TWI478530B - The method and system for ngn traffic monitoring - Google Patents

Description

New generation NGN network monitoring method and system

This patent is a traffic analysis technology for broadband networks. It is a method and system for connecting cross-network traffic, constructing a complete and comprehensive traffic flow and call status, and then intelligently communicating and analyzing. Traffic alert messages greatly reduce the burden of daily maintenance and improve the immediacy of maintenance; therefore, by accurately correlating NGN (Next Generation Network) network command and traditional fixed network SS7 (Signaling System Number 7, Signaling System No. 7) generates comprehensive service status, detects and alarms through effective screening and quantitative analysis, and displays the traffic flow display to facilitate obstacle interpretation, and can dynamically update the alarm period and level. In order to grasp the status of the overall network in a timely manner; the above is the technical characteristics of this patent.

IP (Internet Protocol Address) NGN network gradually replaces traditional TDM (Time Division Multiplexing) network; compared with traditional TDM network, IMS (IP Multimedia Subsystem, IP Multimedia) The technology of the NGN network is more diversified and complex. The SIP (Session Initiation Protocol) is the main call control protocol widely used in broadband access networks, VoIP network calls or Multimedia audio and video services are examples of SIP applications.

With the popularity of the SIP control protocol, the information analysis instruments in the workshop have mushroomed to meet the needs of the market, and the richness of its functions is self-evident. However, any new technology must always be connected to an existing network or system. For example, telecom operators use IMS technology to build NGN networks, and SIP is the call control protocol for NGN networks. However, the existing PSTN (Public Switched Telephone Network) network is still in operation. Therefore, the NGN network must be connected to the existing PSTN network; SIP Control Protocol Must be connected with the SS7 ISUP (ISDN User Part) command, ISDN is the abbreviation of Integrated Services Digital Network (ISDN), cross-network traffic tracking is enough to present a complete traffic flow. And to collect comprehensive information on the status of the traffic, to accurately identify the obstacles and determine the status of the traffic.

When tracking and analyzing call traffic across the network, the device in the room can associate the SIP and the corresponding ISUP command according to the parameters such as the calling number, the called number and the calling time to establish a heterogeneous signal connection across the network. For example, the From header, the P Asserted Identity, and the To header of the SIP are called and called, and then the ISUP Called Party Number (CdPN) and the Calling Party Number (CgPN) are used to establish a cross-network signal of a call. . However, the diversity and flexibility of broadband services creates more complex traffic, and subscriber numbers may be temporarily transcoded, crowned, or spread-numbered; the original calling or called number may be moved to other parameters. Therefore, the generally simplistic association method will miss the signal link and only connect some of the cross-network signals. The cross-network call signal that is missing the link naturally cannot be fully represented in its flow direction and state.

The general communication obstacle monitoring equipment often relies only on the error response information of the signal to present communication obstacles, and treats each call as separate and unrelated, and does not consider the continuous causal relationship between multiple calls. Therefore, when an obstacle occurs, it can only be judged with limited information, and the risk is misappropriated, and it is impossible to find out the crux of the problem. In addition, the common alarm information is mainly text messages, which has no substantial benefit for obstacle elimination; and frequent and repetitive alarms have always been criticized.

It can be seen that there are still many shortcomings in the above-mentioned methods of use, which is not a good design, but needs to be improved.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally successfully developed and completed this new generation NGN network monitoring method and system.

A new generation NGN network monitoring method and system for achieving the above object, and an inter-network communication link and traffic analysis technology is proposed. The new generation NGN network monitoring method and system proposed in this patent comprises five units: (1) ISUP signal acquisition and analysis module, (2) SIP signal acquisition and analysis module, and (3) cross-network communication. Service connection module, (4) cross-network traffic database and (5) intelligent analysis alarm function group.

First, the ISUP signal acquisition and analysis module captures the ISUP signal from the PSTN network and decodes the required parameters. The parameters include the device code (Point Code) for generating the signal, and the circuit identification code CIC (Circuit Identification Code). , signal generation time, signal type, user number, cause of circuit release (cause), etc. Then, the CIC combines all the signals of a call and analyzes the completion status and status reason of the call as an input source of the inter-network communication link module.

The SIP signal acquisition and analysis module captures the SIP signal from the NGN network and decodes the required parameters. The parameters include the signal generation time, the call identification code (Call-ID), the call end (From), and the call end (To). Request (Request), Response (Response), Originator Number (P Asserted Identity), etc. Then, all the signals of a call are combined by Call-ID and the completion status and response code of the call are analyzed as an input source of the inter-network communication connection module.

The inter-network communication link module uses ISUP and SIP signals to capture and analyze the traffic data generated by the module for multi-level inter-network communication. When the ISUP and SIP inter-network traffic are associated, the CgPN and CdPN corresponding to the ISUP signal are connected by the From and To headers of the SIP signal, and the change of the user number by the transcoding, the crowning code or the spreading code is considered. Cross-network traffic link module, incorporating more parameters to improve the association success rate, complete presentation of traffic connections and convergence of services Status is in the inter-network traffic database.

The intelligent analysis alarm module uses the cross-network traffic database as input, and through the traffic filtering function, sorts out effective traffic, which can improve the interpretation of the traffic display and increase the analysis efficiency of the traffic. In addition, for the filtered traffic, combined with the alarm information comparison, the effective warning service can be analyzed, and the traffic content is converted into an alarm parameter and stored in the alarm information database as a future reference threshold. .

The obstacle content sent to the terminal device, in addition to the text prompt, also includes the complete process of alerting the traffic to facilitate the interpretation of the obstacle. At the same time, the format and period of the alarm can be customized through the management interface, and the alarm condition is personalized. When the alarm message is received, the terminal directly responds to the modification through the interactive prompt to avoid the terminal receiving the obstacle message too frequently. repeat. In addition, as the alarm time continues, the alarm level and range will be increased in time to ensure that the obstacles are handled properly.

This patent is a new generation NGN network monitoring method and system. It proposes an inter-network communication link and traffic analysis technology to improve the efficiency of maintenance inspection by fixing the problem of the complete traffic information.

Please refer to FIG. 1. The patent includes five units: ISUP signal acquisition and analysis module 11, SIP signal acquisition and analysis module 12, inter-network communication connection module 20, inter-network communication database 30 and wisdom. Type analysis alarm module 40.

The ISUP signal acquisition and analysis module 11 and the SIP signal acquisition and analysis module 12 respectively capture, decode, and analyze the call signals from the PSTN network and the NGN network to generate respective call states and parameters required by the patent. The results generated by the ISUP signal acquisition and analysis module 11 and the SIP signal acquisition and analysis module 12 are then input to the inter-network communication link module 20.

The inter-network communication link module 20 performs multi-level ISUP and SIP signal connection The link is based on the user number (including the calling number and the called number) in the ISUP signal to compare the subscriber number (including the calling number and the called number) in the SIP signal within a reasonable time range.

Whether the calling number/called number in the ISUP signal and the calling number/called number in the SIP signal are equal or similar, and if the equal or similar user number (including the calling number) is compared within a reasonable time range And the called number), the relevance of the cross-network traffic connection is established, that is, the ISUP signal corresponds to the SIP signal.

Based on the need to route a signal or a special service, the network device transcodes, adds a code, or spreads the number of the user. The network device can reply to the user number through the internal information, but the additional monitoring device only relies on the captured signal. The transcoding, crowning code or spread code changes the user number, resulting in the inability to connect to the inter-network service. Therefore, the cross-network communication link module 20 of the present patent overcomes the connection difficulty caused by the conversion of the user number by the "include" operation, and the "include" operation is used to compare the similar user numbers.

For example, when a fixed network user who has moved into the NGN network receives a call, the original fixed exchange switch of the fixed network adds a prefix to the called number, thereby routing the ISUP signal to the NGN network, at this time in the ISUP signal. The called number seen in the prefix becomes the prefix+CdPN type. When entering the NGN network, the network device deletes the crown number of the called number. At this time, the called number seen in the SIP signal becomes the CdPN type, so the use of " Contains the "operation", the string "prefix + CdPN" contains the string "CdPN" to establish a cross-network connection relationship.

Parameters such as From, To, and request-URI (r-URI) of the SIP signal usually contain the user's phone number. P-Asserted-Identity (PA-ID) will also have a calling number. For the incoming message filled in the From header, the calling number can be provided by the PA-ID, where the From and PA-ID belong to the calling number, To And the r-URI belongs to the called number.

The phone number of the ISUP signal is in CgPN, CdPN, Called IN Number (CdIN) and other parameters. Among them, CgPN belongs to the calling number, CdPN, CdIN belongs to the called number.

For the sake of simplicity, the calling number and the called number are represented in pairs by commas, such as (CgPN, CdPN), the former is the calling number, and the latter is the called number.

In addition, the inter-network communication link module 20 performs multi-level comparison with multiple parameters that may include a user number. For example, the calling number may be in the From or PA-ID parameter, and the called number may be in the To or request-URI. Therefore, the representation method is extended to (From or PA-ID, To or r-URI), meaning (From or PA-ID, To or r-URI) stands for: (From, To), (From, r-URI) Four combinations of (PA-ID, To) and (PA-ID, r-URI).

Refer to Figure 2 for the method and procedure of the connection. The comparison information is from the ISUP signal acquisition and analysis module 11 and the SIP signal acquisition and analysis module 12.

Step 1: Step 1: Obtain and analyze a call subscriber number group (CgPN, CdPN or CdIN) of the module 11 by the ISUP signal to whether the SIP signal acquisition and analysis module 12 compares within a reasonable time range. User number group (From or PA-ID, To or r-URI). If there is a matching user number group, the connection relationship and the call status are written into the inter-network traffic database 30 for reference by the smart inter-network traffic alarm management module 40. If there is no matching user number group, proceed to step 2.

Step 2: Step 2: Compare the (CgPN, CdPN or CdIN) user number group of the ISUP signal with the (From or PA-ID, To or r-URI) user number group of the SIP signal. If there is a comparison to the included user number group, the link relationship and call status are written to the inter-network traffic database 30. If there is no comparison to the included user number group, proceed to step 3.

Step 3, Step 3: Contrary to Step 2, compare the SIP signal (From Or PA-ID, To or r-URI) Whether the user number group contains the (CgPN, CdPN or CdIN) user number group of the ISUP signal. If the matching user number group is matched, the connection relationship and the call status are written into the inter-network traffic database 30, and if the included user number group is not matched, the inter-network communication connection action is terminated.

The function program of the intelligent analysis alarm module 40 is shown in Figure 3. The traffic filtering function group 41, the traffic display function group 42, the traffic analysis function group 43, the alarm information database 44, the alarm processing function group 45, and the condition management function group 46 are included. The input is the inter-network traffic database 30 or the terminal device 50; the output is the terminal device 50. Its functions and procedures are described as follows:

(1) Traffic Filtering Function Group

The traffic filtering function group 41 mainly filters the data stored in the inter-network traffic database 30. The operation process 410 is as shown in FIG. 4, and firstly reads 30 traffic contents 411 according to the time range, for example, the first 10 minutes. The content is classified 412, and the content of the classification example can be combined according to the time of the call, the number of the call, the number of the call, the state of the call, the name of the customer, the service code, the device number, or other fields. If the target content matches 413, the message is performed. Sort 414 and pass the result to the traffic display process 420 and the traffic analysis process 430; if the target content does not match 413, continue to read the content of the cross-network traffic database 30 according to the time range.

(2) Traffic display function group

The operation process 420 of the service display function group 42 is shown in FIG. 5, and the sorted target message 414 is presented to the service 421. The following three methods are mainly used:

1. Provide tabular traffic information 422, and color the field and content, and combine the dynamic icon to highlight the content value, for example, flashing red light to indicate the occurrence of the obstacle.

2. Provide a traffic flow diagram 423 as shown in Figure 6. Providing a traffic flow diagram 423 as a time-ordered flow diagram, including The traffic flow chart of the PSTN, the NGN, or both, and the traffic 4234 that distinguishes the two by the color, provides the traffic flow diagram 423 to indicate the device 4231 through which the traffic flows, and also includes the communication number, the network address, or Related device content, the arrow represents the traffic direction between the devices 4232, and also includes the traffic status 4233 between the devices, which is also separated by color, and is separated by different color blocks for different communication identification numbers. 4234, in order to increase the readability of the traffic flow, and the provided traffic flow diagram 423 also supports interactive display, for example, when the MESG5 is marked, the advanced traffic content 4235 is displayed.

3. Provide a short URL 424 of the mailing address, which is mainly composed of no more than 20 letters, which is convenient for the user to read or reuse, for example, accessing the packet of the traffic flow.

(3) Traffic Analysis Function Group

The operational flow 430 of the traffic analysis function group 43 is shown in FIG. First, the sorted target traffic 431 is read, the alarm information 432 is searched through the alarm database 44, the alarm rule 433 is executed, and the generated quantized result is stored back into the alarm database 435 as a follow-up experience reference. If the alarm condition 434 is satisfied, the alarm processing is performed; if not, the sorted target traffic 431 is continuously read.

The executed alarm rule 433 is a series of logical discriminant grammars, for example, the start time of the analysis traffic is t ₁ , the end time is t ₂ , and the time difference is t ₂ - t ₁ = Δ t , and the total number of calls in the period is N. The call state is S, wherein the call state determined as the alarm is S _w , and the number of calls of the S _w is M. If the alarm threshold of the S _w is Θ and the condition is valid δ , the alarm condition is as follows: IF ( M/N > Θ ) AND( δ = valid )THEN ALARM S _w ELSE IGNORE S _w

Then, when the condition satisfies 434, the system transmits the S _w and related messages to the alarm processing function group 45; otherwise, the target message 431 is continuously read.

According to the above syntax, the alarm call status S _w is “call cancellation”, and the SIP response code is “487 Request Terminated”. The reason may be that the caller hangs up the phone, or the system device may be in an obstacle, causing the waiting time to wait. As a result, the real state of the communication network cannot be known from a single call state. However, through quantization 433 of the time period the alarm rule, for example, 100 through different feed lines 40 a pen to obtain the same SIP response code, i.e., M / N = 0.4, if the alarm parameter value Θ is 0.3, and the effective number of occurrences has been reached, i.e., If the validity is not valid , the condition is 434. The network device abnormality can be reasonably suspected, and the subsequent alarm processing flow 450 is performed. At the same time, the quantized information 433 per unit time is converted into the alarm parameter value Θ , and for different time periods. And the requirements are stored in the inter-network traffic database 30 as a reference for future alarm experience. For example, the historical average number of calls on Monday can be used as a reference for next Monday.

(4) Alarm information database

The alarm information database 44 provides alarm data to the traffic analysis function group 431, and stores the analyzed quantitative data 435; provides alarm schedule data to the alarm processing function group 451; provides alarm information to the condition management function group 461, and stores and edits The result after 464.

As shown in FIG. 8, the associated data table 440 includes a customer profile 441, a service profile 442, a conditional table 443, a call state table 444, an alarm schedule 445, and an alarm object table 446. Only some of the fields are listed.

(5) Alarm processing function group

As shown in FIG. 9, the operation flow 450 of the alarm processing function group 45 first reads the alarm schedule 451 and schedules the target traffic stored in the data table 445. The alarm object 452 is obtained through the data table 446, the traffic display result 453 is read, and the traffic information table 422, the traffic flow chart 423 or the service URL short alias 424 is placed in the alarm message, and finally, the alarm content is transmitted. 454, and update the alarm parameter 455 to re-read the next alarm schedule 451. If the transfer is successful 456 is over; if it is unsuccessful, 456 will judge whether the message is valid 457. If it is valid, it will continue to retry transmission 454. If the alarm content expires to be invalid 457, the scheduling will be terminated, and when the warning content of the alarm is inconsistent, The alarm status is mainly based on the new alarm status. For example, the alarm message of 10:40AM has been transmitted to the terminal device 50, and the alarm message of 10:50AM is stored in the queue because the terminal device 50 is not turned on. If 11:00AM is detected, If the obstacle has been lifted, the 10:50AM message will be invalid and will be removed and replaced with the 11:00 AM barrier exclusion.

In addition, the part of the alarm parameter 455 is updated, and the parameter content may be the number of alarms, the duration of the alarm, etc., because the parameters are different, the alarm schedule is changed, and the alarm object is also changed accordingly, thereby improving the alarm level and range. At the same time, the transmission period can be adjusted to avoid the alarm prompts being too frequent and repeated.

