FR3022721A1 - METHOD AND DEVICE FOR PROCESSING DATA PACKETS ISSUED IN A COMMUNICATION NETWORK - Google Patents

Abstract

The invention relates to a method for processing transmitted data packets in a communication network (R). The method is adapted to obtain data relating to at least one data packet transmitted by a communication equipment (Eql) via said communication network, to analyze the data obtained to determine if the communication equipment (Eql) is or no of a given type of equipment, according to predefined profile data, specific to said type of equipment and to create a message intended for an operator, if said communication equipment is not of the given type of equipment. The invention also relates to a monitoring device (EVS) implementing the treatment method.

Description

The present invention relates to the general field of communications. It relates more particularly to the processing of data contained in data packets sent by communication equipment to other communication equipment via a communication network. It relates more particularly to the processing of anomalies involved in the data packets exchanged. Some of these anomalies come from the network itself, others are caused by users' communication equipment.

Support services are provided to users to solve problems of anomalies due to communication equipment. Users requesting such a service usually sign a support agreement that clearly indicates the type of communication equipment that this support supports. In case of equipment change, the user must sign a new contract. If he does not do so, he can no longer benefit from the contract initially signed. It should be noted that these contracts are only offered for communication equipment approved by the operator, that is to say those for which the operator has validated the operation in the network. However, when reporting a problem reported by a user, it is difficult for a network operator to know, without moving to the user, whether the equipment on which the contract is the one connected to the network. Most of the time, this operator does not check this information and can spend a lot of time detecting anomalies emitted by equipment different from the one supposed, for example equipment not approved by the operator. One of the aims of the invention is to remedy the shortcomings / disadvantages of the state of the art and / or to make improvements thereto. To this end, the invention proposes a method for processing data packets transmitted in a communication network. The processing method comprises the following steps implemented by a processing device of said network: - obtaining data relating to at least one data packet transmitted by a communication equipment via said communication network; analyzing said data obtained to determine whether or not the communication equipment is of a given type of equipment according to predefined profile data specific to said type of equipment; -creation of a message intended for an operator, if said communication equipment is not of the given type of equipment.

3022721 2 Profile data is predefined for a given device type. This profile data is specific to the type of equipment being given. The analysis of data relating to data packets transmitted by a device according to the predefined profile data for a type of equipment makes it possible to determine whether or not the equipment having transmitted these data packets is of the type of equipment. given. In the case where the analysis determines that the equipment in question is not of the given type of equipment, a message intended for an operator is created. The operator, consulting the message, is thus informed that the equipment is not of the given type of equipment.

According to a particular embodiment of the method of processing, the type of equipment is selected from a plurality of types of equipment according to a type of equipment identifier previously associated with an identifier of said equipment The operator in charge The network maintenance thus knows in a simple and inexpensive way if the communication equipment that has sent the data packets is not the type of equipment expected. The message may be significant of a change of communication equipment, for example the replacement of a communication equipment of a first type of equipment with a communication equipment of a second type of equipment.

According to a particular embodiment of the processing method, if said equipment is not of the given type of equipment, the step of analyzing the data obtained is reiterated according to second predefined profile data specific to a second type. of equipment of a predetermined list of equipment types and wherein an identifier of a said second type of equipment is inserted in said created message if said equipment is of the second type of equipment. In the case where the communication equipment is not of the given type of equipment, the reiteration of the analysis step according to second profile data makes it possible to signal to an operator whether the type of equipment is or no of a second type of known equipment.

According to a particular characteristic of the processing method, said message contains data indicating that no type of equipment of the predetermined list corresponds to said equipment. A successive reiteration of the analysis step for a plurality of second profile data belonging to a predetermined list of profiles makes it possible to determine whether the equipment is of a type of equipment from the list.

