Abnormality detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an anomaly detection method and device, electronic equipment and a storage medium, and relates to the technical field of network communication, and the method comprises the steps: obtaining a high-level log of network equipment, and extracting a signaling message of a terminal from the high-level log; comparing the extracted signaling message with a preset standard signaling message, and judging whether the high level of the network equipment is abnormal or not; under the condition that the upper layer is abnormal, acquiring a layer 2 log of the network equipment, detecting whether target information exists in the layer 2 log, and judging whether the layer 2 is abnormal based on a detection result of the target information; an abnormality detection result indicating the detected abnormality is generated. By applying the scheme provided by the embodiment of the invention, the anomaly detection efficiency can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to an anomaly detection method, device, electronic equipment and storage medium. Background Art

[0002] During the process of network communication, the terminal may fail to access the network equipment cell. In the related art, it is generally necessary to manually collect various logs and analyze the logs to detect the reason why the terminal cannot access the network equipment cell.

[0003] However, in the manual analysis process, due to the complexity of the analysis process, the anomaly detection process requires a lot of time and manpower costs, and the efficiency of anomaly detection is low. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide an anomaly detection method, device, electronic device and storage medium to improve the efficiency of anomaly detection. The specific technical solution is as follows:

[0005] In a first aspect, an embodiment of the present invention provides an anomaly detection method, the method comprising:

[0006] Obtain high-level logs of network devices and extract terminal signaling messages from the high-level logs;

[0007] Compare the extracted signaling message with the preset standard signaling message to determine whether there is an abnormality in the upper layer of the network device;

[0008] When an abnormality exists in the high-level layer, obtain the layer 2 log of the network device, detect whether the target information exists in the layer 2 log, and determine whether the layer 2 is abnormal based on the detection result of the target information;

[0009] Anomaly detection results representing the detected anomalies are generated.

[0010] In one embodiment of the present invention, after determining whether layer 2 is abnormal based on the detection result of the target information, the method further includes:

[0011] If there is an abnormality in layer 2, based on the physical layer data of the network device, it is determined whether there is an abnormality in the underlying state of the network device.

[0012] In one embodiment of the present invention, the method further comprises:

[0013] In the case where an abnormality exists in the high-level layer or the second layer, a target detection parameter corresponding to the determined abnormality is determined based on a preset abnormality mapping relationship, where the preset abnormality mapping relationship is a correspondence between the type of abnormality and the detection parameter;

[0014] Obtain the public log of the network device and extract the current value of the target detection parameter from the public log;

[0015] Determine whether the current value of the target detection parameter is outside the preset standard value range of the target detection parameter, and if so, determine that the target detection parameter is an abnormal parameter;

[0016] Generate anomaly detection results representing the detected anomalies, including:

[0017] An anomaly detection result including the detected anomaly parameters is generated.

[0018] In one embodiment of the present invention, before generating an anomaly detection result indicating the detected anomaly, the method further includes:

[0019] Get public logs of network devices;

[0020] When a preset abnormal keyword exists in the abnormal log in the public log, it is determined that an abnormality exists in the network device.

[0021] In one embodiment of the present invention, extracting the signaling message of the terminal from the high-level log includes: extracting the signaling message of the UU interface and the NG interface from the high-level log;

[0022] and / or

[0023] The extracted signaling message is compared with the preset standard signaling message to determine whether there is an abnormality in the high-level of the network device, including: sorting the signaling messages based on the sequence number of the signaling message; judging in order of arrangement whether each signaling message is the same as the preset standard signaling message corresponding to the signaling message; if different, it is determined that there is an abnormality in the high-level.

[0024] In one embodiment of the present invention, judging whether there is an abnormality in the bottom layer state of the network device based on the physical layer data of the network device includes:

[0025] Capture data from the physical layer of network devices;

[0026] Based on the captured data, determine whether there is any abnormality in the underlying status of the network device.

[0027] In one embodiment of the present invention, the detection result indicating the existence of an abnormality includes at least one of the following results: the layer 2 log does not contain the RRCSetupRequest message, the layer 2 log contains a first message indicating the time advance and power of the network device, the layer 2 log contains a second message indicating whether the network device has an information sending failure, and the layer 2 log contains a third message indicating the data reception status and cyclic redundancy check CRC check status of the network device.

[0028] In one embodiment of the present invention, the abnormality in the high layer includes: an abnormal signaling message is detected in the high layer log, or the high layer log does not contain the RRCSetupRequest message.

[0029] In a second aspect, an embodiment of the present invention provides an electronic device, including a memory, a transceiver, and a processor:

[0030] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of a processor; and a processor for reading the computer program in the memory and executing any of the above-mentioned method steps of the first aspect.

[0031] In a third aspect, an embodiment of the present invention provides an abnormality detection device, the device comprising:

[0032] A first acquisition module is used to acquire a high-level log of a network device and extract a signaling message of a terminal from the high-level log;

[0033] A first judgment module is used to compare the extracted signaling message with a preset standard signaling message to determine whether there is an abnormality in the upper layer of the network device;

[0034] The second judgment module is used to obtain the layer 2 log of the network device when an abnormality exists in the high-level layer, detect whether there is target information from the layer 2 log, and judge whether there is an abnormality in the layer 2 based on the detection result of the target information;

[0035] The result generation module is used to generate an anomaly detection result representing the detected anomaly.

[0036] In one embodiment of the present invention, the device further comprises:

[0037] The third judgment module is used to judge whether there is an abnormality in layer 2 based on the detection result of the target information, and if there is an abnormality in layer 2, judge whether there is an abnormality in the bottom layer state of the network device based on the physical layer data of the network device.

[0038] In one embodiment of the present invention, the device further comprises:

[0039] A parameter determination module is used to determine, when an abnormality exists in the high-level layer or the second layer, a target detection parameter corresponding to the determined abnormality based on a preset abnormality mapping relationship, wherein the preset abnormality mapping relationship is a correspondence between the type of abnormality and the detection parameter;

[0040] A second acquisition module is used to obtain a public log of the network device and extract the current value of the target detection parameter from the public log;

[0041] A fourth judgment module is used to judge whether the current value of the target detection parameter is outside the preset standard value range of the target detection parameter, and if so, determine that the target detection parameter is an abnormal parameter;

[0042] The result generating device is specifically used for:

[0043] An anomaly detection result including the detected anomaly parameters is generated.

[0044] In one embodiment of the present invention, the device further comprises:

[0045] A third acquisition module, configured to acquire a public log of the network device before generating an anomaly detection result indicating the detected anomaly;

[0046] The information generation module is used to determine that there is an abnormality in the network device when there is a preset abnormal keyword in the abnormal log in the public log.

[0047] In one embodiment of the present invention, the first acquisition module is specifically used to: extract signaling messages of the UU interface and the NG interface from the high-level log;

[0048] and / or

[0049] The first judgment module is specifically used to: sort the signaling messages based on the sequence numbers of the signaling messages; and judge in sequence in the arrangement order whether each signaling message is the same as the preset standard signaling message corresponding to the signaling message. If they are different, it is determined that an abnormality exists in the high-level layer.

[0050] In one embodiment of the present invention, the third judgment module is specifically used to:

[0051] In case of abnormality in layer 2, data is captured from the physical layer of the network device;

[0052] Based on the captured data, determine whether there is any abnormality in the underlying status of the network device.

