TWI821058B - System and method for root cause analysis of abnormal phone number - Google Patents

Abstract

A system and a method for root cause analysis of an abnormal phone number are provided. The method includes: obtaining a abnormal event database, a historical signaling set, and a statistic model corresponding to the historical signaling set; obtaining an instant signaling set and determining weather a first instant signaling of the instant signaling set matches the statistical model; performing a dial test for a phone number corresponding to the first instant signaling in response to first instant signaling not matching the statistical model; receiving a dial test signaling set corresponding to the dial test; clustering the historical signaling set, the instant signaling set, and the dial test signaling set to obtain a first clustering result including an abnormal cluster; and searching the abnormal event database according to the abnormal cluster to obtain a root cause corresponding to the abnormal cluster and outputting an abnormal state data structure including the root cause.

Description

System and method for root cause analysis of abnormal door numbers

The present invention relates to a telecommunications technology, and in particular to a system and method for root cause analysis of abnormal door numbers.

After decades of development and transformation of telecommunications networks, NGN (next generation network) has now been widely used. The NGN network takes the Internet Protocol multimedia subsystem (IMS) as the core and integrates technologies in the Internet and telecommunication fields to build a modern telecommunications network, and then integrates the network and services to increase business receive. Users mainly switch from traditional telephone equipment to Internet equipment. Therefore, how to quickly analyze anomalies and eliminate obstacles in a network environment where traditional equipment and new generation equipment coexist, so as to avoid affecting the traffic operation of important telecommunication numbers, is one of the topics that telecom operators are most concerned about. In addition, with the transformation of network architecture, the complexity of traffic has also increased, making it very difficult to analyze anomalies in NGN or IMS networks and quickly find the root cause of the obstacle.

In the IMS network, the session initiation protocol (SIP) protocol provides several request (request) or response (response) methods and response codes to complete call control. The header fields and packet contents of SIP protocol messages can be used for debugging, but they are still difficult to directly use for practical troubleshooting. For example, maintenance personnel of a telecommunications network can obtain obstacle information from the response content of the status line. However, how to monitor the telecommunications network and obtain corresponding abnormal packets in order to analyze the obstacles of the telecommunications network is still a problem that must be overcome in practice. .

The present invention provides a system and method for root cause analysis of abnormal door numbers, which can monitor abnormal signaling in a telecommunications network and analyze the root cause of the abnormality.

The present invention is a system for root cause analysis of abnormal door numbers, including a processor, a storage medium and a transceiver. The storage medium stores multiple modules, an abnormal event database, a historical signaling set, and a normal model corresponding to the historical signaling set. The processor is coupled to the storage medium and the transceiver, and accesses and executes a plurality of modules, wherein the plurality of modules include a signaling collection module, a real-time analysis module and an automatic dialing test module. The signaling aggregation module receives the instant signaling aggregation through the transceiver. The real-time analysis module determines whether the first real-time signaling in the real-time signaling set matches the normal model. The automatic dial test module performs a dial test for the door number corresponding to the first instant signaling in response to the mismatch between the first instant signaling and the normal model. The signaling aggregation module receives the dial test signaling set corresponding to the dial test through the transceiver. The real-time analysis module performs clustering on the historical signaling set, the real-time signaling set and the dial test signaling set to obtain the first clustering result including abnormal clusters. The real-time analysis module searches the abnormal event database according to the abnormal cluster to obtain the root cause corresponding to the abnormal cluster, and outputs the abnormal status data structure containing the root cause through the transceiver.

In an embodiment of the present invention, the above-mentioned first clustering result includes a first cluster and a second cluster, wherein the real-time analysis module obtains the first reference signaling from the first cluster and obtains the second reference signaling from the second cluster. , and obtain at least one historical reference signaling from the normal model, wherein the real-time analysis module calculates the first maximum similarity between the first reference signaling and at least one historical reference signaling, and calculates the second reference signaling and at least one historical reference signaling. A second maximum similarity between the historical reference signaling, wherein in response to the second maximum similarity being greater than the first maximum similarity, the instant analysis module selects the first cluster from the first cluster and the second cluster as the anomaly cluster.

In an embodiment of the present invention, the above-mentioned at least one historical reference signaling includes a first historical reference signaling and a second historical reference signaling, wherein the real-time analysis module calculates the first reference signaling and the first historical reference signaling. The first similarity between the first reference signaling and the second historical reference signaling is calculated, wherein in response to the first similarity being greater than the second similarity, the real-time analysis module compares the first A first difference between the reference signaling and the first historical reference signaling, and searching the abnormal event database according to the first difference to obtain the root cause.

In an embodiment of the present invention, the above-mentioned real-time analysis module performs grouping on the historical signaling set and the real-time signaling set to obtain the second grouping result, and determines whether the number of the first cluster in the second grouping result is greater than the normal state. The second number of clusters of the model, wherein in response to the first number of clusters being greater than the second number of clusters, the real-time analysis module determines that the second clustering result contains non-normal clusters, wherein the real-time analysis module includes the non-normal cluster based on the first real-time signaling The cluster determines that the first instant signaling does not match the normal model.

In an embodiment of the present invention, the above-mentioned plurality of modules further include an offline modeling module. The offline modeling module performs clustering on the historical signaling set to generate a normality model.

In an embodiment of the present invention, the above-mentioned offline modeling module performs grouping on the historical signaling set according to a density grouping algorithm.

In an embodiment of the present invention, the above-mentioned storage medium further stores a key field list, wherein before performing grouping on the historical signaling set, the offline modeling module filters the historical signaling set according to the key field list.