The message created makes it possible to inform a user that the type of the communication equipment in question is not a type of equipment contained in the list of predetermined types of equipment. This is particularly useful when the list of types of equipment The equipment contains profile data for each type of equipment approved by the operator because the user is thus informed that the communication equipment used is not approved equipment and that the equipment is for example likely to introduce disturbances in the communication network. According to a particular embodiment of the processing method, the predefined profile data for one type of equipment contains at least one profile characteristic 10 determined from data relating to data packets transmitted by a first device and from data relating to data packets transmitted by at least one second device during a prior phase. According to a particular feature of the processing method, a said profile characteristic is defined by a value of a field contained in a data packet or by a value determined from said field value. According to a particular embodiment, the processing method includes a step of calculating at least one value relating to a time elapsed between at least two consecutive data packets transmitted by a device and a step of comparing said at least one value calculated with a predetermined value for a type of equipment associated with said equipment.

These steps make it possible to detect possible congestion of the network, that is to say a problem of non-compliance with the time elapsed between two consecutive data packets transmitted by a communication equipment. The invention also relates to a processing device comprising: a module for obtaining data relating to at least one data packet transmitted by a communication device via a communication network; a module for analyzing said data obtained to determine whether or not the communication equipment is of a given type of equipment according to predefined profile data specific to said type of equipment; and a creation module capable of creating a message intended for an operator, if said equipment is not of the given type of equipment. According to a preferred implementation, the various steps of the method according to the invention are implemented by software or computer program.

The invention thus relates to a software or program capable of being executed by a computer or a data processor, this software / program comprising instructions for controlling the execution of the steps of a processing method. These instructions are intended to be stored in a memory of a computing device, loaded and then executed by a processor of this computing device. This software / program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in n ' any other desirable form. The computing device can be implemented by one or more physically distinct machines and generally presents the architecture of a computer, including components of such an architecture: data memory (s), processor (s), communication bus hardware interface (s) for connecting this computing device to a network or other equipment, user interface (s), etc. The invention also relates to an information carrier readable by a data processor, and comprising instructions of a program as mentioned above. The information carrier may be any entity or device capable of storing the program. Other features and advantages of the present invention will appear in the following description of an embodiment given by way of non-limiting example. with reference to the accompanying drawings, in which: - Figure 1 is a diagram illustrating a system according to one embodiment of the invention; - Figure 2 is a flowchart illustrating the various steps of a method of treatment 20 according to a 3 illustrates an example of a table of profiles according to one embodiment, FIG. 4 illustrates an example of a table of correspondence according to one embodiment of the invention, FIG. an example of an example of data obtained during a obtaining step according to one embodiment of the invention; FIG. 6 a flowchart illustrating the various steps of a phase of the invention; e generation according to one embodiment of the invention. The invention is implemented by means of software and / or hardware components. In this context, the term "module" can correspond in this document as well to a software component, to a hardware component or to a set of hardware and / or software components, capable of implementing a function or a set of functions, as described below for the module concerned. A software component corresponds to one or more computer programs, one or more subroutines of a program, or more generally to any element of a program or software. Such a software component is stored in memory then loaded and executed by a data processor of a physical entity (terminal, server, gateway, set-top box, router, etc.) and is likely to access the hardware resources. this physical entity (memories, recording media, communication bus, input / output electronic boards, user interfaces, etc.). In the same way, a hardware component corresponds to any element of a hardware set. It may be a programmable hardware component or with an integrated processor for running software, for example an integrated circuit, a smart card, an electronic card for executing a firmware, etc. An embodiment of a data packet processing method will now be described with reference to FIGS. 1 and 2. With reference to FIG. 1, a SYS system comprises a processing device ST, one or more communication equipment and for an operator terminal T. For simplicity, only three communication equipments Eq1, Eq2 and Eq3 are shown in FIG.

The communication equipments Eq1, Eq2, Eq3 are able to communicate with one or more other communication equipment via a communication network R. A communication equipment is for example a telephone terminal, a private telephone exchange or PBX (for "Private" Automatic Branch eXchange "...

The processing device ST is an equipment of the network R, for example a computer of the PC type. The terminal T is for example a computer connected to the processing device ST by a wired connection. As an alternative, the link between the terminal T and the processing device ST is a wireless link. Also, as an alternative, the processing device ST and the terminal T are able to communicate with each other via a communication network, for example the network R. The processing device ST comprises, in a known way, in particular a processing unit. UT equipped with a microprocessor, a ROM type ROM or EEPROM, a RAM type RAM. The processing device ST may comprise in a conventional and non-exhaustive manner the following elements: a microphone, a loudspeaker, a disk drive, a keyboard, a display screen, a display module for displaying on the display screen, storage means ... The ROM comprises registers storing a PG computer program 35 with program instructions adapted to implement a method of processing data packets according to an embodiment of the invention. The invention will be described later with reference to FIG.