[0053] In one embodiment of the present invention, the detection result indicating the existence of an abnormality includes at least one of the following results: the layer 2 log does not contain the RRCSetupRequest message, the layer 2 log contains a first message indicating the time advance and power of the network device, the layer 2 log contains a second message indicating whether the network device has an information sending failure, and the layer 2 log contains a third message indicating the data reception status and cyclic redundancy check CRC check status of the network device.

[0054] In one embodiment of the present invention, the abnormality in the high layer includes: an abnormal signaling message is detected in the high layer log, or the high layer log does not contain the RRCSetupRequest message.

[0055] In a fourth aspect, an embodiment of the present invention provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, and the computer program is used to enable a processor to execute any of the above-mentioned methods of the first aspect.

[0056] In a fifth aspect, an embodiment of the present invention further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the above-mentioned methods of the first aspect.

[0057] Beneficial effects of the embodiments of the present invention:

[0058] An anomaly detection method provided by an embodiment of the present invention realizes step-by-step anomaly judgment from the high layer to the low layer by first judging whether there is an anomaly in the high layer of the network device, and then detecting whether there is an anomaly in layer 2 when an anomaly exists in the high layer. Moreover, since the high layer can reflect the anomalies of all lower layers, only when an anomaly occurs in the high layer will an anomaly judgment of the lower layer be performed, thereby ensuring that the anomaly can be checked step by step, and by generating an anomaly detection result indicating the detected anomaly, the anomaly that causes the terminal connection failure can be automatically determined. The entire anomaly detection process does not require human intervention, thereby realizing the automation of anomaly detection and improving the efficiency of anomaly detection.

[0059] Of course, it is not necessary to achieve all of the above advantages at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0061] Figure 1 A schematic diagram of a flow chart of a first anomaly detection method provided by an embodiment of the present invention;

[0062] Figure 2 A flowchart of manual log analysis provided for related technologies;

[0063] Figure 3 A schematic diagram of multi-layer anomaly detection provided by an embodiment of the present invention;

[0064] Figure 4 A schematic diagram of a flow chart of a second anomaly detection method provided by an embodiment of the present invention;

[0065] Figure 5-1 A schematic diagram of a flow chart of a third anomaly detection method provided by an embodiment of the present invention;

[0066] Figure 5-2 A schematic diagram of a fourth anomaly detection method provided by an embodiment of the present invention;

[0067] Figure 5-3 A schematic diagram of a standard signaling interaction process for a terminal to access a network device provided by an embodiment of the present invention;

[0068] Figure 6 A schematic diagram of a fifth anomaly detection method provided by an embodiment of the present invention;

[0069] Figure 7 A schematic diagram of a sixth anomaly detection method provided by an embodiment of the present invention;

[0070] Figure 8 A schematic diagram of obtaining a network device log provided by an embodiment of the present invention;

[0071] Fig. 9 A schematic diagram of a seventh anomaly detection method provided by an embodiment of the present invention;

[0072] Fig.10 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention;

[0073] Fig.11 A schematic diagram of the structure of an anomaly detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0074] In the embodiments of the present invention, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0075] In the embodiments of the present invention, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0076] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0077] Embodiments of the present invention provide an anomaly detection method, an apparatus, an electronic device, and a storage medium to improve the efficiency of anomaly detection.

[0078] Among them, the method and the device are based on the same inventive concept. Since the principles of solving problems by the method and the device are similar, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0079] In order to improve the efficiency of anomaly detection, the embodiments of the present invention provide an anomaly detection method, an apparatus, an electronic device and a storage medium, which are described in detail below.

[0080] In a first aspect, an embodiment of the present invention provides an anomaly detection method, see Figure 1 , Figure 1 This is a flow chart of a first anomaly detection method provided by an embodiment of the present invention. The method may include the following steps S101-S104.

[0081] The anomaly detection method provided by the present invention can be applied to electronic devices, and the electronic devices can be servers, computers, etc.

[0082] The technical solution provided by the embodiment of the present invention can be applied to anomaly detection of various systems, for example, the applicable system may be a Long Term Evolution (LTE) system, a LTE Frequency Division Duplex (FDD) system, a LTE Time Division Duplex (TDD) system, an Advanced Long Term Evolution (LTE-A) system, a 5G New Radio (NR) system and its evolved communication system, etc. These various systems may include terminal devices and network devices. The system may also include a core network part, such as an Evolved Packet System (EPS), a 5G system (5GS), etc. .

[0083] The network device involved in the embodiment of the present invention may be a base station, which may include multiple cells providing services for the terminal. Depending on the specific application scenario, the base station may also be called an access point, or may be a device in the access network that communicates with the wireless terminal device through one or more sectors on the air interface, or other names. The network device may be used to exchange the received air frames with Internet Protocol (IP) packets, and serve as a router between the wireless terminal device and the rest of the access network, wherein the rest of the access network may include an Internet Protocol (IP) communication network. The network device may also coordinate the attribute management of the air interface. For example, the network device involved in the embodiment of the present invention may be an evolutionary network device (evolutional Node B, eNB or e-NodeB) in a long-term evolution system, a 5G base station (gNB) in a 5G network architecture (next generation system), etc., or a home evolved Node B (HeNB), a relay node, a home base station (femto), a pico base station (pico), a network test device, etc., which is not limited in the embodiment of the present invention. In some network structures, the network devices may include centralized unit (CU) nodes and distributed unit (DU) nodes, and the centralized unit and the distributed unit may also be arranged geographically separately.

[0084] S101, obtaining a high-level log of a network device, and extracting a signaling message of a terminal from the high-level log.

[0085] The above-mentioned high-level log is a log of the RRC (Radio Resource Control) layer, and the specific high-level log may be a signaling analysis log (CDL, Call Detail Log).

[0086] The terminal involved in the embodiment of the present invention may be a terminal device, specifically a device that provides voice and / or data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. In different systems, the name of the terminal device may also be different. For example, in a 5G system, the terminal device may be called a user equipment (UE). The wireless terminal device may be a USB storage device, other personal computer memory devices, and a dongle. It may also communicate with one or more core networks (CN) via a radio access network (RAN). The wireless terminal device may be a mobile terminal device, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal device. For example, it may be a portable, pocket-sized, handheld, computer-built-in, or vehicle-mounted mobile device that exchanges language and / or data with a radio access network. For example, Personal Communication Service (PCS) phones, cordless phones, Session Initiated Protocol (SIP) phones, Wireless Local Loop (WLL) stations, Personal Digital Assistants (PDA), personal computers, tablet computers, Machine-type Communication (MTC) terminal devices, etc. Wireless terminal devices may also be referred to as systems, subscriber units, subscriber stations, mobile stations, mobile stations, remote stations, access points, remote terminal devices, access terminal devices, user terminal devices, user agents, user devices, and wireless access points and routers / modems that meet the limitations of this definition, which are not limited in the embodiments of the present invention.

[0087] S102, comparing the extracted signaling message with a preset standard signaling message to determine whether there is an abnormality in the upper layer of the network device.

[0088] The signaling message of the terminal extracted from the high-level log is the signaling exchanged between the terminal and the network device during the actual access process. Corresponding to the abnormality detection process in the embodiment of the present invention, the signaling message of the terminal extracted from the high-level log is the signaling message that the terminal and the network device need to interact when an abnormality occurs when the terminal accesses the network device.

