A method and system for scheduling soft switch traffic anomaly early warning

Abstract

The present application relates to the technical field of communication, provide a kind of scheduling soft exchange traffic abnormal early warning method and system, comprising: SIP signaling data is analyzed, and key field is filtered to signaling;According to key field, extract the distinguishing node of call and call object, based on distinguishing node and call object query all CALLID involved in call, capture all call actions, determine complete traffic flow, obtain call SIP signaling set;Call SIP signaling set is compressed using compression algorithm after storage;After decoding the compressed storage call SIP signaling set, draw signaling flow chart based on the data obtained by decoding;Using the natural language processing classification model based on deep learning, determine whether signaling is abnormal. Overall guarantee the safe and stable operation of dispatching exchange network.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of communication technology, and particularly relates to a dispatch soft switch traffic abnormality early warning method and system. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute the prior art.

[0003] Power communication soft switch is one of the core devices of network evolution and next-generation packet network, and the soft switch technology is gradually becoming the focus of research and development of dispatch exchange system. It is independent of the transmission network, and can not only provide the service functions of program-controlled exchange system, but also support call control, resource allocation, protocol processing and other services. At present, the power soft switch system is still in the consolidation period, and as the system construction continues to deepen, problems in the system emerge:

[0004] First, the power communication exchange network involves the interworking between the soft switch terminal device and the program-controlled terminal device. This type of cross-domain call scenario involves the change of the unique identifier of the call (CALLID). The current CALLID is used to distinguish different calls, and the call scenario involving CALLID change is difficult to form a complete signaling flow, making it difficult to determine the accurate flow of traffic and analyze the call;

[0005] Secondly, when the user call function of the soft switch system is abnormal, the signaling flow is usually analyzed by using a packet capture tool. However, this method cannot completely reproduce the signaling flow when the fault occurs, and cannot save historical signaling flow data, making it difficult to compare and analyze historical data.

[0006] Thirdly, the SIP (Session Initiation Protocol) telephone for power grid dispatch has basic dispatch functions such as one-key group call, forced insertion and forced removal. This type of call scenario involves meetings and multiple call parties. The conventional signaling flow drawing method is prone to cause unclear signaling display and difficult problem positioning.

[0007] Fourthly, the current soft switch system cannot automatically analyze and warn the call abnormality, which leads to the fact that the fault discovery is not timely enough, and the safe and stable operation of the dispatch exchange network cannot be fully guaranteed. SUMMARY

[0008] In order to solve the technical problems in the above background art, the present application provides a dispatch soft switching traffic anomaly early warning method and system, which captures all call actions by finding all CALL IDs involved in the session time period and the call object, determines the complete traffic flow, avoids the change of CALL ID caused by cross-domain calling, and on this basis, automatically constructs and determines whether the signaling is abnormal, realizes automatic alarm of abnormal signaling, and comprehensively guarantees the safe and stable operation of the dispatch switching network.

[0009] In order to achieve the above purpose, the present application adopts the following technical solutions:

[0010] The first aspect of the present application provides a dispatch soft switching traffic anomaly early warning method, which comprises:

[0011] SIP signaling data is acquired;

[0012] The SIP signaling data is parsed and the key fields of the signaling are filtered;

[0013] According to the key fields, the call distinguishing nodes and the call objects are extracted, all CALL IDs involved in the call are queried based on the distinguishing nodes and the call objects, all call actions are captured, the complete traffic flow is determined, and the call SIP signaling set is obtained;

[0014] The call SIP signaling set is compressed by using a compression algorithm and then stored;

[0015] After the compressed and stored call SIP signaling set is decoded, the signaling flowchart is drawn based on the decoded data;

[0016] Based on the signaling flowchart, a natural language processing classification model based on deep learning is used to determine whether the signaling is abnormal.

[0017] Further, the SIP protocol type is used to parse the signaling data to obtain the signaling message header and the message body.

[0018] Further, the message body is filtered according to the CALL ID, FROM, TO, call time, source IP and destination IP.

[0019] Further, the INVITE and BYE messages of the session type request are used as the call distinguishing nodes to obtain the session start time point and the session end time point.

[0020] Further, the FROM and TO fields in the INVITE and BYE messages are acquired to determine the caller and the called party.

[0021] Further, the specific steps of the compression algorithm are:

[0022] Based on several SIP signaling data, a data dictionary is constructed;

[0023] For the call SIP signaling set, each signaling is encoded and converted using the data dictionary.

[0024] Further, the ordinate of the signaling flow chart is the server node and the session terminal node of the soft switch system, and the abscissa is the signaling interaction between the nodes.

