Abnormal call record detection method and device based on network slicing

Abstract

The present invention discloses an abnormal call record detection method and device based on network slicing, including: constructing a graph network according to slice call record information, slice user information, and slice application type information of the network slice; obtaining a call record feature sequence of the slice call record information, a slice user feature sequence of the slice user information, and a slice application type feature sequence of the slice application type information; determining a first call record fusion feature after fusing the slice user feature according to the call record feature sequence, the slice user feature sequence, and the graph network; determining a second call record fusion feature after fusing the slice application type feature according to the call record feature sequence, the slice application type feature sequence, and the graph network; obtaining a call record input feature determined by the first call record fusion feature and the second call record fusion feature according to the graph network; judging whether the slice call record is abnormal according to a call record classification model, and being able to flexibly identify whether the call record is abnormal according to the actual business conditions of each network slice.

Description

Technical Field

[0001] The present invention relates to the field of electronic information, and in particular to a method and device for detecting abnormal call records based on network slicing. Background Art

[0002] At present, in 5G network slicing, due to the large number of slice instances, diverse slice application types, and different needs of users of each slice, how to quickly find abnormal call records from the numerous billing call records of network slices has become a technical problem that needs to be solved urgently.

[0003] In the prior art, detection of abnormal call records is usually achieved by manually formulating detection rules. However, since the manually formulated rules are too simple and cannot be flexibly adjusted according to the actual business conditions of each network slice, the screening accuracy of abnormal call records is low and the efficiency is low. Summary of the invention

[0004] In view of the above problems, the present invention is proposed to provide an abnormal call record detection method and device based on network slicing that overcomes the above problems or at least partially solves the above problems.

[0005] According to one aspect of the present invention, a method for detecting abnormal call records based on network slicing is provided, comprising:

[0006] Constructing a graph network according to slice call record information, slice user information, and slice application type information corresponding to the network slice to be detected;

[0007] Respectively obtain a call record feature sequence corresponding to the slice call record information, a slice user feature sequence corresponding to the slice user information, and a slice application type feature sequence corresponding to the slice application type information;

[0008] Determine, according to the call record feature sequence, the slice user feature sequence and the graph network, a first call record fusion feature after fusing the slice user feature; and, according to the call record feature sequence, the slice application type feature sequence and the graph network, determine a second call record fusion feature after fusing the slice application type feature;

[0009] According to the graph network, obtain the call record input features determined by the first call record fusion features and the second call record fusion features; input the call record input features into a preset call record classification model, and judge whether the slice call record of the network slice to be tested is abnormal based on the output result of the call record classification model.

[0010] According to another aspect of the present invention, a device for detecting abnormal call records based on network slicing is provided, comprising:

[0011] A graph construction module, adapted to construct a graph network according to slice call record information, slice user information, and slice application type information corresponding to the network slice to be detected;

[0012] A sequence acquisition module, adapted to respectively acquire a call record feature sequence corresponding to the slice call record information, a slice user feature sequence corresponding to the slice user information, and a slice application type feature sequence corresponding to the slice application type information;

[0013] A feature fusion module, adapted to determine a first call record fusion feature after fusing slice user features according to the call record feature sequence, the slice user feature sequence and the graph network; and determine a second call record fusion feature after fusing slice application type features according to the call record feature sequence, the slice application type feature sequence and the graph network;

[0014] The judgment module is suitable for obtaining the call record input features determined by the first call record fusion features and the second call record fusion features according to the graph network; inputting the call record input features into a preset call record classification model, and judging whether the slice call record of the network slice to be detected is abnormal according to the output result of the call record classification model.

[0015] According to another aspect of the present invention, there is provided an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0016] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the above-mentioned abnormal call record detection method based on network slicing.

[0017] According to another aspect of the present invention, a computer storage medium is provided, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to perform operations corresponding to the above-mentioned abnormal call record detection method based on network slicing.

[0018] In the abnormal call bill detection method and device based on network slicing provided by the present invention, a graph network can be constructed according to the slice call bill information, slice user information, and slice application type information corresponding to the network slice to be detected, and the call bill feature sequence corresponding to the slice call bill information, the slice user feature sequence corresponding to the slice user information, and the slice application type feature sequence corresponding to the slice application type information are respectively obtained; thereby obtaining the call bill fusion features that respectively fuse the slice user features and the slice application type features, and then determining whether the call bill is abnormal based on the call bill fusion features. It can be seen that this method can mine the influence of slice user features and slice application types on slice call bills through the graph network, so that it can flexibly identify whether the call bill is abnormal according to the actual business conditions of each network slice, thereby improving the screening accuracy and efficiency of abnormal call bills.