[0089] The above-mentioned preset standard signaling message is a signaling message that needs to be interacted between the terminal and the network device when the terminal normally accesses the network device.

[0090] By comparing the extracted signaling message with the preset standard signaling message under normal access in sequence, if a difference is found, it indicates that an abnormality exists in the high-level log.

[0091] Specifically, the above differences may include: the extracted signaling message may not contain a signaling message that should exist in the preset standard signaling message under normal access, in which case it is determined that the high-level has an abnormality. Or the signaling message contained in the extracted signaling message is different from the preset standard signaling message, it can be determined that the high-level has an abnormality, and the signaling message contained in the extracted signaling message that is different from the preset standard signaling message can be used as abnormal information.

[0092] Specifically, if an abnormality occurs at a layer lower than the upper layer, an abnormality will also occur at the upper layer. Based on this, when an abnormality occurs at the upper layer, it means that the cause of the terminal access abnormality may occur at the upper layer or at a layer lower than the upper layer. In order to conduct a specific investigation of the abnormality, the investigation can be conducted in order from the upper layer to the lower layer.

[0093] In addition, if there is no abnormality in the high-level layer, it means that there is no abnormality in the layer lower than the high-level layer, and the abnormality detection process can be ended.

[0094] S103, when an abnormality exists in the high-level layer, obtain the layer 2 log of the network device, detect whether there is target information from the layer 2 log, and determine whether there is an abnormality in the layer 2 based on the detection result of the target information.

[0095] When an abnormality exists in a high-level layer, an abnormality determination is performed on a layer 2 which is lower than the high-level layer.

[0096] The above-mentioned layer 2 can be a MAC (Medium Access Control) layer, an RLC (Radio Link Control) layer or a PDCP (Packet Data Convergence Protocol) layer, and the layer 2 log can be at least one of a MAC layer log, an RLC layer log, and a PDCP layer log.

[0097] The above-mentioned target information can be the RRCSetupRequest (RRC connection establishment request) message sent by the terminal to the network device at the beginning of the access process, or it can be information indicating the operating status of the network device, for example: a message indicating the timing advance (TA) of the network device, a message indicating the power of the network device, a message indicating whether there is an information sending failure of the network device, a message indicating the data reception status of the network device, and a message indicating the CRC (Cyclic Redundancy Check) check status of the network device.

[0098] Specifically, when the target information is an RRCSetupRequest message, it can be detected whether the message exists in the layer 2 log. If not, it is determined that there is an abnormality in the layer 2.

[0099] When the target information is information representing the operating status of the network device, it can be determined whether parameters such as time advance, power, information transmission failure, data reception, and CRC check are present in the layer 2 log. When at least one of these parameters exists, it is determined whether the parameter value of each parameter is within the standard range of the parameter. If not, it means that the parameter value of the parameter is out of range. In this case, it is determined that an abnormality exists in layer 2, and abnormal information containing the out-of-range parameters can be generated.

[0100] In an example, a parameter standard range table can be established for the parameters in the above-mentioned layer 2 log, and the parameter value of each parameter in the target information can be compared with the standard range of the parameter in the parameter standard range table to determine whether the parameter is out of range. If it is out of range, it is determined that there is an abnormality in layer 2, and abnormal information including the out-of-range parameters can be generated.

[0101] If the target information indicating the running status of the network device does not exist in the layer 2 log and there is an RRCSetupRequest message, it means that the running status of the network device is normal and there is no abnormality in layer 2. Since the premise of the above step S103 is that there is an abnormality in the high layer, if there is no abnormality in layer 2, it means that the abnormality occurs in the high layer. Subsequently, the specific cause corresponding to the abnormality can be determined based on the abnormal information in the high-layer log.

[0102] In addition, if there is an abnormality in layer 2, other lower-level abnormality judgments can be triggered later, such as triggering abnormality judgment of the physical layer (PL) layer (layer 1) log, and specifically triggering abnormality judgment of the MTS (Maintain Tracking System) log. If abnormal information is detected in the MTS log, the abnormal information in the MTS log can be obtained, and step S104 is executed. For the specific process of abnormality judgment on the MTS log, please refer to the relevant technology.

[0103] S104, generating an abnormality detection result indicating the detected abnormality.

[0104] In one embodiment of the present invention, when an abnormality is detected in the aforementioned steps, abnormality information may be generated, and the abnormality information determined above may be used as an abnormality detection result in step S104.

[0105] Specifically, when there is an abnormality in the high layer and no abnormality in the layer 2, an abnormality detection result can be generated including different signaling messages obtained by comparing the high-layer logs; when there is an abnormality in the high layer and no abnormality in the layer 2, an abnormality detection result can be generated including different signaling messages obtained by comparing the high-layer logs and parameters out of range in the layer 2 logs and / or no RRCSetupRequest message received.

[0106] In addition, in the process of detecting anomalies, related technologies require manual collection and analysis of various logs, which may include: CDL logs, layer 2 logs, MTS logs, public logs, terminal logs, etc. Figure 2 , Figure 2 A flowchart of manual log analysis provided for related technologies, such as Figure 2 As shown, the analysis of the logs needs to involve the analysis of customer service personnel, technical personnel, and R&D personnel, resulting in the analysis process involving manpower from multiple aspects, making the analysis process inefficient.

[0107] In the embodiment of the present invention, by first determining whether there is an abnormality in the high layer of the network device, and then detecting whether there is an abnormality in layer 2 when an abnormality exists in the high layer, step-by-step abnormality judgment from the high layer to the low layer is achieved. Moreover, since the high layer can reflect the abnormalities of all lower layers, only when an abnormality occurs in the high layer will the abnormality judgment of the lower layer be performed, thereby ensuring that the abnormality can be checked step by step, and by generating an abnormality detection result indicating the detected abnormality, the abnormality that caused the terminal connection failure can be automatically determined. The entire abnormality detection process does not require human intervention, thereby realizing the automation of abnormality detection and improving the efficiency of abnormality detection.

[0108] In addition, in the process of manual analysis, the related technology will be affected by the analysis experience of the analysts, and the analysis results of the inexperienced analysts will have a high error rate. However, in the solution provided by the embodiment of the present invention, the entire anomaly detection process is automated and will not be affected by the analysis experience of the analysts, thereby improving the fault tolerance of anomaly detection.

[0109] The solution of the embodiment of the present invention performs abnormality judgment on the logs in order from high level to low level. Only when the high level logs are abnormal will the lower level logs be judged abnormally. Figure 3 , Figure 3 A schematic diagram of a multi-layer anomaly detection provided by an embodiment of the present invention, such as Figure 3 As shown, the logs of each layer are judged for abnormalities in the order of layer three (high-level), layer two, layer one (physical layer), and bottom layer. Specifically, first determine whether there is abnormal information in the log of layer three (high-level log). If there is abnormal information in the log of layer three, detect whether there is a target message in the log of layer two. Based on the detection result of the target information, determine whether there is an abnormality in layer two. If there is an abnormality in layer two, determine whether there is abnormal information in the log of layer one (physical layer log). If there is abnormal information in the log of layer one, determine whether there is abnormal information in the public log of the bottom layer. Finally, generate an abnormality detection result indicating the detected abnormality. In addition, if there are other logs, then based on Figure 3 The principle is the same as above, just follow the order from high level to low level to troubleshoot the anomalies.