[0025] The second aspect of the application provides a dispatching soft switch traffic anomaly early warning system, which comprises:

[0026] A signaling collection module configured to acquire SIP signaling data;

[0027] A signaling analysis module configured to analyze the SIP signaling data and filter the key fields of the signaling;

[0028] A traffic anchoring module configured to extract the distinguishing nodes and the call objects of the call according to the key fields, query all CALLIDs involved in the call based on the distinguishing nodes and the call objects, capture all call actions, determine the complete traffic flow direction, and obtain the call SIP signaling set;

[0029] A compressed storage module configured to store the call SIP signaling set after compression using a compression algorithm;

[0030] A signaling display module configured to decode the compressed and stored call SIP signaling set, and draw a signaling flow chart based on the decoded data;

[0031] A signaling analysis module configured to use a natural language processing classification model based on deep learning to determine whether the signaling is abnormal based on the signaling flow chart.

[0032] The third aspect of the application provides a computer readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the steps of the dispatching soft switch traffic anomaly early warning method described above.

[0033] The fourth aspect of the application provides a computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the dispatching soft switch traffic anomaly early warning method described above when executing the program.

[0034] Compared with the prior art, the application has the following beneficial effects:

[0035] The application provides a dispatching soft switching traffic abnormality early warning method.

[0036] The application provides a dispatching soft switching traffic abnormality early warning method, which uses a natural language processing classification model based on deep learning to determine whether signaling is abnormal, realizes automatic alarm of abnormal signaling, and comprehensively guarantees the safe and stable operation of a dispatching switching network. BRIEF DESCRIPTION OF DRAWINGS

[0037] The accompanying drawings, which form a part of this application, are included to provide a further understanding of the application and are incorporated in and constitute a part of this application. The embodiments of the application illustrated in the drawings, and their description, are presented to add generic scope to the application.

[0038] Figure 1 FIG. 1 is a flowchart of a dispatching soft switching traffic abnormality early warning method according to an embodiment of the application. DETAILED DESCRIPTION

[0039] The application will be further described below in conjunction with the drawings and embodiments.

[0040] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the application. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0041] Embodiment one

[0042] The embodiment provides a dispatching soft switching traffic abnormality early warning method, which specifically comprises the following steps.

[0043] Step (1) signaling collection and analysis.

[0044] Signaling data messages are generated in communication between terminal devices in a soft switching system, and all signaling data need to be transmitted through a soft switching server. SIP signaling data is collected in real time from the soft switching server, and the signaling data is analyzed according to a defined protocol type. A signaling filter is used to filter signaling key fields, including CALLID, FROM, TO, call time, source IP, and destination IP.

[0045] The specific steps of step (1) are as follows.

[0046] Step (101): The signaling collection module receives real-time signaling data from the dispatching soft switching system server in the form of a mirror port.

[0047] Step (102): Analyzing the signaling data according to the SIP protocol type, including the signaling message header and the message body, and further filtering the message body according to key fields such as CALLID, FROM, TO, call time, source IP, and destination IP.

[0048] Step (2): Traffic anchoring.

[0049] According to the key field information, multiple signaling data are associated with a specific call (i.e., a signaling data is a component of a specific call), and the complete traffic flow is determined. First, session class requests INVITE and BYE are used as session distinguishing nodes to determine the session time period; second, the calling party FROM and the called party TO are used to determine the call object; since cross-domain calls can cause changes in CALLID, all CALLIDs involved in the call are found through the session time period and the call object to capture all call actions and determine the complete traffic flow.

[0050] Step (201): Using the session class request INVITE and BYE messages as session distinguishing nodes to obtain the session start and end time points.

[0051] Step (202): Obtaining the FROM and TO fields in the INVITE and BYE messages to determine the calling party and the called party.

[0052] Step (203): Using the session start and end time and the call object to query all CALLIDs involved in the call, and integrating all SIP signaling of the call into a call SIP signaling set.

[0053] It should be noted that in a call, if call forwarding or the like is involved, multiple CALL IDs can be included. Here, the CALL ID set is used to obtain all SIP signaling in a call.

[0054] Step (3): Signaling compression storage. The key field information and the signaling set of each call are compressed using a compression algorithm and stored in the system database.

[0055] Scheduling communication daily involves a large number of sessions, generating a large amount of SIP message data, and ordinary storage form will cause storage resource shortage, the internal format of SIP message is key-value pair (Key-Value). Because the common type of SIP message is limited, the type of key in each type appears frequently, so the K value and V value can be represented by numbers, and a data dictionary is constructed. Realize data compression, save storage resources, improve storage capacity. The commonly used keys in the data dictionary and their representations are "Via":01, "From":02, "To":03, "Contact":04, "CSeq":05, "Content-Type":06, "Context-Length":07, etc.

