponding is identical with the IP address of SGSN, and the purpose IP address that user's face GTP packet is corresponding is identical with the IP address of RNC.
The IP address of SGSN is the IP address of carrying in the RAB request message of record in step 201, and the IP address of RNC is the IP address of carrying in the RAB response message of record in step 201.
(4) connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message between RRC the time of advent of user's face GTP packet.
Described up user's face GTP packet ownership correlation rule comprises:
(1) RRC that there is identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, belongs to same session;
Because there is identical SLR and DLR with the RANAP signaling in a SCCP session, SCCP message with carrying RANAP signaling in a connection procedure has identical SLR and DLR, therefore connect when setting up acknowledge message, IU Connection Release and completing message and there is identical SLR and DLR value as RRC, can be judged as that acknowledge message is set up in this RRC connection, the IU Connection Release completes message and belongs to same session; When RAB request message and RAB response message have identical SLR and DLR value, can be judged as this RAB request message and RAB response message and belong to same session; When RRC connects when setting up acknowledge message, IU Connection Release and completing message, RAB request message and RAB response message and have identical SLR and DLR value simultaneously, can be judged as that acknowledge message is set up in the RRC connection, the IU Connection Release completes message, RAB request message and RAB response message and belongs to same session.
(2) TEID in user's face GTP packet packet header is identical with the Tunnel End Point Identifier (TEID) carried in the RAB request message.
TEID in up user's face GTP packet packet header is a field in message, and its information of carrying is the TEID of SGSN side.The TEID carried in the RAB request message is the TEID of GTP tunnel in the SGSN side.
(3) source IP address that user's face GTP packet is corresponding is identical with the IP address of RNC, and the purpose IP address that user's face GTP packet is corresponding is identical with the IP address of SGSN.
The IP address of RNC is the IP address of carrying in the RAB response message of record in step 201, and the IP address of SGSN is the IP address of carrying in the RAB request message of record in step 201.
(4) connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message between RRC the time of advent of user's face GTP packet.
Fig. 3 is business wireless side behavioral statistics analysis embodiment schematic flow sheet of the present invention, the described transmission times according to each recorded message, transmitting time and described type of service, carry out the behavioural analysis of business wireless side, as shown in Figure 3, can comprise the following steps:
Particularly, add up in business procedure RRC and connect and set up acknowledge message (Connect_Confirm) and the Iu Connection Release completes the right number of (Iu_Release_Complete) message, obtain thus the connection number of times.
Particularly, add up in business procedure, the every couple of RRC connects and sets up the time difference sum that acknowledge message (Connect_Confirm) and IU Connection Release complete message (Iu_Release_Complete), obtains thus the connection duration.
The processing method of business wireless side provided by the invention behavioural analysis, pass through the mutual chain of command message of Iu-PS interface by identification RNC and SGSN, and the user face data bag that RNC and SGSN send by Iu-PS interface is resolved, carry out the associated of chain of command and user face data bag according to preset rules again, and according to transmission times, transmitting time and the described type of service of each recorded message, to carry out the behavioural analysis of business wireless side; The processing method of business wireless side provided by the invention behavioural analysis only, by analyzing Iu-PS interface user's face and chain of command data, just can save time, laborsaving, carry out the behavioural analysis of business wireless side at low cost, greatly improve the efficiency of service optimization.
The processing unit example structure schematic diagram that Fig. 4 is business wireless side of the present invention behavioural analysis, as shown in Figure 4, this device comprises identification module 41, parsing module 42 and association analysis module 43.
Now in conjunction with Fig. 1, respectively identification module 41, parsing module 42 and association analysis module 43 are described.Identification module 41, for identifying RNC and the SGSN chain of command message mutual by Iu-PS interface, described chain of command message comprise RRC connect set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, and record described RRC and connect and set up transmission times and the transmitting time that acknowledge message and described IU Connection Release complete message.
Particularly, identification module 41 will identify RNC and SGSN passes through the mutual chain of command message of Iu-PS interface, described chain of command message comprises that acknowledge message is set up in the RRC connection, the IU Connection Release completes message, RAB RAB request message and RAB response message, and connect and set up acknowledge message and IU Connection Release and complete message authentication and belong to same RRC and be connected by RRC, confirm to belong to same RAB carrying by RAB request message and RAB response message.