[0019] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0021] Figure 1 A flowchart of an abnormal call record detection method based on network slicing provided in Embodiment 1 of the present invention is shown;

[0022] Figure 2 A flowchart of an abnormal call record detection method based on network slicing provided in Embodiment 2 of the present invention is shown;

[0023] Figure 3 A structural diagram of an abnormal call record detection device based on network slicing provided in Embodiment 3 of the present invention is shown;

[0024] Figure 4 A schematic diagram of the structure of an electronic device provided by Embodiment 5 of the present invention is shown;

[0025] Figure 5 A schematic diagram showing the relationship between the three types of nodes;

[0026] Figure 6 A specific schematic diagram of the call list classification model built in this example is shown. DETAILED DESCRIPTION

[0027] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] Embodiment 1

[0029] Figure 1 The flowchart of a method for detecting abnormal call records based on network slicing provided by the first embodiment of the present invention is shown. Figure 1 As shown, the method includes:

[0030] Step S110: Construct a graph network based on the slice call record information, slice user information, and slice application type information corresponding to the network slice to be detected.

[0031] The slice bill information corresponding to the network slice to be detected refers to the relevant bill content generated by the slice instance of the network slice. The slice user information refers to the relevant information of the slice user corresponding to the network slice, including user needs, user data, etc. The slice application type information is used to describe the type of the network slice.

[0032] Based on the above three types of information, a graph network can be constructed. A graph network (GN) is a set of functions organized in a topological space according to a graph structure for relational reasoning. In deep learning theory, it is a generalization of graph neural networks (GNN) and probabilistic graphical models (PGM). A graph network is composed of graph network blocks and has a flexible topological structure. It can be specialized into various connectionist models, including feedforward neural networks, recursive neural networks, etc.

[0033] Step S120: respectively obtain the call record feature sequence corresponding to the slice call record information, the slice user feature sequence corresponding to the slice user information, and the slice application type feature sequence corresponding to the slice application type information.

[0034] Among them, the call record feature sequence is used to describe the slice call record information. Specifically, the slice call record information can be encoded and serialized to obtain the call record feature sequence. Similarly, the slice user feature sequence is used to describe the characteristics of the slice user. The slice user information can also be encoded and serialized to obtain the slice user feature sequence. The processing method of the slice application type feature sequence is similar and will not be repeated here.

[0035] The feature sequence can realize the digital representation of information content, thus facilitating subsequent processing.

[0036] Step S130: Determine the first call record fusion feature after fusing the slice user feature based on the call record feature sequence, the slice user feature sequence and the graph network; and determine the second call record fusion feature after fusing the slice application type feature based on the call record feature sequence, the slice application type feature sequence and the graph network.

[0037] The first call record fusion feature after fusion of the slice user feature is obtained by fusing the call record feature sequence with the slice user feature sequence through a graph network. The second call record fusion feature after fusion of the slice application type feature is obtained by fusing the call record feature sequence with the slice application type feature sequence through a graph network.

[0038] Step S140: According to the graph network, obtain the call record input features determined by the first call record fusion features and the second call record fusion features; input the call record input features into a preset call record classification model, and determine whether the slice call record of the network slice to be tested is abnormal based on the output result of the call record classification model.

[0039] The call record input feature refers to a feature obtained by combining the first call record fusion feature and the second call record fusion feature through a graph network, and the feature can fully reflect the call record information. Accordingly, the call record input feature is input into a preset call record classification model, and it can be determined whether the slice call record of the network slice to be detected is abnormal according to the output result of the call record classification model. The call record classification model can be obtained by pre-training.

[0040] It can be seen that this method can mine slice user characteristics and the impact of slice application types on slice call records through the graph network, so that it can flexibly identify whether the call record is abnormal according to the actual business situation of each network slice, thereby improving the screening accuracy and efficiency of abnormal call records.

[0041] Embodiment 2

[0042] Figure 2 The flowchart of a method for detecting abnormal call records based on network slicing provided by the second embodiment of the present invention is shown. Figure 2 As shown, the method includes:

[0043] Step S200: pre-process the sample data corresponding to the acquired network slice sample, and train a call record classification model based on the pre-processed sample data.

[0044] Specifically, the slice data set of the historical network slices is collected to construct the sample data corresponding to the network slice sample. The sample data is preprocessed and then trained, and a call list classification model is obtained according to the training results.

[0045] Step S210: Construct a graph network based on the slice call record information, slice user information, and slice application type information corresponding to the network slice to be detected.

[0046] Among them, the slice call bill information corresponding to the network slice to be detected refers to: the relevant call bill content generated by the slice instance of the network slice. Slice user information refers to: the relevant information of the slice user corresponding to the network slice, including user needs, user data, etc. Slice application type information is used to describe the type of the network slice. A graph network can be constructed based on the above three types of information. A graph network (GN) is a set of functions organized according to a graph structure in a topological space for relational reasoning. In deep learning theory, it is a generalization of graph neural networks (GNN) and probabilistic graphical models (PGM). The graph network is composed of graph network blocks and has a flexible topological structure. It can be specialized into various connectionist models, including feedforward neural networks, recursive neural networks, etc.

