Multi-terminal cooperative communication monitoring alarm system for 5G new call

Abstract

The invention relates to the technical field of communication monitoring and alarming, in particular to a multi-terminal cooperative communication monitoring and alarming system for a 5G new call, and aims to realize comprehensive monitoring and alarming of multi-terminal cooperative communication in a 5G new call scene. The system comprises a data acquisition module, a log mining module, a communication environment simulation module, a risk prediction module, a service operation state monitoring module and an alarm module. The log mining module forms a risk threshold set through data mining of historical system logs, and the risk prediction module monitors index abnormity in real time, calculates an abnormal index prediction value by means of the communication environment simulation module and inputs the abnormal index prediction value into a simulation environment for continuous monitoring. And the service operation state monitoring module performs response time, success rate and concurrency analysis and multi-index abnormal association analysis on the service. According to the system, through cooperative work of multiple modules, efficient monitoring and accurate alarm of 5G new call multi-terminal cooperative communication are realized.

Description

Technical Field

[0001] This invention relates to the field of communication monitoring and alarm technology, and more specifically, to a multi-terminal collaborative communication monitoring and alarm system for 5G new calls. Background Technology

[0002] Against the backdrop of the rapid development of 5G communication technology, multi-terminal collaborative communication has become an important application scenario for new 5G calls.

[0003] However, existing 5G communication monitoring and alarm systems still have many shortcomings when facing multi-terminal collaborative communication. For example, they struggle to comprehensively and in real-time collect network, equipment, and service operation data in multi-terminal environments, resulting in monitoring blind spots; the utilization of historical data is not in-depth enough, making it impossible to accurately establish risk thresholds, leading to insufficient accuracy and timeliness in risk prediction; in terms of service operation status analysis, they lack the ability to comprehensively analyze multi-dimensional indicators such as response time, success rate, and concurrency, making it difficult to quickly locate anomalies and lacking risk control capabilities; for situations with multiple abnormal indicators, they lack effective correlation analysis mechanisms, making it impossible to accurately determine the cause of the anomaly; alarm strategies are simplistic, failing to provide differentiated notification methods based on different risk levels, affecting alarm efficiency and problem-solving speed. These problems seriously affect the stability and reliability of multi-terminal collaborative communication in 5G new calls, urgently requiring a more comprehensive monitoring and alarm system to solve them.

[0004] Therefore, this invention proposes a multi-terminal collaborative communication monitoring and alarm system for 5G new calls. Summary of the Invention

[0005] In view of the shortcomings of existing technologies, the purpose of this invention is to provide a multi-terminal collaborative communication monitoring and alarm system for 5G new calls.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] The 5G new call multi-terminal collaborative communication monitoring and alarm system includes a data acquisition module, a log mining module, a communication environment simulation module, a risk prediction module, a service operation status monitoring module, and an alarm module;

[0008] Data acquisition module: This module is divided into a data acquisition unit based on the network environment, a data acquisition unit based on the terminal device status, and a data acquisition unit based on the business operation status. It actively collects or gathers monitoring indicators sent by the terminal.

[0009] Log mining module: By mining historical system logs, a set of risk thresholds is formed. The data in the set is in the form of the maximum and minimum values ​​of multiple anomalies of a certain monitoring indicator (for data that is larger, the better, take the maximum value among the anomalies; for data that is smaller, the better, take the minimum value among the anomalies) or a combination of multiple anomaly indicators (combined risk thresholds).

[0010] Meanwhile, the alarm prompts are divided into three levels. The set of risk thresholds corresponding to alarms that only cause system fluctuations without affecting the integrity of the process is the first-level risk threshold set. The set of risk thresholds corresponding to alarms that restrict some peripheral functions of the system is the second-level risk threshold set. The set of risk thresholds corresponding to alarms that seriously affect the integrity of the system process and cause key business links to fail to operate normally is the third-level risk threshold set.

[0011] Communication environment simulation module: Calculates the predicted values ​​of abnormal indicators, inputs them into the communication environment built by the simulation tool, and continuously monitors the performance of the simulated communication environment;

[0012] Risk prediction module: This module monitors the monitoring indicators collected by the data acquisition module in real time. When an indicator is abnormal, it sends a signal with the corresponding risk level to the alarm module.