In an embodiment of the present invention, the historical signaling in the above-mentioned historical signaling set includes at least one field, and the offline modeling module determines whether the at least one field includes the first key field in the key field list. , wherein in response to at least one field not containing the first key field, the offline modeling module filters historical signaling.

In an embodiment of the present invention, the historical signaling in the above-mentioned historical signaling set includes fields and the contents of the fields, wherein the offline modeling module determines whether the format of the content matches the key field list, wherein in response to The format does not match the key field list, and the offline modeling module filters historical signaling.

In an embodiment of the present invention, the historical signaling in the above-mentioned historical signaling set includes a field and the content of the field. Before performing grouping on the historical signaling set, the offline modeling module determines the content according to the field. encoding method, and perform encoding on the content according to the encoding method.

In an embodiment of the present invention, the above-mentioned storage medium further stores a list of important door numbers, wherein the signaling aggregation module receives a plurality of historical signalings through the transceiver, and in response to the first historical signaling among the plurality of historical signalings The ordered door number matches the list of important door numbers, and the offline modeling module obtains the historical signaling set based on the first historical signaling.

In an embodiment of the present invention, the above-mentioned storage medium further stores a list of important door numbers, wherein the real-time analysis module determines whether the first real-time signaling matches the key number list in response to the door number of the first real-time signaling matching the important door number list. Normal model matching.

In an embodiment of the present invention, the above-mentioned storage medium stores multiple normality models including normality models, wherein the signaling collection module receives a real-time signaling set during the first period, and the real-time analysis module collects data from the multiple normality models. A normal model corresponding to the first period is selected to determine whether the first instant signaling matches the normal model.

In an embodiment of the present invention, the above-mentioned offline modeling module updates the normal model according to a preset period.

The present invention is a method for root cause analysis of abnormal door numbers, including: obtaining an abnormal event database, a historical signaling set and a normality model corresponding to the historical signaling set; receiving an instant signaling set, and judging the instant signaling Whether the first instant signaling in the set matches the normal model; performing a dial test for the door number corresponding to the first instant signaling in response to the first instant signaling not matching the normal model; receiving a dial test corresponding to the dial test Signaling set; perform clustering on the historical signaling set, real-time signaling set and dial test signaling set to obtain the first clustering result including the abnormal cluster; and search the abnormal event database according to the abnormal cluster to obtain the root corresponding to the abnormal cluster Cause, and output the abnormal status data structure containing the root cause.

Based on the above, the signaling collection module of the present invention can comprehensively collect the signaling of important door numbers in the telecommunications network, so that the offline modeling module can establish a normal model for the important door numbers based on the signaling. The real-time analysis module can instantly detect whether an abnormal door number is occurring based on the normal model, and the automatic dialing test module performs a dialing test on the abnormal door number to increase the number of signaling samples for abnormal door numbers. The real-time analysis module can analyze the root cause of the anomaly based on the dial test signaling obtained through the dial test. Root causes can be used for extended applications such as abnormal alarms, troubleshooting, or filing statistics.

The present invention can monitor the signaling data of important telecom gates by collecting, screening, encoding and analyzing the signaling data of important telecom gates in the telecommunications network. The invention applies technologies such as automatic dialing and testing, signaling collection and aggregation to obtain various signaling (or packets) in the telecommunications network. After filtering and encoding the signaling, the present invention can perform outlier analysis on the signaling based on the grouping algorithm to find abnormal signaling and field content that do not conform to the normal pattern, so as to conduct subsequent obstacle interpretation and root causes. analyze.

FIG. 1 is a schematic diagram of a system 10 for root cause analysis of abnormal door numbers according to an embodiment of the present invention. System 10 may include processor 110, storage media 120, and transceiver 130.

The processor 110 is, for example, a central processing unit (CPU), or other programmable general-purpose or special-purpose micro control unit (MCU), microprocessor, or digital signal processing unit. Digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processing unit (GPU), image signal processor (ISP) ), image processing unit (IPU), arithmetic logic unit (ALU), complex programmable logic device (CPLD), field programmable gate array (field programmable gate array) , FPGA) or other similar components or a combination of the above components. The processor 110 can be coupled to the storage medium 120 and the transceiver 130, and access and execute multiple modules and various applications stored in the storage medium 120.

The storage medium 120 is, for example, any type of fixed or removable random access memory (RAM), read-only memory (ROM), or flash memory. , hard disk drive (HDD), solid state drive (SSD) or similar components or a combination of the above components, used to store multiple modules or various application programs that can be executed by the processor 110 . In this embodiment, the storage medium 120 can store one or more signaling aggregation modules 121, offline modeling modules 122, real-time analysis modules 123, automatic dialing modules 124, signaling database 20, exceptions, etc. The functions of the event database 30 and one or more normality models 40 and other modules will be described later. Multiple normality models 40 may respectively correspond to different time periods. For example, the multiple normality models 40 may include a normality model suitable for the period 10:00~12:00 and a normality model suitable for the period 19:00~20:00.

The transceiver 130 transmits and receives signals in a wireless or wired manner. Transceiver 130 may also perform, for example, low noise amplification, impedance matching, mixing, up or down frequency conversion, filtering, amplification, and similar operations. System 10 may access telecommunications network 200 as shown in FIG. 2 via transceiver 130.