[0047] Specifically, in this embodiment, the slice call bill information corresponding to the network slice to be detected includes: slice instance call bill content, slice instance usage duration, data traffic and / or data charges; slice user information includes: slice user's subscription information, user demand information, and / or usage location information; slice application type information includes: mobile broadband type information, Internet of Things type information, and / or communication type information.

[0048] In the specific implementation, the slice call record information is determined as the central node, the slice user information is determined as the first neighbor node, and the slice application type information is determined as the second neighbor node; a graph network consisting of the central node, the first neighbor node, and the second neighbor node is constructed. It can be seen that the graph network includes a central node and two neighbor nodes, and the data structure of each node is different, which belongs to a graph network consisting of three heterogeneous nodes.

[0049] Step S220: respectively obtain the call record feature sequence corresponding to the slice call record information, the slice user feature sequence corresponding to the slice user information, and the slice application type feature sequence corresponding to the slice application type information.

[0050] Among them, the call record feature sequence is used to describe the sliced ​​call record information. Specifically, the sliced ​​call record information can be encoded and serialized to obtain the call record feature sequence. Similarly, the slice user feature sequence is used to describe the characteristics of the slice user. The slice user information can also be encoded and serialized to obtain the slice user feature sequence. The processing method of the slice application type feature sequence is similar and will not be repeated here. The feature sequence can realize the digital representation of the information content, which is convenient for subsequent processing.

[0051] Step S230: Determine the first call record fusion feature after fusing the slice user feature based on the call record feature sequence, the slice user feature sequence and the graph network; and determine the second call record fusion feature after fusing the slice application type feature based on the call record feature sequence, the slice application type feature sequence and the graph network.

[0052] The first call record fusion feature after fusion of the slice user feature is obtained by fusing the call record feature sequence with the slice user feature sequence through a graph network. The second call record fusion feature after fusion of the slice application type feature is obtained by fusing the call record feature sequence with the slice application type feature sequence through a graph network.

[0053] Specifically, the graph network in this embodiment includes: a neighbor node level graph attention layer and a central node level graph attention layer; accordingly, when determining the first call record fusion feature after fusing the slice user feature according to the call record feature sequence, the slice user feature sequence and the graph network; and, when determining the second call record fusion feature after fusing the slice application type feature according to the call record feature sequence, the slice application type feature sequence and the graph network, it is achieved in the following way: inputting the call record feature sequence and the slice user feature sequence into the neighbor node level graph attention layer to obtain the first call record fusion feature after fusing the slice user feature; and, inputting the call record feature sequence and the slice application type feature sequence into the neighbor node level graph attention layer to obtain the second call record fusion feature after fusing the slice application type feature.

[0054] Step S240: According to the graph network, obtain the call record input features determined by the first call record fusion features and the second call record fusion features; input the call record input features into a preset call record classification model, and determine whether the slice call record of the network slice to be tested is abnormal based on the output result of the call record classification model.

[0055] The call record input feature refers to a feature obtained by combining the first call record fusion feature and the second call record fusion feature through a graph network, and the feature can fully reflect the call record information. Accordingly, the call record input feature is input into a preset call record classification model, and it can be determined whether the slice call record of the network slice to be detected is abnormal according to the output result of the call record classification model. The call record classification model can be obtained by pre-training.

[0056] In specific implementation, when obtaining the call record input feature determined by the first call record fusion feature and the second call record fusion feature according to the graph network, it is achieved in the following way: the first call record fusion feature and the second call record fusion feature are input into the central node level graph attention layer to obtain the call record input feature.

[0057] In this embodiment, the network slice is a 5G network slice, and the graph network is a multi-level heterogeneous graph attention network.

[0058] Through the above method, the sliced ​​call sheet information can be analyzed in combination with the sliced ​​user information and the sliced ​​application type information, thereby improving the accuracy of abnormal call sheet identification. Among them, the influence weight of the sliced ​​user information and the sliced ​​application type information on the sliced ​​call sheet information can be determined through the graph network, so that the final analysis result is more reliable.

[0059] For ease of understanding, the following describes in detail the specific implementation details of the second embodiment of the present invention by taking a specific example as an example:

[0060] At present, in 5G network slices, there are a large number of slice instances, various slice application types, and different needs of slice users, which makes it difficult to find abnormal billing bills. This puts high demands on the accurate detection of abnormal bills. In the prior art, abnormal bill detection of network slices is mainly achieved by manually formulating detection rules, which is not accurate enough, thus affecting the user experience. In order to solve the above problems, this example provides a 5G slice billing bill anomaly detection method based on a multi-level heterogeneous graph attention network. The graph attention network can assign different weights according to the differences in the influence of neighbor nodes in the graph network, and construct a heterogeneous graph network composed of three heterogeneous nodes: slice users in the slice (i.e., the above-mentioned slice user information), slice instance bills (i.e., the above-mentioned slice bill information), and slice application types (i.e., the above-mentioned slice application type information). The constructed multi-level heterogeneous graph attention network includes two parts: neighbor node-level graph attention and central node-level graph attention. First, the slice instance call sheet is taken as the central node, and the neighbor node-level attention aggregation is performed with the two adjacent types of neighbor nodes respectively. The different importance of the neighbor nodes of the slice instance call sheet, namely the slice user and the slice application type, for judging whether it is abnormal is learned, and different weights are assigned to the relationship between nodes according to the difference in importance. Then, the new features of the slice instance call sheet after fusion of the slice user feature information (i.e., the first call sheet fusion feature) and the new features of the slice instance call sheet after fusion of the slice application type feature information (i.e., the second call sheet fusion feature) are output for central node-level attention aggregation. Finally, the fully connected layer is used to output whether there is an abnormality in the detected slice instance billing call sheet. This improves the initiative and timeliness of call sheet anomaly discovery in network slicing and improves the service experience of slice users.