[0013] Business Operation Status Monitoring Module: Based on the data collected by the business operation status data acquisition unit, it analyzes the response time, success rate, and concurrency of each business to quickly locate the business status and anomaly points when abnormal status occurs, and takes corresponding optimization measures; and it uses the principle of comprehensive correlation analysis to deal with the situation of multiple indicators being abnormal.

[0014] Alarm module: Collects alarm information from the risk prediction module and the business operation status monitoring module, and formulates differentiated multi-channel notification strategies based on the alarm level.

[0015] Furthermore, in the data acquisition module, the data acquisition unit based on the network environment includes signal strength, available bandwidth, network latency, and packet loss rate; the data acquisition unit based on the terminal device status collects data including CPU utilization, memory usage, battery level, device temperature, and network interface traffic; and the data acquisition unit based on the service operation status includes service response time, service success rate, and service concurrency.

[0016] Furthermore, in the log mining module, the process for generating the risk threshold set is as follows:

[0017] Historical system logs from various terminals in the network environment are collected, and the logs are aligned in format and time sequence. A large model with a Transformer structure is used to perform semantic analysis and pattern matching on the log text. Keyword matching is used to extract abnormal alarm records, and network environment data and terminal device status data of each terminal participating in communication at that time are extracted. Finally, a structured information of alarm prompts and network parameters is formed and stored in a database. The database is continuously updated and expanded based on the device's operating data. By comparing with normal operating data, abnormal values ​​are identified from the structured information and recorded as a set of risk thresholds.

[0018] Furthermore, the business operation status monitoring module performs response time analysis for each business, and the specific process is as follows:

[0019] When monitored metrics reach alarm thresholds (set based on expert knowledge), the alarm module issues an alarm and generates an alarm reason prompt based on the following logic: First, it identifies the latency stage, which is divided into the request access stage (user request arrives at the system), the system processing stage (business logic execution), and the result return stage (data is sent back to the user). For the request access stage, it checks the request queuing time of the network access gateway and adds access nodes or optimizes load balancing based on the latency. For the system processing stage, it checks the server CPU / memory usage; if it exceeds the risk threshold, it indicates insufficient processing capacity, requiring server expansion or code optimization. For the result return stage, it monitors the data transmission packet loss rate; if it exceeds the risk threshold, it indicates poor network quality, requiring switching transmission routes or enabling QoS guarantees.

[0020] Furthermore, the business operation status monitoring module performs success rate analysis for each business, and the specific process is as follows:

[0021] When the business success rate exceeds the alarm threshold (set based on expert knowledge), the alarm module issues an alarm and generates an alarm reason prompt according to the following logic: The error types of business failures are categorized into three types: user-side problems, server-side problems, and network problems. For user-side problems, the distribution of faulty device models is analyzed to determine if it is a device compatibility issue. If it is a compatibility issue, an update is pushed or the affected terminals are restricted. For server-side problems, service error logs are analyzed, and vulnerabilities are fixed according to the frequency of error types in the service error logs, prioritizing them based on frequency. For network problems, the transmission failure rate is detected; if it exceeds the risk threshold, the network topology is adjusted or a backup link is activated.

[0022] Furthermore, the business operation status monitoring module performs concurrency analysis for each business, and the specific process is as follows:

[0023] When the concurrent traffic reaches the alarm threshold (set based on expert knowledge), the alarm module issues an alarm and generates an alarm reason prompt based on the following logic: Growth is categorized into three types based on its characteristics: sudden growth (a surge in requests within a short period), sustained growth (stable growth exceeding expectations over a long period), and regional concentration (excessive proportion of requests in a specific geographical area). For sudden growth, concurrent events (operational activities, system changes, or external factors that highly overlap with changes in business traffic within a time window) are checked to determine if it falls within the normal business scope. If so, traffic circuit breaking or elastic scaling is implemented. For sustained growth, historical growth curves are compared; if capacity is exceeded by a certain percentage for a continuous period, capacity is revised and permanently expanded. For regional concentration, regional load distribution is detected, and cross-regional traffic scheduling is implemented.