The processing device ST also comprises a capture module CAP, a filtering module FLT, an extraction module EXT and an monitoring device SVE. The SVE monitoring device comprises an OBT obtaining module, an ANL analysis module and a CRE message creation module.

The EVS monitor may also include a GEN profile generation module. In the embodiment described here, the capture module CAP, the filtering module FLT, the extraction module EXT and the monitoring device SVE are integrated in the processing device ST.

As an alternative, these entities are distributed in several devices able to communicate with each other. The CAP capture module is able to capture, that is to say, to intercept data packets contained in the flows exchanged between communication equipment. Interception is here performed without disrupting communications. In other words, any stream sent by a first communication equipment to a second piece of equipment is on the one hand intercepted by the capture module CAP and on the other hand received by the second piece of equipment in the same way as if he was not intercepted. The interception is transparent to the users of the communication equipment. A stream sent by a device contains a succession of data packets.

The capture module CAP accordingly obtains a plurality of data packets from a plurality of equipments. These data packets are obtained for a given time interval, for example 2 hours. The data packets obtained comprise data packets of different types, for example, Session Initiation Protocol (SIP) type data packets and PSTN type data packets (for "Switched Telephone Network"). The filtering module FLT is able to filter the packets obtained by the capture module CAP according to predetermined selection criteria. For example, the FLT filter module is configured to obtain the data packets containing SIP type signaling messages from the data packets obtained by the CAP capture module. This filtering operation consists of extracting data packets obtained by the capture module CAP, the SIP signaling packets and transmitting the extracted packets to the extraction module EXT and / or recording them in a memory of the device ST treatment. The data extraction module EXT is able to obtain data sets extracted from the data packets obtained following the filtering operation. Each data set obtained contains data extracted from a data packet, according to second predefined selection criteria.

For example, in the case where the extracted data packets correspond to SIP signaling messages, the data corresponding to the "sequence type", "from", "to" and "call-id" fields are extracted and recorded. in a memory of the processing device ST in association with a date and time of arrival of the data packet.

An embodiment of a processing method implemented by the processing device ST of the SYS system will now be described with reference to FIG. 2. In a first prior step E0, profile data is respectively recorded in association with equipment type identifiers, in a memory 10 accessible by the processing device ST, for example a memory M of the processing device ST. Figure 3 illustrates a TAP profile table in which profile data has been recorded in association with equipment type identifiers. For example, profile data PF1 is recorded in association with a first device type identifier IdT1 and profile data PF2 is recorded in association with a second device type identifier IdT2. The PF1 profile data recorded in association with the identifier IdT1 contain in this embodiment, a single characteristic Cl. The characteristic Cl is: "the number of characters of the value contained in the field entitled" call-id "is 40 ".

The profile data PF2 recorded in association with the identifier IdT2 contain, for example, a characteristic C2. The characteristic C2 is: "the value contained in the field entitled" sequence "is equal to the value 180 for at least three data packets sent consecutively by the communication equipment considered". The identifiers IdT1, IdT2 form a predetermined list L of equipment type identifiers. In the examples illustrated here, the profile data recorded in association with an identifier type identifier contains only one characteristic. As an alternative, profile data recorded in association with an identifier type identifier contains several features. These characteristics are in this case interconnected, implicitly or explicitly, by Boolean operators, for example Boolean operators of "AND" and / or "OR" type. The profile data recorded in association with an equipment type identifier include one or more profile characteristics determined by the processing device ST during a prior phase of generating profile data and / or one or more characteristics entered. by an operator for example from a user interface of the terminal T.

