Signaling analysis method and device, electronic equipment, storage medium and computer product

Abstract

The invention relates to the technical field of communication, and provides a signaling analysis method and device, electronic equipment, a storage medium and a computer product, and the method comprises the steps: determining to-be-analyzed signaling data based on an input code stream file; respectively performing service information summary extraction and abnormal event analysis based on the to-be-analyzed signaling data to obtain a service information summary and abnormal event analysis result; based on the to-be-analyzed signaling data, logical reasoning is carried out in combination with a preset graph database, a target retrieval mode and a process library, and a logical reasoning result is obtained; a graph structure comprising at least one reasoning chain constructed based on at least one preset rule is stored in the preset graph database; the target retrieval mode comprises mixed retrieval and reordering; the process library stores sub-processes in the service signaling process where the preset rules are located and service explanations of the sub-processes; and generating a signaling analysis result of the input code stream file based on the business information summary, the abnormal event analysis result and the logical reasoning result. According to the invention, the accuracy of signaling analysis can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a signaling analysis method, device, electronic device, storage medium and computer product. Background Art

[0002] Signaling is the language of communication between network devices and terminals. Signaling analysis is the basis of communication network operation and maintenance, and is crucial to ensuring network stability, security, and efficiency. Traditional operators' signaling analysis requires the use of a collection device deployed in the communication link to obtain the original signaling code stream transmitted through a deep packet inspection (DPI) system, and then use a parsing tool or platform to convert the original string format code stream into readable signaling plaintext, and finally use manual identification and positioning of abnormal points. With the continuous growth of network scale and business volume, the demand for signaling analysis is growing rapidly and the complexity of analysis is increasing. Traditional analysis methods can no longer cope with the current situation of signaling analysis, and new solutions are urgently needed to achieve automated and highly reliable signaling analysis.

[0003] There is a signaling analysis method in the prior art, which locates the interval of abnormal signaling according to the change of the abnormal degree of the abnormal signaling process. However, misjudgment is prone to occur in special scenarios such as the same abnormal signaling is transmitted between multiple network elements and there are alternative processes for abnormal signaling. Therefore, the current signaling analysis is insufficiently accurate. Summary of the invention

[0004] The present application aims to solve at least one of the technical problems existing in the related art. To this end, the present application proposes a signaling analysis method, device, electronic device, storage medium and computer product to solve the problem of easy misjudgment in the current signaling analysis and improve the accuracy of signaling analysis.

[0005] According to the first aspect of the present application, the signaling analysis method includes: Determine the signaling data to be analyzed based on the input code stream file; Based on the signaling data to be analyzed, service information summary extraction and abnormal event analysis are performed respectively to obtain service information summary and abnormal event analysis results; Based on the signaling data to be analyzed, logical reasoning is performed in combination with a preset graph database, a target retrieval method and a process library to obtain a logical reasoning result; the preset graph database stores a graph structure including at least one reasoning chain constructed based on at least one preset rule; the target retrieval method includes mixed retrieval and reordering; the process library stores sub-processes and business explanations in the business signaling process where each preset rule is located; Based on the business information summary, the abnormal event analysis result and the logical reasoning result, a signaling analysis result of the input code stream file is generated.

[0006] According to an embodiment of the present application, the logical reasoning is performed based on the signaling data to be analyzed, in combination with a preset graph database, a target retrieval method and a process library to obtain a logical reasoning result, including: Based on the signaling data to be analyzed, reasoning chain matching is performed in a preset graph database to obtain a target reasoning chain and its business interpretation; Determine the message name, network element information and cell information of the fields corresponding to the target reasoning chain; Based on the message name, the network element information and the information element information, a process search is performed in the process library in a target search mode to obtain target process information; Generate a first prompt word based on the target process information, the target reasoning chain and its business interpretation, and build a first language model based on the first prompt word; The signaling data to be analyzed is input into the first large language model to obtain a logical reasoning result output by the first large language model.