Wherein, connect and set up acknowledge message (Connect_Confirm) (step 5) in Fig. 1 identifies RRC(Radio Resource Control) connection foundation confirmation by the RRC in identification Internal call control protocol (SCCP), the value that type of message " SCCP Message Type " attribute in Internal call control protocol (SCCP) of confirming that (Connect_Confirm) message is corresponding is set up in this connection is 0x02.Record its transmitting time simultaneously and connect the time of setting up as RRC, and included SLR and the DLR of record " Connect_Confirm " message.
IU Connection Release by identification in RANAP completes message (step 14 in figure) IU Connection Release and completes message and identify the RRC Connection Release, it is " Iu_Release_Complete " that this Iu Connection Release completes " Procedure Name " attribute corresponding to message in RANAP, record the IU Connection Release and complete the time of the transmitting time of message as the RRC Connection Release, and record Iu_Release_Complete " included SLR and the DLR of message.
Also will record RRC in the embodiment of the present invention connects and to set up the transmission times that acknowledge message and IU Connection Release complete message.
RAB request message (step 8) in Fig. 1 and the RAB response message (step 11) in Fig. 1 in the identification RANAP, " Procedure Name " attribute corresponding to these two message is respectively " RAB-Assignment Request " and " RAB_Assignment Response " in RANAP, record the IP address of carrying in RAB RAB request message and TEID as Iu-PS user's face in this conversation procedure at the identifier of SGSN side, and included SLR and the DLR of record " RAB_Assignment Request " message; Record the IP address of carrying in the RAB response message and TEID as Iu-PS user's face in this conversation procedure at the identifier of RNC side, and included SLR and the DLR of record " RAB_Assignment Response " message.
Parsing module 42, resolved for user's face GTP packet that RNC and SGSN are sent by Iu-PS interface, obtains corresponding Tunnel End Point Identifier (TEID), source IP address, purpose IP address and the type of service of described user's face GTP packet.
Particularly, user's face GTP packet that 42 couples of RNC of parsing module and SGSN send by Iu-PS interface is resolved, it is application deep packet identification DPI (Deep Packet Inspection) detection method, user's face GTP packet that RNC and SGSN are sent by Iu-PS interface is resolved, and obtains Tunnel End Point Identifier (TEID), source IP address, purpose IP address and the type of service that in described user's face GTP packet packet header, the TEID attribute is corresponding (as micro-letter, FTP download and web page browsing etc.).
Further, described preset rules comprises: downlink user face GTP packet ownership correlation rule and up user's face GTP packet ownership correlation rule.
Described downlink user face GTP packet ownership correlation rule comprises:
(1) RRC that there is identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB request message and RAB response message, belongs to same session;
Because there is identical SLR and DLR with the RANAP signaling in a SCCP session, SCCP message with carrying RANAP signaling in a connection procedure has identical SLR and DLR, therefore connect when setting up acknowledge message, IU Connection Release and completing message and there is identical SLR and DLR value as RRC, can be judged as that acknowledge message is set up in this RRC connection, the IU Connection Release completes message and belongs to same session; When RAB request message and RAB response message have identical SLR and DLR value, can be judged as this RAB request message and RAB response message and belong to same session; When RRC connects when setting up acknowledge message, IU Connection Release and completing message, RAB request message and RAB response message and have identical SLR and DLR value simultaneously, can be judged as that acknowledge message is set up in the RRC connection, the IU Connection Release completes message, RAB request message and RAB response message and belongs to same session.
(2) TEID in user's face GTP packet packet header is identical with the Tunnel End Point Identifier (TEID) carried in the RAB response message.
TEID in downlink user face GTP packet packet header is a field in message, and its information of carrying is the TEID of RNC side.The TEID carried in the RAB response message is the TEID of GTP tunnel in the RNC side.
Described user's face GTP packet is the packet that RNC sends to SGSN.
(3) source IP address that user's face GTP packet is corresponding is identical with the IP address of SGSN, and the purpose IP address that user's face GTP packet is corresponding is identical with the IP address of RNC.
(4) connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message between RRC the time of advent of user's face GTP packet.
Described up user face data bag ownership correlation rule comprises:
(1) RRC that there is identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, belongs to same session;
Because there is identical SLR and DLR with the RANAP signaling in a SCCP session, SCCP message with carrying RANAP signaling in a connection procedure has identical SLR and DLR, therefore connect when setting up acknowledge message, IU Connection Release and completing message and there is identical SLR and DLR value as RRC, can be judged as that acknowledge message is set up in this RRC connection, the IU Connection Release completes message and belongs to same session; When RAB request message and RAB response message have identical SLR and DLR value, can be judged as this RAB request message and RAB response message and belong to same session; When RRC connects when setting up acknowledge message, IU Connection Release and completing message, RAB request message and RAB response message and have identical SLR and DLR value simultaneously, can be judged as that acknowledge message is set up in the RRC connection, the IU Connection Release completes message, RAB request message and RAB response message and belongs to same session.