[0061] To facilitate understanding, the following first introduces the business terms involved in this example:

[0062] A network slice is an end-to-end logical function and a collection of physical or virtual resources required for it, including access networks, transmission networks, core networks, etc. A network slice can be considered a virtualized "private network" in a 5G network. Network slices are built on a unified infrastructure based on NFV to achieve low-cost and efficient operations. Network slicing technology can achieve logical isolation of communication networks, allowing network elements and functions to be configured and reused in each network slice to meet specific industry application requirements. The slice management architecture is mainly composed of CSMF, NSMF, and NSSMF.

[0063] Among them, CSMF (Communication Service Management Function) is a communication service management function that completes the ordering and processing of user business communication service needs. It is responsible for converting the communication service needs of operators / third-party customers into needs for network slices, and sends the needs for network slices to NSMF through the interface between NSMF (such as creating, terminating, modifying network slice instance requests, etc.), and obtains network slice management data (such as performance, fault data, etc.) from NSMF.

[0064] Among them, NSMF (Network Slice Management Function) is responsible for receiving network slicing requirements sent by CSMF (Communication Service Management Function), managing the life cycle, performance, and faults of network slice instances, orchestrating the composition of network slice instances, decomposing the requirements of network slice instances into the requirements of each network slice subnet instance or network function, and sending network slice subnet instance management requests to each NSSMF.

[0065] Among them, NSSMF (Network Slice Subnet Management Function) receives the network slice subnet deployment requirements issued by NSMF, manages the network slice subnet instances, orchestrates the composition of the network slice subnet instances, maps the SLA requirements of the network slice subnet to the QoS requirements of the network service, and sends the network service deployment request to the NFVO system of the ETSI NFV domain.

[0066] At present, in 5G network slices, there are many slice instances, various slice application types, and different needs of slice users, which makes it difficult to find abnormal billing bills. This puts high demands on the accurate detection of abnormal bills. In the existing technology, abnormal bill detection of network slices is mainly achieved by manually formulating detection rules, which is not accurate enough, thus affecting the user experience. The difficulty of detecting abnormal bills of slice bills is that it is not only necessary to analyze the bills generated by slice users, but also to analyze the SLA requirements of slice users associated with the bills and the type of slice applications to which the slice instances belong. Therefore, this example uses the characteristics of the graph attention network that can assign different weights according to the differences in the influence of neighbor nodes in the graph network, and proposes a multi-level heterogeneous graph attention network. With the slice instance bill node as the center, the node types of slice heterogeneity are constructed to analyze abnormal bills of network slices.

[0067] The graph attention network introduces the attention mechanism into the graph network. The attention mechanism is introduced in the propagation layer, so that different weights are assigned to different adjacent nodes during the aggregation process of the central node features, and the attention to the neighboring nodes is different. The focus is on those slice nodes with relatively large associations, while ignoring some slice nodes with relatively small associations. The original GCN and other graph neural networks use static and non-adaptive propagation rules. It is impossible to capture which neighbor node of the central node contributes more to the classification of the central node. In real data, not all edges represent the same association strength.

[0068] The graph in this example refers to a relationship graph composed of three types of heterogeneous data in the slice network, which can be expressed as G = (V, E). The nodes in the graph represent three types of heterogeneous data, namely three types of heterogeneous nodes. E is a set of edges. The edges in the graph represent two relationships between the three types of heterogeneous data. The node feature set is represented by h, and the feature hi of each vertex is a high-dimensional vector. This scenario is regarded as a classification problem of the slice instance call list node, and the final output is whether the detected slice instance call list is abnormal (1 represents abnormality, 0 represents normality).

[0069] The “heterogeneous” mentioned here refers to the heterogeneity of node types in the graph network of this scenario, which specifically includes the following three types of nodes:

[0070] (1) Slice user: The characteristics of this type of node are related information of the slice user, expressed as U = {u1, u2, u3, ..., un}, including user subscription information, user SLA requirements, user usage location, etc. This node is the first neighbor node mentioned above;

[0071] (2) Slice bill: This type of node is characterized by the slice bill content, expressed as B = {b1, b2, b3, ..., bm}, which contains information such as the duration, traffic, and cost of the slice instance. This node is the central node mentioned above, also called the slice bill information node;

[0072] (3) Slice application type: The characteristic of this type of node is the description of the slice application type, expressed as A = {a1, a2, a3, ..., ak}, such as enhanced mobile broadband, large-scale Internet of Things, high-reliability and low-latency communication, etc. This node is the second neighbor node mentioned above.

