TWI470971B - A Map - based Network Barrier Reporting System and Anomalous Analysis Method - Google Patents

Description

A map-based network obstacle notification system and anomaly analysis method

The present invention relates to a network obstacle notification system and method, and more particularly to a method for capturing and decoding a network interface and decoding, and backend abnormal signaling by using a signal acquisition decoder installed at a front end of a network equipment room. A map-based network obstacle notification system and anomaly analysis method for decoding and obstacle notification of each interface after the analyzer and the map obstacle notification device are decoded.

Signaling anomaly analysis for the network is often the primary task of eliminating network barriers and consolidating customers. Through the signaling anomaly analysis operation, network operators can find out the causes of network obstacles and perform obstacle removal operations; thereby improving the quality of network services to consolidate customers. The network check operation has the following restrictions:

1. The signaling analysis operation can only use the signaling capture decoder to manually classify and analyze each interface signaling, but with the increasing complexity of the network signaling communication protocol and the increase of the signaling amount, this method is used. When signaling tracking operations, it is difficult for personnel to quickly find out the complete signaling process tracking and then make obstacles.

2. Network maintenance personnel lack the efficient obstacle detection analysis and notification tools when conducting network maintenance, and cannot grasp the network operation status at the first time.

It can be seen that there are still many shortcomings in the above-mentioned methods of use, which is not a good design, but needs to be improved.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally succeeded in researching and developing this map. Network barrier notification system and anomaly analysis methods.

The object of the present invention is to provide a map-type network obstacle notification system and anomaly analysis method, which is to improve commercial software only for network signaling tracking, and it is difficult to provide increasingly difficult network detection and analysis and notification work. A map-type network obstacle notification system and anomaly analysis method for achieving the above object aims to use the front-end device to perform network interface capture and decoding, and the back-end device performs abnormal analysis of each interface signaling to achieve The map mode displays the results of abnormal signaling analysis and notification of obstacles. The method comprises the following steps: using a signaling capture decoder installed in a network equipment room to perform signal acquisition and decoding of each interface of the network, and the decoded signaling is analyzed by using an abnormal signaling analyzer for abnormality of signaling, The results of each interface signaling analysis are obtained, and finally, the analysis result of the abnormal signaling analyzer and the obstacle notification are displayed by the map obstacle notification device.

The map type network obstacle notification system and the abnormality analysis method provided by the invention have the following advantages when compared with other conventional technologies:

1. When performing the abnormal signaling analysis, the present invention automatically analyzes the signaling process into a circuit-switched and packet-switched domain abnormal registration procedure analysis event and anomaly according to the world standard such as 3GPP and IETF, the network device communication protocol communication process and related information. Authentication parameter program analysis event, abnormal SM MO/MT program analysis event, abnormal Voice MO/MT program analysis event, abnormal DNS program analysis event, abnormal IP program analysis event and other abnormal program analysis events, so it can be more complete Signaling analysis results.

2. When the invention performs abnormal rate statistics, it has an automatic calculation of the telecommunications industry to which the inbound user belongs. The abnormality rate of the circuit-switching domain registration procedure, the abnormality rate of the registration procedure in the packet-switching domain, the abnormality rate of the authentication parameter program, the abnormality rate of the SM MO/MT program, the abnormality rate of the Voice MO/MT program, and the abnormality of the DNS program The rate, the IP program abnormal rate and other program exception rate functions, so it is possible to clearly understand the abnormal rate of the network operators.

3. When the present invention displays the abnormal rate in a map manner, it has an automatic display of the abnormal rate of each operator in each program on the map in order of high and low, and a colored highlight, symbol or number on the map where the telecommunications operators are located. Wait to show. If the abnormal rate of the operator is higher than the setting threshold, in addition to the color point, symbol or digital color change, an alarm window will appear, which will list the telecommunications operators who have an abnormality, and will issue an alarm sound and notify the maintenance personnel by SMS. Time knows that there are obstacles in the network.

4. The present invention uses the map to perform the abnormal signaling advanced analysis, selects the highlights, symbols or numbers corresponding to the telecommunications operators on the map, and can query the user, the reason, the communication flow and related information of the abnormality, so that the maintenance personnel can Easy to fully grasp the network status.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

The network of the present invention may be a mobile network, a roaming network thereof and a fixed network, etc., wherein the mobile network may include a Global System for Mobile Communication (GSM) system and a radio service system (General Packet). Radio Service, GPRS) and Universal Mobile Telecommunication System (UMTS), etc. This patent uses the front-end network interface signaling capture and decoder and back-end abnormal signaling analyzer and map-type obstacle notifier. The combination is to achieve the purpose of notifying the obstacles by map and presenting the results of the signaling analysis.

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. Hereinafter, the present invention will be further described with reference to the accompanying drawings:

Please refer to FIG. 1 , which is a system architecture diagram of a map type network obstacle notification system and anomaly analysis method, wherein the mobile network and its roaming network and fixed network 11 are objects that can be captured by the present invention. The signaling (Signalling) capture decoder 21, the abnormal signaling analyzer 22, and the map-type obstacle notifier 23 are constituent elements of the present invention. After the signaling capture decoder 21 retrieves and decodes the interface signaling 31 in the mobile roaming network 11, the decoded interface signaling 32 is transmitted to the abnormal signaling analyzer 22, and the abnormal signaling analyzer 22 executes the abnormal signal. The signaling analysis result 33 is obtained after the analysis operation, and finally the map-type obstacle notifier 23 uses the map to display the abnormal signaling analysis result and the obstacle notification 34.