[0007] According to an embodiment of the present application, based on the message name, the network element information and the information element information, a process search is performed in a process library in a target search manner to obtain target process information, including: Perform process retrieval on the message name, the network element information and the information element information in the process library respectively to obtain corresponding first process retrieval results, second process retrieval results and third process retrieval results; Determine a first process intersection of the first process search result, the second process search result, and the third process search result; After the message name, the network element information and the information element information are concatenated, a process search is performed in a process library to obtain a fourth process search result; Determine a second process intersection of the first process intersection and the fourth process search result; Reorder the processes in the intersection of the second processes to obtain target process information.

[0008] According to an embodiment of the present application, extracting a service information summary based on the signaling data to be analyzed to obtain a service information summary includes: The signaling data to be analyzed is input into a second largest language model to obtain business summary information output by the second largest language model; a first preset prompt word is set in the second largest language model; the first preset prompt word includes target extraction information, extraction rules, data processing rules and output format.

[0009] According to an embodiment of the present application, abnormal event analysis is performed based on the signaling data to be analyzed to obtain abnormal event analysis results, including: Inputting the signaling data to be analyzed into a third language model to obtain an abnormal event output by the third language model; a second preset prompt word is set in the third language model; and the second preset prompt word is generated based on an abnormal event retrieval rule; Based on the process protocol, message name and failure code description of the corresponding fields of the abnormal event, a target search method is used to search in the preset failure code knowledge base to obtain an abnormal information interpretation list; Generate a second prompt word according to the abnormal information interpretation list and build a fourth language model based on the second prompt word; input the signaling data to be analyzed into the fourth language model to obtain the abnormal event analysis result output by the fourth language model.

[0010] According to an embodiment of the present application, determining the signaling data to be analyzed based on the input code stream file includes: Parse the input code stream file to obtain the signaling plain text; Performing protocol screening on the signaling plain text to obtain screened signaling information; The signaling information is filtered to obtain signaling data to be analyzed.

[0011] According to the second aspect of the present application, the signaling analysis device includes: A determination module, used to determine the signaling data to be analyzed based on the input code stream file; A first processing module is used to extract a service information summary and analyze abnormal events based on the signaling data to be analyzed, and obtain a service information summary and abnormal event analysis results; The second processing module is used to perform logical reasoning based on the signaling data to be analyzed, in combination with a preset graph database, a target retrieval method and a process library, to obtain a logical reasoning result; the preset graph database stores a graph structure including at least one reasoning chain constructed based on at least one preset rule; the target retrieval method includes mixed retrieval and reordering; the process library stores sub-processes and business explanations in the business signaling process where each preset rule is located; A generation module is used to generate a signaling analysis result of the input code stream file based on the business information summary, the abnormal event analysis result and the logical reasoning result.

[0012] According to an electronic device of an embodiment of the third aspect of the present application, the electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the signaling analysis method described above is implemented.

[0013] According to the storage medium of the fourth aspect embodiment of the present application, the storage medium is a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements any of the signaling analysis methods described above.

[0014] A computer program product according to an embodiment of the fifth aspect of the present application includes a computer program, which, when executed by a processor, implements any of the signaling analysis methods described above.

[0015] The above one or more technical solutions in the embodiments of the present application have at least the following technical effects: Based on the input code stream file, the signaling data to be analyzed is determined, so that the business information summary extraction and abnormal event analysis can be performed respectively based on the signaling data to be analyzed, and the business information summary and abnormal event analysis results can be obtained; and, based on at least one preset rule, at least one reasoning chain is constructed to form a graph structure and stored in the preset graph database, and the sub-processes and business interpretations in the business signaling process where each preset rule is located are stored in the process library, so that logical reasoning can be performed based on the signaling data to be analyzed, combined with the preset graph database, the target retrieval method and the process library, to obtain the logical reasoning result; therefore, the signaling analysis result of the input code stream file can be generated based on the business information summary, the abnormal event analysis result and the logical reasoning result. The target retrieval method including hybrid retrieval and reordering is adopted to effectively improve the retrieval accuracy of special scenarios such as the inconsistency between the code stream field and the specification and the high similarity of the signaling name in the signaling analysis scenario; by constructing a graph database based on reasoning rules, the business meaning and logical relationship between the signaling process itself and the processes are fully considered, and the accuracy of retrieval can also be improved; therefore, the accuracy of signaling analysis can be improved.