An exemplary embodiment of a profile data generation phase is described later in the description with reference to FIG. 6. In a second preliminary step E2, the processing device ST obtains one or more identifiers of equipment. It also obtains for each equipment identifier 5 obtained, a profile type identifier. Then, it stores in a memory accessible by this processing device ST, for example the memory M, each equipment identifier obtained in association with an identifier of the type of communication equipment IdT. The identifier idE of the equipment and the identifier IdT of the associated equipment type are, for example, entered by an operator by means of, for example, a user interface, for example a computer mouse, of the terminal T and transmitted to the processing device ST which records them. Figure 4 illustrates a mapping table TAE in which equipment type identifiers are recorded respectively with equipment identifiers. For example, three idEl, IdE2, IdE3 equipment identifiers are stored in the TAE mapping table 15. The equipment type identifier registered in association with the equipment identifier IdEl of the equipment Eql is the equipment type identifier IdT1. The equipment type identifier registered in association with the equipment identifier IdE2 of the equipment Eq2 and with the equipment identifier IdE3 of the equipment Eq3 is the equipment type identifier IdT2.

In a step E4, the capture module CAP of the processing device ST captures data packets transmitted during a predefined time interval IV. The time interval IV is for example of a duration of two hours. The filtering module FLT obtains, from the data packets captured by the capture module CAP, data packets corresponding to the SIP signaling messages 25 sent by the equipments Eq1, Eq2 and Eq3 listed in the correspondence table TAE. Then the extraction module EXT obtains for each data packet obtained by the filtering module FLT, a set of data ES. The data of each set of ES data is data extracted from a data packet obtained by the extraction module EXT.

For example, each set of ES data includes the data corresponding to the fields "sequence type", "from", "to", "call-id" of the SIP message contained in a data packet and a date and an arrival time of the data packet. For example, the fields labeled "sequence type", "from", "to", "call-id" of a SIP message are defined in the June 2002 version of RFC 3261 35 (for "Request"). For Comments ") defined by the IETF (" Internet Engineering Task Force ").

During a step E6, the obtaining module OBT of the processing device ST obtains DP data relating to at least one data packet transmitted by a communication device, for example the equipment Eq1. The DP data comprises DPE data extracted from at least one data packet emitted by the communication equipment Eq1 and DPC data computed from all or part of the DPE data. Alternatively, the DP data includes only DPE data extracted from at least one data packet transmitted by the Eql communication equipment or only DPC data computed from DPE data.

The DPE data is all or part of the ES data set data obtained by the extraction module EXT and obtained from the packets transmitted by the equipment Eql. The data sets corresponding to the packets transmitted by the equipment Eql are extracted from the data sets obtained by the extraction module EXT by sorting according to the "FROM" field. Indeed, according to the SIP protocol, the field "FROM" 15 contains an identifier of the equipment Eql. The DPC data includes one or more values calculated from one or more DPE data. Such a calculated value is for example a value LG (call-id) defined by the number of characters of the field "call-Id".

FIG. 5 illustrates an example of data obtained during the obtaining step. In a step E8, the analysis module ANL of the monitoring device SVE analyzes the obtained DP data to determine whether or not the communication equipment is of the given type, that is to say if the equipment of Eql communication presents the feature (s) defining the PF1 profile data recorded in association with the equipment type identifier registered for the Eql communication equipment. For example, the equipment type identifier registered in association with the identifier IdEl of the equipment Eql is the identifier IdT1 and the analysis module ANL determines whether the characteristic C1 is respected by the data DP. In the example described, the analysis module ANL checks whether the DP data contained in the fields "call id" all have a number of characters equal to 40. If it is determined that the equipment does not have the characteristics expected, for example if the number of characters of the field "call-id" is different from the value 40 for one or more data packets, an ERR error message is constructed during a step E10 by the module for creating CRE messages from the EVS monitor.

This ERR error message indicates that the equipment is not of the expected type. It may also contain information to identify the feature or features not met. This message is intended to inform an operator in charge of network maintenance.

