Three-layer integrated operation and maintenance method and system for IMS (IP Multimedia Subsystem) service

Abstract

The invention discloses an IMS service-oriented three-layer integrated operation and maintenance method and system, and the system comprises a resource layer construction module, a container layer construction module, a service layer construction module, a three-layer cooperation module, a big data analysis module, and a fault self-healing module. The resource layer construction module is connected with the container layer construction module, the service layer construction module is connected with the container layer construction module, the three-layer cooperation module is connected with the resource layer construction module, the container layer construction module and the service layer construction module, the big data analysis module is connected with the three-layer cooperation module, and the fault self-healing module is connected with the big data analysis module. The method has the advantages of high collaboration and high data consistency; the IMS signaling packet capture and analysis technology and the K-means method are adopted to effectively optimize operation indexes, network abnormity is recognized, fault self-recovery is carried out, and the method has the advantages of being high in efficiency and intelligent.

Description

Technical Field

[0001] The present invention relates to the field of power systems, and specifically to a three-layer integrated operation and maintenance method and system for IMS services. Background Art

[0002] With the continuous improvement of the informatization level of power enterprises, the IMS architecture has entered the mature stage in terms of standards, and can basically meet the needs of operators for the development of multimedia services. At the same time, it is gradually developing from multi-level tandem connection to flattening, requiring the operation and maintenance system to have stronger centralized management and control capabilities to achieve real-time monitoring and rapid response to the entire network.

[0003] Compared with traditional networks, the diversification of access methods and multiple bearer networks in IMS make the operation and maintenance of IMS service opening more difficult, and end-to-end full-process operation and maintenance management needs to be achieved. In terms of IMS operation and maintenance and repair, automated operation and maintenance detection means are required to realize intelligent patrol inspection of IMS terminals and networks, signaling process monitoring and intelligent fault location means to assist operation and maintenance personnel to timely discover and eliminate system faults and ensure the normal operation of the system.

[0004] Chinese Patent with Publication No. CN110851414B discloses a method and system for boundary data analysis by clustering method. Key variables and thresholds are preset in various log data generated by boundary data exchange behaviors, and then the data is classified by a clustering algorithm to obtain a clustering analysis result. Then, the data generated by new boundary data exchange behaviors is subjected to clustering analysis, and the obtained result is compared with the established form to discover outliers and make identifications and statistics, and an alarm is given after exceeding the threshold. The system includes a data collection module, a variable analysis and storage module, a clustering analysis module, a clustering analysis result storage module, a clustering analysis result comparison module, an outlier identification module, an outlier identification times statistics module, and an alarm module. The above invention mainly focuses on data clustering analysis and anomaly detection of boundary data, does not involve a three-layer integrated operation and maintenance system for IMS services, and has low resource utilization efficiency. Therefore, it is urgent for those skilled in the art to solve the above technical problems. Summary of the Invention

[0005] The purpose of the present invention is to provide a three-layer integrated operation and maintenance method and system for IMS services, in which the coordination between various service layers in IMS services is poor and the resource utilization rate is low.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: A three-layer integrated operation and maintenance method for IMS services, including the following steps:

[0007] Step S1: Construct a resource layer to provide infrastructure resources such as computing resources, storage resources, network resources, and operating system resources, and realize dynamic allocation and flexible scheduling of resources through virtualization technology;

[0008] Step S2: Build a container layer to provide a containerized running environment above the resource layer, and achieve automated deployment, management, and monitoring of containers through container orchestration technology;

[0009] Step S3: Build a business layer to provide specific applications and services of the IMS business above the container layer, achieve rapid deployment and upgrade of the business by invoking the containerized running environment provided by the container layer, and at the same time use operation and maintenance management tools and technologies to perform intelligent monitoring and management of the business;

[0010] Step S4: Achieve collaborative work among the three layers. Through defining clear interfaces and protocols, achieve information interaction and collaborative work among the R & D resource layer, container layer, and business layer, and ensure the correctness of data flow and business logic among the layers;

[0011] Step S5: Achieve anomaly diagnosis and self-healing of faults. Use machine learning algorithms and big data technologies to analyze IMS signaling, monitor the IMS business process in real time, quickly locate faults, timely discover and handle potential problems, and at the same time, through intelligent diagnosis and prediction algorithms, achieve self-healing and rapid recovery of faults.

[0012] By adopting the above technical solutions, the resource layer realizes dynamic allocation of computing, storage, network, and operating system resources through virtualization technology, improves resource utilization rate, avoids resource waste, supports flexible scheduling and dynamic expansion of resources, meets the requirements of IMS business for elastic adjustment of resources, the container layer provides a standardized running environment, supports rapid deployment and update of IMS business, shortens the business go-live cycle, container orchestration technology realizes automated deployment, management, and monitoring of containers, reduces the complexity of manual operations, improves operation and maintenance efficiency, the business layer uses intelligent operation and maintenance tools to monitor the status, performance, and signaling process of IMS business in real time, ensures the stable operation of the system, and through machine learning and big data technologies, quickly locates the root cause of faults and triggers the fault self-healing mechanism, reducing system downtime.