FIG. 2 shows a schematic diagram of the deployment of the signaling aggregation module 121 according to an embodiment of the present invention. Multiple signaling aggregation modules 121 can be deployed in different areas (for example, areas 210, 220, or 230) of the telecommunications network 200 to collect signaling associated with important door numbers from each area. In this embodiment, door numbers that need to be monitored can be defined as important door numbers. For example, if a certain phone number applies to the service provider for root cause analysis of abnormal door numbers, the service provider can set the phone number as an important phone number. The telecommunications network 200 may include different telecommunications networks such as NGN network, public land mobile network (PLMN) or public switched telephone network (PSTN), and their hybrid architectures.

FIG. 3 illustrates a flow chart of a method for root cause analysis of abnormal door numbers according to an embodiment of the present invention, wherein the method can be implemented by the system 10 shown in FIG. 1 .

In step S310, the signaling aggregation module 121 may receive a plurality of historical signalings from the telecommunications network 200 through the transceiver 130. Historical signaling may include signaling transmitted in the telecommunications network 200 during previous periods. Historical signaling may include signaling of IP packets such as SIP signaling, Diameter protocol signaling, or E.164 number mapping (ENUM) domain name system (DNS) signaling, or may include Non-IP packet signaling such as integrated services digital network (ISDN) user part signaling and intelligent network application part (INAP) signaling. The signaling aggregation module 121 can sort each historical signaling according to the time stamp of the signaling, and store the historical signaling in the signaling database 20 for subsequent use. Table 1 is an example of the data structure of signaling in this embodiment. Table 1 signaling identifier Timestamp Source number Destination door number customer identifier Field Name #1 Original Content #1 Feature Encoding #1 Field name #2 Original content #2 Feature Encoding #2 … … … Field name #N Original content #N Feature encoding #N

In step S320, the offline modeling module 122 may determine whether the time during which the normality model 40 has not been established or updated is greater than a preset period. If the time is greater than the preset period, step S330 is entered. If the time is less than or equal to the preset period, step S340 is entered. Through the execution of step S320, the offline modeling module 122 can establish or update the normality model 40 according to a preset period, so that the normality model 40 adapts to the current usage habits of the door number user. The default period can be customized by the user. For example, users can set the default period to 1 month, 3 months or 1 year.

In step S330 , the offline modeling module 122 may perform clustering on the historical signaling set to generate the normality model 40 . FIG. 4 illustrates a detailed flowchart of step S330 according to an embodiment of the present invention. In step S401, the signaling aggregation module 121 can sequentially import the collected multiple historical signalings into the offline modeling module 122 according to the time stamp.

In step S402, the offline modeling module 122 may determine whether the received historical signaling corresponds to an important door number. If the historical signaling corresponds to an important door number, step S403 is entered. If the historical signaling does not correspond to the important door number, step S404 is entered.

Specifically, the storage medium 120 may store an important phone number list recording one or more important phone numbers. After the signaling aggregation module 121 transmits the historical signaling to the offline modeling module 122, the offline modeling module 122 can compare whether the door number corresponding to the historical signaling matches the list of important door numbers. If the door number corresponding to the historical signaling is recorded in the important door number list, the offline modeling module 122 can determine that the door number matches the important door number list, and then allocate the historical signaling to the normal door number for training the normal model 40 A collection of historical signaling. If the door number corresponding to the historical signaling is not recorded in the important door number list, the offline modeling module 122 may determine that the door number does not match the important door number list, and then filter or discard the historical signaling.

Taking SIP signaling as an example, SIP signaling can include fields such as source door number (SIP-from-address) or destination door number (SIP-to-address). If the source door number or the destination door number records a door number in the important door number list, the offline modeling module 122 can determine that the SIP signaling matches the important door number list. If neither the source door number nor the destination door number records the door number in the important door number list, the offline modeling module 122 may determine that the SIP signaling does not match the important door number list.

Taking Diameter protocol signaling as an example, Diameter protocol signaling can include fields such as user name. If the user name records a door number in the list of important door numbers, the offline modeling module 122 can determine that the Diameter protocol signaling matches the list of important door numbers. If the user name does not record the door number in the important door number list, the offline modeling module 122 may determine that the Diameter protocol signaling does not match the important door number list.

In step S403, the offline modeling module 122 may mark the corresponding time period for the historical signaling according to the time stamp of the historical signaling. For example, if the timestamp of historical signaling is 11:00, the offline modeling module 122 can mark the historical signaling as a historical signaling set corresponding to the time period 10:00~12:00, where the time period 10: The historical signaling set from 00 to 12:00 is used to train a normal model suitable for establishing the signaling period from 10:00 to 12:00.

In step S404, the offline modeling module 122 may determine whether the signaling aggregation module 121 has stopped importing historical signaling. If the signaling aggregation module 121 has stopped importing historical signaling, step S405 is entered. If the signaling aggregation module 121 has not stopped importing historical signaling, step S401 is executed again.

In step S405, the offline modeling module 122 may perform key field filtering on the historical signaling in the historical signaling set. The storage medium 120 may store a key field list recording one or more key fields. The offline modeling module 122 can extract the data of key fields in historical signaling according to the key field list, and delete the data of fields that are not key fields. In this way, unnecessary data can be deleted, thereby saving computing resources required to perform subsequent steps.

The key fields of SIP signaling may include but are not limited to timestamp (for example: timestamp of starting time), source door number (SIP-from-address), destination door number (SIP-to-address), customer identifier (For example: call-ID), Cseq (command sequence) command sequence, tag (tag) or response code, etc. Key fields of SS7 signaling may include but are not limited to circuit identification code (CIC), calling party number or called party number, etc.