[0024] Furthermore, the business operation status monitoring module employs a comprehensive correlation analysis principle to address situations where multiple indicators are abnormal, as detailed below:

[0025] We statistically analyze all business failure records over a period of time, establish a correspondence between abnormal indicator combinations and their actual causes, and use the ratio of the frequency of abnormal indicator combinations to the frequency of their corresponding actual causes as the probability that the current indicator anomaly is due to that cause.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] 1. Precise Risk Threshold Establishment and Risk Prediction: The log mining module, through a combination of large-scale model semantic analysis and pattern matching, deeply mines historical system logs to form a precise set of risk thresholds, overcoming the shortcomings of traditional threshold setting methods that rely on manual intervention and are detached from the actual system. The risk prediction module, based on risk thresholds and communication environment simulation, can accurately predict risks and send corresponding risk level signals, improving the accuracy and timeliness of risk prediction.

[0028] 2. Efficient business operation status analysis and anomaly localization: The business operation status monitoring module can quickly locate abnormal business status and anomaly points by conducting detailed analysis of business response time, success rate, and concurrency, as well as comprehensive correlation analysis of multiple indicator anomalies, and provide corresponding optimization suggestions, effectively improving the stability and reliability of business operations. Attached Figure Description

[0029] Figure 1 Block diagram of a multi-terminal collaborative communication monitoring and alarm system for 5G new calls;

[0030] Figure 2 This is a schematic diagram of the business operation status monitoring module;

[0031] Figure 3 This is a schematic diagram for comprehensive correlation analysis. Detailed Implementation

[0032] Example, refer to Figure 1 The 5G new call multi-terminal collaborative communication monitoring and alarm system of this embodiment includes a data acquisition module, a log mining module, a communication environment simulation module, a risk prediction module, a service operation status monitoring module, and an alarm module.

[0033] Data acquisition module: This module is divided into a data acquisition unit based on the network environment, a data acquisition unit based on the terminal device status, and a data acquisition unit based on the business operation status. It actively collects or gathers monitoring indicators sent by the terminal.

[0034] The data acquisition unit based on the network environment collects data including signal strength, available bandwidth, network latency, and packet loss rate;

[0035] Signal strength: Terminal devices obtain signal strength values ​​by measuring the power of the received signal, usually in dBm. The larger the value, the stronger the signal.

[0036] Available bandwidth: Using an active measurement method, test data at different rates are sent to the target server, and the maximum transmittable rate, i.e., the available bandwidth, is determined based on the data transmission situation;

[0037] Network latency: ICMP echo request messages are sent periodically, and the time of sending and receiving the response message is recorded. The difference between the two is the network latency.

[0038] Packet loss rate: Send a certain number of test data packets, count the number of data packets that do not receive a response, and calculate the packet loss rate;

[0039] The data acquisition unit based on the terminal device status collects data including CPU utilization, memory usage, battery level, device temperature, and network interface traffic.

[0040] CPU utilization: obtained through an interface provided by the operating system;

[0041] Memory usage: Calculated by dividing the locally used memory on the terminal by the total memory capacity;

[0042] Battery power: Directly reads the battery percentage data provided by the terminal device's battery management system;

[0043] Equipment temperature: Real-time temperature data is obtained using the built-in temperature sensor of the terminal device;

[0044] Network interface traffic: The amount of data received and sent by the network interface per unit time, converted to Mbps;

[0045] The data acquisition unit based on business operation status includes business response time, business success rate, and business concurrency.

[0046] Service response time: The time interval from when a user initiates a service request to when the system returns a response result. It is calculated when the terminal completes the service return result and the request queuing time of the service access gateway is extracted.

[0047] Business success rate: The success rate is calculated by dividing the number of business transactions successfully completed by a business module by the total number of historical business requests, and recording the number of data packets that failed to be transmitted. The transmission failure rate is calculated based on the total number of data packets transmitted.

[0048] Business concurrency: The number of business requests being processed at the same time, obtained by monitoring the threads or processes of the business server, and recording the historical curve of business concurrency;

[0049] Log mining module: Collects historical system logs from various terminals in the network environment, performs format alignment and time sequence alignment on the logs; uses a large model with a Transformer structure to perform semantic analysis and pattern matching on the log text, and uses keyword matching to extract abnormal alarm records (service interruption, module failure, poor service performance, etc.), and extracts network environment data and terminal device status data of each terminal participating in communication at that time, and finally forms structured information of alarm prompts + network parameters (network environment data and terminal device status data), which is stored in a database and continuously updated and expanded by the device's operating data;