Referring to FIG. 2, it is a flowchart of operation of a map type network obstacle notification system and anomaly analysis method. After the abnormal signaling analyzer 22 identifies the interface to which each interface signaling has been decoded, First, the grouping function is performed by each interface signaling grouping module 22a-22e in the abnormal signaling analyzer 22, and then the grouped signaling is sent to the abnormal signaling analysis module 22f to perform signaling analysis, and then the abnormal rate calculation mode is performed. The 22g group calculates the abnormal rate of each operator of each program, and then the abnormality rate display module 231 in the map obstacle notifier 23 displays the abnormal rate of each operator in each program on the map in descending order, when the abnormal rate exceeds the alarm threshold. The obstacle alarm module 232 displays the program and the operator in the independent alarm window, and sends an alarm message and an alarm sound. Finally, the abnormal signaling advanced analysis module 233 allows the maintenance personnel to directly query the map for an abnormality. User, reason, communication process and related information.

Please refer to FIG. 3 , which is a coverage interface diagram of a map type network obstacle notification system and anomaly analysis method. The mobile network is configured by a Home Public Land Mobile Network (HPLMN). The left half of the left picture is one of the land mobile phone network rooms, the right half is another computer room of the same land mobile phone network, and the mobile roaming network is the land mobile phone network and roaming network. The Mobile Public Land Mobile Network (VPLMN) consists of a mobile network and its roaming network and fixed network coverage interface, including: 1. Mobile Switching Center (MSC) and home location recorder (Home Location Register, HLR) C interface, suitable for mobile networks and their roaming networks; 2. D location between Visitor Location Register (VLR) and home location recorder, for mobile networks Road and its roaming network; 3. The E interface between the mobile switch and the Short Message Center (SMSC), suitable for mobile networks and their roaming networks; 4. Public Switched Telephone Network (PSTN) interface between mobile switch and mobile switch, suitable for mobile networks and their roaming networks; 5. Integrated Serving GPRS Support Node (SGSN) The Gr interface with the home location recorder is suitable for mobile networks and their roaming networks. 6. Integrate the DNS interface between the wireless service service node and the Domain Name System Server (DNS Server). The DNS interface between the naming system server and the domain naming system server is applicable to the mobile network and its roaming network. 7. Integrating the divided wireless service service node and the integrated GPRS support node (GGSN) Gn/Gp interface, where Gn is suitable for mobile networks, Gp is suitable for mobile roaming networks; and 8. PSTN interface between public telecommunication network switches and public telecommunication network switches, suitable for fixed networks.