In step S406, the offline modeling module 122 may perform filtering and coding on the historical signaling in the historical signaling set. The offline modeling module 122 can filter the historical signaling set according to the key field list.

In one embodiment, the offline modeling module 122 can filter historical signaling with missing values. Specifically, the historical signaling in the historical signaling set may include one or more fields. If one or more fields of the historical signaling contains information on all key fields recorded in the key field list, it means that the historical signaling contains necessary data required for training the normality model 40 . Accordingly, the offline modeling module 122 may not filter the historical signaling. Relatively speaking, if one or more fields of the historical signaling does not contain the information of a key field recorded in the key field list, it means that the historical signaling lacks necessary data required for training the normality model 40 . Accordingly, the offline modeling module 122 can filter the historical signaling.

In one embodiment, the offline modeling module 122 may filter historical signaling that contains data with type errors. Specifically, the key field list may further record the format corresponding to the content of the key field. The historical signaling in the historical signaling set may include fields and content corresponding to the fields (for example: field name #1 and corresponding original content #1 shown in Table 1). The offline modeling module 122 can determine whether the format of the field content of the historical signaling matches the key field list. If the format matches the key field list, the offline modeling module 122 may not filter historical signaling. If the format does not match the key field list, the offline modeling module 122 can filter historical signaling.

Taking SIP signaling as an example, SIP signaling can include invitation signaling, in which the invitation signaling can include the source door number field or the destination door number field, and the content format of these fields should conform to the record address ( address-of-record (AOR) format, that is, the content must contain the string "SIP:user@domain". If the SIP signaling does not contain the string "SIP:user@domain", the offline modeling module 122 can determine that the format does not match the key field list, and then filter the historical signaling.

The offline modeling module 122 may determine the encoding method of the corresponding content according to the fields in the historical signaling, and perform encoding on the content according to the encoding method. After completing the encoding, the offline modeling module 122 can perform min-max normalization on the encoded content, linearly converting the value of the content to the [0,1] interval to unify the data value. Scope.

For example, the offline modeling module 122 can use one-hot encoding to encode the method field of SIP signaling, converting the string content value originally representing the method category into 0 or The value of 1, and maintain the unordered characteristics of the method field, for example, convert the "REGISTER" string in the method field to the "Is_Register" field with a value of 1. The offline modeling module 122 can use labeling encoding to encode the field containing the door number in the SIP signaling, and convert the original string content into a customized numerical label, such as the user's door number "+ 886123456789" is converted into a numerical label of "123456789". The value of the result-code field in SIP signaling represents different types of response results. Since there is no logical sequential relationship between various response codes, the offline modeling module 122 can use a one-bit valid encoding to encode the result code field.

In step S407, the offline modeling module 122 may perform clustering on the historical signaling set to generate the normality model 40. In one embodiment, the offline modeling module 122 may perform clustering on the historical signaling set according to a density-based clustering algorithm such as a shared nearest neighbor (SNN) algorithm. The shared nearest neighbor algorithm improves the problem that multi-dimensional data may suffer from the curse of dimensionality. Table 2 is an example of normality model 40. Normality model 40 may contain M clusters, where M is a positive integer. In one embodiment, the offline modeling module 122 may perform clustering according to an unsupervised machine learning algorithm. Table 2 Cluster #1-1 Cluster #1-2 … Cluster #1-M

In step S408 , the offline modeling module 122 may exclude historical signaling (ie, noise) belonging to outliers from the normal model 40 . The density grouping algorithm used in step S407 can automatically find historical signaling that does not belong to the M clusters in Table 2, and exclude these historical signalings. Historical signaling that has not been excluded is normal signaling with high similarity. Accordingly, the M clusters in Table 2 can be called normal clusters.

In step S409, the offline modeling module 122 may store the normality model 40 into the storage medium 120 for use in subsequent steps.

Returning to FIG. 3 , in step S340 , the real-time analysis module 123 can analyze the real-time signaling of the door number according to the normality model 40 to determine whether the door number is abnormal, and output the root cause of the abnormality.

FIG. 5 illustrates a detailed flowchart of step S340 according to an embodiment of the present invention. In step S501, the signaling aggregation module 121 may receive multiple instant signalings from the telecommunications network 200 through the transceiver 130. Immediate signaling may include signaling transmitted in the telecommunications network 200 during the current period. Immediate signaling may include signaling in IP packets such as SIP signaling, Diameter protocol signaling or ENUM DNS signaling, or may include signaling in non-IP packets such as ISDN User Part signaling, INAP signaling. The signaling aggregation module 121 can sort each instant signaling according to the time stamp of the signaling, and store the instant signaling in the signaling database 20 for subsequent use. The data structure of instant signaling can be shown in Table 1 as an example.

In step S502, the signaling aggregation module 121 can sequentially import the collected multiple real-time signalings into the real-time analysis module 123 according to the time stamp.

In step S503, the real-time analysis module 123 may determine whether the received real-time signaling corresponds to an important door number. If the instant signaling corresponds to an important door number, step S504 is entered. If the instant signaling does not correspond to the important door number, step S505 is entered.

Specifically, the storage medium 120 may store an important phone number list recording one or more important phone numbers. After the signaling aggregation module 121 transmits the real-time signaling to the real-time analysis module 123, the real-time analysis module 123 can compare whether the door number corresponding to the real-time signaling matches the list of important door numbers. If the door number corresponding to the instant signaling is recorded in the important door number list, the real-time analysis module 123 can determine that the door number matches the important door number list, and then allocate the instant signaling to the instant signaling set. If the door number corresponding to the instant signaling is not recorded in the important door number list, the real-time analysis module 123 may determine that the door number does not match the important door number list, and then filter or discard the instant signaling.