[0050] By comparing with normal operating data, abnormal values ​​are identified from structured information and recorded as a set of risk thresholds. The specific process is as follows:

[0051] First, the system uses statistical methods to construct a multi-dimensional normal operation data model based on network environment data and terminal device status data collected during historical normal operation periods, forming a baseline parameter range. The system dynamically compares the structured information of alarms with the corresponding normal operation data model. Besides using traditional threshold comparison methods (e.g., exceeding the normal range by ±20% is considered an abnormal threshold), it can also utilize deep learning-based anomaly detection models (e.g., Autoencoder, Isolation Forest, etc.) to accurately identify abnormal values ​​deviating from the normal pattern by analyzing data distribution characteristics and pattern differences. In this embodiment, the threshold comparison method is used.

[0052] The data in the set is in the form of the maximum and minimum values ​​of multiple anomalies of a certain monitoring indicator (for data that is larger, the maximum value is taken; for data that is smaller, the minimum value is taken) or a combination of multiple anomaly indicators (combined risk threshold).

[0053] At the same time, based on the structured information, the alarm prompts are divided into three levels. The set of risk thresholds corresponding to alarms that only cause system fluctuations without affecting the integrity of the process is the first-level risk threshold set. The set of risk thresholds corresponding to alarms that restrict some peripheral functions of the system is the second-level risk threshold set. The set of risk thresholds corresponding to alarms that seriously affect the integrity of the system process and cause key business links to fail to operate normally is the third-level risk threshold set.

[0054] Communication Environment Simulation Module: When the risk prediction module detects that an indicator has reached or exceeded an element in the set of secondary risk thresholds (for a combination of multiple abnormal indicators, the current indicator is considered to have reached or exceeded the element only when each dimension of the current indicator reaches or exceeds the combined risk threshold in the set), the time series prediction model is used to obtain the predicted value of the network parameters of the corresponding indicator.

[0055] Simulation tools (such as Beijing Touchpoint Interactive Xpro series tools) are used to simulate the current 5G communication network environment. Hardware parameters (battery level, device temperature) are reflected through changes in chip performance. Specifically, the battery level affects the chip's power supply stability. When the battery level is low, the chip automatically reduces its operating frequency to reduce power consumption, resulting in slower data processing speed, simulating the device performance degradation caused by insufficient power. Device temperature is related to the chip's thermal management mechanism. When the simulated device's operating load increases and the chip temperature rises, the chip will trigger a frequency reduction protection mechanism to reduce the computing speed, thereby simulating the device performance degradation caused by overheating. This comprehensively and realistically presents the operating performance of 5G devices under different hardware conditions.

[0056] Input the predicted network parameters into the simulation environment and continuously monitor the performance of the simulated communication environment.

[0057] Risk Prediction Module: This module monitors the monitoring indicators collected by the data acquisition module in real time. When an indicator reaches or exceeds an element in the first-level risk threshold set, it sends a low-risk signal to the alarm module, indicating a minor risk. When an indicator reaches or exceeds an element in the second-level risk threshold set, it activates the communication environment simulation module. While continuously monitoring the simulated communication environment with the input network parameter prediction values, if a link fails to operate normally or communication is interrupted, it sends a medium-risk signal to the alarm module, indicating a potential risk that needs to be investigated promptly. When an indicator reaches or exceeds the third-level risk threshold set, it directly sends a high-risk signal to the alarm module, indicating a fault that requires urgent personnel investigation.

[0058] Business operation status monitoring module: such as Figure 2As shown, based on the data collected by the data acquisition unit based on the business operation status, by performing response time analysis, success rate analysis, and concurrency analysis on each business, the business status and the anomaly point location in abnormal status can be quickly located, and corresponding optimization measures can be taken.

[0059] Business response time analysis logic: When the monitored indicators reach the alarm threshold (set according to expert knowledge), the alarm module issues an alarm and generates an alarm reason prompt according to the following logic: First, locate the delay stage, which is divided into the request access stage (user request arrives at the system), the system processing stage (business logic execution), and the result return stage (data is sent back to the user). For the request access stage, check the request queuing time of the network access gateway and add access nodes or optimize load balancing according to the delay; for the system processing stage, check the server CPU / memory usage. If it exceeds the risk threshold, it indicates insufficient processing capacity, and the server needs to be expanded or the code optimized; for the result return stage, monitor the data transmission packet loss rate. If it exceeds the risk threshold, it indicates poor network quality, and the transmission route needs to be switched or QoS protection needs to be enabled.