[0016] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a flow chart of the signaling analysis method provided in an embodiment of the present application.

[0019] Figure 2It is a flow chart of the hybrid retrieval + reordering retrieval scheme in the signaling analysis method provided in the embodiment of the present application.

[0020] Figure 3 It is a schematic diagram of process identification in the signaling analysis method provided in an embodiment of the present application.

[0021] Figure 4 It is a schematic diagram of the overall process of the signaling analysis method provided in the embodiment of the present application.

[0022] Figure 5 It is a structural schematic diagram of the electronic device provided by this application. DETAILED DESCRIPTION

[0023] The following is a further detailed description of the implementation of the present application in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present application but cannot be used to limit the scope of the present application.

[0024] In the description of the embodiments of the present application, it should be noted that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, which are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the embodiments of the present application. In addition, the terms "first", "second", and "third" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance.

[0025] In the description of the embodiments of the present application, it should be noted that, unless otherwise clearly specified and limited, the terms "connected" and "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the embodiments of the present application can be understood according to specific circumstances.

[0026] In the embodiments of the present application, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may mean that the first and second features are in direct contact, or the first and second features are in indirect contact through an intermediate medium. Moreover, a first feature being "above", "above" or "above" a second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being "below", "below" or "below" a second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is lower in level than the second feature.

[0027] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiments of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0028] The present application proposes a signaling analysis method, device, electronic device, storage medium and computer product.

[0029] Figure 1 is a flow chart of the signaling analysis method provided in the embodiment of the present application, such as Figure 1 As shown, the signaling analysis method includes: Step 110: determining the signaling data to be analyzed based on the input code stream file.

[0030] Step 120 , extracting a service information summary and analyzing abnormal events are performed based on the signaling data to be analyzed, to obtain a service information summary and abnormal event analysis results.

[0031] Step 130, based on the signaling data to be analyzed, logical reasoning is performed in combination with the preset graph database, the target retrieval method and the process library to obtain the logical reasoning result; the preset graph database stores a graph structure including at least one reasoning chain constructed based on at least one preset rule; the target retrieval method includes hybrid retrieval and reordering; the process library stores the sub-processes in the business signaling process where each preset rule is located and their business interpretations.

[0032] Step 140, based on the service information summary, the abnormal event analysis result and the logical reasoning result, a signaling analysis result of the input code stream file is generated.

[0033] It should be noted that the execution subject of the signaling analysis method provided in the embodiment of the present application may be a server, a computer device, etc. The computer device may be, for example, a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook or a personal digital assistant (PDA), etc. It should be noted that the data required to be obtained in this application are all obtained through formal channels after being authorized by the relevant users.

[0034] A signaling analysis device may be provided or connected in the server or computer device of the present application, thereby controlling the signaling analysis device to execute the signaling analysis method of the present application.

[0035] This application may include business information summary extraction, abnormal event analysis and logical reasoning.

[0036] Specifically, business information summary extraction is to extract the information summary of the business corresponding to the code stream based on the information elements carried by the signaling message using a large language model. Abnormal event analysis is to identify and analyze the failure code elements carried in the signaling message. Logical reasoning is to combine graph data retrieval and process library retrieval to achieve root cause reasoning of code stream abnormalities.

[0037] Furthermore, a signaling analysis result is generated based on the processing results of the above three parts.

[0038] Specifically, in this application, users can upload the original code stream file.

[0039] Therefore, the present application can capture the original code stream file as the input code stream file at each interface of the communication link. Since the original code stream file captured at each interface of the communication link is usually a binary file, it is necessary to parse the input code stream file into a readable signaling plaintext, and further perform protocol screening and cell screening, and use the signaling data finally screened as the signaling data to be analyzed. It should be noted that the signaling data to be analyzed may include one or more signaling data, and each signaling data is composed of a message name, a carried cell name, and a configuration field.