(2) TEID in user's face GTP packet packet header is identical with the Tunnel End Point Identifier (TEID) carried in the RAB request message.
TEID in up user's face GTP packet packet header is a field in message, and its information of carrying is the TEID of SGSN side.The TEID carried in the RAB request message is the TEID of GTP tunnel in the SGSN side.
(3) source IP address that user's face GTP packet is corresponding is identical with the IP address of RNC, and the purpose IP address that user's face GTP packet is corresponding is identical with the IP address of SGSN.
(4) connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message between RRC the time of advent of user's face GTP packet.
Further, as shown in Figure 5, the structural representation of another embodiment of the processing unit that Fig. 5 is business wireless side of the present invention behavioural analysis, described association analysis module comprises: associative cell 51 and analytic unit 52.Wherein:
Associative cell 51, for carry out the associated of chain of command and user's face GTP packet according to preset rules, and transmission times, transmitting time and the described type of service of each message of record.
Analytic unit 52, the transmission times of each message recorded according to associative cell, transmitting time and described type of service are carried out the behavioural analysis of business wireless side.
Particularly, add up in business procedure RRC and connect and set up acknowledge message (Connect_Confirm) and the IU Connection Release completes the right number of message (Iu_Release_Complete) message, obtain thus the connection number of times.Add up in business procedure, the every couple of RRC connects and sets up the time difference sum that acknowledge message (Connect_Confirm) and Iu Connection Release complete message (Iu_Release_Complete), obtains thus the connection duration.
Because the processing unit of business wireless side provided by the invention behavioural analysis possesses: identification RNC and SGSN pass through the identification module 41 of the mutual chain of command message of Iu-PS interface, the parsing module 42 that the user face data bag that RNC and SGSN are sent by Iu-PS interface is resolved, carry out the associated of chain of command and user face data bag according to preset rules, and according to transmission times, transmitting time and the described type of service of each recorded message, to carry out the association analysis module 43 of business wireless side behavioural analysis; Therefore by the processing unit that the invention provides the behavioural analysis of business wireless side can save time, laborsaving, carry out the behavioural analysis of business wireless side at low cost, greatly improve the efficiency of service optimization.
One of ordinary skill in the art will appreciate that: realize that the hardware that all or part of step of above-mentioned each embodiment of the method can be relevant by program command completes.Aforesaid program can be stored in a computer read/write memory medium.This program, when carrying out, is carried out the step that comprises above-mentioned each embodiment of the method; And aforesaid storage medium comprises: various media that can be program code stored such as ROM, RAM, magnetic disc or CDs.
Finally it should be noted that: above each embodiment, only in order to technical scheme of the present invention to be described, is not intended to limit; Although with reference to aforementioned each embodiment, the present invention is had been described in detail, those of ordinary skill in the art is to be understood that: its technical scheme that still can put down in writing aforementioned each embodiment is modified, or some or all of technical characterictic wherein is equal to replacement; And these modifications or replacement do not make the essence of appropriate technical solution break away from the scope of various embodiments of the present invention technical scheme.
Claims (8)
1. the processing method of business wireless side behavioural analysis, is characterized in that, comprising:
The chain of command message that identification RNC and SGSN are mutual by Iu-PS interface, described chain of command message comprise RRC connect set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, and record described RRC and connect and set up transmission times and the transmitting time that acknowledge message and described IU Connection Release complete message;
The user face data bag that RNC and SGSN are sent by Iu-PS interface is resolved, and obtains TEID, source IP address, purpose IP address and type of service that described user face data bag is corresponding;
Carry out the associated of chain of command and user face data bag according to preset rules, and, according to transmission times, transmitting time and the described type of service of each recorded message, carry out the behavioural analysis of business wireless side.