[0060] Business success rate analysis logic: When the business success rate exceeds the alarm threshold (set according to expert knowledge), the alarm module issues an alarm and generates an alarm reason prompt according to the following logic: The error types of business failures are divided into three categories: user-side problems, server-side problems, and network problems. For user-side problems, the distribution of faulty device models is analyzed to determine if it is a device compatibility issue. If it is a compatibility issue, an update is pushed or the affected terminals are restricted. For server-side problems, service error logs are analyzed, and vulnerabilities are fixed according to the frequency of error types in the service error logs, prioritizing them by frequency. For network problems, the transmission failure rate is detected. If it exceeds the risk threshold, the network topology is adjusted or a backup link is activated.

[0061] Business concurrency analysis logic: When the business concurrency reaches the alarm threshold (set according to expert knowledge), the alarm module issues an alarm and generates an alarm reason prompt according to the following logic: Based on growth characteristics, it is divided into three categories: sudden growth (a surge in requests within a short period of time), continuous growth (stable growth exceeding expectations over a long period of time), and regional concentration (excessive proportion of requests in a specific geographical area). For sudden growth, it checks concurrent events (concurrent events refer to operational activities, system changes, or external factors that highly overlap with business traffic changes in the time window) to determine whether it falls within the normal business scope. If so, it performs traffic circuit breaking or elastic scaling. For continuous growth, it compares with historical growth curves. If the capacity exceeds the limit by a certain percentage (90% in this example) for a continuous period (3 days), it revises the capacity and permanently expands it. For regional concentration, it detects regional load distribution and implements cross-regional traffic scheduling.

[0062] like Figure 3As shown, for cases with multiple abnormal indicators, a comprehensive correlation analysis principle is adopted. All business failure records from the past year are statistically analyzed, and a table corresponding to abnormal indicator combinations and their actual causes is established, as shown in Table 1:

[0063] Table 1

[0064]

[0065] The alarm module is responsible for collecting alarm information from the risk prediction module and the business operation status monitoring module. Based on the alarm level, it formulates differentiated multi-channel notification strategies. Level 3 risks are notified to key personnel through a combination of methods such as SMS, telephone, APP pop-ups, and full-screen flashing on the operation and maintenance platform. Level 2 risks are notified to relevant teams through email, instant messaging tools, and platform highlighting. Level 1 risks are marked on the platform and a to-do item is generated to remind operation and maintenance personnel. After issuing a notification, the alarm module continuously tracks the processing progress, forming a complete closed-loop management process from generation and notification to processing.

[0066] Through the detailed description of the above embodiments, the 5G new call multi-terminal collaborative communication monitoring and alarm system of the present invention, through the log mining module, forms a risk threshold set by data mining of historical system logs, which is more in line with the actual system compared with the traditional single fixed threshold setting method; the risk prediction module monitors abnormal indicators in real time, and calculates the predicted value of abnormal indicators with the help of the communication environment simulation module and inputs it into the simulation environment for continuous monitoring, so as to predict and alarm for possible systemic risks in a timely manner; the service operation status monitoring module performs response time, success rate, concurrency analysis and multi-indicator abnormal correlation analysis on the service. In summary, the system composed of the above modules effectively improves the accuracy and timeliness of risk prediction, and also improves the stability and reliability of service operation.

[0067] The above formulas are all dimensionless calculations, and the preset parameters in the formulas should be set by those skilled in the art according to the actual situation.