Referring to FIG. 4, it is a module diagram of an abnormality signaling analyzer 22 of a map type network obstacle notification system and anomaly analysis method, which is a signaling grouping module of each interface, and an abnormal signaling analysis. The module 22f and the abnormal rate calculation module 22g, wherein each interface signaling grouping module comprises a C/D/E/Gr interface signaling grouping module 22a (for mobile networks and roaming networks), and a PSTN interface letter The grouping module 22b (for mobile networks and their roaming networks and fixed networks), the DNS interface signaling grouping module 22c (for mobile networks and their roaming networks), and the Gn/Gp interface signaling grouping module Group 22d (for mobile networks and their roaming networks), D and PSTN interface data link module 22e (for mobile networks and their roaming networks). The functions of each module are described as follows: 1. C/D/E/Gr interface signaling grouping module 22a: responsible for performing C/D/E/Gr interface signaling grouping function, and its signaling grouping rule is to identify the same origin transaction. Code (Originating Transaction Identifier, OTI)/Destination Transaction Identifier (DTI)/Originating Point Code (OPC)/Destination Point Code (DPC) C/D/E /Gr signaling is classified into the same group and constitutes a C/D/E/Gr basic event (Event), which includes at least the occurrence time, the program name, and the International Mobile Subscriber Identity (IMSI). Mobile Subscriber ISDN Number (MSISDN), Signalling Connection Control Part (SCCP) Calling Address Signals, Signal Connection Control Layer Called Address Signals (Called) Address Signals), SMS center number, Roaming Address Signal and reason for program disconnection; 2. PSTN interface signaling grouping module 22b: responsible for performing PSTN interface signaling grouping function, Let the grouping rule classify the same circuit identification code (CIC)/OPC/DPC PSTN signaling into the same group and form a PSTN basic event, including at least the occurrence time, program name, and calling Calling Party Number, Called Party Number, and reason for program disconnection; 3. DNS interface signaling grouping module 22c: responsible for performing DNS interface signaling grouping function, and its signaling grouping rule is The DNS signaling of the same Transaction Identifier (TI) is classified into the same group and constitutes a DNS basic event, which includes at least the occurrence time, the program name, the query name (Query Name), and the IP source address ( IP Source Address), IP destination address and program disconnection reasons, etc. 4. Gn/Gp interface signaling grouping module 22d: responsible for performing Gn/Gp interface signaling grouping function, signaling grouping The rule is to classify the Gn/Gp signaling of the same Tunnel Endpoint Identifier (TEID) into the same group and form a Gn/Gp basic event, which includes at least the occurrence time, the program name, and the country. Information such as mobile subscriber ID, mobile subscriber's telephone number, IP source address, IP destination address, Access Point Name (APN), Quality of Service (QoS), and reason for program disconnection; 5. D and PSTN interface data link module 22e: responsible for linking the data of the same user on the D and PSTN faces and forming the same signaling behavior group, the connection rule is to reply the same interface interface Provide Roaming Number (Acknowledge) message The signaling of the roaming address signal and the called number in the PSTN interface Initial Address Message (IAM) is classified into the same group and constitutes a D/PSTN composite event, and the event includes at least D basic event and PSTN basic event related information; 6. Abnormal signaling analysis module 22f: Please refer to Figure 5, the abnormal signaling analysis module is based on C/D/E/Gr basic events, PSTN basic events, DNS The basic event, the Gn/Gp basic event and the D/PSTN composite event are subjected to signaling analysis, and include a registration program analysis module 221, an acquisition authentication parameter program analysis module 222, a short message program analysis module 223, a voice program analysis module 224, The DNS program analysis module 225 obtains the IP program analysis module 226 and other program analysis modules 227. Each program analysis module is described as follows: a. Registered program analysis module 221: The registration program includes a Circuit-Switched Domain registration program and a Packet-Switched Domain registration program, wherein the circuit exchange domain registration program It consists of the Update Location program of the D basic event, and the packet exchange domain registration procedure consists of the Update GPRS Location program of the Gr basic event. The registration program analysis module 221 determines that the registration program belongs to a normal or abnormal program analysis event according to all the information in the Update Location and Update GPRS Location programs and related information in the message, wherein the normal registration program analysis event is defined as the registration program is 3GPP. The complete process defined by the standard or the user equipment (UE) cannot complete the registration procedure, but the reasons for the inability to complete are not caused by network device operation, communication protocol communication or network abnormality, such as Roaming Not Allowed and Unknown Subscriber; The abnormal registration procedure analysis event is unable to complete the registration process, but the reason for the failure to complete is caused by network device operation, communication protocol communication or network abnormality, such as Unexpected Data Value, System Failure, Data Missing, and not responding to Update Location or Update. GPRS Location reply and so on. Since the Update Location and Update GPRS Location programs have information corresponding to the international mobile subscriber identity and the mobile subscriber's telephone number, the registration procedure analysis module 221 will automatically record the corresponding application for other modules; b. Obtain the authentication parameter program analysis module. Group 222: Consists of the Send Authentication Information program for D basic events. Obtaining the authentication parameter The program analysis module 222 determines, according to all the messages in the Send Authentication Information program and the related information in the message, that the obtained authentication parameter program belongs to a normal or abnormal program analysis event, wherein the normal acquisition of the authentication parameter program analysis event is defined as the acquisition. The authentication parameter program is a complete process defined by the 3GPP standard or the user terminal device cannot complete the process of obtaining the authentication parameter, but cannot be completed due to non-network device operation, communication protocol communication or network abnormality, such as Unknown Subscriber, etc.; The authentication parameter program analysis event is unable to complete the process of obtaining the authentication parameter, but the reason for the inability to complete is the network device operation, communication protocol communication or network abnormality, such as System Failure and non-response to the Send Authentication Information reply; c. The analysis module 223 is composed of an MO Forward Short Message program of the E basic event and an MT Forward Short Message program. The short message program analysis module 223 determines whether the news program is a normal or abnormal program analysis event according to all the messages in the MO Forward Short Message and the MT Forward Short Message program, and the normal short message program analysis event is defined as the newsletter. The program is a complete process defined by the 3GPP standard or the user terminal device cannot complete the SMS program, but cannot be completed due to non-network device operation, communication protocol communication or network anomaly, such as Absent Subscriber, SM-Delivery Failure, Unidentified Subscriber and Subscriber Busy For MT-SMS, etc.; and the anomaly SMS program analysis event is unable to complete the SMS program, but can not be completed due to network device operation, communication protocol communication or network abnormalities, such as System Failure, Short Term Denial and Respond to MO Forward Short Message or MT Forward Short Message reply. The MT Forward Short Message program belongs to Short Message Mobile Terminated (SM MT), and the MO Forward Short Message can be classified into Short Message Mobile Originated (SM MO) and SM MT according to TP Message Type Indicator (TP-MPI). When TP-MPI is SMS-SUBMIT or SMS-COMMAND is SM MO, if TP-MPI is SMS-DELIVER, it is SM MT; d. Voice program analysis module 224: Provide Roaming Number program of D basic event and PSTN basic event ISDN User Part (ISUP) program. The voice program analysis module 224 determines that the voice program belongs to a normal or abnormal program analysis event according to the information in the Provide Roaming Number and the ISDN user program, and the normal voice program analysis event is defined as the voice program. The complete process defined by the 3GPP standard or the user terminal device cannot complete the voice program, but the reason for the inability to complete is not caused by network device operation, communication protocol communication or network abnormality, such as Normal-unspecified, No answer from user, No user responding, User busy, Subscriber absent and Absent Subscriber, etc.; abnormal voice program analysis events are unable to complete the voice program, but can not be completed due to network device operation, communication protocol communication or network abnormalities, such as Temporary failure, Recovery on timer Expiry, Interworking, unspecified, Protocol error, unspecified, Resource unavailable-unspec., Destination out of order, No circuit available, No Roaming Number Available, and System Failure. If the ISDN user program has a corresponding Provide Roaming Number program, it is classified as Voice MT; otherwise, it is Voice MO. Since the International Mobile Subscriber ID and the mobile user's telephone number correspond to the information in the Provide Roaming Number program, the voice program analysis module 224 automatically records the corresponding application for other modules; e. DNS program analysis module 225: by DNS The basic query DNS query program consists of. The DNS program analysis module 225 determines that the DNS program belongs to a normal or abnormal program analysis event according to all the information in the DNS program and related information in the message, wherein the normal DNS program analysis event is defined as the complete process defined by the IETF standard. Or the user terminal device cannot complete the process of obtaining the authentication parameter, but the reason for the inability to complete is not caused by the operation of the network device, communication protocol, or network abnormality, such as Name Error (3), Not Implemented (4), and Format error (1). [When the Queries type is A6 (IPv6 address with indirection) or AAAA (IPv6 address)]; the abnormal DNS program analysis event is unable to complete the DNS program, but the reason for the inability to complete is the network device operation, communication protocol communication or network. Path abnormality, such as Format error (1) [When Queries type is non-A6 and AAAA] and not responding to DNS reply, etc.; f. Obtain IP program analysis module 226: composed of Gn/Gp basic event Create PDP Context program . The obtained IP program analysis module 226 determines, according to all the information in the Create PDP Context program and related information in the message, that the obtained IP program is a normal or abnormal program analysis event, wherein the normal acquisition of the IP program analysis event is defined as the acquisition of the IP program. The complete process defined by the 3GPP standard or the user terminal device cannot complete the IP procedure, but the reason for the inability to complete is caused by non-network device operation, communication protocol communication or network abnormality, such as User authentication failed (209) and APN access denied; The abnormal IP file analysis event is unable to complete the IP program, but the reason for the inability to complete is network device operation, communication protocol communication or network abnormality, such as No resources available (199) and no response to Create PDP Context reply. And g. Other program analysis module 227: consists of programs such as non-Update Location, Update GPRS Location, Send Authentication Information, MO Forward Short Message or MT Forward Short Message in the C/D/E/Gr basic event. The other program analysis module 227 determines that the other program belongs to a normal or abnormal program analysis event according to all the messages in the other program and related information in the message, wherein the normal other program analysis event is defined as the complete process defined by the 3GPP standard. Or the user terminal device cannot complete other programs, but the reason for the inability to complete is not caused by the operation of the network device, the communication protocol communication or the network abnormality; and the other program analysis events are unable to complete other programs, but the reason for the failure to complete is the network. Path device operation, communication protocol communication or network abnormality; and 7. abnormal rate calculation module 22g: Referring to FIG. 5, the abnormal rate calculation module performs abnormal rate calculation according to the analysis result of the abnormal signaling analysis module 22f, and each The abnormal rate of each telecom operator is defined as: the abnormal rate of each operator in each program = the abnormality analysis event of each telecommunication industry in each program within a certain period of time / the normal and abnormal program analysis events of all the operators of each program