[0073] The relationships between several nodes include the following two:

[0074] (1) Between slice users and slice instance call records: Each slice instance used by a slice user generates a corresponding slice instance call record;

[0075] (2) Between slice instance call records and slice application types: the relationship between slice instance call records and one or more slice application types.

[0076] Figure 5 The figure shows the relationship between the three nodes. Figure 5 As shown, the first neighbor node includes: slice user 1, slice user 2, slice user 3; the central node includes: slice instance bill 1, slice instance bill 2, slice instance bill 3, slice instance bill 4; the second neighbor node includes: slice application type 1, slice application type 1, slice application type 1. Among them, the first neighbor node and the second neighbor node are both associated with the central node.

[0077] In specific implementation, the calculation process of graph attention is divided into two steps: calculating the attention coefficient and weighted summation. The GAT model is implemented by stacking graph attention layers. The input of each graph attention layer is the set of warning text features generated by the node:

[0078]

[0079] The output is a new set of warning text features:

[0080]

[0081] In order to calculate the weight of each neighbor node, a shared weight matrix W of F×F' is applied to each node, and then the attention coefficient can be calculated, which can represent the importance of node j relative to node i:

[0082]

[0083] In order to make the attention coefficient easier to calculate and compare, softmax is introduced to regularize all the neighboring nodes j of i:

[0084]

[0085] Therefore, the feature representation of node i after the graph attention layer is obtained as: that is, the new feature output by GAT for each vertex i (integrating the neighborhood information), and σ is the activation function.

[0086]

[0087] Where Ni represents the set of neighbor nodes of node i, and the coefficient α is the coefficient used for weighted summation during each convolution.

[0088] Specifically, the network slice abnormal call record online detection process proposed in this example includes the following operations:

[0089] (1) NSMF obtains the billing record content of the detected slice instance, the user-related information of the slice to which it belongs, and the description of the application type of the slice to which it belongs in real time;

[0090] (2) Taking the slice instance call record as the central node, a graph network consisting of three heterogeneous nodes in the slice: slice user, slice instance call record, and slice application type;

[0091] (3) After encoding the slice instance billing bill content, the slice user related information and the slice application type description features thereof into sequence representations, respectively, a bill feature sequence corresponding to the slice bill information, a slice user feature sequence corresponding to the slice user information, and a slice application type feature sequence corresponding to the slice application type information are obtained, and then input into the slice billing bill anomaly detection model;

[0092] (4) The feature contents of the three types of nodes are converted into fixed vectors through the word embedding layer and then input into the neighbor node level graph attention layer, which outputs the new feature h of the slice instance call list after integrating the slice user feature information. bi 1 (i.e. the first call record fusion feature after fusion of slice user features ) and the new feature h of the slice instance call record after integrating the feature information of the slice application type bi 2 (i.e., the second call record fusion feature after fusion of slice application type features).

[0093] (5) The above two new features of the slice instance call list that respectively integrate the features of a single type of neighbor node are input into the central node-level graph attention layer, and the new feature of the slice instance call list that integrates the features of two types of neighbor nodes is output. bi '(i.e., the call record input features determined by the first call record fusion features and the second call record fusion features obtained according to the graph network).

[0094] (6) Slice the new feature h of the call sheet bi 'The input is sent to the classifier composed of the fully connected layer. The model finally outputs whether there is any abnormality in the billing call record of the detected slice instance, and returns the result to NSMF. Among them, the classifier composed of the fully connected layer is the call record classification model mentioned above.

[0095] It can be seen that the implementation of this example is mainly divided into the following two core steps:

[0096] Step 1: Slice feature preprocessing. Collect historical network slice datasets from NSMF and construct a graph network consisting of three types of heterogeneous nodes: slice users, slice instance bills, and slice application types. The dataset is the features of three types of heterogeneous nodes, including the relevant information set of slice users, the content set of slice instance bills, and the description set of slice application types, which are encoded as sequence representations.

[0097] Step 2: Build and train the model. The multi-level heterogeneous graph attention network built in this model includes two parts: neighbor node-level graph attention and central node-level graph attention. The slice instance call sheet is taken as the central node, and neighbor node-level attention aggregation is performed with the two adjacent types of neighbor nodes respectively. The neighbor nodes (i.e., slice users and slice application types) of the slice instance call sheet are learned for different importance in judging whether it is abnormal, and different weights are assigned to the relationship between nodes according to the difference in importance. Then, the new features of the slice instance call sheet after the slice user feature information is output and the new features of the slice instance call sheet after the slice application type feature information is integrated are aggregated at the central node level. Finally, the fully connected layer is used to output whether there is an abnormality in the detected slice instance billing call sheet.