[0110] In one embodiment of the present invention, see Figure 4 , Figure 4 A flow chart of a second anomaly detection method provided by an embodiment of the present invention is shown in FIG. Figure 1 After step S103, the following step S105 may also be included.

[0111] S105, when there is an abnormality in layer 2, determine whether there is an abnormality in the bottom layer state of the network device based on the physical layer data of the network device.

[0112] The above-mentioned physical layer data is data that characterizes the underlying status of the network device. For details, please refer to the relevant technology.

[0113] When it is determined that an abnormality exists in the underlying state of the network device, abnormality information indicating that an abnormality exists in the underlying state of the network device may be generated.

[0114] In an example, the above physical layer data is a constellation diagram of a network device. The constellation diagram of the network device can be used to determine whether there is an abnormality in the underlying state of the network device. When it is determined that there is an abnormality in the underlying state of the network device, abnormal information including the abnormal constellation diagram can be generated.

[0115] When it is determined that there is no abnormality in the underlying state of the network device, it means that the underlying state of the network device is normal, and the cause of the abnormal terminal access is at layer 2, and step S104 can be directly executed.

[0116] In addition, in the related art, after discovering that the terminal access is abnormal, if one wants to determine whether the underlying state of the network device is normal, it will directly determine whether the underlying state of the network device is abnormal based on the data of the physical layer.

[0117] In the embodiment of the present invention, the trigger condition for judging the bottom layer status is that there is an abnormality in layer 2, that is, only when there is an abnormality in layer 2, the bottom layer status of the network device will be judged. When there is no abnormality in layer 2, there is no need to judge the bottom layer status, thereby saving judgment steps and reducing the processing resources consumed in the abnormality detection process. In addition, by judging whether there is an abnormality in the bottom layer status of the network device through the physical layer data of the network device, it is possible to implement abnormality troubleshooting of the bottom layer status.

[0118] In one embodiment of the present invention, see Figure 5-1 , Figure 5-1 A schematic diagram of a flow chart of a third anomaly detection method provided by an embodiment of the present invention, Figure 1 Step S101 may specifically include the following steps S101A.

[0119] S101A, obtaining a high-level log of the network device, and extracting signaling messages of the UU (Uu Interface, a wireless interface between the wireless access network and the user equipment) interface and the NG (an interface between the wireless access network and the core network) interface from the high-level log.

[0120] When a terminal accesses a network device, the terminal needs to interact with the core network and the network device through signaling messages. Therefore, when extracting signaling messages from high-level logs, it is necessary to extract signaling messages from the UU interface and the NG interface.

[0121] In an embodiment of the present invention, by extracting signaling messages of the UU interface and the NG interface from high-level logs, signaling messages of the terminal interacting with the core network during the terminal access process and signaling messages of the terminal interacting with the network device can be extracted, ensuring that there will be no missing signaling messages during the subsequent comparison with the preset standard signaling messages, so that the subsequent comparison process can proceed normally.

[0122] In one embodiment of the present invention, see Figure 5-2 , Figure 5-2 A schematic diagram of a fourth anomaly detection method provided by an embodiment of the present invention. Figure 1 Step S102 may specifically include the following steps S102A-S102B.

[0123] S102A, sort the signaling messages based on the sequence numbers of the signaling messages.

[0124] The above sequence numbers are sequence numbers arranged according to the transmission sequence of the signaling messages. Specifically, the signaling messages may be arranged according to the transmission sequence of the signaling messages.

[0125] S102B, determining in sequence in the order of arrangement whether each signaling message is the same as a preset standard signaling message corresponding to the signaling message; if each signaling message is different from the preset standard signaling message corresponding to the signaling message, determining that an abnormality exists in the high-level layer.

[0126] The above-mentioned preset standard signaling message can be determined according to actual conditions, specifically, according to the signaling message that the terminal and the network device need to interact with during the normal access of the terminal to the network device in the actual corresponding scenario.

[0127] For an example, see Figure 5-3 , Figure 5-3 A schematic diagram of a standard signaling interaction process of a terminal accessing a network device provided by an embodiment of the present invention, such as Figure 5-3As shown, the preset standard signaling messages that need to be interacted during the normal access of the terminal include the following signaling messages in sequence from the start of access to the end of access: RRCSetupRequest message sent by the terminal to the network device, RRCSetup (RRC connection establishment) message sent by the network device to the terminal, RRCSetupComplete (RRC connection establishment completion) message sent by the terminal to the network device, InitialUeMessage (user equipment initial message) sent by the network device to the core network, InitialContextSetupRequest (initial context establishment request) message sent by the core network to the network device, SecurityModeCommand (security mode command) message sent by the network device to the terminal, RRCReconfiguration (RRC reset) message sent by the network device to the terminal, SecurityModeComplete (security mode completion) message sent by the terminal to the network device, RRCReconfigurationComplete (RRC reset completion) message sent by the terminal to the network device, and InitialContextSetupResponse (initial context establishment response) message sent by the network device to the core network.

[0128] In example a-1, the signaling messages arranged according to the transmission timing of the signaling messages are as follows: RRC connection establishment request message, RRC connection establishment message, RRC connection establishment completion message, user equipment initial message, initial context establishment request message, security mode command message, and RRC reset message.

[0129] In example a-2, the signaling messages arranged in example a-1 are combined with Figure 5-3 By comparing the preset standard signaling message in the RRC reset message, it is determined that the actual signaling message is exactly the same before the RRC reset message, and is different from the preset standard signaling message after the RRC reset message. This means that the actual signaling message does not have a security mode completion message after the RRC reset message, which can indicate that the terminal security mode encryption has failed, and an exception message of security mode encryption failure can be generated.

[0130] In example a-3, the actual signaling message is compared with Figure 5-3By comparing the actual signaling message with the preset standard signaling message shown in the figure, it is determined that the actual signaling message is exactly the same before the RRC connection establishment request message, and is different from the preset standard signaling message after the RRC connection establishment request message, indicating that the actual signaling message does not have an RRC connection establishment message after the RRC connection establishment request message. It can be seen that after receiving the RRC connection establishment request message, the network device did not send the RRC connection establishment message to the terminal, and an abnormal information indicating that the RRC connection establishment message failed to be sent can be generated.

[0131] In example a-4, the actual signaling message is compared with Figure 5-3 By comparing the actual signaling message with the preset standard signaling message shown in the figure, it is determined that the actual signaling message is different from the preset standard signaling message after the RRC connection establishment message, which means that no RRC connection establishment completion message appears after the RRC connection establishment message. It can be seen that after receiving the RRC connection establishment message, the terminal did not send the RRC connection establishment completion message to the network device, and generated an abnormal information that the RRC connection establishment completion message was not received.

[0132] In example a-5, the actual signaling message is compared with Figure 5-3 By comparing the preset standard signaling message shown in , it is determined that the actual signaling message is different from the preset standard signaling message after the RRC reset completion message, indicating that the actual signaling message does not have an initial context establishment response message after the RRC reset completion message. It can be seen that after the network device receives the RRC reset completion message, it does not send an initial context establishment response message to the core network, and generates abnormal information indicating that the core network has not received the initial context establishment response message.

[0133] In addition, if each signaling message is the same as the preset standard signaling message corresponding to the signaling message, it means that the signaling interaction process of the terminal at the high layer is normal, and there is no abnormality at the high layer, and the abnormality detection process can be ended.