The roaming user can distinguish between the outbound user who roams to the foreign carrier of the cost network user and the inbound user who roams to the local network by the foreign carrier.

The inbound/outbound user program exception rate is described as follows: a. Registered program exception rate (Inbound, Outbound): When the inbound user performs the circuit switched domain/package exchange domain registration procedure, the Update Location/Update GPRS Location request message is the guest of the network. The location recorder/integrated packetized wireless service service node sends the home location record to the foreign carrier: on the contrary, the Outbound user performs the circuit exchange field/package exchange domain registration procedure when the Update Location/Update GPRS Location request message is sent by the foreign telecommunications The customer's guest location recorder/integrated and encapsulated wireless service service node sends the home location recorder to the network, and then according to the abnormal rate The definition can calculate the abnormality rate of the registration procedure of the carrier of the inbound user and the carrier of the outbound user; b. Obtain the abnormality rate of the authentication parameter program (Inbound, Outbound): the Send Authentication Information request message when the inbound user performs the authentication procedure is The guest location record of the network is sent to the foreign carrier's home location recorder; otherwise, the Outbound user performs the authentication procedure when the Send Authentication Information request message is sent to the home location of the network by the foreign carrier's guest location recorder. The logger can calculate the exception rate of the authentication parameter program of the carrier of the inbound user and the carrier of the outbound user according to the abnormality rate definition; c. the abnormality rate of the short message program (Inbound, Outbound): when the inbound user executes the SM MO program The MO Forward Short Message (TP-MPI is SMS SUBMIT or SMS COMMAND) request message is sent to the SMS center of the foreign carrier by the mobile switch of the local network; otherwise, the MO Forward Short Message request message when the Outbound user executes the SM MO program is Foreign telecom operators' actions Change to the SMS center of this website. When the inbound user executes the SM MT program, the MO Forward Short Message (TP-MPI is SMS DELIVER) or MT Forward Short Message request message is sent to the mobile switch of the local network by the foreign carrier's SMS center; otherwise, the Outbound user executes the SM MT. The MO Forward Short Message or MT Forward Short Message request message is sent to the mobile switch of the foreign carrier by the SMS center of the website. According to the abnormal rate definition, the SM MO/MT program abnormal rate of the carrier of the inbound user and the carrier of the outbound user can be calculated; d. The abnormality rate of the voice program (Inbound, Outbound): the start of the inbound user when executing the Voice MO program The address information is sent to the mobile switch of the foreign carrier by the mobile switch of the network; otherwise, the start address message when the Outbound user executes the Voice MO program is sent to the mobile switch of the local network by the mobile switch of the foreign carrier. . The inbound user's start address message when the Voice MT program is executed is sent to the mobile switch of the local network by the foreign carrier's mobile switch; otherwise, the outbound user's start address message when the Voice MT program is executed is the mobile switch of the local network. The mobile switch sent to the foreign telecom operators can calculate the abnormality rate of the Voice MO/MT program of the carrier of the inbound user and the carrier of the outbound user according to the abnormal rate definition; e. The abnormal rate of the DNS program (Inbound, Outbound): The DNS query request message when the inbound user executes the DNS program is sent to the domain naming system server of the foreign carrier by the domain naming system server of the network; otherwise, the DNS query request message when the outbound user executes the DNS program is by the foreign telecommunications The domain naming system server of the industry is sent to the domain naming system server of the network, and then the abnormality rate definition can be used to calculate the abnormality rate of the DNS program of the carrier of the inbound user and the operator of the outbound user; f. Obtaining the abnormal rate of the IP program (Inbound, Outbound): Create a PDP Context request message when an inbound user executes an IP program. By this The integrated wireless service node of the network is sent to the integrated telecommunications wireless service gateway node of the foreign telecom operator; otherwise, the Create PDP Context request message when the Outbound user performs the IP procedure is integrated by the foreign telecommunications provider. The integrated packetized wireless service gateway node sent to the network, and then according to the abnormal rate definition, can calculate the IP program abnormal rate obtained by the carrier of the inbound user and the carrier of the outbound user; and g. other program abnormal rate (Inbound, Outbound ): When the inbound user executes other programs, the request message is sent to the device of the foreign carrier by the device of the local network; otherwise, the request message sent by the outbound user to other programs is sent to the device of the network by the device of the foreign carrier.