[0098] Among them, the main process of data preprocessing described in step 1 is as follows:

[0099] Firstly, the historical network slicing dataset is collected from NSMF, and a graph network consisting of three types of heterogeneous nodes in the slice, namely slice users, slice instance call records, and slice application types, is constructed. The dataset is the features of the three types of heterogeneous nodes, including the relevant information set of slice users, the content set of slice instance call records, and the description set of slice application types, which are encoded into sequence representations respectively.

[0100] Then, the relevant information set of the slice user, the content set of the slice instance call list, and the description set of the slice application type are encoded as sequence representations. The encoding sequence length of each node feature is defined as F, and the longest length F in the data set is taken as its encoding sequence length. The length of each data is filled to F, and the dictionary size is taken as z.

[0101] Next, the label matrix Y is a manually labeled matrix of whether each slice instance call record is an abnormal call record, and its shape is N*1.

[0102] Finally, the total data set is divided into training data and test data, taking 80% of the entire data set as training data and the remaining 20% ​​as test data. The training set is used for training so that the reconstructed data is as close to the original data as possible, and the test set is used to evaluate and verify the model.

[0103] The main process of building and training the model described in step 2 is as follows:

[0104] The multi-level heterogeneous graph attention network built by this model includes two parts: neighbor node-level graph attention and central node-level graph attention. The slice instance call sheet is taken as the central node, and the neighbor node-level attention aggregation is performed with the two adjacent types of neighbor nodes. The node-level attention mechanism is used to learn the different importance of the neighbor nodes of the slice instance call sheet, namely the slice user and the slice application type, for judging whether it is abnormal. Different weights are assigned to the relationship between nodes according to the difference in importance. Then, the new features of the slice instance call sheet after the slice user feature information is integrated and the new features of the slice instance call sheet after the slice application type feature information is integrated are aggregated at the central node level.

[0105] Figure 6 The specific schematic diagram of the call list classification model built in this example is shown. The input of the model is the characteristic attributes of three heterogeneous data in the historical network slice: slice users, slice instance call lists, and slice application types. The model mainly includes the following branches:

[0106] Branch 1: Learn the weight of the first-class neighbor node "slice user" of slice instance call record i. Input the call record text feature h of slice instance call record i bi , and the attribute characteristics h of its slice user neighbors ui After being converted into vectors by the word embedding layer, they are input into the neighbor node level graph attention layer, and the new feature h of the slice instance call list after integrating the feature information of the neighbor node "slice user" is output. bi 1 ;

[0107] Branch 2: Learn the weight of the importance of the second type of neighbor node "slice application type" of the slice instance call record i. Input the call record text feature h of the slice instance call record i bi , and the descriptive features of its slice application type neighbors h ai After being converted into vectors by the word embedding layer, they are input into the neighbor node level graph attention layer, and the new feature h of the slice instance call list after integrating the feature information of the neighbor node "slice application type" is output. bi 2 ;

[0108] The embedding layer: uses word embedding to convert each word into a vector. The input data dimension is z, and the output is set to convert the word into a 64-dimensional space vector. The input sequence length is F, so the shape of the output data of this layer is (None, F, 64). The function of this layer is to perform vector mapping on the input word and convert the index of each word into a 64-dimensional fixed-shape vector.

[0109] The neighbor node level graph attention layer has 256 convolution kernels and the activation function is set to "relu".

[0110] Then the new feature h of the slice instance call list after integrating the slice user feature information output by the above two branches is bi 1 and the new feature h of the slice instance call record after integrating the feature information of the slice application type bi 2 Input to the central node level graph attention layer for central node level attention aggregation, and output the new feature h of the slice instance bill that integrates the features of two types of neighbor nodes. bi '. Finally, the new feature h of the slice instance call list bi 'Input to the classifier consisting of fully connected layers.

[0111] Among them, the central node level graph attention layer: the number of convolution kernels is 128, and the activation function is set to "relu";

[0112] Among them, the classifier is composed of a fully connected layer (Dense): the number of neurons is set to 1, the activation function is set to "sigmoid", and the output is whether there is an abnormality in the billing call record of the detected slice instance (1 is abnormal, 0 is normal).

[0113] Then the error between the predicted slice instance call list detection result and the actual slice instance call list detection result is calculated, and the training goal is to minimize the error. The objective function selects the 'binary_crossentropy' binary logarithmic loss function:

[0114]

[0115] The number of training rounds is set to 1000 (epochs = 1000), and the gradient descent optimization algorithm selects the adam optimizer to improve the learning speed of traditional gradient descent (optimizer = 'adam'). The neural network can find the optimal weight value that minimizes the objective function through gradient descent, and the neural network will learn the weight value autonomously through training. Use the training set to train so that the objective function is as small as possible, and use the test set to evaluate and verify the model after each round of training. After the model converges, the weight of the model is derived.