2. method according to claim 1, is characterized in that, described preset rules comprises:
Downlink user face packet ownership correlation rule comprises:
RRC with identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB request message and RAB response message, belongs to same session;
TEID in user face data bag packet header is identical with the TEID carried in the RAB response message;
The source IP address that the user face data bag is corresponding is identical with the IP address of SGSN, and the purpose IP address that the user face data bag is corresponding is identical with the IP address of RNC;
Connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message the time of advent of user face data bag between RRC;
Up user face data bag ownership correlation rule comprises:
RRC with identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, belongs to same session;
TEID in user face data bag packet header is identical with the TEID carried in the RAB request message;
The source IP address that the user face data bag is corresponding is identical with the IP address of RNC, and the purpose IP address that the user face data bag is corresponding is identical with the IP address of SGSN;
Connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message the time of advent of user face data bag between RRC.
3. method according to claim 1 and 2, is characterized in that, the described transmission times according to each recorded message, transmitting time and described type of service are carried out the behavioural analysis of business wireless side, comprising:
Connect and set up the transmission times that acknowledge message and described IU Connection Release complete message according to described RRC, obtain the connection number of times of each type of service; And connect and set up the transmitting time that acknowledge message and described IU Connection Release complete message according to described RRC, obtain the connection duration of each type of service;
According to the connection number of times of each type of service be connected duration, carry out the behavioural analysis of business wireless side.
4. method according to claim 3, is characterized in that, the described user face data bag that RNC and SGSN are sent by Iu-PS interface is resolved, and comprising:
Application deep packet identification DPI method, the user face data bag that RNC and SGSN are sent by Iu-PS interface is resolved.
5. the processing unit of business wireless side behavioural analysis, is characterized in that, comprising:
Identification module, for identifying RNC and the SGSN chain of command message mutual by Iu-PS interface, described chain of command message comprise RRC connect set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, and record described RRC and connect and set up transmission times and the transmitting time that acknowledge message and described IU Connection Release complete message;
Parsing module, resolved for the user face data bag that RNC and SGSN are sent by Iu-PS interface, obtains TEID, source and destination IP address and type of service that described user face data bag is corresponding;
The association analysis module, for carry out the associated of chain of command and user face data bag according to preset rules, and, according to transmission times, transmitting time and the described type of service of each recorded message, carry out the behavioural analysis of business wireless side.
6. device according to claim 5, is characterized in that, described preset rules comprises:
Downlink user face packet ownership correlation rule comprises:
RRC with identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB request message and RAB response message, belongs to same session;
TEID in user face data bag packet header is identical with the TEID carried in the RAB response message;
The source IP address that the user face data bag is corresponding is identical with the IP address of SGSN, and the purpose IP address that the user face data bag is corresponding is identical with the IP address of RNC;
Connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message the time of advent of user face data bag between RRC;
Up user face data bag ownership correlation rule comprises:
RRC with identical SLR and DLR be connected set up acknowledge message, the IU Connection Release completes message, RAB RAB request message and RAB response message, belongs to same session;
TEID in user face data bag packet header is identical with the TEID carried in the RAB request message;
The source IP address that the user face data bag is corresponding is identical with the IP address of RNC, and the purpose IP address that the user face data bag is corresponding is identical with the IP address of SGSN;
Connect and to set up acknowledge message and the IU Connection Release completes between the transmitting time of message the time of advent of user face data bag between RRC.
7. according to the described device of claim 5 or 6, it is characterized in that, described association analysis module comprises:
Associative cell, for carry out the associated of chain of command and user face data bag according to preset rules, and transmission times, transmitting time and the described type of service of each message of record;
Analytic unit, the transmission times of each message recorded according to associative cell, transmitting time and described type of service are carried out the behavioural analysis of business wireless side.