The telecommunication industry and the outbound user's telecommunication industry are judged by the inbound user: Inbound user registration/acquisition parameter/SM MO program belongs to the carrier and the outbound user SM MT program is located in the telecom operator. The address signal is obtained by the Country Code (CC) and the National Destination Code (NDC). The outbound user registration/acquisition parameter/SM MO program is located in the carrier and the inbound user SM MT program belongs to the carrier. The calling address signal of the connection control layer is obtained by matching the country code with the domestic area code. The international mobile subscriber identification code can be obtained by using the information of the international mobile subscriber identity of the registration program analysis module 221 and the voice program analysis module 224 and the information of the mobile subscriber's telephone number in conjunction with the telecommunications industry information of the inbound subscriber and the outbound subscriber. Mobile user phone number and The telecom industry in which the inbound user belongs to the telecom industry/outbound user; this corresponding information will be applied to other modules. The carrier of the inbound user Voice MO program/outbound user Voice MO program can be obtained by the calling number in the start address message and the corresponding information. The carrier of the inbound user Voice MT program belongs to the carrier/outbound user Voice MT program. The operator can obtain the international mobile subscriber identity code, the mobile subscriber's telephone number and the corresponding information obtained in the voice program analysis module 224. The inbound user DNS/telecom operator with the IP program and the outbound user DNS/acquisition of the IP program can be obtained by the destination IP address and the carrier to which the IP address belongs.

Please refer to the attachment, which is a module diagram included in the map type obstacle notification system and the abnormality analysis method of the present invention, which is an abnormality rate display module 231 and an obstacle alarm module 232, respectively. The abnormal signaling advanced analysis module 233. The function of each module is described as follows: 1. The abnormality rate display module 231: according to the abnormality rate calculation module 22g, the abnormality rate of the circuit switching domain registration procedure and the registration of the switched exchange domain can be obtained by the carrier of the inbound user and the carrier of the outbound user. Program abnormality rate, acquisition of authentication parameter program abnormal rate, SM MO/MT program abnormal rate, Voice MO/MT program abnormal rate, DNS program abnormal rate, acquisition of IP program abnormal rate, and other program abnormal rate. As shown in Figure 6, the abnormal rate of each program on the map has a display window. The abnormal rate of each operator in the program is displayed in the window in addition to the height, and can be displayed on the map with colored highlights, symbols or numbers. The location of the various telecommunications operators; 2. Obstacle alarm module 232: The obstacle alarm module can perform obstacle notification according to the result of the abnormality rate display module 231 in a map manner, and the maintenance personnel can set the alarm threshold by itself, for example, 3%, when the abnormal rate of a certain procedure of the telecommunication operator In the threshold, the highlights, symbols or numbers will be shown in green; otherwise, the highlights, symbols or numbers will turn red, and another independent alarm window will appear on the map, which will list the carriers who have anomalies and sound an alarm. And inform the maintenance personnel by SMS to achieve the purpose of notification obstacles; and 3. Abnormal signaling advanced analysis module 233: The abnormal signaling advanced analysis module allows the maintenance personnel to easily grasp the status of the roaming network in a gradual manner. If the operator wants to inquire about the detailed information of the abnormal player, you can select the location of the corresponding spot, symbol or number on the map. A new window will appear on the map. This window will show all the abnormal reasons of the carrier. And proportion. If you select the corresponding position next to the abnormal proportion in the window, another new window will appear, in which all users causing the cause can be seen. If you select the corresponding location next to a user in the window, you can know the related events of the user's cause of the exception. If you select the corresponding position on an event, another new window will appear, and the communication flow of the event will appear in the window.

The above is only the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention; the modifications and equivalents of the present invention are intended to be included in the scope of the present invention without departing from the spirit and scope of the invention. Within the scope of protection.

11‧‧‧Mobile networks and their roaming and fixed networks

21‧‧‧ Signaling Capture Decoder

22‧‧‧Exception Signal Analyzer

23‧‧‧Map-type obstacle informer

22a‧‧‧C/D/E/Gr interface signaling grouping module

22b‧‧‧PSTN interface signaling grouping module

22c‧‧‧DNS interface signaling grouping module

22d‧‧‧Gn/Gp interface signaling grouping module

22e‧‧D and PSTN interface data link module

22f‧‧‧Abnormal Signaling Analysis Module

22g‧‧‧ abnormal rate calculation module

31‧‧‧Interface signaling

32‧‧‧Decoded interface signaling

33‧‧‧Signal analysis results

34‧‧‧ Displaying abnormal signaling analysis results and conducting notification of obstacles

221‧‧‧Registration Analysis Module

222‧‧‧Get certified parameter program analysis module

223‧‧‧Scheme Program Analysis Module

224‧‧‧Voice Program Analysis Module

225‧‧‧DNS program analysis module

226‧‧‧Get IP program analysis module

227‧‧‧Other program analysis modules

231‧‧‧Exception rate display module

232‧‧‧ obstacle warning module

233‧‧‧Anomaly Signaling Advanced Analysis Module

1 is a system architecture diagram of a map type network obstacle notification system and anomaly analysis method according to the present invention; 2 is a flow chart of operation of a map type network obstacle notification system and anomaly analysis method according to the present invention; FIG. 3 is a coverage interface diagram of a map type network obstacle notification system and anomaly analysis method according to the present invention; 4 is a map type network obstacle notification system and anomaly analysis method abnormal signaling analyzer and its internal interface signaling grouping module diagram; FIG. 5 is a map type of the present invention The abnormality signaling analyzer of the network obstacle notification system and the abnormal analysis method and the internal abnormal signaling analysis module and the abnormal rate calculation module diagram; and the accessory is a map type network obstacle notification system of the present invention The internal module diagram of the map obstacle notification device for the anomaly analysis method.