[0040] The present application can analyze and sort out the filtered fields (i.e., the above-mentioned signaling data to be analyzed) by means of a large model (specifically a large language model) + prompt words, and output the business summary information involved in the input code stream file.

[0041] Furthermore, the present application can use the large model + prompt word method to extract abnormal events carried in the code stream information from the content of the filtered code stream field (ie, the above-mentioned signaling data to be analyzed) according to preset rules.

[0042] It should be noted that the present application can extract the knowledge of interpreting the protocol cause values ​​of Session Initiation Protocol (SIP), Diameter, S1 Application Protocol (S1AP) and Next Generation Access Protocol (NGAP) in advance from the Third Generation Partnership Project (3GPP) protocol, Request for Comments (RFC) and other specifications and IP (Internet Protocol) Multimedia Subsystem (IMS) equipment vendor product documents, and further manage to form a knowledge base as a preset failure code knowledge base, including fields such as process protocol, cause value (also called failure code) name, process name, failure analysis and solution suggestions. The Diameter protocol is a protocol cluster, which includes basic protocols and various application protocols extended from the basic protocols. S1AP is the most important protocol of the S1 interface.

[0043] Furthermore, the present application can use a target retrieval method including hybrid retrieval and rerank (ReRank) based on the process protocol, message name and failure code description of the corresponding fields of the abnormal event to search in a preset failure code knowledge base to obtain an abnormal information interpretation list formed by the interpretation content of each abnormal information.

[0044] Furthermore, prompt words are generated according to the abnormal information interpretation list, and abnormal events are analyzed and sorted out through a large model + prompt words to obtain abnormal event analysis results.

[0045] It should be noted that the present application can store the root cause location reasoning step knowledge in the form of a graph database.

[0046] Therefore, the present application can also perform reasoning chain matching in a preset graph database based on the signaling data to be analyzed to obtain the target reasoning chain and its business interpretation.

[0047] Furthermore, the message name, network element information and information element information of the corresponding fields of the target reasoning chain can be determined, and then based on the message name, network element information and information element information, a target retrieval method can be used to perform process retrieval in a process library constructed by multiple sub-processes of the same business process to obtain the target process information.

[0048] Furthermore, prompt words are generated based on the target process information, the target reasoning chain and its business interpretation, and the large model + prompt word method is used to perform logical reasoning on the content of the filtered code stream field (i.e. the above-mentioned signaling data to be analyzed) to obtain logical reasoning results.

[0049] Furthermore, the service information summary, abnormal event analysis results and logical reasoning results together form a code stream overall analysis report as a signaling analysis result of the input code stream file.

[0050] According to the signaling analysis method of the embodiment of the present application, the signaling data to be analyzed is determined based on the input code stream file, so that the service information summary extraction and abnormal event analysis can be performed based on the signaling data to be analyzed, and the service information summary and abnormal event analysis results can be obtained; and, at least one reasoning chain is constructed based on at least one preset rule to form a graph structure and stored in a preset graph database, and the sub-processes and their business interpretations in the service signaling process where each preset rule is located are stored in the process library, so that the signaling data to be analyzed can be combined with the preset graph database, the target retrieval method and the process library to perform logical reasoning to obtain the logical reasoning result; therefore, the signaling analysis result of the input code stream file can be generated based on the business information summary, the abnormal event analysis result and the logical reasoning result. The target retrieval method including hybrid retrieval and reordering is adopted to effectively improve the retrieval accuracy of special scenarios such as the inconsistency between the code stream field and the specification and the high similarity of the signaling name in the signaling analysis scenario; by constructing a graph database based on reasoning rules, the business meaning and logical relationship between the signaling process itself and the processes are fully considered, and the accuracy of the retrieval can also be improved; therefore, the accuracy of the signaling analysis can be improved.

[0051] The signaling process identification method of this application can not only identify and distinguish multiple business processes that may be included in the code stream, but also identify and interpret each sub-process occurring in the same business process, thereby improving the interpretability of the overall code stream. In addition, the workflow method of signaling analysis based on a large model can realize automatic analysis of operator business signaling, thereby improving the efficiency of signaling analysis.