[0134] In addition, if the signaling message extracted from the high-level log does not include the RRCSetupRequest message, it means that the network device has not received the RRCSetupRequest message, generates abnormal information that the RRCSetupRequest message has not been received, and triggers abnormal detection of layer 2.

[0135] In an embodiment of the present invention, by sorting the signaling messages according to the sequence numbers, the sorted signaling messages can be arranged according to the transmission timing, ensuring that the arranged signaling messages can be judged whether they are the same as the preset standard signaling messages arranged according to the normal transmission timing, and by determining that there is an abnormality in the high-level when a difference is judged, and determining the signaling message that is judged different as abnormal information, the abnormal signaling messages that are not interacted according to the preset standard signaling messages can be checked out and saved in the abnormality detection results.

[0136] In one embodiment of the present invention, the above-mentioned target information can specifically be at least one of an RRCSetupRequest message, a first message indicating the operating status of a network device, a second message, and a third message. See Table 1. Table 1 is an information table of three messages indicating the operating status in the target information provided in an embodiment of the present invention.

[0137] Table 1

[0138]

[0139] As shown in Table 1, the three messages indicating the operating status may include: a first message indicating the timing advance and power of the network device, a second message indicating whether the network device has an information sending failure, and a third message indicating the data reception status and CRC check status of the network device.

[0140] In an embodiment of the present invention, the detection result indicating the existence of an abnormality may include at least one of the following results: the layer 2 log does not contain the RRCSetupRequest message, the layer 2 log contains a first message indicating the time advance and power of the network device, the layer 2 log contains a second message indicating whether the network device has an information sending failure, and the layer 2 log contains a third message indicating the data reception status and cyclic redundancy check CRC check status of the network device.

[0141] The above step S103 may specifically include the following steps A1-A4.

[0142] Step A1, when the target information detected from the layer 2 log includes the first message, it is determined that the detection result is that the layer 2 log contains the first message indicating the time advance and power of the network device, then it is determined whether the parameter value of the time advance in the first message exceeds the standard range of the time advance, and whether the actual value of the power is within the standard range of the power. If the time advance is not within the standard range of the time advance and the power is not within the standard range of the power, it is determined that an abnormality exists in layer 2, and the abnormal information is information indicating the abnormality of the time advance and the power.

[0143] In addition, if the timing advance is not within the standard range of the timing advance or the power is not within the standard range of the power, it is determined that layer 2 has an abnormality. Correspondingly, the abnormal information may be information indicating a timing advance abnormality or information indicating a power abnormality.

[0144] Step A2, when the target information detected from the layer 2 log includes a second message, it is determined that the detection result is that the layer 2 log contains a second message indicating whether the network device has an information sending failure, then the specific circumstances of the information sending failure in the second message are judged, and when the information sending failure indicates that the information has indeed failed to be sent, it is determined that there is an abnormality in layer 2, and the abnormal information is information indicating the information sending failure.

[0145] Step A3, when the target information detected from the layer 2 log includes the third message, it is determined that the detection result is that the layer 2 log contains the third message indicating the data reception status and the cyclic redundancy check CRC verification status of the network device, then the specific situation of the data reception status and the CRC verification status is determined, and when it is determined that the data reception fails and the CRC verification fails, it is judged that there is an abnormality in the layer 2, and the abnormal information is the information indicating the data reception failure and the CRC verification failure.

[0146] Step A4, when the target information detected from the layer 2 log does not include the RRCSetupRequest message, it is determined that the detection result is that the layer 2 log does not include the RRCSetupRequest message, then it can be determined that there is an abnormality in the layer 2.

[0147] In addition, the execution order of the above steps A1-A4 may be: step A1, step A2, step A3, step A4. Of course, the execution order of steps A1-A4 may also be adjusted according to actual needs.

[0148] In an embodiment of the present invention, the target information includes at least one of an RRCSetupRequest message, a first message, a second message, and a third message, so that when the detection result is that the RRCSetupRequest message is not included, a layer 2 abnormality can be determined; and based on the parameter values ​​of the time advance and power in the first message, it can be judged whether there is an abnormality in layer 2, and the parameter abnormality can be checked; and based on the specific situation of the information sending failure in the second message, it can be judged whether there is an abnormality in layer 2, and the information sending failure can be checked; and based on the specific situation of the data reception and CRC verification in the third message, it can be judged whether there is an abnormality in layer 2, and the data reception failure and CRC verification failure can be checked.

[0149] In one embodiment of the present invention, see Figure 6 , Figure 6 A flowchart of a fifth anomaly detection method provided by an embodiment of the present invention is shown in FIG. Figure 1 Before step 104, the following steps S106-S108 may be performed, and, Figure 1 The step 104 may specifically include the following steps S104A.

[0150] S106, when an abnormality exists in the high layer or the second layer, a target detection parameter corresponding to the determined abnormality is determined based on a preset abnormality mapping relationship.

[0151] The above-mentioned preset abnormality mapping relationship is a corresponding relationship between the abnormality type and the detection parameter.

[0152] Specifically, the determined exception may be represented by the above-determined exception information, and the preset exception mapping relationship may be the type of exception information or the correspondence between the undetected RRCSetupRequest message and the detection parameter.

[0153] See Table 2, which is an exception mapping table provided in an embodiment of the present invention.

[0154] Table 2

[0155]

[0156] As shown in Table 2, the abnormal information of security mode encryption failure, RRC connection establishment message sending failure, RRC connection establishment completion message not received, and initial context establishment response message not received corresponds to the high-level access parameter. For specific corresponding parameters under the high-level access parameter, please refer to the relevant technology, which will not be repeated here.

[0157] As shown in Table 2, the abnormal information of not receiving the RRCSetupRequest message, abnormal timing advance, abnormal power, information transmission failure, data reception failure, and CRC check failure corresponds to the layer 2 access parameters. For which specific parameter in the layer 2 access parameter corresponds to which, please refer to the relevant technology, which will not be repeated here.

[0158] Corresponding to the above examples a-2 to a-5, the abnormal information of security mode encryption failure, RRC connection establishment message sending failure, RRC connection establishment completion message not received, and initial context establishment response message not received can be mapped to high-level access parameters.

[0159] Corresponding to the above steps A1-A4, after executing step A1, the information indicating the timing advance and power abnormality is mapped to the layer 2 access parameters; after executing step A2, the information indicating the failure of information sending is mapped to the layer 2 access parameters; after executing step A3, the information indicating the failure of data reception and the failure of CRC check is mapped to the layer 2 access parameters; after executing step A4, the abnormal information of not receiving the RRCSetupRequest message is mapped to the layer 2 access parameters.

[0160] In addition, only when the parameters involved in the abnormal information are configurable parameters, the above-mentioned step of determining the target detection parameters corresponding to the abnormal information based on the preset abnormal mapping relationship will be performed. Specifically, parameter mapping is performed only for layers such as the high layer or layer 2 where configurable parameters exist, and there will be no parameter mapping step for the bottom layer such as the physical layer where no configurable parameters exist.

[0161] In example b-1, the abnormal information of security mode encryption failure corresponds to the security mode parameter.

[0162] In an example b-2, the abnormal information of power abnormality corresponds to the power parameter.

[0163] S107, obtaining a public log of the network device, and extracting a current value of the target detection parameter from the public log.

[0164] Specifically, the current value of the target detection parameter is extracted from the parameter log in the public log.