11‧‧‧Mobile networks and their roaming and fixed networks

21‧‧‧ Signaling Capture Decoder

22‧‧‧Exception Signal Analyzer

23‧‧‧Map-type obstacle informer

31‧‧‧Interface signaling

32‧‧‧Decoded interface signaling

33‧‧‧Signal analysis results

34‧‧‧ Displaying abnormal signaling analysis results and conducting notification of obstacles

Claims (14)

A map-type network obstacle notification system includes: a signaling capture decoder that extracts and decodes multi-party interface signaling of the network and generates a set of decoded interface signaling; an abnormal signaling analysis And connecting the signaling capture decoder and receiving the set of decoded interface signaling, the exception signaling analyzer further comprising an interface signaling group module, an abnormal signaling analysis module and an abnormal rate calculation The module, the decoded interface signaling is first grouped into a set of interface basic events by using the identification code in the interface signaling group module, and then the abnormal signaling analysis module performs the message according to the basic events of the series interface. A program signaling abnormality analysis, and generating a set of analysis results, the abnormal rate calculation module further calculating a set of abnormal rates according to the set of analysis results; a map type obstacle notifier, connecting the abnormal signaling analyzer, the The map obstacle notification device further includes an abnormality rate display module, an obstacle alarm module and an abnormal signaling advanced analysis module, and the abnormality rate display module displays the abnormality rate of the group in the order of high and low In the figure, when the abnormal rate of the abnormality rate exceeds an alarm threshold, the obstacle alarm module displays the abnormal rate exceeding the alarm threshold in the independent alarm window, and sends an alarm message and an alarm sound. The abnormal signaling advanced analysis module is configured to enable the maintenance personnel to directly query the map for information related to the abnormal rate exceeding the alarm threshold; wherein the abnormality rate is defined as: δ for all programs of the abnormal rate of carriers, carriers for a program analysis abnormal events within each program period α, and β all carriers for the program of normal and abnormal event analysis program, and the set abnormal rate system comprising Inbound The abnormality rate of the registration procedure in the circuit-switched domain of the telecommunications carrier and the outbound user of the user to which the user belongs, the abnormality rate of the registration procedure in the packet exchange domain, the abnormality rate of the obtained authentication parameter program, the abnormality rate of the SM MO/MT program, the abnormality rate of the Voice MO/MT program, DNS program exception rate, IP program exception rate and other program exception rate. The map type network obstacle notification system according to claim 1, wherein the interface signaling grouping module further comprises a C/D/E/Gr interface signaling grouping module and a public telecommunication network (Public). Switched Telephone Network (PSTN) interface signaling grouping module, Domain Name System (DNS) interface signaling grouping module, a Gn/Gp interface signaling grouping module, and a D/PSTN interface data linking module The identification code of the C/D/E/Gr interface signaling grouping module is an Originating Transaction Identifier (OTI), a Destination Transaction Identifier (DTI), a starting point code. (Originating Point Code, OPC) or Destination Point Code (DPC), and the interface basic event generated by the C/D/E/Gr interface signaling grouping module includes the occurrence time, the program name, and the international mobile International Mobile Subscriber Identity (IMSI), Mobile Subscriber ISDN Number (MSISDN), Signalling Connection Control Part (SCCP) Caller Address Signal (Call) Ing Address Signals), signal connection control layer caller address signal (Called Address Signals), SMS center number, roaming address signal (Roaming Address Signal) and program disconnection reasons, etc. The identification code of the PSTN interface signaling group module is Circuit Identity Code (CIC), OPC or DPC, and the basic events generated by the PSTN interface signaling grouping module include the occurrence time, the program name, and the main The calling number (Calling Party Number), the called number (Called Party Number), and the reason for the disconnection of the program, and the identification code of the DNS interface signaling grouping module is a Transaction Identifier (TI), and the DNS interface The interface basic event of the signaling grouping module includes the occurrence time, the program name, the Query Name, the IP Source Address, the IP Destination Address, and the reason for the program disconnection. The identification code of the Gn/Gp interface signaling grouping module is a Tunnel Endpoint Identifier (TEID), and the interface basic event of the Gn/Gp interface signaling grouping module includes an occurrence time, a program name, and International Mobile Subscriber ID, Mobile User Phone Number, IP Source Address, IP Destination Address, Access Point Name (APN), Quality of Service (QoS), and Program Shutdown The reason is that the ID of the D/PSTN interface data link module is the Roaming Address Signal and the PSTN interface start address message in the Enable Roaming Number Acknowledge message. The corresponding called number (Called Party Number) in the IAM), and the interface basic event of the D/PSTN interface data link module is related information of the D basic event and the PSTN basic event. The map type network obstacle notification system according to claim 1, wherein the abnormal signaling analysis module further comprises a registration program analysis module, an authentication parameter program analysis module, and a short message program analysis module. Group, a voice program analysis module, a DNS The program analysis module, an IP program analysis module and an other program analysis module, and the abnormal signaling analysis module determines that the program belongs to a normal according to all information in the basic event program of each interface and related information in the message. A program analysis event or an abnormal program analysis event, wherein the normal program analysis event is a complete process or user equipment (User Equipment, UE) conforming to the definition of the World Standards Organization (3GPP, IETF), although the program cannot be completed, but cannot The reason for the completion is caused by non-network device operation, communication protocol communication or network abnormality, and the abnormal program analysis event is unable to complete the program, but the reason for the inability to complete is network device operation, communication protocol communication or network abnormality. For example, the map type network obstacle notification system described in claim 3, wherein the registration program analysis module performs analysis according to the D/Gr basic event Update Location/Update GPRS Location program, and the registration program analysis module The normal registration procedure analyzes the cause of the incident as Roaming Not Allowed and Unknown Subscriber, and the registration procedure analysis module's abnormal registration procedure analyzes the cause of the event as Unexpected Data Value, System Failure, Data Missing, Unresponsive Update Location, or Update GPRS. The location reply, and the obtained authentication parameter program analysis module performs analysis according to the D basic event Send Authentication Information program, and the reason for obtaining the authentication parameter program analysis module is that the normal acquisition authentication parameter