[0052] Therefore, it can assist signaling analysts to quickly locate abnormal signaling process problems, so that the signaling analysis work can be advanced to the complaint takers, ensuring the efficiency and quality of complaint analysis and network optimization analysis, and achieving the goal of improving user satisfaction and key network indicators.

[0053] Based on the above embodiment, determining the signaling data to be analyzed based on the input code stream file includes: Parse the input code stream file to obtain the signaling plain text; Perform protocol screening on the signaling plain text to obtain the filtered signaling information; The signaling information is filtered and the signaling data to be analyzed is obtained.

[0054] Specifically, since the original code stream files captured at each interface of the communication link are usually binary files, the present application can parse them according to the parsing rules. Specifically, different protocol parsing rules can be matched according to each port and protocol parsing parameter, and the binary files can be parsed into readable signaling plaintext according to the matched protocol parsing rules.

[0055] Since the parsed signaling usually includes all protocols of the communication protocol stack, the present application can further filter out the signaling information of the target protocol to be analyzed as the filtered signaling information according to the preset protocol type.

[0056] It should be noted that the filtered signaling information consists of a message name, a cell name and a configuration field. Usually, a code stream contains dozens of messages, and each message carries dozens of cells. This causes the number of tokens in the input data to be as high as tens of thousands. In order to reduce a series of illusion problems caused by the input data exceeding the maximum token_size of the large language model, the present application can further formulate the cell templates required by each analysis module based on expert experience, perform cell filtering according to the corresponding cell templates, and then filter out the target field as the signaling data to be analyzed, including the message name and the cell name and configuration field after filtering. In this way, the number of tokens input to the large language model data is greatly reduced. A token refers to an element in the text that can be regarded as a single unit, such as a word, number or symbol. The maximum token_size refers to the maximum number of tokens that the model can process or generate.

[0057] This application converts binary files into readable signaling plaintext through parsing rules, which can understand and analyze communication data more quickly and improve the efficiency of data processing. By screening out the target protocol, you can focus on analyzing specific types of protocol signaling, which helps to locate problems more accurately and analyze the behavior of the communication protocol stack. Due to the huge amount of original code stream data, direct processing may result in a waste of computing resources and a reduction in processing speed. Through screening and templating, the amount of data to be processed can be greatly reduced, thereby reducing computing costs. Large language models may have comprehension deviations when processing data that exceeds their maximum token_size, the so-called "hallucination problem." By reducing the number of tokens in the input data, these problems can be avoided and the accuracy of the model output can be improved. Using expert experience to formulate cell templates can ensure that only the most critical information is focused on during the analysis process, which helps to improve the pertinence and depth of the analysis and helps to improve the accuracy of signaling analysis.

[0058] This application can automatically complete the identification, interpretation and analysis of various signaling processes contained in the code stream, improving the analysis efficiency. At the same time, it uses the existing reasoning chain data for reasoning analysis to improve the accuracy of the analysis conclusion, and it has strong generalization and can be applied to the signaling process analysis of various services such as voice, data, and 5G new calls in the operator's existing network.

[0059] Based on the above embodiment, a service information summary is extracted based on the signaling data to be analyzed to obtain a service information summary, including: The signaling data to be analyzed is input into the second largest language model to obtain the business summary information output by the second largest language model; the second largest language model is provided with a first preset prompt word; the first preset prompt word includes target extraction information, extraction rules, data processing rules and output format.

[0060] Specifically, the signaling cell records the route, identification, location, failure reason and other information of the signaling transmission, and is used to convey different control information. Extracting the configuration field from a specific cell can quickly obtain key business information such as user identification, business type, network location, etc.

[0061] Therefore, in the present application, a prompt word can be constructed as the first preset prompt word through the preset target extraction information, extraction rules, data processing rules and output format, and the first preset prompt word is used in the large language model, thereby obtaining the second large language model. The second large language model can extract business summary information from the input data according to the first preset prompt word.