[0116] In summary, the online detection process of network slicing billing call bills proposed in this example is as follows: (1) NSMF obtains the billing call bill content of the detected slice instance, the slice user related information and the slice application type description in real time; (2) With the slice instance bill as the central node, a graph network consisting of three heterogeneous nodes in the slice: slice user, slice instance bill, and slice application type is constructed; (3) The features of the slice instance billing call bill content, the slice user related information and the slice application type description are encoded into sequence representations and input into the slice billing call bill anomaly detection model; (4) The feature contents of the three types of nodes are converted into fixed vectors through the word embedding layer, and then input into the neighbor node level graph attention layer, and the new features h of the slice instance bill after integrating the slice user feature information are output. bi 1 and the new feature h of the slice instance call record after integrating the feature information of the slice application type bi 2 (5) The above two new features of the slice instance call record that respectively integrate the features of a single type of neighboring node are input into the central node-level graph attention layer, and the new feature of the slice instance call record that integrates the features of two types of neighboring nodes is output. bi '. (6) Slice the new feature h of the call list bi 'The input is sent to the classifier composed of a fully connected layer. The model finally outputs whether there is any abnormality in the billing call record of the detected slice instance and returns the result to NSMF.

[0117] It can be seen that the embodiment of the present invention discloses a 5G slice billing call sheet anomaly detection method based on a multi-level heterogeneous graph attention network. The graph attention network can assign different weights according to the difference in the influence of neighbor nodes in the graph network, and construct a heterogeneous graph network consisting of three heterogeneous nodes in the slice, namely, slice users, slice instance call sheets, and slice application types. The constructed multi-level heterogeneous graph attention network includes two parts: neighbor node-level graph attention and central node-level graph attention. First, the slice instance call sheet is taken as the central node, and neighbor node-level attention aggregation is performed with the two adjacent neighbor nodes respectively. The neighbor nodes of the slice instance call sheet, namely, the slice user and the slice application type, are learned for judging whether they are abnormal. Different weights are assigned to the relationship between the nodes according to the difference in importance. Then, the new features of the slice instance call sheet after the slice user feature information is output and the new features of the slice instance call sheet after the slice application type feature information is integrated are output for central node-level attention aggregation. Finally, the detected slice instance billing call sheet is output through the fully connected layer to determine whether there is an abnormality. Thereby improving the initiative and timeliness of call sheet anomaly discovery in network slices and improving the service experience of slice users.

[0118] Embodiment 3

[0119] Figure 3 The schematic diagram of the structure of an abnormal call record detection device based on network slicing provided in the third embodiment of the present invention is shown, which specifically includes:

[0120] A graph construction module 31, adapted to construct a graph network according to slice call record information, slice user information, and slice application type information corresponding to the network slice to be detected;

[0121] A sequence acquisition module 32, adapted to respectively acquire a call record feature sequence corresponding to the slice call record information, a slice user feature sequence corresponding to the slice user information, and a slice application type feature sequence corresponding to the slice application type information;

[0122] The feature fusion module 33 is adapted to determine a first call record fusion feature after fusing slice user features according to the call record feature sequence, the slice user feature sequence and the graph network; and determine a second call record fusion feature after fusing slice application type features according to the call record feature sequence, the slice application type feature sequence and the graph network;

[0123] The judgment module 34 is suitable for obtaining the call record input features determined by the first call record fusion features and the second call record fusion features according to the graph network; inputting the call record input features into a preset call record classification model, and judging whether the slice call record of the network slice to be detected is abnormal according to the output result of the call record classification model.

[0124] Optionally, the graph construction module is specifically suitable for:

[0125] Determine the slice call record information as the central node, determine the slice user information as the first neighbor node, and determine the slice application type information as the second neighbor node;

[0126] A graph network consisting of the central node, the first neighbor node and the second neighbor node is constructed.

[0127] Optionally, the graph network includes: a neighbor node level graph attention layer and a center node level graph attention layer;

[0128] Then the feature fusion module is specifically suitable for:

[0129] Inputting the call record feature sequence and the slice user feature sequence into the neighbor node level graph attention layer to obtain a first call record fusion feature after fusing the slice user feature; and

[0130] The call record feature sequence and the slice application type feature sequence are input into the neighbor node level graph attention layer to obtain a second call record fusion feature after fusing the slice application type feature.

[0131] Optionally, the judgment module is specifically adapted to:

[0132] The first call record fusion feature and the second call record fusion feature are input into the central node level graph attention layer to obtain the call record input feature.

[0133] Optionally, before the device is executed, the method further comprises:

[0134] The training module is suitable for preprocessing the sample data corresponding to the acquired network slice samples, and training the call record classification model according to the preprocessed sample data.

[0135] Optionally, the slice bill information corresponding to the network slice to be detected includes: slice instance bill content, slice instance usage time, data traffic and / or data charges;

[0136] The slice user information includes: slice user's subscription information, user demand information, and / or usage location information;

[0137] The slice application type information includes: mobile broadband type information, Internet of Things type information, and / or communication type information.