In step S504, the real-time analysis module 123 may mark a corresponding time period for the real-time signaling according to the time stamp of the real-time signaling. For example, if the timestamp of the instant signaling is 11:00, the instant analysis module 123 can mark the instant signaling as a set of instant signaling corresponding to the time period 10:00~12:00.

In step S505, the real-time analysis module 123 may determine whether the signaling aggregation module 121 has stopped importing real-time signaling. If the signaling aggregation module 121 has stopped importing real-time signaling, step S506 is entered. If the signaling aggregation module 121 has not stopped importing real-time signaling, step S502 is executed again.

In step S506, the real-time analysis module 123 may perform key field screening on the real-time signaling in the real-time signaling set. The storage medium 120 may store a key field list recording one or more key fields. The real-time analysis module 123 can extract the data of the key fields in the real-time signaling according to the key field list, and delete the data of the fields that are not key fields.

In step S507, the real-time analysis module 123 may perform filtering and coding on the real-time signaling in the real-time signaling set. The real-time analysis module 123 can filter the real-time signaling set according to the key field list.

In one embodiment, the real-time analysis module 123 can filter real-time signaling with missing values. Specifically, the instant signaling in the instant signaling set may include one or more fields. If one or more fields of the real-time signaling contains the information of all key fields recorded in the key field list, it means that the real-time signaling contains necessary data. Accordingly, the real-time analysis module 123 may not filter the real-time signaling. Relatively speaking, if one or more fields of the real-time signaling does not contain the information of a certain key field recorded in the key field list, it means that the real-time signaling lacks necessary data. Accordingly, the real-time analysis module 123 can filter the real-time signaling.

In one embodiment, the real-time analysis module 123 can filter real-time signaling that contains data of the wrong type. Specifically, the key field list may further record the format corresponding to the content of the key field. The instant signaling in the instant signaling set may include fields and content corresponding to the fields. The real-time analysis module 123 can determine whether the format of the field content of the real-time signaling matches the key field list. If the format matches the key field list, the real-time analysis module 123 may not filter the real-time signaling. If the format does not match the key field list, the real-time analysis module 123 can filter the real-time signaling.

The real-time analysis module 123 can determine the encoding method of the corresponding content according to the fields in the real-time signaling, and perform encoding on the content according to the encoding method. After completing the encoding, the real-time analysis module 123 can perform minimum and maximum normalization on the encoded content, linearly converting the value of the content to the [0,1] interval to unify the range of data values.

In step S508, the real-time analysis module 123 may determine whether the real-time signaling in the real-time signaling set matches the normality model 40, where the normality model 40 and the real-time signaling set correspond to the same time period. For example, if the signaling aggregation module 121 receives a real-time signaling aggregation during a specific period (for example: 10:00~12:00), the real-time analysis module 123 obtains a real-time signal from multiple normal models in the storage medium 120 In 40, a normal model 40 corresponding to the specific time period (for example: 10:00~12:00) is selected for comparison with the instant signaling set to determine whether the two match. If the immediate signaling matches the normality model 40, step S512 is entered. If the immediate signaling does not match the normal model 40, step S509 is entered.

Specifically, the real-time analysis module 123 can perform grouping (for example, using a density grouping algorithm or an unsupervised machine learning algorithm) on the historical signaling set and the real-time signaling set used to train the normality model 40 to obtain the grouping. As a result, the historical signaling set and the instant signaling set need to correspond to the same time period (for example: 10:00~12:00). Then, the real-time analysis module 123 can determine whether the clustering results include abnormal clusters. If the number of clusters included in the clustering results is greater than the number of clusters in the normal model 40, the real-time analysis module 123 may determine that the above-mentioned clustering results include non-normal clusters. The number of clusters in the non-normal clusters may be equal to the number of clusters of the clustering results minus the number of clusters of the normal model 40 .

Table 3 is an example of the grouping results of the historical signaling set and the immediate signaling set. Taking Tables 2 and 3 as examples, since the number of clusters included in the clustering results (i.e., M+1 clusters) is greater than the number of clusters in the normal model 40 (i.e., M clusters), the real-time analysis module 123 can determine the clustering results. Contains 1 non-normal cluster. In one embodiment, the real-time analysis module 123 may determine which clusters in the clustering results are non-normal clusters based on the shortest distance between the clusters in the clustering results and all clusters in the normality model 40 . For example, the real-time analysis module 123 can calculate the distance between cluster #2-(M+1) in the clustering result and each cluster in the normal model 40, and then obtain the corresponding cluster #2-(M+1) the shortest distance. If the shortest distance corresponding to cluster #2-(M+1) is greater than the shortest distance corresponding to other clusters in the clustering results (for example: cluster #2-1, #2-2 or #2-M), then analyze immediately Module 123 can determine that cluster #2-(M+1) is an abnormal cluster. table 3 Cluster #2-1 Cluster #2-2 … Cluster #2-M Cluster #2-(M+1) (non-normal)

In step S509, the real-time analysis module 123 may determine that the real-time signaling in the non-normal cluster does not match the normal model 40. Then, the automatic dial test module 124 can perform a dial test on the door number corresponding to the instant signaling in the non-normal cluster. The automatic dialing module 124 can control telephones or switches in different areas (for example, areas 210, 220, or 220) to dial the door number, so as to generate a large amount of signaling related to the door number in the telecommunications network 200. The signaling collection module 121 can collect the signaling related to the door number from the telecommunications network 200 through the transceiver 130 as a dial test signaling set. The system 10 can increase the number of signaling samples of door numbers belonging to the non-normal cluster by executing step S509, so as to determine whether the door number is abnormal based on richer data.