[0165] Corresponding to the above example b-1, the current value of the security mode parameter is extracted from the public log.

[0166] Corresponding to the above example b-2, the current value of the power parameter is extracted from the public log.

[0167] S108, determining whether the current value of the target detection parameter is outside the preset standard value range of the target detection parameter, and if so, determining that the target detection parameter is an abnormal parameter.

[0168] Corresponding to the above example b-1, it is determined whether the current value of the safety mode parameter is outside the preset standard value range of the safety mode parameter. If so, it is determined that the safety mode parameter is an abnormal parameter.

[0169] Corresponding to the above example b-2, it is determined whether the current value of the power parameter is outside the preset standard value range of the power parameter. If so, it is determined that the power parameter is an abnormal parameter.

[0170] S104A, generating an abnormality detection result including the detected abnormal parameters.

[0171] Corresponding to the above example b-1, an abnormality detection result including the security mode parameters is generated. Specifically, an abnormality detection result including abnormal information of security mode encryption failure and the security mode parameters can be generated.

[0172] Corresponding to the above example b-2, an abnormality detection result including power parameters is generated. Specifically, abnormality information including power abnormality and an abnormality detection result including power parameters can be generated.

[0173] In addition, the abnormal detection result may also include a preset standard value range corresponding to the abnormal parameter, so that the abnormal parameter can be reset according to the preset standard value range, and the value of the abnormal parameter can be changed to a normal value within the preset standard value range. In addition, the abnormal information in the abnormal detection result can be fed back to the R&D personnel for further analysis.

[0174] In an embodiment of the present invention, by determining the target detection parameter for the anomaly existing in the high-level or layer 2, it is determined whether the current value of the target detection parameter is outside the preset standard value range of the target detection parameter, thereby determining the abnormal parameter outside the preset standard value range of the target detection parameter, and realizing the investigation of abnormal parameters in the high-level log or layer 2 log.

[0175] In one embodiment of the present invention, see Figure 7 , Figure 7 A flowchart of a sixth anomaly detection method provided by an embodiment of the present invention is shown in FIG. Figure 1 Before step S104, the above method may further include the following steps S701-S702.

[0176] S701, obtaining a public log of a network device.

[0177] Specifically, obtain the abnormal log in the public log of the network device.

[0178] S702: When a preset abnormal keyword exists in the abnormal log in the public log, it is determined that an abnormality exists in the network device.

[0179] Specifically, the LMT (Local Maintenance Terminal) interface or the polling interface may be called to parse the exception log in the public log, extract the preset exception keywords contained in the exception log, and use the preset exception keywords extracted from the exception log in the public log as exception information.

[0180] The preset abnormal keywords may include: abnormal task suspension, task operation failure, memory pool exhaustion, etc. The preset abnormal keywords may be set according to actual needs.

[0181] In addition, when other logs are processed, the corresponding parsing interface can be called for parsing, so that the log content can be processed later.

[0182] In the embodiment of the present invention, by performing preset abnormal keyword detection on the abnormal log in the public log, the content in the abnormal log that represents the abnormality of the underlying operating state or related conditions can be checked to achieve the checking of the underlying operating state.

[0183] In one embodiment of the present invention, the above step S105 may specifically include the following steps B1-B2.

[0184] Step B1: If there is an abnormality in layer 2, capture data from the physical layer of the network device.

[0185] Generally, the physical layer cannot save physical layer logs for a long time. If you need to detect abnormalities in the operation status of the physical layer, you can do so by capturing data from the physical layer.

[0186] Specifically, in the process of capturing data, data can be captured based on the anomalies existing in layer 2 to ensure that only the data that may be abnormal is captured. In an example, data is captured based on the abnormal information in the layer 2 log that represents the abnormal data transmission, so that the data of the part with abnormal data transmission is captured.

[0187] Step B2: Based on the captured data, determine whether there is any abnormality in the underlying status of the network device.

[0188] In addition, the time for grabbing data can be set according to needs. In an example, the time for grabbing data is 20ms.

[0189] In the embodiment of the present invention, based on the data captured from the physical layer of the network device, it is determined whether there is any abnormality in the underlying state of the network device, thereby realizing abnormal troubleshooting of the underlying state of the network device.

[0190] In one embodiment of the present invention, the above-mentioned abnormality in the high layer includes: an abnormal signaling message is detected in the high layer log, or the high layer log does not contain the RRCSetupRequest message.

[0191] The abnormal signaling message is the signaling message that is different from the one shown in the comparison.

[0192] In addition, the high-level log does not contain the RRCSetupRequest message, indicating that an abnormality exists in the initial access, and it is necessary to perform abnormality detection on a lower layer than the high-level layer. In this case, abnormality detection can be started on layer 2, that is, to determine whether there is an abnormality in layer 2.

[0193] In an embodiment of the present invention, only when an abnormal signaling message is detected in the high-level log, or the high-level log does not contain the RRCSetupRequest message, will it start to determine whether there is an abnormality in layer 2. When there is no abnormal information in the high-level layer, there is no need to determine whether there is an abnormality in layer 2, which can save the judgment steps and reduce the processing resources consumed in the abnormality detection process.

[0194] For an example, see Figure 8 , Figure 8 A schematic diagram of obtaining a network device log provided by an embodiment of the present invention, such as Figure 8 As shown, in the process of obtaining the logs of the network device, the electronic device can be connected to the network device through the SNMP (Simple Network Management Protocol) protocol interface, and the relevant logs can be extracted using the OMC (Operation and Maintenance Center) command. Specifically, the CDL log, layer 2 log, MTS log, public log and other logs can be extracted.

[0195] For an example, see Fig. 9 , Fig. 9 This is a flow chart of a seventh abnormality detection method provided by an embodiment of the present invention. The method may include the following steps C1-C5.

[0196] Step C1, obtaining the log of the network device.

[0197] Specifically, you can directly obtain CDL logs, layer 2 logs, MTS logs, public logs and other logs, or you can determine whether you need to obtain the logs of the next level based on the anomaly detection situation of the previous level. The hierarchical anomaly detection process is carried out in order from high level to low level.

[0198] Step C2: Analyze the log to determine whether there is any abnormal information in the log.

[0199] Specifically, whether the log of the previous level contains abnormal information can be used to determine whether the log analysis and judgment process of the next level needs to be performed. The log analysis and judgment process is performed in order from the top level to the bottom level. And, only when abnormal information exists in the top level, the log of the next level is judged.

[0200] Step C3: If there is abnormal information, parameter mapping is performed on the abnormal information in the log to generate target detection parameters corresponding to the abnormal information.

[0201] Specifically, based on a preset abnormality mapping relationship, a target detection parameter corresponding to the abnormal information is determined.

[0202] Step C4, performing parameter value judgment on the target detection parameter to determine whether the current value of the target detection parameter is outside the preset standard value range.

[0203] Step C5: If the current value of the target detection parameter is outside the preset standard value range, the target detection parameter is determined to be an abnormal parameter, and an abnormal detection result is generated.

[0204] The above anomaly detection result may include anomaly information and anomaly parameters.

[0205] In a second aspect, an embodiment of the present invention provides an electronic device, see Fig.10 , Fig.10 A structural schematic diagram of an electronic device provided in an embodiment of the present invention, the electronic device includes a memory 1001, a transceiver 1002, and a processor 1003: the memory 1001 is used to store computer programs; the transceiver 1002 is used to send and receive data under the control of the processor 1003; the processor 1003 is used to read the computer program in the memory 1001 and execute any of the above-mentioned abnormality detection method steps.