8. device according to claim 7, is characterized in that, described parsing module specifically for:
Application deep packet identification DPI method, the user face data bag that RNC and SGSN are sent by Iu-PS interface is resolved.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310368100.5A CN103458438B (en) | 2013-08-21 | 2013-08-21 | The treatment process of business wireless side behavioural analysis and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310368100.5A CN103458438B (en) | 2013-08-21 | 2013-08-21 | The treatment process of business wireless side behavioural analysis and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103458438A true CN103458438A (en) | 2013-12-18 |
| CN103458438B CN103458438B (en) | 2016-06-01 |
Family
ID=49740301
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310368100.5A Active CN103458438B (en) | 2013-08-21 | 2013-08-21 | The treatment process of business wireless side behavioural analysis and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103458438B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105323785A (en) * | 2014-06-04 | 2016-02-10 | 中国移动通信集团广东有限公司 | Method and device for determining time-domain characteristic of network |
| CN105359568A (en) * | 2014-05-15 | 2016-02-24 | 华为技术有限公司 | Detection apparatus and method for determining air-interface resource consumed by service |
| CN104768172B (en) * | 2014-10-24 | 2018-11-09 | 北京中创信测科技股份有限公司 | A method of 3G wireless channels are occupied based on IuPS interface analysis data services |
| CN109845216A (en) * | 2016-11-29 | 2019-06-04 | 华为技术有限公司 | A kind of communication means and device |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP4542937B2 (en) * | 2005-03-31 | 2010-09-15 | 株式会社日立国際電気 | Base station equipment |
| CN101090358B (en) * | 2006-06-15 | 2011-02-02 | 华为技术有限公司 | Method for recovering user data transmission |
| CN101505472B (en) * | 2008-02-05 | 2011-07-20 | 华为技术有限公司 | User data server system and apparatus |
-
2013
- 2013-08-21 CN CN201310368100.5A patent/CN103458438B/en active Active
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105359568A (en) * | 2014-05-15 | 2016-02-24 | 华为技术有限公司 | Detection apparatus and method for determining air-interface resource consumed by service |
| CN105359568B (en) * | 2014-05-15 | 2019-11-12 | 华为技术有限公司 | Detection device and the method for determining the interface-free resources that business consumes |
| CN105323785A (en) * | 2014-06-04 | 2016-02-10 | 中国移动通信集团广东有限公司 | Method and device for determining time-domain characteristic of network |
| CN105323785B (en) * | 2014-06-04 | 2019-06-14 | 中国移动通信集团广东有限公司 | A kind of determination method and device of network session characteristic |
| CN104768172B (en) * | 2014-10-24 | 2018-11-09 | 北京中创信测科技股份有限公司 | A method of 3G wireless channels are occupied based on IuPS interface analysis data services |
| CN109845216A (en) * | 2016-11-29 | 2019-06-04 | 华为技术有限公司 | A kind of communication means and device |
| CN109845216B (en) * | 2016-11-29 | 2020-08-25 | 华为技术有限公司 | Communication method and device |
| US11019463B2 (en) | 2016-11-29 | 2021-05-25 | Huawei Technologies Co., Ltd. | Communication method and communications apparatus |
| US11930423B2 (en) | 2016-11-29 | 2024-03-12 | Huawei Technologies Co., Ltd. | Communication method and communications apparatus |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103458438B (en) | 2016-06-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107743307A (en) | A kind of location-based MEC processing method and equipment | |
| CN101938705B (en) | Group management method, network equipment and network system | |
| CN101998531B (en) | Strategy and charging control rule authorization method, device and system | |
| CN103650623A (en) | Transmission of short packet data messages via a signaling radio bearer | |
| CN102421145B (en) | Method and system for carrying out direct communication of data among base stations | |
| CN102547610A (en) | Message processing method, device and system | |
| CN104486091A (en) | Charging method and device | |
| CN103458438B (en) | The treatment process of business wireless side behavioural analysis and device | |
| CN102984703A (en) | Hybrid network as well as method and device for obtaining and transmitting user data | |
| CN103686906B (en) | Method for switching network, terminal equipment and gateway equipment | |
| CN102036304B (en) | Method for providing maximum transmission unit length for terminal and packet switch gateway | |
| CN101588571B (en) | Method, device and system for managing position based on S1 uniform interface | |
| CN101572861B (en) | Method, device and system for context management based on Sl uniform interface | |
| CN103220818A (en) | Method and device for building X2 port IPSec tunnel | |
| CN102917386B (en) | Device and method for consistency protocol verification of interfaces S1 of LTE (Long Term Evolution) wireless network | |
| CN103024876B (en) | Connection control method, gateway and system | |
| CN103227982B (en) | Data straight through processing method, equipment and system | |
| CN103096433A (en) | Service gateway choosing method and system of terminal group | |
| CN101111059B (en) | Method for associated update of position district and routing district | |
| CN101233772B (en) | Dynamically providing of service for a mobile node | |
| CN104506380B (en) | Mobile terminal data service performance test methods based on protocol analyzer and system | |
| CN102026403A (en) | Method and communication system for processing business requests as well as HNB (home node B) gateway | |
| CN102984813A (en) | Data straight-through processing method, equipment and system | |
| CN103636252A (en) | Method, system and device for processing data packet | |
| CN102752795B (en) | Data communications method and communication service node |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |