TWI510109B - The recursive method of network traffic anomaly detection - Google Patents

Description

Recursive abnormal network traffic detection method

This patent belongs to the signaling anomaly analysis technology of the mobile network. In addition to the analysis of the abnormal content of the signaling, it can also provide the evaluation value of the traffic change through the traffic information of the traffic to assist in determining the crux of the abnormal operation problem. Further reduce the traffic prediction time through the cloud architecture, improve the prediction accuracy and immediacy, and timely grasp the overall network status. The above is the technical feature of this patent.

With the popularity of smart phones, smart tablets, audio and video media and APP applications, the bandwidth and transmission quality of mobile networks are becoming more and more important, especially the problem of network congestion has been criticized. Therefore, it is possible to grasp the behavior pattern of the user's Internet access and the traffic trend of each device, which will help determine the crux of the abnormal problem.

At present, the equipment such as the Base Station Controller (BSC)/Radio Network Controller (RNC), etc., the traffic information provided by the network management function is mainly based on device traffic; Policy Charging and Rules Function (PCRF)/Policy and Charging Enforcement Function (PCEF) can provide users with With traffic, it is impossible to know the connection status of the access device; in addition, the judgment of abnormal traffic generally depends on the experience of the administrator or the operator or directly adopts the system default value, which is less able to truly reflect the traffic. Anomalies, let alone dynamically detect anomalous changes.

"Congestion detection method and apparatus for cell in mobile network" world patent WO2011144061, using RRT (Round Trip Time) between Acquisition Unit and Cell device as the main identification method for congestion detection, and with a preset RRTH (Round Trip Time) Threshold value) is the basis for judgment. If RRT>RRTH indicates that the Cell congestion occurs, otherwise it does not. However, through this pre-set RRTH, although it is possible to immediately reflect whether the current connection state is blocked, it cannot display abnormal changes.

"Immediate mobile network data service rate inquiry device" Taiwan patent M394652, which provides mobile user test connection download service, through the transmission file to understand the connection status of the network, so it can only provide a small range of personal traffic test, can not snoop The overall network device status and abnormal changes in traffic.

In addition, when the traffic information is obtained through the network management function of the mobile core network device, the computing time of the device is consumed, which affects the system performance. If the device operation is fully loaded, the abnormal situation is more difficult to resolve. Moreover, the operation mode of the equipment will be relatively complicated due to the different manufacturers. If it is to be fully monitored, it will inevitably increase the additional customization cost. In addition, the equipment in the workshop has almost no function of providing traffic prediction, so that the traffic data cannot be effectively utilized, and it cannot be considered as the expansion or correction of the future equipment capacity.

In short, although the general mobile communication network monitoring equipment has instant traffic information, it is more difficult to counter with a fixed threshold. The change in abnormal traffic should be made, not to mention the user's or device traffic assessment and prediction functions; in addition, the device operating mode and output data format are also different because of the manufacturer. Therefore, in the network environment of a variety of devices, it is more difficult to be tens of thousands, and must be customized. On the other hand, when the device performs traffic data extraction or analysis, it will affect the system performance, and it is impossible to perform huge amounts of data calculation. Therefore, the flow data cannot be effectively utilized, and the abnormal situation is difficult to resolve, which is often the affliction of the maintenance personnel.

It can be seen that there are still many shortcomings in the above-mentioned methods of use, which is not a good design, but needs to be improved.

The purpose of this patent is to monitor the abnormal traffic status of the mobile communication network, and use the method proposed in this patent to analyze the captured signaling and collected traffic data, and determine whether the connection is abnormal through signaling analysis, and according to the user. Or the historical flow change of the equipment, together with judging the abnormal state of the current network, and determining the crux of the abnormal problem, improving the efficiency and correctness of the inspection. In addition, the patent further analyzes the signaling obtained by the analysis, and predicts the traffic through the statistical learning model as a basis for future device capacity amplification or correction.

A recursive abnormal network traffic detection method that achieves the above object is proposed, and an abnormal analysis and prediction technique is proposed. The recursive abnormal network traffic detection method proposed by the patent comprises four units: (1) an action signaling acquisition module, (2) a signaling anomaly detection module, and (3) a cloud server and (4) Anomaly evaluation reference module.

The action signaling acquisition module captures signaling from the mobile core network device, obtains the acquisition time, and obtains the user identification code, the device identification code, the operation code, the connection status, the user uplink and downlink traffic, and the user through the decoding function. Device transmission Traffic, etc. The signaling anomaly detection module performs connection state analysis. If the status of the packet content is directly interpreted as abnormal, an abnormal warning is immediately issued. If the direct interpretation is not possible, the traffic flow comparison is performed, and the traffic prediction value calculated by the recursion is a reference value. If the actual measurement value and the reference value are greater than the error threshold, an abnormal warning is included. Finally, the results and corresponding user and device parameters are collated and stored in the cloud server for the next recursive operation.

The abnormality evaluation reference module takes the flow data stored by the cloud server as input, and through the data filtering function, sorts out the effective traffic flow, which can increase the efficiency of the abnormal analysis and improve the accuracy of the abnormality evaluation. At the same time, because of the cloud architecture, the computing time of huge amounts of data can be shortened, thereby improving the immediacy of abnormal predictions. In addition, according to the learning model of the connection state transition, the corrected abnormality index can be obtained through the actual measured flow value, and used as the basis for the next abnormality assessment to improve the accuracy of the abnormal prediction.

The recursive abnormal network traffic detection method of this patent is different from the monitoring device in the workshop, except that it can parse device traffic, such as Cell, RNC, etc.; it can also analyze user traffic, similar to the traffic statistics function of PCRF/PCEF; Analysis of the connection content, when compared with other conventional technologies, has the following advantages:

1. The mobile signaling capture module of this patent uses a signaling offloading method to extract signaling from between devices without affecting the performance of the mobile core network device.

2. The signaling anomaly detection module of this patent can analyze the connection status of the user and the device, and can immediately notify the abnormality when the abnormal information of the field occurs.

3. The signaling anomaly detection module of the patent can perform signaling flow detection for a connection that is not abnormal or cannot determine an abnormality. Linking the generated signaling traffic by user and device identification code, and based on past traffic The reference value is used to determine whether it is abnormal.

4. The abnormality evaluation reference module of this patent uses a cloud server to process huge amounts of data, which can integrate computing resources and reduce computing time.

5. The anomaly evaluation reference module of this patent uses a statistical learning model to estimate the flow as a basis for abnormal traffic.

10‧‧‧Action Signaling Capture Module

20‧‧‧Signal anomaly detection module

201‧‧‧Signal Analysis

202‧‧‧Is the state comparison abnormal?

203‧‧‧Abnormal warning

204‧‧‧Link traffic information

205‧‧‧ Whether the flow comparison is greater than the error threshold

206‧‧‧Traffic finishing

30‧‧‧Cloud Server

40‧‧‧Anomaly Evaluation Reference Module

401‧‧‧ data filtering

402‧‧‧Anomaly analysis

403‧‧‧Anomaly assessment

404‧‧‧ learning model

405‧‧‧ Training materials

Please refer to the detailed description of the present invention and the accompanying drawings, and the technical contents of the present invention and its effects can be further understood; the related drawings are:

FIG. 1 is a module diagram of the patent recursive abnormal network traffic detection method.

FIG. 2 is a flow chart of operation of the patent signaling abnormality detecting module.

FIG. 3 is a functional program diagram of the abnormality evaluation reference module of the present patent.

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

Hereinafter, the present invention will be further described with reference to the accompanying drawings:

The patent is a recursive abnormal network traffic detection method, which analyzes the captured signaling content to detect the connection state of the mobile network, and determines whether the network is abnormal by comparing the reference value of the past traffic. The measurement value with large filtering error is used to converge the training data, and the evaluation parameters are corrected recursively to increase the accuracy of the abnormal flow judgment.

Referring to FIG. 1 , the patent includes four units: an action signaling capture module 10 , a signaling anomaly detection module 20 , a cloud server 30 , and an abnormality evaluation reference module 40 .

The action signaling capture module 10 captures signaling between the mobile network devices, obtains the acquisition time, and generates a user identification code, a device identification code, an operation code, a connection status, a user uplink and downlink traffic, and a device transmission through decoding. The traffic, etc., is then output to the signaling anomaly detection module 20. The mobile network equipment is a common mobile nuclear network equipment, such as a base station controller (BSC) / radio network controller (RNC), a radio access network (GSM/EDGE Radio Access Network, GERAN) / radio access Universal Terrestrial Radio Access Network (UTRAN), Evolved UTRAN (EUTRAN), Serving GPRS Support Node (SGSN), Gateway GPRS Support Node (GGSN) , Serving Gateway (S-GW), Packet Data Network Gateway (P-GW) or Mobile Management Entity (MME).

The signaling abnormality detecting module 20 performs the connection state analysis, and if it can directly interpret the abnormality, it immediately alerts abnormally. If the direct comparison is not possible, the flow comparison is performed, and the predicted value of the simultaneous segment generated by the abnormality evaluation reference module 40 or the average value of the different time periods is used as the reference value. If the measured value and the reference value are greater than the error threshold, the abnormal warning is included. Finally, the results and corresponding user and device parameters are collated and stored in the cloud server 30.

For the execution step, refer to FIG. 2: First, the signaling field decoded by the action signaling extraction module 10 is read by the signaling analysis 201, and the connection status comparison 202 is performed. If the connection state of the user or the device can be directly interpreted as If the error is abnormal, the connection information is transmitted to the abnormal warning 203 and marked as abnormal. The connection status is any status field that can identify the user or device as defined by the 3GPP file, such as Radio Network Layer Cause, Transport Layer Cause, Protocol Cause, and Miscellaneous Cause, etc. If the abnormality cannot be directly interpreted, the connection information 204 obtains the traffic information in the current time period according to the user or the device identification code, and then the traffic reference value is read by the abnormality evaluation reference module 40; if the traffic reference value does not exist, the flow is skipped. The traffic comparison 205 enters the traffic collation 206; conversely, if there is a traffic reference value, the traffic comparison 205 is performed. The comparison formula is as follows:

The flow reference value generated by the reference module 40 is abnormally evaluated; M _t is the actual flow value obtained by the action signaling acquisition module 10; H is the relative error threshold. If the error range is greater than the error threshold, the pen connection information is also transmitted to the abnormality alert 203 and marked as abnormal. If it is less than the error threshold, it enters flow grooming 206. The traffic content sorting 206 will pre-store each connection content, including the extraction time, user identification code, device identification code, operation code, connection status, user uplink and downlink traffic, device transmission traffic, traffic reference value and Relative error values, etc., to facilitate storage to the cloud server. Finally, the result is output to the cloud server 30.

The cloud server 30 stores the huge amount of traffic data and comparison parameters generated by the signaling abnormality detecting module 20 in a distributed database, and uses a MapReduce distributed computing environment to convert huge amounts of data into key pairs of values and values. They are respectively sent to different Mappers for processing. After the operation of the abnormality evaluation reference module 40 is completed, the results are also sorted into key pairs of values and values, and then transmitted to the Reducer to sort the results, providing integrated computing resources and reducing computation time.

The abnormality assessment reference module 40 mainly establishes a probability model of statistical learning through the filtered normal historical traffic data of the user or the device, and applies the evaluation formula to generate a traffic reference value in a recursive manner to determine the abnormal situation of the user or the device, and fine-tune Anomaly index to increase the accuracy of the assessment.

For the operation procedure, please refer to Figure 3: First, read the traffic matching data stored by the cloud server 30, and obtain the traffic data of the user or device at the same time through the filtering of the data filtering 401. If the data of the simultaneous segment is not found, the average daily traffic is obtained. Instead, it is stored in training material 405. Then, the abnormality analysis 402 transmits the filtered user or device connection flow data to the corresponding statistical model according to the learning model 404 according to the feature data provided by the training data 405, and obtains the abnormality index as the judgment basis of the abnormality assessment 403, and The traffic reference value generated by the evaluation formula is transmitted to the signaling abnormality detecting module 20. The reference value generated by the abnormality assessment 403 is also fed back to the learning model 404, and the abnormality analysis 402 compares the actual measured values of the next data filtering 401 to obtain new abnormal parameters, and corrects the reference of the abnormality assessment 403. The value makes the predicted reference value more accurate. Its formula is as follows:

Estimate the current estimate of 403 for anomalies; The previous estimate of 403 is evaluated for the abnormality; K _t is the abnormality index; M _t is the actual measured value of the data filtering 401 screening. Through the module's continuous recursive execution and fine-tuning, the resulting predicted reference values will be closer to the actual measured results.

In summary, the embodiments of the present patent can be exemplified as follows: the mobile signaling acquisition module 10 is implemented in a mobile network device base station controller (BSC) or a radio network controller (RNC) and a GPRS service support node (Serving GPRS Support). Between the Node and the SGSN, the RANAP (Radio Access Network Application Part) signaling of the IuPS (Interface UMTS Packet Switched) interface is obtained; and the reason for the radio network layer of the field is found in the signaling abnormality detecting module 20 (Radio) The value of Network Layer Cause) is Unable to Establish During Relocation, so it is directly interpreted as an exception; if there is no such field or the content of the message cannot be determined abnormally, the analysis is the same. The reference value of the traffic generated by the Radio Network Controller (RNC-ID) (GPRS Tunneling Protocol-Control, GTP-C) traffic and abnormality evaluation reference module 40 is compared with the error between the two. If it is greater than the error threshold of 10%, it is determined to be abnormal, and the result is stored in the cloud server 30 for the next estimation.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

10‧‧‧Action Signaling Capture Module

20‧‧‧Signal anomaly detection module

30‧‧‧Cloud Server

40‧‧‧Anomaly Evaluation Reference Module

Claims (6)

A method for recursive abnormal network traffic detection, which comprises: a signaling anomaly detection module, which is based on information provided by an action signaling capture module, and reads a device or user connection status, if If the direct interpretation is abnormal, an abnormal warning is immediately performed, and then the signaling analysis is performed to compare the predicted result of the abnormality evaluation reference module within a reasonable time range. If the actual measured value and the predicted value of the signaling are larger than the error range, the abnormality is included. The warning and the abnormality evaluation reference module establish a probability model of statistical learning through the historical flow data of the user or the device, and apply the evaluation formula in a recursive manner to generate a flow reference value to determine the abnormal state of the user or the device. The execution steps of the abnormality assessment reference module include: Step 1: Filtering the traffic information measured by the signaling abnormality detecting module; Step 2: Applying the historical traffic information to the evaluation formula to generate the traffic reference value; Step 3: Comparing the reference The error between the value and the actual measured value, fine-tuning the abnormal index to correct the learning model; and step 4, the actual measured value within the storage error range As a recursive implementation of the samples. The method for recursive abnormal network traffic detection according to claim 1, wherein the signaling abnormality detecting module is configured to identify a status field of the user or the device. The method for recursive abnormal network traffic detection according to the first aspect of the patent application, wherein the signaling abnormality detecting module has a signaling analysis step: Step 1: obtaining user traffic information according to the user identification code; Step 2: Obtain device traffic information according to the device identification code; Step 3: Compare the reference value of the reference module for the abnormality evaluation; and step 4, when the error is greater than the threshold value, the abnormal warning is included. The method for recursive abnormal network traffic detection according to claim 3, wherein in step 1 of the signaling analysis, the user identification code is to identify the user to link the user's traffic information, and the identification The code system is the address of the field identifying the user. The method for recursive abnormal network traffic detection according to claim 3, wherein in step 2 of the signaling analysis, the device identification code is a traffic information for identifying the device to link the device, the identifier It is the field that identifies the device. The method for recursive abnormal network traffic detection as described in claim 1 of the patent scope, wherein the evaluation formula is ,among them Evaluate the current estimate for anomalies, The previous estimate is evaluated for the anomaly, K _t is the anomaly index, and M _t is the actual measured value of the data filtering filter.