[0206] In the process of performing anomaly detection using the electronic device provided by the embodiment of the present invention, by first determining whether there is an anomaly in the high layer of the network device, and then detecting whether there is an anomaly in layer 2 when an anomaly exists in the high layer, a step-by-step anomaly judgment from the high layer to the low layer is achieved. Moreover, since the high layer can reflect the anomalies of all lower layers, only when an anomaly occurs in the high layer will an anomaly judgment of the lower layer be performed, thereby ensuring that the anomaly can be checked step by step, and by generating an anomaly detection result indicating the detected anomaly, the anomaly that caused the terminal connection failure can be automatically determined. The entire anomaly detection process does not require human intervention, thereby realizing the automation of anomaly detection and improving the efficiency of anomaly detection.

[0207] Among them, Fig.10 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 1003 and various circuits of memory represented by memory 1001 are linked together. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 1002 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, which transmission medium may include a wireless channel, a wired channel, an optical cable, and other transmission media. The processor 1003 is responsible for managing the bus architecture and general processing, and the memory 1001 may store data used by the processor 1003 when performing operations.

[0208] The processor 1003 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0209] In a third aspect, an embodiment of the present invention provides an abnormality detection device, see Fig.11 , Fig.11 A schematic diagram of the structure of an abnormality detection device provided by an embodiment of the present invention, the device comprising:

[0210] The first acquisition module 1101 is used to acquire a high-level log of a network device and extract a signaling message of a terminal from the high-level log;

[0211] The first judgment module 1102 is used to compare the extracted signaling message with the preset standard signaling message to determine whether there is an abnormality in the upper layer of the network device;

[0212] The second judgment module 1103 is used to obtain the layer 2 log of the network device when an abnormality exists in the high layer, detect whether there is target information from the layer 2 log, and judge whether there is an abnormality in the layer 2 based on the detection result of the target information;

[0213] The result generation module 1104 is used to generate an anomaly detection result representing the detected anomaly.

[0214] In the embodiment of the present invention, by first determining whether there is an abnormality in the high layer of the network device, and then detecting whether there is an abnormality in layer 2 when an abnormality exists in the high layer, a step-by-step abnormality judgment from the high layer to the bottom layer is achieved. Moreover, since the high layer can reflect the abnormalities of all lower layers, only when an abnormality occurs in the high layer will an abnormality judgment of the lower layer be performed, thereby ensuring that the abnormality can be checked step by step, and by generating an abnormality detection result representing the detected abnormality, the abnormality that caused the terminal connection failure can be automatically determined. The entire abnormality detection process does not require human participation, thereby realizing the automation of abnormality detection and improving the efficiency of abnormality detection.

[0215] It should be noted that the division of modules in the embodiments of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the various embodiments of the present invention may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0216] In one embodiment of the present invention, the device further comprises:

[0217] The third judgment module is used to judge whether there is an abnormality in the bottom layer state of the network device based on the physical layer data of the network device when there is an abnormality in the layer 2.

[0218] In the embodiment of the present invention, the trigger condition for judging the bottom layer status is that there is an abnormality in layer 2, that is, only when there is an abnormality in layer 2, the bottom layer status of the network device will be judged. When there is no abnormality in layer 2, there is no need to judge the bottom layer status, thereby saving judgment steps and reducing the processing resources consumed in the abnormality detection process. In addition, by judging whether there is an abnormality in the bottom layer status of the network device through the physical layer data of the network device, it is possible to implement abnormality troubleshooting of the bottom layer status.

[0219] In one embodiment of the present invention, the device further comprises:

[0220] A parameter determination module is used to determine, when an abnormality exists in the high-level layer or the second layer, a target detection parameter corresponding to the determined abnormality based on a preset abnormality mapping relationship, wherein the preset abnormality mapping relationship is a correspondence between the type of abnormality and the detection parameter;

[0221] A second acquisition module is used to obtain a public log of the network device and extract the current value of the target detection parameter from the public log;

[0222] A fourth judgment module is used to judge whether the current value of the target detection parameter is outside the preset standard value range of the target detection parameter, and if so, determine that the target detection parameter is an abnormal parameter;

[0223] The result generating device is specifically used to generate an abnormality detection result including the detected abnormal parameters.

[0224] In an embodiment of the present invention, the target detection parameter is determined by the anomaly existing in the high-level or layer 2, and it is judged whether the current value of the target detection parameter is outside the preset standard value range of the target detection parameter, thereby determining the abnormal parameter outside the preset standard value range of the target detection parameter, and realizing the investigation of abnormal parameters in the high-level log or layer 2 log.

[0225] In one embodiment of the present invention, the device also includes: a third acquisition module, which is used to obtain the public log of the network device before generating an anomaly detection result representing the detected anomaly; an information generation module, which is used to determine that there is an anomaly in the network device when there is a preset anomaly keyword in the anomaly log in the public log.

[0226] In the embodiment of the present invention, by performing preset abnormal keyword detection on the abnormal log in the public log, the content in the abnormal log that represents the abnormality of the underlying operating state or related situations can be checked to realize the checking of the underlying operating state.

[0227] In one embodiment of the present invention, the first acquisition module is specifically used to: extract signaling messages of the UU interface and the NG interface from the high-level log;

[0228] and / or

[0229] The first judgment module is specifically used to: sort the signaling messages based on the sequence numbers of the signaling messages; determine in sequence whether each signaling message is the same as the preset standard signaling message corresponding to the signaling message in the arrangement order, and if different, determine that an abnormality exists in the high-level.

[0230] In an embodiment of the present invention, by extracting signaling messages of the UU interface and the NG interface from the high-level log, the signaling messages of the terminal and the core network in the process of terminal access and the signaling messages of the terminal and the network equipment can be extracted, ensuring that there will be no missing signaling messages in the subsequent comparison with the preset standard signaling messages, so that the subsequent comparison process can proceed normally. In addition, by sorting the signaling messages according to the sequence number, the sorted signaling messages can be arranged according to the transmission sequence, ensuring that the arranged signaling messages can be judged to be the same as the preset standard signaling messages arranged according to the normal transmission sequence, and by determining that the high-level is abnormal when different is judged, and determining the signaling message that is judged to be different as abnormal information, the abnormal signaling message that is not interacted according to the preset standard signaling message can be checked out and saved in the abnormal detection result.

[0231] In one embodiment of the present invention, the third judgment module is specifically used to: when there is an abnormality in layer 2, capture data from the physical layer of the network device; and based on the captured data, determine whether there is an abnormality in the underlying state of the network device.

[0232] In the embodiment of the present invention, based on the data captured from the physical layer of the network device, it is determined whether there is any abnormality in the underlying state of the network device, thereby realizing abnormal troubleshooting of the underlying state of the network device.

[0233] In one embodiment of the present invention, the detection result indicating the existence of an abnormality includes at least one of the following results: the layer 2 log does not contain the RRCSetupRequest message, the layer 2 log contains a first message indicating the time advance and power of the network device, the layer 2 log contains a second message indicating whether the network device has an information sending failure, and the layer 2 log contains a third message indicating the data reception status and cyclic redundancy check CRC check status of the network device.