[0013] Furthermore, the method for building the resource layer in step S1 is specifically as follows:

[0014] Build the resource layer for the IMS high-concurrency and low-latency scenario, adopt a combination of a processor and an acceleration card, and perform hardware acceleration for SIP protocol processing;

[0015] Deploy a distributed storage cluster to improve the ability to access user data with low latency and high concurrency;

[0016] Configure a replication mechanism to ensure data reliability;

[0017] Adopt an NVMe SSD storage pool to process real-time session data;

[0018] Deploy intelligent network cards to support SR-IOV virtualization;

[0019] Adopt Open vSwitch accelerated by DPDK to separate the signaling plane from the control plane;

[0020] Set the highest priority queue for SIP signaling traffic;

[0021] Build a virtualization layer, allocate exclusive instances for different IMS network elements, and adopt an auto-scaling algorithm based on the SIP message rate as the dynamic scheduling strategy.

[0022] By adopting the above technical solutions, integrate and optimize computing, storage, and network resources through virtualization technology to avoid resource idleness and waste. The resource monitoring tool monitors the resource usage in real time, combines with the intelligent scheduling algorithm, dynamically optimizes resource allocation, improves the overall efficiency. The virtualization technology supports on-demand resource allocation, realizes flexible resource scaling, meets the dynamic demand changes of IMS services for resources. The virtualized network configuration enhances the security and flexibility of network resources, provides a stable connection for the service. Deploy a virtualized storage solution, centrally manage the scattered storage resources, realize unified scheduling and dynamic allocation, simplify the operation and maintenance process, comprehensively evaluate the existing resources, formulate a planning plan in combination with business requirements to ensure that the resource configuration meets the needs of existing and future business development. The resource layer has good scalability and can quickly increase the required resources according to business growth to ensure service continuity.

[0023] Further, the method for building the container layer in step S2 is specifically as follows:

[0024] Build a container layer adapted to the IMS microservice architecture, adopt the Kubernetes multi-cluster federation architecture, where each major region deploys an independent cluster, and achieve cross-region load balancing through ClusterAPI;

[0025] The main network uses the Calico BGP mode to achieve Pod cross-node communication, and the auxiliary network uses Multus CNI to allocate an independent network plane for media streams;

[0026] Configure SIP transaction fusing based on Hystrix.

[0027] By adopting the above technical solutions, the containerized operating environment supports rapid deployment and migration, enabling the IMS service to adapt to dynamic resource demand changes. The microservices transformation splits the IMS service into independent modules, supporting on-demand expansion and update, reducing the impact on the overall system. Configuring a container orchestration tool (such as Kubernetes) enables automated deployment, management, and monitoring of containers, reducing manual operations and improving operation and maintenance efficiency. The automated load balancing function ensures the reasonable distribution of business traffic among containers, enhancing system performance and reliability. The container orchestration technology supports automatic restart, expansion, and fault recovery, ensuring the high availability of the service. The microservices management tool realizes the automated processing of service registration and configuration, ensuring the stability of communication between business modules. Configuring network isolation and permission control policies ensures the security of communication between containers, reducing the risk of security vulnerabilities. Container security scanning tools (such as Clair, Trivy) perform security detection on images, promptly discovering and fixing potential vulnerabilities, and enhancing the overall security level of the system.

[0028] Further, the method for constructing the service layer in step S3 is specifically as follows:

[0029] Construct a service layer for the IMS core business, adopt a hierarchical deployment mode as the service deployment structure, from the terminal device to the edge access layer, through the SIP signaling to the regional service layer, and then to the media forwarding layer or from Diameter to the core data layer cluster;

[0030] Track the intermediate key through the SIP message and configure a signaling tracking system;

[0031] In the fault switching process, the response latency of the CSCF node is monitored in real time. When the latency exceeds a certain threshold within a certain period of time, the Pod eviction is automatically triggered and migrated to a healthy node. The VIP pointing is adjusted through BGPAnycast, and finally the session state is restored from the standby node.

[0032] By adopting the above technical solutions, the containerized operating environment supports rapid deployment and migration, enabling the IMS service to adapt to dynamic resource demand changes. The microservices transformation splits the IMS service into independent modules, supporting on-demand expansion and update, reducing the impact on the overall system. Configuring a container orchestration tool (such as Kubernetes) realizes the automated deployment, management, and monitoring of containers, reduces manual operations, and improves operation and maintenance efficiency. The automated load balancing function ensures the reasonable distribution of business traffic among containers, enhancing system performance and reliability. The container orchestration technology supports automatic restart, expansion, and fault recovery, ensuring the high availability of the service. The microservices management tool realizes the automated processing of service registration and configuration, ensuring the stability of communication between business modules. Configuring network isolation and permission control policies ensures the security of communication between containers, reducing the risk of security vulnerabilities. Container security scanning tools (such as Clair, Trivy) perform security detection on images, promptly discovering and fixing potential vulnerabilities, and enhancing the overall security level of the system.