[0056] Step (301): First, grab 100000 SIP messages, and structure the SIP messages. Write a script to count the frequency of K and V values in the message, take the K and V values with a frequency of more than 1000 times, construct a data dictionary, and use numbers to refer to them as much as possible to cover all possible situations in the message.

[0057] Step (302): After obtaining the call SIP signaling set, use the data dictionary to encode and convert each signaling, and store it in the system database in order.

[0058] Step (4): Signaling visualization display. Use the filtered signaling set and key field information to draw a signaling flowchart for visualization.

[0059] After obtaining the signaling data set of the session and the key field key value, the session flow needs to be visualized. According to the data dictionary, the compressed signaling is decoded to obtain the number of call signaling, signaling flow direction, etc. Use this information to draw a signaling flowchart. The vertical coordinate is the server, session terminal and other nodes of the soft switch system, and the horizontal coordinate shows the signaling interaction between nodes.

[0060] Step (401): First, build a Dash framework based on Python language, according to the ordered signaling set, extract all session nodes involved in this session, such as different service nodes of soft switch server, session terminal nodes, etc.

[0061] Step (402): Draw the signaling flowchart horizontally according to the signaling interaction direction.

[0062] Step (5): Signaling analysis and early warning. Finally, analyze and early warn the signaling session data. Use a long short-term memory model based on deep learning to automatically identify abnormal signaling in the signaling interaction process, and realize automatic early warning of call abnormality.

[0063] Step (501): Using 50000 sets of signaling session data (a set of signaling session data is a signaling set of a specific call), randomly define them as a training set, a test set and a validation set in a ratio of 8:1:1, and define a data loader.

[0064] Step (502): Use sliding window to make signaling sequences for training, input these sequences into the LSTM model encoder for global attention calculation and feature extraction. Finally, input the LSTM model output sequence into a multilayer perceptron for anomaly discrimination. Use the training set and the test set for batch training, and use the validation set to determine the best parameters of the model.

[0065] Step (503): Use a set of signaling sessions as model input, use the trained model to detect whether there is abnormal signaling in the session, and obtain suspected abnormal signaling.

[0066] Step (504): Trigger the abnormality warning script to perform abnormality warning according to the abnormal signaling screened by the model.

[0067] Embodiment Two

[0068] The embodiment provides a dispatching soft switching traffic anomaly warning system, which specifically comprises:

[0069] a signaling collection module configured to acquire SIP signaling data;

[0070] a signaling analysis module configured to analyze the SIP signaling data and filter key fields of the signaling;

[0071] a traffic anchoring module configured to extract a distinguishing node and a call object of a call according to the key fields, query all CALLIDs involved in the call based on the distinguishing node and the call object, capture all call actions, determine a complete traffic flow direction, and obtain a call SIP signaling set;

[0072] a compression storage module configured to store the call SIP signaling set after compression by using a compression algorithm;

[0073] a signaling display module configured to decode the compressed and stored call SIP signaling set, and draw a signaling flowchart based on the decoded data;

[0074] a signaling analysis module configured to use a deep learning-based natural language processing classification model to determine whether the signaling is abnormal based on the signaling flowchart.

[0075] It should be noted that each module in the embodiment corresponds to each step in Embodiment One, and the specific implementation process is the same, which will not be repeated here.

[0076] Embodiment three

[0077] The embodiment provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement steps in a soft switching traffic abnormality early warning method according to the above embodiment one.

[0078] Embodiment four

[0079] The embodiment provides a computer device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements steps in a soft switching traffic abnormality early warning method according to the above embodiment one when executing the program.

[0080] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage, etc.) containing computer-usable program code.

[0081] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus for performing the functions specified in one or more flows and / or blocks.

[0082] These computer program instructions can also be stored in a computer readable memory capable of guiding a computer or other programmable data processing devices to work in a specific manner, so that the instructions stored in the computer readable memory produce a product including instruction apparatus, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus for performing the functions specified in one or more flows and / or blocks.

[0083] These computer program instructions can also be loaded into a computer or other programmable data processing device, so that a series of operational steps are performed on the computer or other programmable data processing device to generate a computer-implemented process, thus the instructions executed on the computer or other programmable data processing device provide a process for implementing the functions described in the flowchart Figure 1 one flow or multiple flows and / or the functions specified in the block Figure 1 one flow or multiple flows and / or the functions specified in the block

[0084] Those of ordinary skill in the art can understand that all or part of the flow of the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the flow of the above-mentioned embodiment of each method. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), a random access memory (RAM), and the like.