program analysis event is Unknown Subscriber, and the acquisition is performed. Authentication parameter analysis module exception acquisition authentication parameter program analysis event includes System Failure and non-response Send Authentication Information response, the SMS program analysis module is based on E basic event MO Forward Short Message The program and the MT Forward Short Message program perform analysis, and the reason for the normal short message program analysis event of the short message program analysis module is Absent Subscriber, SM-Delivery Failure, Unidentified Subscriber and Subscriber Busy For MT-SMS, and the like. The module's abnormal newsletter analyzes the cause of the event as System Failure, Short Term Denial, and does not respond to the MO Forward Short Message or MT Forward Short Message reply. The voice program analysis module is based on the D basic event's Provide Roaming Number program. Perform analysis with the ISDN User Part (ISUP) program of the PSTN basic event. The reason for the normal voice program analysis event of the voice program analysis module is Normal-unspecified, No answer from user, No user responding, User busy. , Subscriber absent and Absent Subscriber, etc., and the reason for the abnormal voice program analysis event of the voice program analysis module is Temporary failure, Recovery on timer expiry, Interworking, unspecified, Protocol error, unspecified, Resource unavailable-unspec., Destination out Of Order, No circuit available, No Roaming Number Available, and System Failure. The DNS program analysis module performs analysis based on the DNS basic event DNS program. The reason for the normal DNS program analysis event of the DNS program analysis module is Name Error (3). ), Not Implemented(4), Format error(1) [When the Queries type is A6 (IPv6 address with indirection) or AAAA (IPv6 address)], and the reason for the abnormal DNS program analysis event of the DNS program analysis module is Such as Format error (1) [When the Queries type is non-A6 and AAAA] and does not respond to the DNS reply, the IP program analysis module is based on the Gn/Gp basic event. The Create PDP Context program performs analysis, and the reason for obtaining the IP program analysis event of the IP program analysis module is User authentication failed (209) and APN access denied, etc., and the IP program analysis module obtains the IP program of the abnormality of the IP program analysis module. The reason for analyzing the event is No resources available (199) and does not respond to the Create PDP Context reply. The other program analysis modules are based on the non-Update Location, Update GPRS Location, and Send Authentication Information in the C/D/E/Gr basic events. , MO Forward Short Message and MT Forward Short Message program execution analysis. The map type network obstacle notification system according to claim 1, wherein the abnormal rate display module displays the calculation result of the abnormal rate calculation module on the map, and each abnormal rate has a display window. And the abnormality rate display module sorts the abnormality rate of the group to be displayed on the map with one of the bright spots, a symbol or a number. For example, in the map type network obstacle notification system described in claim 5, wherein the abnormal rate in the abnormality rate of the group exceeds the alarm threshold, the bright spot, the symbol or the number is changed, and the map is An independent alarm window appears, the independent alarm window lists relevant information exceeding the abnormal rate of the alarm threshold, and sends the alarm message or alarm sound. The map type network obstacle notification system according to claim 1, wherein the abnormal signaling advanced analysis module is for the operator to select the bright spot, the symbol or the position of the number on the map, local A new window will appear on the map to select the highlight on the map, the symbol or the position of the number, and the new window displays a message indicating the abnormal rate exceeding the alarm threshold. A map-type network obstacle notification anomaly analysis method includes at least the following steps: decoding by a signaling capture decoder multi-party interface signaling of the network, and generating a set of decoded interface signaling; An abnormal signaling analyzer receives the set of decoded interface signaling, and the set of decoded interface signaling is grouped into a set of interface basic events via an identification code in one of the interface signaling clustering modules of the abnormal signaling analyzer; Receiving, by an abnormal signaling analysis module of the abnormal signaling analyzer, a message of the series of basic event events, and performing a program signaling abnormality analysis to generate a set of analysis results; and the abnormal signaling signaling device An abnormal rate calculation module receives the analysis result of the group and calculates a set of abnormal rate; the abnormal rate display module of a map type obstacle notification device receives the abnormal rate of the group, and the abnormal rate display module The abnormal rate of the group is displayed on the map in high order; when the abnormal rate of the abnormal rate exceeds an alarm threshold, one of the obstacle warning modules in the map obstacle notification device will exceed The abnormality rate of the alarm threshold is displayed in the independent alarm window, and an alarm message and an alarm sound are sent; and an abnormality signaling advanced parameter of the map obstacle notification device is used to query the abnormal rate exceeding the alarm threshold on the map. Related information; the abnormal rate is defined as: δ for all programs of the abnormal rate of carriers, carriers for a program analysis abnormal events within each program period α, and β all carriers for the program of normal and abnormal event analysis program, and the set abnormal rate system comprising Inbound The abnormality rate of the registration procedure in the circuit-switched domain of the telecommunications carrier and the outbound user of the user to which the user belongs, the abnormality rate of the registration procedure in the packet exchange domain, the abnormality rate of the obtained authentication parameter program, the abnormality rate of the SM MO/MT program, the abnormality rate of the Voice MO/MT program, DNS program exception rate, IP program exception rate and other program exception rate. For example, the method for anomaly analysis of the network type network notification notified in the application of the patent scope, wherein the interface signaling grouping module further comprises a C/D/E/Gr interface signaling grouping module and a PSTN interface. Signaling grouping module, a DNS interface signaling grouping module, a Gn/Gp interface signaling grouping module, and a D/PSTN interface data link module, the C/D/E/Gr interface signaling grouping module The identification code is an Originating Transaction Identifier (OTI), a Destination Transaction Identifier (DTI), an Originating Point Code (OPC), or a Destination Point Code (Destination Point Code). DPC), and the interface basic events generated by the C/D/E/Gr interface signaling grouping module include the time of occurrence, the program name, the International Mobile Subscriber Identity (IMSI), and the mobile subscriber's telephone number. (Mobile Subscriber ISDN Number, MSISDN), Signalling Connection Control Part (SCCP) Calling Address Signals, and Signal Connection Control Layer Called Address Signals (Called Ad) Dress Signals), the message center number, the roaming address signal and the reason for the disconnection, and the identification code of the PSTN interface signaling group module is Circuit Identity Code (CIC), OPC or DPC, and the PSTN interface signaling grouping module The basic events