(6) Condition Management Function Group

The operational flow 460 of the condition management function group 46 is shown in FIG. First, the alarm information 461 of the alarm information database 44 is read and temporarily stored in the memory of the terminal device 50, and the function 462 for adding, editing, and deleting alarm conditions can be performed. If the 463 is confirmed, the temporary terminal device 50 is The content of the memory is stored back to the alarm database 464; otherwise, the function group can be operated by the terminal device 50 through the provided management interface, or the interactive condition prompt provided by the transmitted alarm content, and the condition management event is started. The modification function of the alarm condition may be performed, and the management interface may be a webpage or an application installed on the terminal. The interactive prompt provided by the alert content may be a newsletter code, a web link, or an input provided by the terminal application.

11‧‧‧ISUP signal acquisition and analysis module

12‧‧‧SIP Signal Acquisition and Analysis Module

20‧‧‧Inter-network communication link module

30‧‧‧Inter-network communication database

40‧‧‧Smart Analysis Alarm Module

41‧‧‧Traffic Filtering Function Group

410‧‧‧Traffic Filtering Function Group Operation Process

411‧‧‧Read the content of the inter-network traffic database

412‧‧‧Inter-networking content classification

413‧‧‧Determination of cross-network communication content as target traffic

414‧‧‧Sort target traffic

42‧‧‧Traffic Display Function Group

420‧‧‧Service Display Function Group Operation Process

421‧‧‧Information content summary output

422‧‧‧Formal information

423‧‧‧ Graphical Traffic Process

4231‧‧‧Marking equipment flowing through the service

4232‧‧‧Marking the direction of traffic between devices

4233‧‧‧Marking the status of the service between devices

4234‧‧‧Communication identification code blocks indicating similarities and differences

4235‧‧‧ Displaying advanced content of the service

424‧‧‧Service URL Short Name

43‧‧‧ Traffic Analysis Function Group

430‧‧‧Service Analysis Function Group Operation Process

431‧‧‧Read sorted target traffic

432‧‧‧Search target traffic is located in the alarm information database alarm information

433‧‧‧Alarm rules for the execution of target traffic

434‧‧‧Check whether the quantified result of the alarm service meets the alarm condition

435‧‧‧ Quantitative results of stored target traffic in the alert information database

44‧‧‧Alarm Information Database

440‧‧‧Affiliated data sheet for the alarm information database

441‧‧‧Customer Information Sheet

442‧‧‧Service Information Sheet

443‧‧‧Conditions

444‧‧‧Call status table

445‧‧‧Alarm Schedule

446‧‧‧Alarm object table

45‧‧‧Alarm Processing Function Group

450‧‧‧ Alarm Processing Function Group Operation Process

451‧‧‧Read alarm schedule

452‧‧‧Get the alarm object in the alarm object table

453‧‧‧Get the results of the traffic display

454‧‧‧Transfer alarm content

455‧‧‧Update alarm parameters

456‧‧‧Check if the alarm information is successfully transmitted

457‧‧‧Check if the alarm status is valid

46‧‧‧ Conditional Management Function Group

460‧‧‧ Condition Management Function Group Operation Process

461‧‧‧Read the alarm information of the alarm information database

462‧‧‧ Functions to add, edit and delete alarm conditions

463‧‧‧Consult whether the editing of the alarm condition is valid

464‧‧‧Storage alarm conditions in the alarm information database

50‧‧‧ Terminal equipment

Please refer to the detailed description of the patent and its accompanying drawings, which will further understand the technical content of the patent and its purpose. The related drawings are: Figure 1 is a block diagram of the new generation NGN network monitoring method and system.

FIG. 2 is a multi-level communication connection method of the patent cross-network communication link module.

Figure 3 is a functional program diagram of the intelligent analysis alarm module of the patent.

Figure 4 is a flow chart showing the operation of the patented traffic filtering function group.

Figure 5 is a flow chart showing the operation of the patent service display function group.

Figure 6 is a display diagram of the patent flow chart.

Figure 7 is a flow chart of the operation of the patent traffic analysis function group.

Figure 8 is the alarm information related data sheet of this patent.

Figure 9 is a flow chart showing the operation of the patent alarm processing function group.

Figure 10 is a flow chart of the operation of the patent condition management function group.