[0085] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Those of ordinary skill in the art can make various modifications and changes to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for scheduling softswitch traffic anomaly early warning, characterized in that, The method comprises the following steps: acquiring SIP signaling data; parsing the SIP signaling data and filtering key fields of the signaling; extracting distinguishing nodes and call objects of a call according to the key fields, querying all CALL IDs involved in the call based on the distinguishing nodes and the call objects, capturing all call actions, determining a complete call traffic flow, and obtaining a call SIP signaling set; storing the call SIP signaling set after compression using a compression algorithm; decoding the compressed and stored call SIP signaling set, and drawing a signaling flowchart based on the decoded data; using a deep learning-based natural language processing classification model to determine whether the signaling is abnormal based on the signaling flowchart, specifically: using a deep learning-based long short-term memory model to automatically determine abnormal signaling in the signaling interaction process by taking signaling session data as input, thereby realizing automatic warning of call abnormalities; defining 50,000 groups of signaling session data as a training set, a test set, and a validation set in a ratio of 8:1:1, and defining a data loader; using a sliding window to generate signaling sequences for training, inputting these sequences into an LSTM model encoder for global attention calculation and feature extraction, and finally inputting the LSTM model output sequence into a multilayer perceptron for abnormality determination; using the training set and the test set for batch training, and using the validation set to determine the best parameters of the model; taking a group of signaling sessions as model input, using the trained model to detect whether there is abnormal signaling in the session, and obtaining suspected abnormal signaling; triggering an early warning script to perform abnormal early warning based on the abnormal signaling filtered by the model.

2. The method of claim 1, wherein the softswitch traffic anomaly early warning is scheduled. 2 The signaling data is parsed according to the SIP protocol type to obtain a signaling message header and a message body.

3. The method for early warning of abnormal traffic in a scheduling softswitch as described in claim 2, characterized in that, The message body is filtered according to CALL ID, FROM, TO, call time, source IP, and destination IP.

4. The method of claim 1, wherein the method further comprises: The INVITE and BYE messages of the session type request are taken as distinguishing nodes of the call to obtain a session start time point and a session end time point.

5. The method for early warning of abnormal traffic in a scheduling softswitch as described in claim 4, characterized in that, The FROM and TO fields in the INVITE and BYE messages are obtained to determine the calling party and the called party.

6. The method of claim 1, wherein the method further comprises: The specific steps of the compression algorithm are: constructing a data dictionary based on a plurality of SIP signaling data; encoding and converting each signaling in the call SIP signaling set using the data dictionary.

7. The method for early warning of abnormal traffic in a scheduling softswitch as described in claim 1, characterized in that, The vertical coordinate of the signaling flowchart is a server node and a session terminal node of a softswitch system, and the horizontal coordinate is signaling interaction between nodes.

8. A dispatch softswitch traffic anomaly early warning system, characterized in that, The method comprises the following steps: a signaling acquisition module configured to acquire SIP signaling data; a signaling parsing module configured to parse the SIP signaling data and filter key fields of the signaling; a call anchoring module configured to extract distinguishing nodes and call objects of a call according to the key fields, query all CALL IDs involved in the call based on the distinguishing nodes and the call objects, capture all call actions, determine a complete call traffic flow, and obtain a call SIP signaling set; a compressed storage module configured to store the call SIP signaling set after compression using a compression algorithm; The signaling display module is configured to draw a signaling flow chart based on the decoded data after decoding the compressed stored call SIP signaling set; The signaling analysis module is configured to determine whether the signaling is abnormal based on the signaling flow chart using a deep learning-based natural language processing classification model, specifically: Using a deep learning-based long short-term memory model, the signaling session data is taken as input to automatically determine abnormal signaling in the signaling interaction process, thereby realizing automatic warning of call abnormality; 50000 groups of signaling session data are randomly defined as a training set, a test set and a validation set in a ratio of 8:1:1, and a data loader is defined; The signaling sequence for training is prepared in the form of a sliding window, the sequences are input into the LSTM model encoder for global attention calculation and feature extraction, and finally the LSTM model output sequence is input into a multilayer perceptron for abnormality determination; the training set and the test set are used for batch training, and the validation set is used to determine the best parameters of the model; A group of signaling sessions is taken as model input, and the trained model is used to detect whether there is abnormal signaling in the session to obtain suspected abnormal signaling; According to the abnormal signaling screened by the model, an abnormality warning script is triggered to perform abnormality warning.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps of the dispatching soft switch traffic abnormality warning method in any one of claims 1-7.

10. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the steps of the dispatching soft switch traffic abnormality warning method in any one of claims 1-7.

Images