[0033] Further, the method for realizing the collaborative work among the three layers in step S4 is specifically as follows:

[0034] Between the resource layer and the container layer: Use the Kubernetes API as the resource allocation interface, Prometheus as the resource monitoring interface, Kubernetes as the resource scheduling interface, the Kubernetes API as the resource management protocol, the Prometheus Pull protocol as the resource monitoring protocol, and the internal protocol of the Kubernetes scheduler as the resource scheduling protocol;

[0035] Between the container layer and the business layer: Use the Kubernetes Service as the service discovery interface, gRPC as the service call interface, Prometheus + Grafana as the service monitoring interface, gRPC as the service call protocol, the Kubernetes DNS-based as the service discovery protocol, and the Prometheus Pull protocol as the service monitoring protocol;

[0036] Ensure the information interaction between the resource layer and the container layer: Through the Raft protocol of Etcd, ensure the data consistency between the resource layer and the container layer, and guarantee data storage and synchronization;

[0037] Use the EFK Stack for centralized log management, where Fluentd is responsible for collecting the logs of each layer, Elasticsearch stores the log data, and Kibana provides log query and visualization;

[0038] Use Alertmanager as the alarm system;

[0039] Monitor the IMS business process through Prometheus. After an anomaly is detected, trigger the Kubernetes Operator to perform fault repair.

[0040] By adopting the above technical solution, seamless docking and information interaction between the resource layer, container layer, and business layer are achieved through clearly defined interfaces (such as code repository interfaces, build tool interfaces, container management interfaces, etc.). Efficient collaboration can be carried out between layers, with accurate data flow and business logic processing, ensuring the functional integrity and operation efficiency of the overall system. Configuring the container management interface and resource monitoring interface enables automated management of containers and real-time monitoring of resource usage, further enhancing the intelligent capabilities of operation and maintenance. The build and deployment processes are automatically triggered between layers, reducing manual intervention, improving the automation level and response speed. Through the API Key mechanism and fine-grained permission control, the security of calls between layers is ensured, unauthorized access is avoided, sensitive data is encrypted during transmission and storage, effectively preventing data leakage and tampering, meeting high-security requirements. Configuring the resource interface and data access interface realizes dynamic allocation, access, and avoidance of resource waste. By real-time monitoring resource usage, resource allocation is adjusted and optimized in a timely manner, improving the overall resource utilization rate.

[0041] Further, the method for realizing anomaly diagnosis in step S5 is specifically as follows:

[0042] Select appropriate nodes in the IMS network for signaling packet capture, parse the captured signaling in real time, extract the key features of the signaling data and preprocess it, and organize it into feature vectors. First, use the elbow method to select the K value applicable to the K-means algorithm, and then perform the K-means algorithm on the signaling data based on the obtained feature vectors and K value for clustering analysis. Visualize the clustering results in the form of a scatter plot. By analyzing the signaling data features represented by the feature vectors of the cluster centers, define the types of abnormal registration call behaviors represented by the clusters, identify and predict faults within the nodes, and generate corresponding alarm information, specifically as follows:

[0043] Select the CSCF node in the IMS core network, use tcpdump to capture SIP signaling, parse the pcap file through Python and extract features, preprocess the corresponding data, convert it into a DataFrame, encode and standardize it;

[0044] Preset the K value range, calculate the SSE for different K values, draw the elbow curve, and select the K value corresponding to the inflection point of the curve where the SSE decline rate significantly slows down as the optimal number of clusters. Perform model training through Python, add the clustering results to the dataset, further reduce the dimension to 2D space and draw a scatter plot;

[0045] Set the inverse normalization clustering center, define the abnormal type with the feature pattern of high response code and long transaction time as server internal error, define the abnormal type with the feature pattern of normal response code and transaction time of 200 - 400 ms as normal business flow, define the abnormal type with the feature pattern of frequent REGISTER messages and abnormal Via hop count as malicious registration attack, and number the clusters corresponding to each abnormal type respectively;

[0046] Set the sliding window statistics, detect the proportion of abnormal clusters and set the alarm trigger condition to detect the logic in real time;

[0047] Establish an incremental update model for incremental learning optimization, calculate the correlation coefficient between features and clustering results for multi-dimensional feature correlation analysis, and further dynamically adjust based on the adaptive threshold of historical data.

[0048] By using the above technical solutions, through signaling packet capture and feature extraction, comprehensively collect the key data features in the IMS network to ensure the integrity and reliability of the basic data for anomaly detection. Adopt the K-means clustering analysis algorithm to accurately identify different types of registration call abnormal behaviors, improve the accuracy of fault identification. Select the optimal K value through the elbow method to optimize the effect of the clustering algorithm, be able to discover potential fault risk points in advance. The analysis results of the clustering center can help define the types of abnormal behaviors, realize the early prediction and prevention of faults, reduce the risk of service interruption. Combine clustering analysis with visual display, enabling operation and maintenance personnel to quickly locate the abnormal position, clearly understand the problem features, shorten the troubleshooting time. The system automatically generates alarm information and notifies relevant personnel in real time, greatly improving the fault response speed. With the help of the K-means algorithm and big data technology, signaling analysis and anomaly classification can be carried out without relying on manual experience, improving the intelligence level of operation and maintenance work. The automated anomaly diagnosis method reduces manual intervention, reduces labor costs and avoids human errors.