[0062] Among them, the target extraction information of this application is the information that needs to be extracted. The extraction rules provide methods for how to extract information such as the calling number, called number, calling network standard, calling cell, calling area and calling terminal type from the information element. The data processing rules include information such as format conversion and cell standard conversion.

[0063] Therefore, the signaling data to be analyzed can be input into the second largest language model, and the second largest language model extracts the service summary information of the signaling data to be analyzed according to the first preset prompt word, thereby obtaining the service summary information output by the second largest language model.

[0064] This application not only helps complaint analysts quickly verify whether the complaint ticket information is consistent with the code stream data through business information interpretation, but also provides a comprehensive business information overview for the entire code stream, thereby improving the accuracy and efficiency of problem diagnosis during signaling analysis.

[0065] Based on the above embodiment, abnormal event analysis is performed based on the signaling data to be analyzed to obtain abnormal event analysis results, including: Inputting the signaling data to be analyzed into the third language model to obtain an abnormal event output by the third language model; the third language model is provided with a second preset prompt word; the second preset prompt word is generated based on an abnormal event retrieval rule; Based on the process protocol, message name and failure code description of the corresponding fields of the abnormal event, the target search method is used to search in the preset failure code knowledge base to obtain the abnormal information interpretation list; Generate a second prompt word according to the abnormal information interpretation list and build a fourth language model based on the second prompt word; The signaling data to be analyzed is input into the fourth language model to obtain the abnormal event analysis result output by the fourth language model.

[0066] Specifically, this application defines abnormal error responses in the signaling interaction process as abnormal events. The occurrence of abnormal events may cause a single signaling process to fail, and then cause the failure of the entire business process. Therefore, the capture and analysis of abnormal events plays an important role in the overall analysis of signaling. Signaling error responses usually carry a cause value cell indicating the preliminary cause of the fault. By interpreting this cell, a preliminary analysis of the abnormal event can be completed.

[0067] Therefore, the present application can generate a prompt word as the second preset prompt word according to the preset abnormal event retrieval rule, and apply the second preset prompt word to the large language model to obtain the third large language model. The third large language model can extract abnormal events from the input data according to the second preset prompt word.

[0068] Figure 2 is a flow chart of a hybrid search + reordering search solution in a signaling analysis method provided in an embodiment of the present application, such as Figure 2 As shown, the present application can use the signaling data to be analyzed as the original code stream to extract abnormal messages (ie, abnormal events).

[0069] Specifically, the signaling data to be analyzed can be input into the third largest language model, and the third largest language model can extract abnormal events from the signaling data to be analyzed according to the second preset prompt word, thereby obtaining the abnormal events output by the third largest language model, thereby extracting the abnormal events carried in the code stream information.

[0070] Furthermore, due to the characteristics of the business process, after receiving an error signaling response, a network element will pass the error signaling response to other network elements, resulting in multiple repeated error signaling responses in a code stream. Therefore, the signaling with the same process protocol, message name, and failure code is deduplicated, and the earliest one is retained, so as to obtain a list of abnormal events for the entire code stream as the abnormal event code stream.

[0071] Furthermore, the present application can traverse the abnormal messages of abnormal events in the abnormal event list, and specifically determine whether there is a next message in the list. If there is, key fields such as process protocol, message name, and failure code description can be extracted from the current abnormal event message and searched in the preset failure code knowledge base. Considering that the list fields and the knowledge base fields may have inconsistent formats, and the same meaning may be expressed in multiple words, the knowledge base is vectorized and searched using a mixed search with reordering to improve the accuracy of the search.

[0072] Specifically, the retrieval process uses two methods for hybrid retrieval. The first step is to perform retrieval-augmented generation (RAG) retrieval on the three fields of the process protocol, message name, and failure code corresponding to the abnormal event, respectively, with the corresponding three fields in the preset failure code knowledge base, and obtain the process protocol similarity list, message name similarity list, and failure code description similarity list, respectively. Finally, the intersection of the three lists is taken as the similarity list for this retrieval. The second step is to splice (merge) the field contents of the process protocol, message name, and failure code into a unique primary key, and perform RAG retrieval with the corresponding unique primary key in the preset failure code knowledge base as the full-field similarity list for this retrieval. Finally, the two retrieval similarity lists are merged and the union of the hybrid retrieval is taken, and the most similar abnormal information interpretation content is obtained by reordering as the interpretation knowledge of this abnormal message.