For example, it is transmitted and displayed on a screen of the terminal T. Alternatively, it is recorded in an anomaly file. The anomalies file can for example be consulted by an operator later. Also, as an alternative, the message is transmitted to the operator in the form of an electronic mail message, an SMS (for "Short Message Service") ... The message can also be a voice message transmitted to a telephone terminal of the operator. If it is determined that the equipment has the expected characteristic (s), no ERR error message is constructed during a step El0 by the message creation module CRE of the SVE monitoring device. Step El0 is in this case a step of not creating a message. As an alternative, an error message indicating that the equipment has the expected characteristic (s) is created. The process steps can then be reiterated later for the same equipment Eq1 or for another equipment registered in the correspondence table TAE. In a variant of the embodiment, if it is determined in step E8 that the communication equipment considered Eql does not have the expected characteristics, that is to say the characteristic C1, the equipment Eql n is not of the type identified by the equipment type identifier IdT1 and step E8 is followed by a step E20 in which the analysis unit ANL of the processing device ST analyzes the DP data obtained during step E6 to determine if the equipment Eql is of a type, for example of the type identified by the identifier of type IdT2 of the list L of types of identifiers. The list L contains the types of identifiers IdT1 and IdT2 for which profile data has been stored in the TAP profile table. In step E20, the analysis module ANL checks according to the data DP if the equipment Eql has the characteristic C2. Step E20 is similar to step E6 previously described. In the case where the equipment Eq1 has the characteristic C2, the equipment Eql is of the type identified by the equipment type identifier IdT2 and the step E20 is followed by the step El () of creation of Error message. The error message created is for example a message indicating that the equipment Eql is not of the IdT1 identifier type but is of the IdT2 identifier type. In the case where the equipment Eq1 does not have the characteristic C2, the equipment Eql 35 is not of the type identified by the equipment type identifier IdT2 and the step E20 is followed by the step El0 of creating an error message.

The error message created is for example a message indicating that the equipment Eql is neither the type of identifier IdT1, nor the type of identifier IdT2. The error message may also indicate that the equipment type Eql is not a known type.

In the case where the list L of type identifiers contains more than two types of equipment, the analysis step E20 can be repeated one or more times. In another alternative embodiment, DSQ sequencing data is recorded in the TAP profile table in association with each equipment type identifier in step E0. The sequencing data DSQ is for example a value VQ1 corresponding to a time elapsed between the sending of two consecutive data packets by the same equipment and a value VQ2 corresponding to an accepted margin of error for the value VQ1. The value VQ1 is for example obtained by calculating an average of the elapsed times between the sending of consecutive data packets and the value VQ2 is the standard deviation calculated on the same data. In this variant, if it is determined during step E8 or during a step E20 that the equipment is of a determined type, for example of the type of identification device IdT1, step E8 or step E20 is followed by a step E30 in which an average duration value VD passed between consecutive packets and a standard deviation value VE for this average duration value VD are calculated from the DP data. . Step E30 is followed by a step E32 in which the calculated values VD and VE are compared with the recorded values VQ1 and VQ2. Step E32 is then followed by a step E34 of creating a message MSG indicating the result of the comparison step. As an alternative, step E34 is performed only if the values VD and VE on the one hand and VQ1 and VQ2 on the other hand do not match.

An embodiment of the generation phase will now be described with reference to FIG. 6. In a step E50, the capture module CAP of the processing device ST captures data packets transmitted during a time interval IV1. predefined. The time interval IV1 is before the time interval IV. Thus, the data used for the generation phase (step E50 and following) are not the data used in a subsequent monitoring phase (steps E4 to E34 described above). The duration of the IV1 interval is for example two hours.

The filtering module FLT obtains, from the data packets captured by the capture module CAP during the time interval IV, data packets corresponding to the SIP signaling messages sent by the equipments Eql, Eq2 and Eq3. contained in the TAE correspondence table.

Then, the extraction module EXT obtains for each data packet obtained by the filtering module FLT, an ESG data set. The data of each ESG data set is data extracted from an ESG data set obtained from a data packet obtained by the extraction module EXT. For example, each ESG data set comprises the data corresponding to the "sequence type", "from", "to", "call-id" fields of the SIP signaling messages contained in the data packets, and a date and time of arrival of the data packet. In a step E52, the generation module GEN of the processing device DT obtains DG data relating to at least one data packet transmitted by one or more communication devices, for example the devices Eq1, Eq2 and Eq3. The DG data comprises DGE data extracted from at least one data packet transmitted by one of the communication equipments Eq1, Eq2, Eq3 and DGC data calculated from the DGE data. As an alternative, the DG data comprises only DGE data extracted from at least one data packet transmitted by one of the communication equipments Eq1, Eq2, Eq3 or only DGC data calculated from the DGE data. The DGE data relating to a data packet is all or part of the data of the ESG data set obtained for this data packet by the extraction module EXT of the processing device ST. The data packets are the packets transmitted by one of the communication equipments Eq1, Eq2, Eq3. The DGC data relating to a data packet is calculated from one or more DGC data relating to this data packet. For example, for each field value expressed in the form of a string of characters, the DGC data includes a value representing the number of characters in the string.