In step S510, the real-time analysis module 123 may perform screening, filtering and encoding of key fields on the dial-test signaling in the dial-test signaling set. The method of performing filtering, filtering and encoding of key fields is similar to the method recorded in step S506 or step S507, and therefore will not be described again here.

In step S511, the real-time analysis module 123 may determine whether the door number is abnormal based on the door number's historical signaling set, real-time signaling set, and dial test signaling set. The real-time analysis module 123 can perform grouping (for example, using a density grouping algorithm or an unsupervised machine learning algorithm) on the historical signaling set, the real-time signaling set, and the dial test signaling set to obtain the grouping results, and can determine Which clusters in the clustering results are abnormal clusters.

The real-time analysis module 123 can obtain reference signaling from each cluster of the grouping result. Table 4 is an example of the grouping results of the historical signaling set, the immediate signaling set and the dial test signaling set. In this embodiment, it is assumed that the clustering result contains M+2 clusters. Clustering results can contain unusual clusters. The number of clusters in the abnormal cluster may be equal to the number of clusters of the clustering result minus the number of clusters of the normal model 40 (i.e.: (M+2)-M=2). Table 4 Cluster #3-1 Cluster #3-2 … Cluster #3-M Cluster #3-(M+1) (Exception) Cluster #3-(M+2) (Exception)

Specifically, the real-time analysis module 123 can randomly select reference signaling from M+2 clusters, that is, the real-time analysis module 123 can obtain a total of M+2 reference signaling. On the other hand, the real-time analysis module 123 can randomly select historical reference signaling from the M clusters of the normal model 40 , that is, the real-time analysis module 123 can obtain a total of M historical reference signaling.

The real-time analysis module 123 can calculate the maximum similarity between each reference signaling and all historical reference signaling, and can select abnormal clusters from the grouping results based on the maximum similarity. Taking the selection of abnormal clusters from cluster #3-(M+1) and cluster #3-1 as an example, the real-time analysis module 123 can calculate M clusters of cluster #3-(M+1) and the normal model 40 (for example: M similarities between clusters #1-1, #1-2, or #1-M) and select the maximum similarity from the M similarities. On the other hand, the real-time analysis module 123 can calculate M similarities between cluster #3-1 and the M clusters of the normal model 40, and select the maximum similarity from the M similarities. If the maximum similarity corresponding to cluster #3-1 is greater than that corresponding to cluster #3-(M+1), the real-time analysis module 123 may select from cluster #3-1 and cluster #3-(M+1) Cluster #3-(M+1) serves as the abnormal cluster. The real-time analysis module 123 may perform the above steps for the remaining clusters in the clustering results (that is, other clusters that have not been determined to be abnormal clusters) to select another abnormal cluster. The real-time analysis module 123 can repeatedly perform the above steps until 2 abnormal clusters are selected from the M+2 clusters of the clustering results, where the 2 abnormal clusters are, for example, cluster #3-(M shown in Table 4 +1) or cluster #3-(M+2).

After finding the abnormal cluster, the real-time analysis module 123 can find the root cause of the abnormality for the abnormal cluster. Specifically, the real-time analysis module 123 can calculate the similarity between the reference signaling of the abnormal cluster and all historical reference signaling of the normal model 40, and find the maximum similarity from all the obtained similarities. The real-time analysis module 123 can compare the difference between the historical reference signaling corresponding to the maximum similarity and the reference signaling of the abnormal cluster, and search the abnormal event database 30 based on the difference to obtain the root cause of the abnormality.

Taking cluster #3-(M+1) as an example, the real-time analysis module 123 can calculate the reference signaling of cluster #3-(M+1) and the cluster #1-1, cluster #1-2, ..., cluster #1-M and other M historical reference signalings to obtain M similarities. If the similarity between the reference signaling of cluster #3-(M+1) and the historical reference signaling of cluster #1-M is the maximum similarity between M similarities, then the real-time analysis module 123 can Compare the difference between the reference signaling of cluster #3-(M+1) and the historical reference signaling of cluster #1-M (ie: the reference signaling with the greatest similarity and the historical reference signaling). For example, the real-time analysis module 123 can compare the reference signaling and the historical reference signaling and find that one or more fields of the two records different contents. The real-time analysis module 123 may define the reference signaling of cluster #3-(M+1) as abnormal signaling, and define one or more fields recording different contents as abnormal fields. For example, if the customer identifier field of the reference signaling and the customer identifier field of the historical reference signaling record different contents, the real-time analysis module 123 can define the customer identifier field of the reference signaling as Exception field. Based on steps similar to the above, the real-time analysis module 123 can obtain the abnormal signaling and abnormal fields corresponding to cluster #3-(M+2).