[0073] An abnormal information interpretation list is formed according to the abnormal message interpretation knowledge corresponding to each abnormal event.

[0074] Furthermore, a prompt word for abnormal event analysis is constructed through the abnormal information interpretation list as a second prompt word, and the second prompt word is applied to the large language model to obtain a fourth large language model. The fourth large language model is used to perform abnormal event analysis on the input data according to the second prompt word.

[0075] Therefore, the signaling data to be analyzed can be input into the fourth language model, and the abnormal events of the signaling data to be analyzed can be analyzed and sorted out through the fourth voice model, and the results of the abnormal event analysis can be output, thereby obtaining the abnormal event analysis results output by the fourth language model.

[0076] This application is based on a retrieval method of hybrid retrieval + reordering, which effectively improves the retrieval accuracy in special scenarios such as signaling analysis scenarios where the code stream field is inconsistent with the specification and the signaling name similarity is high, and helps to improve the accuracy of signaling analysis.

[0077] Based on the above embodiment, based on the signaling data to be analyzed, combined with the preset graph database, the target retrieval method and the process library, logical reasoning is performed to obtain logical reasoning results, including: Based on the signaling data to be analyzed, the inference chain is matched in the preset graph database to obtain the target inference chain and its business interpretation; the message name, network element information and cell information of the corresponding field of the target inference chain are determined; Based on the message name, network element information and cell information, the target search method is used to search the process in the process library to obtain the target process information; Generate a first prompt word based on the target process information, the target reasoning chain and its business interpretation, and build a first language model based on the first prompt word; The signaling data to be analyzed is input into the first largest language model to obtain the logical reasoning result output by the first largest language model.

[0078] It should be noted that the signaling communication process of a complete business is usually completed by the cooperation of multiple protocol processes. Each protocol process framework contains multiple sub-processes. The completion status of each sub-process will affect the status of other processes. Therefore, when accurately locating abnormal signaling problems, it is usually necessary to refer to the context logic of the abnormal event for joint analysis, and check each process until the fault occurs.

[0079] This application can first sort out the signaling problem reasoning chain and conclusion from the existing network signaling cases. The reasoning chain is composed of one or more sub-rules (i.e., the above-mentioned preset rules). The content of each sub-rule configuration can be the signaling name, failure reason value, time difference between signaling, cell parameters, etc.

[0080] Because the same code stream may satisfy multiple sets of reasoning chains, it is necessary to repeatedly poll and retrieve from the code stream. The rule matching method has a large amount of computation and low computational efficiency. The use of a graph database can quickly lock the initial node according to the HashNode, greatly improving the computational efficiency. It meets the high-frequency and large-volume scenarios such as code stream analysis. In a graph database, each node can be regarded as a key-value pair in a hash table, where the node's attributes are the key (key), and the node itself and its associated data are the value (value). By calculating the hash values ​​of these keys, the corresponding node, that is, the HashNode, can be quickly located.

[0081] The inference rules are further stored in the form of a graph database to ensure the efficiency of rule retrieval and the convenience of rule maintenance. The construction process of the graph database is divided into the following steps: First, all sub-rules are mapped into unique codes to obtain a sub-rule mapping code table. In this application, A, B, C, D, E and other examples can be used. For example, text="No user responding" is mapped to A.

[0082] The graph structure in the preset graph database in this application is composed of nodes and edges, where nodes are divided into two types: rule nodes and marked nodes, and edges are divided into two types: process edges and starting node edges. The encoding of the sub-rule mapping in the reasoning chain is used as the node name, and the node type is defined as the rule node. The edge pointing to the next node is marked as a process edge. When the reasoning chain reaches the last node, the node extends a new node to record the starting node information of the rule chain. The node type is a marked node, and the node name is the name of the initial node in the rule chain. The edge pointing to the node is the starting node edge.