The fields for which the number of characters is calculated are predefined, for example by an operator. As an alternative, a number of characters is calculated for each field of type "string of characters". In a step E54, the DG data is grouped by communication equipment 35 Eql, Eq2, Eq3. For example, the DG data is grouped according to an equipment identifier contained in the field labeled "FROM".

For example, three groups G1, G2 and G3 are obtained respectively for each equipment Eql, Eq2 and Eq3. Then, during a step E56, the generation module GEN determines whether one or more of the DG data obtained for a given piece of equipment, for example the equipment item Eql, is or is not representative of a type of equipment. A datum is representative of a type of equipment if, on the one hand, the value obtained for a datum of one or more groups, typically a field, is associated with a first predefined percentage threshold, for example 90%, and the The percentage of obtaining this value for the other groups is less than a second predefined percentage threshold, for example 20%.

For example, the value LG (Id) corresponding to the number of characters of the values obtained for the field "Call-Id" is the value 40 with a percentage of 1 for the group G1 and the percentage of obtaining the value 40 for the group G2 and for the group G3 is the value 0. The value "field length" is therefore a representative value of the equipment 1. Consequently, during a step E58, the characteristic "length of the Call-Id field = 40 "15 is stored in the profile data PF1 associated with the equipment Eql.

Claims (9)

REVENDICATIONS1. Method for processing transmitted data packets in a communication network (R), characterized in that it comprises the following steps implemented by a processing device (ST) of said network: Obtaining (E6) data (DP) relating to at least one packet of data transmitted by a communication equipment (Eql) via said communication network; Analyzing (E8) said obtained data (DP) to determine whether or not the communication equipment (Eql) is of a given type of equipment according to predefined profile data (DP1) specific to said type of equipment; Creation (E10) of a message intended for an operator, if said communication equipment is not of the given type of equipment. The method of claim 1 wherein the equipment type is selected from a plurality of equipment types based on a previously registered equipment type identifier in association with an identifier of said equipment. 3. Processing method according to one of the preceding claims wherein if said equipment is not of the given type of equipment, the step of analyzing the data obtained is reiterated according to second predefined profile data specific to a given device. second type of equipment of a predetermined list of equipment types and wherein an identifier of a said second type of equipment is inserted into said created message if said equipment is of the second type of equipment. 4. Processing method according to claim 3 wherein said message contains data indicating that no type of equipment of the predetermined list corresponds to said equipment 5. Processing method according to one of the preceding claims wherein the predefined profile data for a type of equipment considered contain at least one profile characteristic determined from data relating to data packets transmitted by said equipment and to from data relating to data packets transmitted by at least one second device during a prior phase. The processing method according to claim 5 wherein a said profile characteristic is defined by a value of a field contained in a data packet or by a value determined from said field value. 3022721 15 7. Treatment method according to one of the preceding claims characterized in that it comprises a step of calculating at least one value relating to a time elapsed between at least two consecutive data packets, a comparison step of said minus a calculated value with a predetermined value for a type of equipment associated with said equipment. 8. Monitoring device (EVS), characterized in that it comprises: a module for obtaining data relating to at least one data packet transmitted by a communication device via a communication network; A module for analyzing said data obtained to determine whether or not the communication equipment is of a given type of equipment according to predefined profile data specific to said type of equipment; an authoring module capable of creating a message intended for an operator, if said equipment is not of the given type of equipment. 15 A computer program product comprising instructions for carrying out the steps of a processing method according to one of claims 1 to 7, when loaded and executed by a processor. 20 25