[0068] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0069] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0070] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0071] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0072] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0073] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0074] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

A multi-terminal collaborative communication monitoring and alarm system for 1.5G new calls, characterized in that, The system includes a data acquisition module, a log mining module, a communication environment simulation module, a risk prediction module, a business operation status monitoring module, and an alarm module. Data acquisition module: This module is divided into a data acquisition unit based on the network environment, a data acquisition unit based on the terminal device status, and a data acquisition unit based on the business operation status. It actively collects or gathers monitoring indicators sent by the terminal. Log mining module: By mining historical system logs, a set of risk thresholds is formed, and alarm prompts are divided into three risk levels. Communication environment simulation module: Calculates the predicted values ​​of abnormal indicators, inputs them into the communication environment built by the simulation tool, and continuously monitors the performance of the simulated communication environment; Risk prediction module: Monitors the indicators collected by the data acquisition module in real time. When an indicator is abnormal, it sends a signal with the corresponding risk level to the alarm module. Business Operation Status Monitoring Module: Based on the data collected by the data acquisition unit based on business operation status, it performs response time analysis, success rate analysis, and concurrency analysis for each business, quickly analyzes the business status, and locates the point of anomaly. At the same time, the principle of comprehensive correlation analysis is adopted to deal with situations where multiple indicators are abnormal; Alarm module: Collects alarm information from the risk prediction module and the business operation status monitoring module, and formulates differentiated multi-channel notification strategies based on the alarm level.

2. The 5G new call multi-terminal collaborative communication monitoring and alarm system according to claim 1, characterized in that, In the data acquisition module, the data acquisition unit based on the network environment includes signal strength, available bandwidth, network latency, and packet loss rate; the data acquisition unit based on the terminal device status collects data including CPU utilization, memory usage, battery level, device temperature, and network interface traffic; and the data acquisition unit based on the service operation status includes service response time, service success rate, and service concurrency.

3. The 5G new call multi-terminal collaborative communication monitoring and alarm system according to claim 1, characterized in that, In the log mining module, the process of generating the risk threshold set is as follows: Historical system logs from various terminals in the network environment are collected, and the logs are aligned in format and time sequence. A large model is used to perform semantic analysis and pattern matching on the log text. Keyword matching is used to extract abnormal alarm records, and network environment data and terminal device status data of each terminal participating in communication at that time are extracted to form structured information of alarm prompts and network parameters. This information is stored in a database, which is continuously updated and expanded based on device operating data. By comparing with normal operating data, abnormal values ​​are identified from the structured information and recorded as a set of risk thresholds.

4. The 5G new call multi-terminal collaborative communication monitoring and alarm system according to claim 1, characterized in that, In the business operation status monitoring module, response time analysis is performed for each business. The specific process is as follows: First, locate the latency stage, which is divided into the request access stage, the system processing stage, and the result return stage. For the request access stage, check the request queuing time of the network access gateway and add access nodes or optimize load balancing based on the latency. During the system processing phase, check the server's CPU and memory usage. If they exceed the risk threshold, it indicates insufficient processing capacity, requiring server expansion or code optimization. During the result return phase, monitor the data transmission packet loss rate. If it exceeds the risk threshold, it indicates poor network quality, requiring switching transmission routes or enabling QoS guarantees.

5. The 5G new call multi-terminal collaborative communication monitoring and alarm system according to claim 1, characterized in that, In the business operation status monitoring module, a success rate analysis is performed on each business. The specific process is as follows: The types of business failures are categorized into three types: client-side issues, server-side issues, and network issues. For client-side issues, the distribution of faulty device models is analyzed to confirm whether it is a device compatibility problem. For server-side issues, analyze service error logs and fix vulnerabilities based on the frequency of error types in the service error logs, prioritizing them according to frequency. For network issues, check the transmission failure rate.

6. The 5G new call multi-terminal collaborative communication monitoring and alarm system according to claim 1, characterized in that, In the business operation status monitoring module, concurrency analysis is performed on each business. The specific process is as follows: Based on growth characteristics, growth is categorized into three types: sudden growth, continuous growth, and regional concentration. For sudden growth, concurrent events are examined to determine if it falls within the normal business scope. For continuous growth, historical growth curves are compared to analyze the proportion and duration of continuous overcapacity. For regional concentration, regional load distribution is detected, and cross-regional traffic scheduling is implemented.

7. The 5G new call multi-terminal collaborative communication monitoring and alarm system according to claim 1, characterized in that, In the business operation status monitoring module, the principle of comprehensive correlation analysis is used to analyze the anomalies of multiple indicators, as detailed below: We statistically analyze all business failure records over a period of time, establish a correspondence between abnormal indicator combinations and their actual causes, and use the probability of the actual cause with the highest probability as the probability of the current indicator anomaly based on the ratio of the number of times the abnormal indicator combination occurs to the number of times the corresponding actual cause occurs.

Images