[0049] The present invention also discloses a three-layer integrated operation and maintenance system for IMS services, which uses the three-layer integrated operation and maintenance method for IMS services as the operation logic, including a resource layer construction module, a container layer construction module, a service layer construction module, a three-layer coordination module, a big data analysis module, and a fault self-healing module. The container layer construction module is connected to the resource layer construction module, the service layer construction module is connected to the container layer construction module, the three-layer coordination module is connected to the resource layer construction module, the container layer construction module, and the service layer construction module, the big data analysis module is connected to the three-layer coordination module, and the fault self-healing module is connected to the big data analysis module.

[0050] Furthermore, the resource layer provides underlying support for the entire operation and maintenance system. By providing infrastructure resources such as computing resources, storage resources, network resources, and operating system resources, it realizes the dynamic allocation and flexible scheduling of resources through virtualization technology, providing a stable and reliable basic environment for upper-layer applications;

[0051] The container layer is located above the R & D resource layer and is responsible for providing a containerized running environment, providing an isolated, secure, and efficient running environment for upper-layer business applications. Through container orchestration technology, it realizes the automated deployment, management, and monitoring of containers, ensuring the stable operation of business applications;

[0052] The business layer realizes the rapid deployment and upgrade of services by invoking the containerized running environment provided by the container layer, and at the same time provides functions such as service operation and maintenance, status tracking, signaling process monitoring, and fault self-healing.

[0053] By adopting the above technical solutions, through signaling packet capture and feature extraction, key data features in the IMS network are comprehensively collected to ensure the integrity and reliability of the basic data for anomaly detection. By using the K-means clustering analysis algorithm, different types of registration call anomaly behaviors can be accurately identified, improving the accuracy of fault identification. By using the elbow method to select the optimal K value, the effect of the clustering algorithm is optimized, potential fault risk points can be discovered in advance, and the analysis results of the cluster centers can help define the types of anomaly behaviors, realizing the early prediction and prevention of faults, reducing the risk of service interruption. The combination of clustering analysis and visual display enables operation and maintenance personnel to quickly locate the anomaly position, clearly understand the problem features, shorten the troubleshooting time, and the system automatically generates alarm information and notifies relevant personnel in real time, greatly improving the fault response speed.

[0054] Furthermore, the three-layer collaboration module is used to define clear interfaces and protocols between the resource layer, the container layer, and the business layer to ensure the correct transfer and interaction of information, configure the data flow path and business logic processing flow, ensure the correct flow and processing of data at each layer, and conduct comprehensive tests on the collaborative work between the three layers to ensure that the three layers can work together correctly and meet business requirements;

[0055] The big data analysis module is used to obtain IMS operation and maintenance-related data such as resources, environment, and signaling flowing between the resource layer, the container layer, and the business layer, identify and process abnormal data through big data analysis technology, and transmit the results to the fault self-healing module.

[0056] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0057] 1. Through the three - layer integrated architecture design of the resource layer, container layer, and service layer, the present invention defines clear interfaces and protocols, optimizes the data flow path, ensures the accuracy of information interaction between layers and the correctness of business logic, realizes efficient collaboration among the three layers, improves the stability and reliability of IMS services, optimizes operation indicators such as anomaly detection accuracy, false alarm rate, fault prediction lead time, and alarm classification fineness, and can effectively identify anomalies and faults such as SIP flooding attacks, core network element overload (long - term transaction clustering), routing anomalies, and media negotiation failures in the IMS network;

[0058] 2. The present invention utilizes big data analysis technology and machine learning algorithms to monitor IMS signaling and service processes in real - time, quickly identify anomalies and accurately locate problems, and achieve automated fault self - healing through intelligent diagnosis and prediction, reducing manual intervention and significantly improving operation and maintenance efficiency;

[0059] 3. The present invention adopts virtualization technology and containerization technology to realize dynamic allocation, flexible scheduling, and automated management of resources. Combining with microservice architecture and container orchestration technology, it improves system scalability and resource utilization rate, supports rapid deployment and upgrade of IMS services, and meets the changes in dynamic business requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 is a flowchart of the method of the present invention;

[0061] Figure 2 is a schematic block diagram of the system module composition of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0062] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0063] As Figure 1 shown, the present invention discloses a three - layer integrated operation and maintenance method for IMS services, including the following steps:

[0064] Step S1: Construct a resource layer to provide infrastructure resources such as computing resources, storage resources, network resources, and operating system resources, and realize dynamic allocation and flexible scheduling of resources through virtualization technology;

[0065] Step S2: Construct a container layer to provide a containerized running environment on top of the resource layer, and realize automated deployment, management, and monitoring of containers through container orchestration technology;

[0066] Step S3: Build the business layer, providing specific applications and services for the IMS service above the container layer, realizing the rapid deployment and upgrade of the service by invoking the containerized running environment provided by the container layer, and at the same time using operation and maintenance management tools and technologies to intelligently monitor and manage the service;

[0067] Step S4: Achieve collaborative work among the three layers. By defining clear interfaces and protocols, realize information interaction and collaborative work among the R & D resource layer, the container layer and the business layer, and ensure the correctness of data flow and business logic among the layers;

[0068] Step S5: Achieve exception diagnosis and self-healing of faults. Use machine learning algorithms and big data technologies to analyze IMS signaling, monitor the IMS service process in real time, quickly locate faults, timely discover and handle potential problems, and at the same time, through intelligent diagnosis and prediction algorithms, achieve self-healing and rapid recovery of faults.