The abnormal event database 30 may record a mapping relationship between one or more abnormal fields of one or more abnormal signaling and the root cause of the abnormal door number. The real-time analysis module 123 can search the abnormal event database 30 according to the obtained abnormal signaling and its abnormal fields, so as to obtain the root cause corresponding to the abnormal signaling and its abnormal fields. Then, the real-time analysis module 123 can output the abnormal status data structure including the root cause of the abnormal door number through the transceiver 130 . Table 5 is an example of the abnormal status data structure. The example in Table 5 assumes that the number of abnormal clusters is K (K can be a positive integer), so the real-time analysis module 123 can obtain abnormal signaling from K abnormal clusters respectively to obtain K abnormal signaling. The abnormal status summary field can record the root cause of the abnormal door number. table 5 Exception status identifier start time end time customer identifier Abnormal door number Exception Signaling #1 One or more exception fields #1 One or more anomalous content #1 Exception status summary Exception signaling #2 One or more exception fields #2 One or more anomalous content #2 … … … Abnormal signaling #K One or more exception fields#K One or more anomalous content#K

In step S512, the system 10 may complete the process of step S340.

FIG. 6 illustrates a flow chart of a method for root cause analysis of abnormal door numbers according to an embodiment of the present invention, wherein the method can be implemented by the system 10 shown in FIG. 1 . In step S601, an abnormal event database, a historical signaling set, and a normality model corresponding to the historical signaling set are obtained. In step S602, receive the instant signaling set, and determine whether the first instant signaling in the instant signaling set matches the normal model. In step S603, in response to the first instant signaling not matching the normal model, a dial test is performed for the door number corresponding to the first instant signaling. In step S604, a dial test signaling set corresponding to the dial test is received. In step S605, clustering is performed on the historical signaling set, the immediate signaling set and the dial test signaling set to obtain a first clustering result including abnormal clusters. In step S606, the abnormal event database is searched according to the abnormal cluster to obtain the root cause corresponding to the abnormal cluster, and an abnormal status data structure including the root cause is output.

The system and method for root cause analysis of abnormal door numbers provided by the present invention mainly detect abnormal signaling of important telecommunication door numbers by monitoring telecommunications network packets, and analyze their abnormal root causes. The root cause analysis results can be used as a key technology for telecommunications network maintenance and troubleshooting, and can also be linked to other systems such as alarm notifications, automatic repairs, and archiving statistics. When compared with other conventional technologies, the present invention has the following benefits and advantages.

(1) The present invention adopts unsupervised machine learning algorithm modeling and analysis, and can determine the occurrence and cause of abnormal events without manually labeling huge signaling data in advance. Therefore, the present invention can reduce the amount of manual work in advance to a minimum and provide another aspect of monitoring and analysis to assist network administrators in maintaining and operating the network.

(2) This invention can filter, clean, and encode important fields of historical signaling such as door numbers, packet types, and response codes before an abnormal state occurs, thereby improving the effectiveness of machine learning. The present invention can establish a normal model based on historical data and allow the normal model to learn the signaling normality that the network should have. When abnormal signaling is detected, the system of the present invention can immediately notify maintenance and operation personnel, allowing maintenance and operation personnel to grasp the full picture of abnormal events more quickly.

(3) When an abnormal state occurs, the present invention can analyze the abnormal signaling in the telecommunications network to prompt the occurrence of the abnormality, and provide important information such as door number, customer name, signaling type, response code or source equipment. information to improve the timeliness and accuracy of obstacle notifications.

(4) After an abnormal state occurs, the present invention can perform a dial-in test on the important door number where the abnormality occurred, and then analyze the abnormal packets, fields and contents based on real-time signaling and historical signaling, and extract the data from the abnormal event database. Query the root cause of obstacles, assist maintenance personnel in determining obstacles, and reduce the time required to eliminate obstacles.

To sum up, the present invention can be applied in the field of obstacle detection. For example, the present invention can grasp the occurrence of obstacles through detected abnormal signaling and packets, and then automatically dial and query the door number where the abnormality occurs. Exception fields and contents. The present invention can further analyze the root causes of obstacles based on the data in the abnormal event database to improve the timeliness and accuracy of obstacle elimination. On the other hand, the present invention can also be used for value-added services. For example, the present invention can learn the normal signaling pattern of an important phone number to avoid peak hours and maintain circuits or recommend exclusive phone bill plans to customers based on the normal signaling pattern. .

10:System 110: Processor 120:Storage media 121: Signaling aggregation module 122:Offline modeling module 123:Real-time analysis module 124: Automatic dial test module 130:Transceiver 20:Signaling database 200:Telecom network 210, 220, 230: Area 30: Abnormal event database 40:Normal model S310, S320, S330, S340, S401, S402, S403, S404, S405, S406, S407, S408, S409, S501, S502, S503, S504, S505, S506, S507, S508, S509, S510, S511, S5 12. S601, S602, S603, S604, S605, S606: steps

FIG. 1 is a schematic diagram of a system for root cause analysis of abnormal door numbers according to an embodiment of the present invention. FIG. 2 is a schematic diagram illustrating the deployment of a signaling aggregation module according to an embodiment of the present invention. FIG. 3 illustrates a flow chart of a method for root cause analysis of abnormal door numbers according to an embodiment of the present invention. FIG. 4 illustrates a detailed flowchart of step S330 according to an embodiment of the present invention. FIG. 5 illustrates a detailed flowchart of step S340 according to an embodiment of the present invention. FIG. 6 illustrates a flow chart of a method for root cause analysis of abnormal door numbers according to an embodiment of the present invention.