[0234] In an embodiment of the present invention, the target information includes at least one of the RRCSetupRequest message, the first message, the second message, and the third message, so that when the detection result is that the RRCSetupRequest message is not included, it can be determined that the layer 2 is abnormal; and it can be judged whether there is an abnormality in the layer 2 based on the parameter values ​​of the time advance and power in the first message, so as to realize the abnormality investigation of the parameters; and it can be judged whether there is an abnormality in the layer 2 based on the specific situation of the information sending failure in the second message, so as to realize the investigation of the information sending failure; and it can be judged whether there is an abnormality in the layer 2 based on the specific situation of the data reception and CRC verification in the third message, so as to realize the data.

[0235] In one embodiment of the present invention, the abnormality in the high layer includes: an abnormal signaling message is detected in the high layer log, or the high layer log does not contain the RRCSetupRequest message.

[0236] In an embodiment of the present invention, only when an abnormal signaling message is detected in the high-level log, or the high-level log does not contain the RRCSetupRequest message, will it start to determine whether there is an abnormality in layer 2. When there is no abnormal information in the high-level layer, there is no need to determine whether there is an abnormality in layer 2, which can save the judgment steps and reduce the processing resources consumed in the abnormality detection process.

[0237] In another embodiment of the present invention, a processor-readable storage medium is provided. The processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute any of the above-mentioned abnormality detection methods.

[0238] In the process of performing anomaly detection using the computer program stored in the processor-readable storage medium provided by the embodiment of the present invention, by first determining whether there is an anomaly in the high layer of the network device, and then detecting whether there is an anomaly in layer 2 when an anomaly exists in the high layer, a step-by-step anomaly judgment from the high layer to the low layer is achieved. Moreover, since the high layer can reflect all the anomalies in the lower layers, only when an anomaly occurs in the high layer will an anomaly judgment in the lower layers be performed, thereby ensuring that the anomaly can be checked step by step. By generating an anomaly detection result indicating the detected anomaly, the anomaly that caused the terminal connection failure can be automatically determined. The entire anomaly detection process does not require human intervention, thereby realizing the automation of anomaly detection and improving the efficiency of anomaly detection.

[0239] In another embodiment of the present invention, a computer program product including instructions is provided, which, when executed on a computer, enables the computer to execute any one of the anomaly detection methods in the above embodiments.

[0240] In the process of performing anomaly detection using the computer program product provided by the embodiment of the present invention, by first determining whether there is an anomaly in the high layer of the network device, and then detecting whether there is an anomaly in layer 2 when an anomaly exists in the high layer, a step-by-step anomaly judgment from the high layer to the low layer is achieved. Moreover, since the high layer can reflect all the anomalies in the lower layers, only when an anomaly occurs in the high layer will an anomaly judgment in the lower layers be performed, thereby ensuring that the anomaly can be checked step by step. By generating an anomaly detection result indicating the detected anomaly, the anomaly that caused the terminal connection failure can be automatically determined. The entire anomaly detection process does not require human intervention, thereby achieving automation of anomaly detection and improving the efficiency of anomaly detection.

[0241] If the above-mentioned integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0242] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The computer instructions can be stored in a processor-readable storage medium, or transmitted from a processor-readable storage medium to another processor-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The above-mentioned processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0243] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0244] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the electronic device, device, processor-readable storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0245] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, electronic devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0246] The present invention is described with reference to flowcharts and / or block diagrams of methods, electronic devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0247] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0248] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0249] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0250] The above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Obtaining a high-level log of a network device, and extracting a signaling message of a terminal from the high-level log; Comparing the extracted signaling message with a preset standard signaling message to determine whether there is an abnormality in the upper layer of the network device; In the case that the high layer has an abnormality, obtaining the layer 2 log of the network device, detecting whether there is target information from the layer 2 log, and judging whether there is an abnormality in the layer 2 based on the detection result of the target information; Anomaly detection results representing the detected anomalies are generated.

2. The method according to claim 1, characterized in that After determining whether layer 2 is abnormal based on the detection result of the target information, the method further includes: If the layer 2 is abnormal, it is determined whether the bottom layer state of the network device is abnormal based on the physical layer data of the network device.

3. The method according to claim 1, characterized in that The method further comprises: In the case where an abnormality exists in the high layer or the layer 2, a target detection parameter corresponding to the determined abnormality is determined based on a preset abnormality mapping relationship, wherein the preset abnormality mapping relationship is a correspondence between the type of abnormality and the detection parameter; Obtaining a public log of a network device, and extracting a current value of the target detection parameter from the public log; Determining whether the current value of the target detection parameter is outside the preset standard value range of the target detection parameter, and if so, determining that the target detection parameter is an abnormal parameter; The generating an anomaly detection result indicating the detected anomaly includes: An anomaly detection result including the detected anomaly parameters is generated.

4. The method according to claim 1, characterized in that Before generating an abnormality detection result indicating the detected abnormality, the method further includes: Get public logs of network devices; When a preset abnormal keyword exists in the abnormal log in the public log, it is determined that the network device has an abnormality.

5. The method according to any one of claims 1 to 4, characterized in that The extracting the signaling message of the terminal from the high-level log comprises: extracting the signaling message of the radio interface UU interface between the universal terrestrial radio access network and the user equipment and the interface NG interface between the radio access network and the core network from the high-level log; and / or The extracted signaling message is compared with the preset standard signaling message to determine whether there is an abnormality in the high-level of the network device, including: sorting the signaling messages based on the sequence number of the signaling message; determining whether each signaling message is the same as the preset standard signaling message corresponding to the signaling message in the order of arrangement, and if different, determining that there is an abnormality in the high-level.

6. The method according to claim 2, characterized in that The determining, based on the physical layer data of the network device, whether the underlying state of the network device is abnormal includes: Capture data from the physical layer of the network device; Based on the captured data, it is determined whether there is any abnormality in the underlying state of the network device.

7. The method according to any one of claims 1 to 4, characterized in that The detection result indicating the existence of an abnormality includes at least one of the following results: the layer 2 log does not contain a wireless resource control connection establishment request RRCSetupRequest message, the layer 2 log contains a first message indicating the timing advance and power of the network device, the layer 2 log contains a second message indicating whether the network device has an information sending failure, and the layer 2 log contains a third message indicating the data reception status and cyclic redundancy check CRC check status of the network device.

8. The method according to any one of claims 1 to 4, characterized in that The abnormality of the high layer includes: detecting an abnormal signaling message in the high layer log, or the high layer log does not contain an RRCSetupRequest message.

9. An electronic device, characterized in that: Including memory, transceiver, processor: A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and executing the method steps of any one of claims 1 to 8.

10. An abnormality detection device, characterized in that: The device comprises: A first acquisition module, used to acquire a high-level log of a network device, and extract a signaling message of a terminal from the high-level log; A first judgment module is used to compare the extracted signaling message with a preset standard signaling message to determine whether there is an abnormality in the upper layer of the network device; A second judgment module is used to obtain a layer 2 log of the network device when an abnormality exists in the high layer, detect whether there is target information from the layer 2 log, and judge whether there is an abnormality in the layer 2 based on the detection result of the target information; The result generation module is used to generate an anomaly detection result representing the detected anomaly.

11. A processor-readable storage medium, characterized in that: The processor-readable storage medium stores a computer program, and the computer program is used to cause the processor to execute the method according to any one of claims 1 to 8.

Images