[0069] The method of building the resource layer in Step S1 is specifically as follows:

[0070] First, conduct a comprehensive evaluation of IMS operation and maintenance resources, evaluate the existing computing resources, storage resources, network resources and operating system resources, and formulate a resource planning scheme according to the actual needs, operation scale and test environment of the IMS service;

[0071] Specifically: Build the resource layer for the IMS high-concurrency and low-latency scenario, adopt the combination of Intel Xeon Scalable processors + FPGA acceleration cards, and perform hardware acceleration for SIP protocol processing; Deploy a Ceph distributed storage cluster to provide low-latency and high-concurrency user data access capabilities for the HSS, and configure a 3-replica mechanism to ensure data reliability, and use an NVMe SSD storage pool to process real-time session data; Deploy 100Gbps intelligent network cards to support SR-IOV virtualization; Use DPDK-accelerated Open vSwitch to separate the signaling plane and the control plane; Set the highest-priority queue (DSCP 46) for SIP signaling traffic; Use KVM + Libvirt to build the virtualization layer, and allocate exclusive instances for different IMS network elements. Among them, the CSCF node is allocated 4 vCPUs / 16GB of memory / 10Gbps virtual network card, the MGCF node is configured with PCI Passthrough to dock with the PSTN gateway, and an automatic scaling algorithm based on the SIP message rate is used as the dynamic scheduling strategy.

[0072] The method of building the container layer in Step S2 is specifically as follows:

[0073] The construction of the container layer is based on the computing, storage and network resources provided by the resource layer. In this step, select appropriate container technologies to build a containerized running environment. The specific steps are as follows:

[0074] Build a service layer for IMS core services, adopt a hierarchical deployment mode as the service deployment structure, from the terminal device to the edge access layer, through SIP signaling to the regional service layer, and then to the media forwarding layer or from Diameter to the core data layer cluster;

[0075] Configure the signaling tracing system by tracking the intermediate key through SIP messages;

[0076] In the failover process, monitor and detect the response latency of the CSCF node in real time. When the latency exceeds a certain threshold within a certain period of time, automatically trigger Pod eviction and migrate to a healthy node, adjust the VIP pointing through BGPAnycast, and finally restore the session state from the standby node.

[0077] The method of building the service layer in step S3 is specifically as follows:

[0078] Utilize the containerized running environment provided by the container layer to quickly deploy IMS service applications. During the application deployment process, configure the database, middleware, and other service-dependent components to ensure the high availability and stability of the service;

[0079] Build a service layer for IMS core services, adopt a hierarchical deployment mode as the service deployment structure, from the terminal device to the edge access layer, through SIP signaling to the regional service layer (CSCF cluster), and then to the media forwarding layer (MRF container group) or from Diameter to the core data layer (HSS) cluster; configure the signaling tracing system by tracking the intermediate key through SIP messages; in the failover process, monitor and detect the response latency of the CSCF node in real time. When the latency exceeds a certain threshold (such as latency > 500ns for 10s continuously), automatically trigger Pod eviction and migrate to a healthy node, adjust the VIP pointing through BGPAnycast, and finally restore the session state from the standby node.

[0080] The method of realizing the collaborative work among the three layers in step S4 is specifically as follows:

[0081] When realizing the collaborative work of the resource layer, container layer, and service layer, ensure the smooth transfer and interaction of information between layers by defining clear interfaces and protocols. The specific methods are as follows:

[0082] Between the resource layer and the container layer: Use the Kubernetes API as the resource allocation interface, Prometheus as the resource monitoring interface, Kubernetes as the resource scheduling interface, the Kubernetes API (based on HTTP / 2 and gRPC) as the resource management protocol, the Prometheus Pull protocol (HTTP-based) as the resource monitoring protocol, and the internal protocol of the Kubernetes scheduler as the resource scheduling protocol.

[0083] Between the container layer and the business layer: Use Kubernetes Service as the service discovery interface, gRPC as the service invocation interface, Prometheus + Grafana as the service monitoring interface (Prometheus collects the running metrics of business services from the container layer and visualizes them through Grafana), gRPC (based on HTTP / 2) as the service invocation protocol, Kubernetes DNS-based as the service discovery protocol, and Prometheus Pull protocol (HTTP-based) as the service monitoring protocol.

[0084] Ensure information interaction between the resource layer and the container layer: Through the Raft protocol of Etcd, ensure data consistency between the resource layer and the container layer to guarantee data storage and synchronization; Use the EFK Stack for centralized log management, where Fluentd is responsible for collecting logs from each layer, Elasticsearch stores log data, and Kibana provides log query and visualization; Use Alertmanager (integrated with Prometheus) as the alerting system; Monitor the IMS business process through Prometheus, and trigger the Kubernetes Operator for fault repair after detecting anomalies.