generated include the time of occurrence, the name of the program, the Calling Party Number, the Called Party Number, and the reason for the disconnection of the program. The identification code of the DNS interface signaling group module is the transaction. Transaction Identifier (TI), and the interface basic event of the DNS interface signaling grouping module includes the occurrence time, the program name, the query name (Query Name), the IP source address (IP Source Address), and the IP destination bit. The IP address of the IP address and the reason for the disconnection of the program, and the identification code of the Gn/Gp interface signaling group module is a Tunnel Endpoint Identifier (TEID), and the Gn/Gp interface signaling grouping mode The basic event of the group interface includes the time of occurrence, the program name, the international mobile subscriber ID, the mobile subscriber's telephone number, the IP source address, the IP destination address, the access point name (APN), and the service level (Quality). Of Service, QoS) and the reason for the disconnection of the program, and the identification code of the D/PSTN interface data link module is the roaming address letter in the Enable interface of the D interface Provide Roaming Number No. (Roading Address Signal) and the corresponding Called Party Number in the Initial Address Message (IAM) of the PSTN interface, and the basic event of the D/PSTN interface data link module is D basic. Information about events and PSTN basic events. For example, the abnormality analysis method of the map type network obstacle notification according to the application scope of the patent scope, wherein the abnormal signaling analysis module further comprises a registration program analysis module, an authentication parameter program analysis module, and a short message. a program analysis module, a voice program analysis module, a DNS program analysis module, an IP program analysis module, and an other program analysis module, and the abnormal signaling analysis module is based on each interface basic event program. All messages and related information in the message determine that the program belongs to a normal program analysis event or an abnormal program analysis event, wherein the normal program analysis event is a complete process or user terminal device conforming to the definition of the World Standards Organization (3GPP, IETF). (User Equipment, UE), although the program could not be completed, but the reason could not be completed due to non-network device operation, communication protocol communication or network abnormality, and the abnormal program analysis event could not complete the program, but the reason could not be completed. Network device operation, communication protocol communication or network anomaly. For example, the method for anomaly analysis of a map type network obstacle notification according to claim 10, wherein the registration program analysis module performs analysis according to the D/Gr basic event Update Location/Update GPRS Location program, and the registration program analyzes The normal registration procedure of the module analyzes the cause of the incident as Roaming Not Allowed and Unknown Subscriber, and the abnormality registration procedure of the registration program analysis module analyzes the event as Unexpected Data Value, System Failure, Data Missing, and does not respond to Update Location. Or Update GPRS Location reply, and the obtained authentication parameter program analysis module performs analysis according to the D basic event Send Authentication Information program, and the reason for obtaining the authentication parameter program analysis module is that the normal acquisition authentication parameter program analysis event is Unknown Subscriber, The reason for obtaining the authentication parameter program analysis module abnormality acquisition authentication parameter program analysis event includes System Failure and non-response Send Authentication Information reply, the short message program analysis module is based on E basic event MO Forward Short Message And MT Forward Short Message program execution analysis, the newsletter of the normal program analysis module program analysis newsletter The reason for the event is Absent Subscriber, SM-Delivery Failure, Unidentified Subscriber, and Subscriber Busy For MT-SMS, etc., and the reason for the abnormality of the brief program analysis module analysis event is System Failure, Short Term Denial, and In response to the MO Forward Short Message or the MT Forward Short Message reply, the voice program analysis module performs analysis based on the Provide Roaming Number program of the D basic event and the ISDN User Part (ISUP) program of the PSTN basic event. The reason of the normal speech program analysis event of the program analysis module is Normal-unspecified, No answer from user, No user responding, User busy, Subscriber absent and Absent Subscriber, etc., and the abnormal program of the speech program analysis module is analyzed. The reason is Temporary failure, Recovery on timer expiry, Interworking, unspecified, Protocol error, unspecified, Resource unavailable-unspec., Destination out of order, No circuit available, No Roaming Number Available, and System Failure. system According to the DNS basic event DNS program execution analysis, the reason for the normal DNS program analysis event of the DNS program analysis module is Name Error (3), Not Implemented (4), Format error (1) [When the Queries type is A6 (IPv6) Address with indirection) or AAAA (IPv6 address)], and the reason for the abnormal DNS program analysis event of the DNS program analysis module is such that Format error (1) [When Queries type is non-A6 and AAAA] and does not respond to DNS reply The obtained IP program analysis module performs analysis according to the Create PDP Context program of the Gn/Gp basic event, and the IP program analysis module obtains the IP program analysis event normally. The reason is User authentication failed (209) and APN access denied, etc., and the reason for obtaining the IP program analysis module for the IP program analysis event is No resources available (199) and does not respond to the Create PDP Context reply. The program analysis module performs analysis according to the non-Update Location, Update GPRS Location, Send Authentication Information, MO Forward Short Message and MT Forward Short Message programs in the C/D/E/Gr basic event. The abnormality analysis method of the map type network obstacle notification according to claim 8 of the patent application scope, wherein the abnormal rate display module displays the calculation result of the abnormal rate calculation module on the map, and each abnormal rate is There is a display window, and the abnormality rate display module sorts the abnormality rate of the group to be displayed on the map with a bright spot, a symbol or a number. For example, in the map type network obstacle notification abnormality analysis method described in claim 13, wherein the abnormal rate in the abnormality rate exceeds the alarm threshold, the bright spot, the symbol or the number is changed, and the notification is An independent alarm window will appear on the map. The independent alarm window will list relevant information of the abnormal rate exceeding the alarm threshold and issue the alarm message or alarm sound. For example, the abnormality analysis method of the map type network obstacle notification according to claim 8 of the patent application scope, wherein the abnormal signaling advanced analysis module is for the maintenance personnel to select the bright spot, the symbol or the number on the map. Location, a new window appears on the local map to select the highlight on the map, the symbol or the location of the number. The new window displays information about the abnormal rate of the alarm threshold.