[0138] Optionally, the network slice is a 5G network slice, and the graph network is a multi-level heterogeneous graph attention network.

[0139] Embodiment 4

[0140] Embodiment 4 of the present application provides a non-volatile computer storage medium, wherein the computer storage medium stores at least one executable instruction, and the computer executable instruction can execute the abnormal call record detection method based on network slicing in any of the above method embodiments. The executable instruction can be specifically used to enable the processor to perform the corresponding operations in the above method embodiments.

[0141] Embodiment 5

[0142] Figure 4 A schematic structural diagram of an electronic device according to Embodiment 5 of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the electronic device.

[0143] like Figure 4 As shown, the electronic device may include: a processor (processor) 402 , a communication interface (Communications Interface) 406 , a memory (memory) 404 , and a communication bus 408 .

[0144] in:

[0145] The processor 402 , the communication interface 406 , and the memory 404 communicate with each other via a communication bus 408 .

[0146] The communication interface 406 is used to communicate with other devices such as clients or other servers.

[0147] Processor 402 is used to execute program 410, and can specifically execute the relevant steps in the above-mentioned abnormal call record detection method embodiment based on network slicing.

[0148] Specifically, the program 410 may include program codes, which include computer operation instructions.

[0149] The processor 402 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the electronic device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0150] The memory 404 is used to store the program 410. The memory 404 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0151] The program 510 may be specifically used to enable the processor 502 to execute the corresponding operations in the above method embodiment.

[0152] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0153] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0154] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in all of the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0155] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0156] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0157] The various component embodiments of the present invention can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components in the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0158] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A method for detecting abnormal call records based on network slicing, comprising: Constructing a graph network according to slice bill information, slice user information, and slice application type information corresponding to the network slice to be detected; wherein the slice bill information is determined as a central node, the slice user information is determined as a first neighbor node, and the slice application type information is determined as a second neighbor node; constructing a graph network consisting of the central node, the first neighbor node, and the second neighbor node, the graph network comprising: a neighbor node-level graph attention layer and a central node-level graph attention layer; Respectively obtain a call record feature sequence corresponding to the slice call record information, a slice user feature sequence corresponding to the slice user information, and a slice application type feature sequence corresponding to the slice application type information; Input the call record feature sequence and the slice user feature sequence into the neighbor node level graph attention layer to obtain a first call record fusion feature after fusing the slice user feature; and input the call record feature sequence and the slice application type feature sequence into the neighbor node level graph attention layer to obtain a second call record fusion feature after fusing the slice application type feature; The first call record fusion feature and the second call record fusion feature are input into the central node level graph attention layer to obtain the call record input feature; the call record input feature is input into a preset call record classification model, and whether the slice call record of the network slice to be detected is abnormal is determined according to the output result of the call record classification model.

2. The method according to claim 1, wherein: Before the method is performed, it further comprises: The sample data corresponding to the acquired network slice samples are preprocessed, and the call record classification model is trained based on the preprocessed sample data.

3. The method according to claim 1, wherein: The slice bill information corresponding to the network slice to be detected includes: slice instance bill content, slice instance usage time, data traffic and / or data charges; The slice user information includes: slice user's subscription information, user demand information, and / or usage location information; The slice application type information includes: mobile broadband type information, Internet of Things type information, and / or communication type information.

4. The method according to any one of claims 1 to 3, wherein: The network slice is a 5G network slice, and the graph network is a multi-level heterogeneous graph attention network.

5. An abnormal call record detection device based on network slicing, comprising: A graph construction module is adapted to construct a graph network according to slice bill information, slice user information, and slice application type information corresponding to the network slice to be detected; wherein the slice bill information is determined as a central node, the slice user information is determined as a first neighbor node, and the slice application type information is determined as a second neighbor node; a graph network consisting of the central node, the first neighbor node, and the second neighbor node is constructed, and the graph network includes: a neighbor node level graph attention layer and a central node level graph attention layer; A sequence acquisition module, adapted to respectively acquire a call record feature sequence corresponding to the slice call record information, a slice user feature sequence corresponding to the slice user information, and a slice application type feature sequence corresponding to the slice application type information; A feature fusion module, adapted to input the call record feature sequence and the slice user feature sequence into the neighbor node level graph attention layer to obtain a first call record fusion feature after fusing the slice user feature; and input the call record feature sequence and the slice application type feature sequence into the neighbor node level graph attention layer to obtain a second call record fusion feature after fusing the slice application type feature; The judgment module is suitable for inputting the first call record fusion feature and the second call record fusion feature into the central node level graph attention layer to obtain the call record input feature; inputting the call record input feature into a preset call record classification model, and judging whether the slice call record of the network slice to be detected is abnormal according to the output result of the call record classification model.

6. An electronic device comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the abnormal call record detection method based on network slicing as described in any one of claims 1-4.

7. A computer storage medium, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables the processor to perform operations corresponding to the abnormal call record detection method based on network slicing as described in any one of claims 1-4.

Images