[0085] The method for implementing anomaly diagnosis in step S5 is specifically as follows:

[0086] Select a CSCF node in the IMS core network, use tcpdump to capture SIP signaling, parse the pcap file through Python and extract features, preprocess the corresponding data, convert it into a DataFrame, encode and standardize it; preset the range of K values (such as 1-11), calculate the SSE for different K values, draw an elbow curve, and select the K value corresponding to the inflection point of the curve where the SSE decline rate significantly slows down as the optimal number of clusters. Conduct model training through Python, add the clustering results to the dataset, further reduce the dimension to 2D space and draw a scatter plot; set the inverse standardized clustering center, define the abnormal type with the feature pattern of high response code (5xx) and long transaction time (>800ms) as an internal server error, define the abnormal type with the feature pattern of normal response code (200OK) and transaction time of 200-400ms as a normal business flow, and define the abnormal type with the feature pattern of frequent REGISTER messages (>5 times / minute) and abnormal Via hops (>5) as a malicious registration attack, and number the clusters corresponding to each abnormal type respectively; set a sliding window statistic, detect the proportion of abnormal clusters and set an alarm trigger condition (such as the abnormal proportion is greater than the set threshold) for real-time detection logic; establish an incremental update model for incremental learning optimization, calculate the correlation coefficient between features and clustering results for multi-dimensional feature correlation analysis, and further dynamically adjust based on the adaptive threshold of historical data.

[0087] Optimized operation indicators such as abnormal detection accuracy, false alarm rate, fault prediction lead time, and alarm classification fineness, and can effectively identify anomalies and faults such as SIP flooding attacks (high-frequency REGISTER clusters), core network element overload (long-time transaction clusters), routing anomalies (high Via hop clusters), and media negotiation failures (abnormal Content-Length clusters) in the IMS network.

[0088] By analyzing the feature vectors of the clustering centers, they can be interpreted according to business requirements. Specifically as follows:

[0089] Normal behavior clustering: Some clustering centers may represent normal registration and call behaviors. The feature vectors of these clusters may be regular, such as the response time within a certain range, normal status code, stable request timestamp interval, etc.

[0090] Abnormal behavior clustering: Other clustering centers may represent abnormal call behaviors or fault types. The feature vectors of these clusters may be manifested as abnormal timestamps, too long response times, frequent error status codes (such as 5xx or 4xx), abnormal request headers, etc.

[0091] Based on the clustering results, the characteristics of registration and call behaviors represented by different clusters can be defined:

[0092] Normal behavior of registered calls: The request timestamp intervals are relatively regular, the response times are within the normal range, and the status codes are 200 or other status codes indicating success.

[0093] Abnormal behavior of registered calls: The request timestamp intervals are irregular, the response times are significantly longer than the normal range, and the status codes are frequently 4xx or 5xx, which may indicate system failures, network delays, or request errors.

[0094] Based on the results of K-means clustering, the system can diagnose anomalies in the IMS network:

[0095] Abnormal cluster identification: By analyzing the cluster centers, potential abnormal clusters are identified. For example, some clusters may indicate situations of registered call failures, such as high response times, error status codes, etc.

[0096] Fault diagnosis: Through further analysis of abnormal clusters and combined with information such as network status and resource usage, the system diagnoses potential faults in IMS nodes. Combining historical data and trend analysis, the system can also predict possible faults and intervene in advance.

[0097] Alarm generation and handling: Once abnormal clusters or potential faults are identified, the system can generate alarm information to notify operation and maintenance personnel or automatically perform fault recovery operations;

[0098] Fault self-healing and recovery: Based on the fault diagnosis results, the system automatically adjusts resources through intelligent prediction and self-healing algorithms, quickly restores the normal operation of IMS services, reduces human intervention, and improves system reliability;

[0099] In the test environment, select the relevant nodes of P-CSCF, I-CSCF, and S-CSCF in the IMS network. Use Wireshark as the signaling packet capture tool, configure the packet capture environment to ensure that the packet capture device has sufficient permissions to capture all passing network traffic, set the filter to capture only SIP protocol data packets, and deploy Wireshark on the selected nodes for signaling packet capture;

[0100] Export the captured signaling data packets as PCAP files. Write scripts in Python, use the scapy library or pyshark library to read the PACP files, and parse the SIP registration requests and their response messages. Extract the request timestamp, response time, status code, and header information in the request as key data features from the unpacked data. Remove the invalid data records that only contain requests but no responses or have a response status code of Timeout. At the same time, to ensure that all features have the same weight in the clustering process, standardize the data, construct each data record as a feature vector, and establish a feature vector set;

[0101] As shown in Figure 2 the figure, the present invention also discloses a three - layer integrated operation and maintenance system for IMS services, including a resource layer construction module, a container layer construction module, a service layer construction module, a three - layer coordination module, a big data analysis module, and a fault self - healing module. The container layer construction module is connected to the resource layer construction module, the service layer construction module is connected to the container layer construction module, the three - layer coordination module is connected to the resource layer construction module, the container layer construction module, and the service layer construction module, the big data analysis module is connected to the three - layer coordination module, and the fault self - healing module is connected to the big data analysis module.