S601, S602, S603, S604, S605, S606: steps

Claims (14)

A system for root cause analysis of abnormal door numbers, including: a transceiver; a storage medium that stores multiple modules, an abnormal event database, a historical signaling set, and a normal model corresponding to the historical signaling set; and A processor is coupled to the storage medium and the transceiver, and accesses and executes the plurality of modules, wherein the plurality of modules includes: a signaling aggregation module, which receives instant messages through the transceiver. command set; a real-time analysis module to determine whether the first real-time signaling in the real-time signaling set matches the normal model; and an automatic dialing test module to respond to the first real-time signaling and the normal The model does not match and a dialing test is performed for the door number corresponding to the first instant signaling, wherein the signaling collection module receives a dialing test signaling set corresponding to the dialing test through the transceiver, wherein the The real-time analysis module performs grouping on the historical signaling set, the real-time signaling set and the dial test signaling set to obtain a first grouping result including abnormal clusters, wherein the real-time analysis module performs grouping according to the The anomaly cluster searches the anomaly event database to obtain a root cause corresponding to the anomaly cluster, and outputs an anomaly status data structure including the root cause through the transceiver; wherein the first grouping result includes a first cluster and the second cluster, The real-time analysis module obtains first reference signaling from the first cluster, obtains second reference signaling from the second cluster, and obtains at least one historical reference signaling from the normal model, wherein the The real-time analysis module calculates a first maximum similarity between the first reference signaling and the at least one historical reference signaling, and calculates a first maximum similarity between the second reference signaling and the at least one historical reference signaling. a second maximum similarity, wherein in response to the second maximum similarity being greater than the first maximum similarity, the real-time analysis module selects the first first cluster from the first cluster and the second cluster. cluster as the anomaly cluster. The system according to claim 1, wherein the at least one historical reference signaling includes a first historical reference signaling and a second historical reference signaling, wherein the real-time analysis module calculates the relationship between the first reference signaling and the a first similarity between the first historical reference signaling, and calculating a second similarity between the first reference signaling and the second historical reference signaling, wherein in response to the first similarity Greater than the second similarity, the real-time analysis module compares the first difference between the first reference signaling and the first historical reference signaling, and searches for the abnormal event based on the first difference database to obtain the root cause. The system according to claim 1, wherein the real-time analysis module performs grouping on the historical signaling set and the real-time signaling set to obtain a second grouping result, and determines the degree of the second grouping result. Whether the first cluster number is greater than the second cluster number of the normal model, wherein in response to the first cluster number being greater than the second cluster number, the real-time analysis module determines that the second clustering result includes non-normal Cluster, wherein the real-time analysis module determines that the first real-time signaling does not match the normal model based on the first real-time signaling being included in the abnormal cluster. The system of claim 1, wherein the plurality of modules further includes: an offline modeling module that performs grouping on the historical signaling set to generate the normality model. The system according to claim 4, wherein the offline modeling module performs grouping on the historical signaling set according to a density grouping algorithm. The system of claim 4, wherein the storage medium further stores a key field list, and before performing grouping on the historical signaling set, the offline modeling module filters all the key fields based on the key field list. Described historical signaling collection. The system of claim 6, wherein the historical signaling in the historical signaling set includes at least one field, and the offline modeling module determines whether the at least one field includes the key field list The first key field in , wherein in response to the at least one field not including the first key field, the offline modeling module filters the historical signaling. The system according to claim 6, wherein the historical signaling in the historical signaling set includes a field and the content of the field, wherein The offline modeling module determines whether the format of the content matches the key field list, wherein in response to the format not matching the key field list, the offline modeling module filters the history signaling. The system of claim 4, wherein the historical signaling in the historical signaling set includes a field and the content of the field, wherein the offline modeling before performing grouping on the historical signaling set The module determines the encoding method of the content according to the field, and performs encoding on the content according to the encoding method. The system of claim 6, wherein the storage medium further stores a list of important door numbers, wherein the signaling aggregation module receives a plurality of historical signalings through the transceiver, and in response to the plurality of historical signaling The door number of the first historical signaling in the order matches the important door number list, and the offline modeling module obtains the historical signaling set according to the first historical signaling. The system of claim 1, wherein the storage medium further stores a list of important door numbers, and the door number of the real-time analysis module in response to the first real-time signaling matches the list of important door numbers. And determine whether the first instant signaling matches the normal model. The system of claim 1, wherein the storage medium stores a plurality of normality models including the normality model, and wherein the signaling aggregation module receives the real-time signaling set during the first period, The real-time analysis module selects the normal model corresponding to the first period from the plurality of normal models to determine whether the first real-time signaling matches the normal model. The system according to claim 4, wherein the offline modeling module updates the normality model according to a preset period. A method for root cause analysis of abnormal door numbers, including: obtaining an abnormal event database, a historical signaling set, and a normality model corresponding to the historical signaling set; receiving an instant signaling set, and judging the instant signaling set. Whether the first instant signaling in the command set matches the normal model; in response to the first instant signaling not matching the normal model, performing a dial test for the door number corresponding to the first instant signaling ; Receive a dial test signaling set corresponding to the dial test; perform grouping on the historical signaling set, the immediate signaling set and the dial test signaling set to obtain a first grouping result including an abnormal cluster, The first grouping result includes a first cluster and a second cluster, first reference signaling is obtained from the first cluster, second reference signaling is obtained from the second cluster, and at least one is obtained from the normal model. A historical reference signaling, calculating the first maximum similarity between the first reference signaling and the at least one historical reference signaling, and calculating the second reference signaling and the at least one historical reference signaling. a second maximum similarity between them, in response to the second maximum similarity being greater than the first maximum similarity, from the first group Select the first cluster from the set and the second cluster as the anomaly cluster; and search the anomaly event database according to the anomaly cluster to obtain the root cause corresponding to the anomaly cluster, and output including the anomaly cluster. The abnormal status data structure describing the root cause.

Images