11‧‧‧ISUP signal acquisition and analysis module

12‧‧‧SIP Signal Acquisition and Analysis Module

20‧‧‧Inter-network communication link module

30‧‧‧Inter-network communication database

40‧‧‧Smart Analysis Alarm Module

50‧‧‧ Terminal equipment

Claims (9)

A new generation NGN network monitoring system, including: ISUP (Integrated Service Digital Network User Part) signal acquisition and analysis module, from PSTN (Public Switched Telephone Network) The network captures, decodes, and analyzes the ISUP signal to generate call status and required parameters; SIP (Session Initiation Protocol) signal acquisition and analysis module, which is captured, decoded, and retrieved from the NGN network. And analyzing the SIP signal to generate a call state and required parameters; the inter-network traffic database is connected to the ISUP signal acquisition and analysis module and the SIP signal acquisition and analysis module, and stores the inter-network traffic The connection and the status of the call and the related parameters; and the alarm transmission module, the alarm content is transmitted to the terminal device of the alarm object through the network; the inter-network communication connection module is the ISUP signal acquisition and analysis module And the information provided by the SIP signal acquisition and analysis module is stored in the inter-network traffic database, and the comparison step is: comparing the ISUP user number group with the SIP Whether the household number group is equal; whether the SIP user number group is included in the ISUP user number group; whether the SIP user number group includes the ISUP user number group; the intelligent analysis alarm module is filtered and stored in the inter-network Information Information and sorting of the database. The system for monitoring a new generation NGN network according to the first aspect of the patent application, wherein the inter-network communication link module, the SIP user number group is composed of a calling number and a called number, the main The calling number must include From or PA-ID, and the called number must include To or r-URI. For example, in the system of the new generation NGN network monitoring described in claim 1, wherein the inter-network communication link module, the ISUP user number group is composed of a calling number and a called number, wherein the calling party The number must include CgPN, and the called number must include CdPN or CdIN. For example, the system for monitoring the new generation NGN network described in the first paragraph of the patent scope, wherein the intelligent analysis alarm module first filters according to the time range, and then classifies the inter-network traffic according to the field, and finally the result. Sort by the selected field. For example, the system for monitoring the new generation NGN network described in claim 1 of the patent scope, wherein the intelligent analysis alarm module performs quantitative judgment on the plurality of traffic messages, and converts the traffic state into an alarm reference value, through history. Data comparison, find out the specific traffic group. For example, in the system of the new generation NGN network monitoring described in claim 1, wherein the smart analysis alarm module includes: a tabular traffic information, that is, a tabular service. Content combined with the presentation of dynamic graphics; Second, the traffic flow chart, that is, including device information, traffic flow, traffic status and group presentation, and interactive content display function; Third, the short message URL Alias, with no more than 20 letters, provided The user reads the advanced content and reuses it. For example, the system for monitoring the new generation NGN network described in the first paragraph of the patent scope, wherein the intelligent analysis alarm module has a personalized alarm management mode, and the alarm object directly customizes the alarm parameter through the management interface, and also borrows The alarm parameters are modified by the interaction prompt of the alarm content. For example, the system for monitoring the new generation NGN network described in claim 1 of the patent scope, wherein the intelligent analysis alarm module provides a status check for the alarm message that fails to be transmitted or has not yet been transmitted, and determines the validity of the alarm to avoid A large number of alarm messages are simultaneously delivered to the terminal device. A new generation NGN network monitoring method, the steps are as follows: Step 1: The ISUP (Integrated Service Digital Network User Part) signal acquisition and analysis module and the SIP (Session Initiation Protocol) , the session initiation protocol) the signal acquisition and analysis module provides information, performs multiple levels of the ISUP and the SIP signal link, compares the ISUP user number group and the SIP user number group within a reasonable time range, and establishes The connection relationship between the ISUP and the SIP signal is stored in the inter-network traffic database. Step 2: Filter and store the data stored in the inter-network traffic database, analyze the status of the inter-network traffic, and compare The alarm condition is converted to the quantized alarm parameter and then processed. The quantized alarm parameter is reused as a reference for future alarm experience. The intelligent analysis alarm module provides complete traffic display function and personalized self. Set the alarm condition function, If the alarm condition is met, the alarm content is transmitted to the alarm transmission module.