[0102] The resource layer is the underlying support for the entire operation and maintenance system, mainly responsible for providing infrastructure resources such as computing resources, storage resources, network resources, and operating system resources. Through virtualization technology, it realizes the dynamic allocation and flexible scheduling of resources, providing a stable and reliable basic environment for upper - layer applications;

[0103] The container layer is above the R & D resource layer, mainly responsible for providing a containerized running environment, providing an isolated, secure, and efficient running environment for upper - layer business applications. Through container orchestration technology, it realizes the automated deployment, management, and monitoring of containers, ensuring the stable operation of business applications;

[0104] The service layer is mainly responsible for realizing the rapid deployment and upgrade of services by invoking the containerized running environment provided by the container layer, and at the same time provides service operation and maintenance, status tracking, signaling process monitoring, and fault self - healing functions.

[0105] The three - layer coordination module is used to define clear interfaces and protocols between the resource layer, the container layer, and the service layer, ensure that information can be correctly transmitted and interacted, configure the data flow path and business logic processing flow, ensure that the data of each layer can be correctly flowed and processed, and conduct a comprehensive test on the collaborative work between the three layers to ensure that the layers can correctly cooperate and meet business requirements;

[0106] The big data analysis module is used to obtain IMS operation and maintenance related data such as resources, environment, and signaling flowing between the resource layer, the container layer, and the service layer, identify and process abnormal data through big data analysis technology, and transmit the results to the fault self - healing module.

[0107] The above are only the preferred embodiments of the present invention and are not used to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, for those skilled in the art, they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent substitution on some of the technical features. Any modification, equivalent substitution, and improvement made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A three - layer integrated operation and maintenance method for IMS services, characterized in that It includes the following steps: Step S1: Build a resource layer to provide infrastructure resources such as computing resources, storage resources, network resources, and operating system resources, and achieve dynamic allocation and flexible scheduling of resources through virtualization technology; Step S2: Build a container layer to provide a containerized running environment on top of the resource layer, and achieve automated deployment, management, and monitoring of containers through container orchestration technology; Step S3: Build a business layer to provide specific applications and services of the IMS service on top of the container layer, achieve rapid deployment and upgrade of the service by invoking the containerized running environment provided by the container layer, and at the same time use operation and maintenance management tools and technologies to perform intelligent monitoring and management of the service; Step S4: Achieve collaborative work among the three layers, and achieve information interaction and collaborative work among the R & D resource layer, container layer, and business layer by defining clear interfaces and protocols, ensuring the correctness of data flow and business logic among the layers; Step S5: Achieve anomaly diagnosis and fault self-healing. Use machine learning algorithms and big data technologies to analyze IMS signaling, monitor the IMS service process in real time, quickly locate faults, discover and handle potential problems in a timely manner, and at the same time achieve self-healing and rapid recovery of faults through intelligent diagnosis and prediction algorithms.

2. The three - layer integrated operation and maintenance method for IMS services according to claim 1, characterized in that, The method of building the resource layer in the step S1 is specifically as follows: Build the resource layer for the IMS high-concurrency and low-latency scenario, adopt a combination of a processor and an acceleration card, and perform hardware acceleration for SIP protocol processing; Deploy a distributed storage cluster to improve the ability to access user data with low latency and high concurrency; Configure a replica mechanism to ensure data reliability; Adopt an NVMe SSD storage pool to process real-time session data; Deploy an intelligent network card to support SR-IOV virtualization; Adopt an Openv Switch accelerated by DPDK to separate the signaling plane and the control plane; Set the highest priority queue for SIP signaling traffic; Build a virtualization layer, allocate exclusive instances for different IMS network elements, and adopt an auto-scaling algorithm based on the SIP message rate as the dynamic scheduling strategy.

3. The three - layer integrated operation and maintenance method for IMS services according to claim 2, characterized in that, The method of building the container layer in the step S2 is specifically as follows: Build a container layer adapted to the IMS microservice architecture, adopt a Kubernetes multi-cluster federation architecture, where an independent cluster is deployed in each large area, and cross-region load balancing is achieved through ClusterAPI; The main network uses the Calico BGP mode to achieve Pod cross-node communication, and the auxiliary network uses Multus CNI to allocate an independent network plane for media streams; Perform SIP transaction fuse configuration based on Hystrix.

4. The three - layer integrated operation and maintenance method for IMS services according to claim 3, characterized in that The method of building the business layer in the step S3 is specifically as follows: Build the business layer for the IMS core business, adopt a hierarchical deployment mode as the service deployment structure, from the terminal device to the edge access layer, through the SIP signaling to the regional service layer, and then to the media forwarding layer or from Diameter to the core data layer cluster; Configure a signaling tracing system through the SIP message tracing intermediate key; During the failover process, the response latency of the CSCF node is monitored in real time. When the latency exceeds a certain threshold within a certain period of time, the Pod eviction is automatically triggered and migrated to a healthy node. The VIP pointing is adjusted through BGP Anycast, and finally the session state is restored from the standby node.

5. The three - layer integrated operation and maintenance method for IMS services according to claim 4, characterized in that, The method for realizing the collaborative work among the three layers in step S4 is specifically as follows: Between the resource layer and the container layer: Use the Kubernetes API as the resource allocation interface, Prometheus as the resource monitoring interface, Kubernetes as the resource scheduling interface, Kubernetes API as the resource management protocol, Prometheus Pull protocol as the resource monitoring protocol, and the internal protocol of the Kubernetes scheduler as the resource scheduling protocol; Between the container layer and the business layer: Use Kubernetes Service as the service discovery interface, gRPC as the service call interface, Prometheus + Grafana as the service monitoring interface, gRPC as the service call protocol, Kubernetes DNS-based as the service discovery protocol, and Prometheus Pull protocol as the service monitoring protocol; Ensure the information interaction between the resource layer and the container layer: Through the Raft protocol of Etcd, ensure the data consistency between the resource layer and the container layer, and guarantee data storage and synchronization; Use the EFK Stack for centralized log management, where Fluentd is responsible for collecting the logs of each layer, Elasticsearch stores the log data, and Kibana provides log query and visualization; Use Alertmanager as the alarm system; Monitor the IMS service process through Prometheus, and trigger the Kubernetes Operator for fault repair after an anomaly is found.

6. The three-layer integrated operation and maintenance method for IMS services according to claim 5, wherein The method for realizing anomaly diagnosis in step S5 is specifically as follows: Select appropriate nodes in the IMS network for signaling packet capture, parse the captured signaling in real time, extract the key features of the signaling data and preprocess it, organize it into feature vectors, first use the elbow method to select the K value applicable to the K-means algorithm, and then perform the K-means algorithm on the signaling data according to the obtained feature vectors and K value for clustering analysis. Visualize the clustering results in the form of a scatter plot, and define the types of abnormal registration call behaviors represented by the clusters by analyzing the signaling data features represented by the feature vectors of the cluster centers. Identify and predict the faults within the nodes, and generate corresponding alarm information, specifically: Select the CSCF node in the IMS core network, use tcpdump to capture SIP signaling, parse the pcap file through Python and extract features, preprocess the corresponding data, convert it into a DataFrame, encode and standardize it; Preset the K - value range, calculate the SSE for different K - values, plot the elbow curve, select the K - value corresponding to the inflection point of the curve where the SSE decline rate significantly slows down as the optimal number of clusters, perform model training through Python, add the clustering results to the dataset, further reduce the dimension to 2D space and plot the scatter plot; Set the inverse - standardized clustering center, define the abnormal type with the feature pattern of high response code and long transaction time as internal server error, define the abnormal type with the feature pattern of normal response code and transaction time of 200 - 400ms as normal business flow, define the abnormal type with the feature pattern of frequent REGISTER messages and abnormal Via hop count as malicious registration attack, and number the clusters corresponding to each abnormal type respectively; Set the sliding - window statistics, detect the proportion of abnormal clusters and set the alarm - triggering condition for real - time detection logic; Establish an incremental update model for incremental learning optimization, calculate the correlation coefficient between features and clustering results for multi - dimensional feature correlation analysis, and further perform dynamic adjustment based on the adaptive threshold of historical data.

7. A three - layer integrated operation and maintenance system for IMS services, characterized in that, Use the three - layer integrated operation and maintenance method for IMS services described in any one of claims 1 - 6 as the operation logic, including a resource - layer construction module, a container - layer construction module, a service - layer construction module, a three - layer coordination module, a big - data analysis module, and a fault self - healing module. The container - layer construction module is connected to the resource - layer construction module, the service - layer construction module is connected to the container - layer construction module, the three - layer coordination module is connected to the resource - layer construction module, the container - layer construction module, and the service - layer construction module. The big - data analysis module is connected to the three - layer coordination module, and the fault self - healing module is connected to the big - data analysis module.

8. The three - layer integrated operation and maintenance system for IMS services according to claim 7, characterized in that, The resource layer provides underlying support for the entire operation and maintenance system. By providing infrastructure resources such as computing resources, storage resources, network resources, and operating - system resources, it realizes the dynamic allocation and flexible scheduling of resources through virtualization technology, providing a stable and reliable basic environment for upper - layer applications; The container layer is located above the R & D resource layer and is responsible for providing a containerized running environment, providing an isolated, secure, and efficient running environment for upper - layer business applications. Through container orchestration technology, the container layer realizes the automated deployment, management, and monitoring of containers to ensure the stable operation of business applications; The service layer realizes the rapid deployment and upgrade of services by calling the containerized running environment provided by the container layer, and at the same time provides service operation and maintenance, status tracking, signaling - process monitoring, and fault self - healing functions.

9. The three-layer integrated operation and maintenance system for IMS services according to claim 8, wherein The three - layer coordination module is used to define clear interfaces and protocols between the resource layer, the container layer, and the service layer to ensure the correct transfer and interaction of information, configure the data - flow path and business - logic processing flow to ensure the correct flow and processing of data at each layer, and conduct comprehensive testing on the coordinated work between the three layers to ensure the correct coordinated work between each layer and meet business requirements; The big - data analysis module is used to obtain IMS operation and maintenance - related data such as resources, environment, and signaling flowing between the resource layer, the container layer, and the service layer, identify and process abnormal data through big - data analysis technology, and transmit the results to the fault self - healing module.

Images