[0083] Traverse and build all reasoning chains until the graph structure is completed and stored in the preset graph database.

[0084] Therefore, based on the signaling data to be analyzed, reasoning chain matching is performed in the preset graph database. The specific process can be seen in the following steps 1-8.

[0085] Step 1: For the code stream field in the signaling data to be analyzed, match it with the sub-rule mapping table in chronological order to obtain the mapping rule coding (Identification, ID) table (also called code stream mapping coding table) of the code stream field, as shown in the structure of [A, F, B, G, K, C] in the following example.

[0086] Step 2: Quickly retrieve the relevant nodes in the graph structure from the first rank of the code stream mapping encoding table (the HashNode of the node type + node name must be consistent).

[0087] Step 3: Traverse the graph node to the downstream node in sequence according to the code stream order. If the message cannot be found, abandon the message and execute the subsequent steps in sequence until the next node in the graph structure is retrieved.

[0088] Step 4: Follow the search process in step 3 above, stop when encountering a node with an edge type that is the starting node type, and retrieve the marked node under it. If the node name of the marked node is consistent with the node name of the starting node, save the rule chain.

[0089] Step 5: Retrieve the root cause information (i.e. the business explanation mentioned above) according to the rule chain and store it in the root cause list.

[0090] Step 6: Continue to traverse the subsequent nodes in the execution code stream information, and if other reasoning chains are found, continue to store them in the root cause list.

[0091] Step 7: After the search from the beginning is completed, continue to execute the above steps 2-6 from the second order (third order, fourth order...) in the code stream information until all the inference rules are found.

[0092] Step 8: Output the relevant reasoning chain as the target reasoning chain and output its root cause information.

[0093] Furthermore, the present application can extract the message name, sending / destination network element and other network element information and cell information of the code stream field corresponding to each ID based on the matching target inference chain in the code stream field code table.

[0094] Furthermore, based on the message name, network element information and cell information, a target search method including hybrid search and reordering is adopted to perform process search in a pre-built process library to obtain target process information.

[0095] Further, a prompt word is constructed as a first prompt word according to the target process information, the target reasoning chain and its business interpretation, and the first prompt word is applied to the large language model to obtain a first large language model. The first large language model can perform logical reasoning on the input data according to the first prompt word.

[0096] Therefore, the present application can input the signaling data to be analyzed into the first largest language model, and the first largest language model performs logical reasoning on the signaling data to be analyzed according to the first prompt word, thereby obtaining the logical reasoning result output by the first largest language model.

[0097] This application builds a graph database based on inference rules, fully considering the business meaning and logical relationship between the signaling process itself and the processes, which can improve the accuracy of retrieval, and thus improve the accuracy of signaling analysis. In addition, the construction of the graph database based on inference rules and the retrieval based on the graph database not only improves the accuracy of retrieval but also reduces the complexity of inference rule maintenance.

[0098] Based on the above embodiment, based on the message name, network element information and cell information, a process search is performed in the process library using a target search method to obtain target process information, including: The message name, network element information and information element information are respectively searched in the process library to obtain the corresponding first process search result, second process search result and third process search result; Determine a first process intersection of the first process search results, the second process search results, and the third process search results; After the message name, network element information and cell information are spliced ​​together, a process search is performed in the process library to obtain a fourth process search result; and a second process intersection of the first process intersection and the fourth process search result is determined; Reorder the processes in the second process intersection to obtain target process information.

[0099] It should be noted that the inference rule library does not store the interpretation information of the message flow corresponding to the rules. In order to further increase the verifiability of the output reasoning steps, this application breaks down the standard business signaling process into different sub-processes according to the transaction type of signaling interaction, and sorts out the detailed transaction content, failure characteristics and other knowledge of the sub-processes to form a signaling process library.

[0100] Figure 3 is a schematic diagram of process identification in the signaling analysis method provided in the embodiment of the present application, such as Figure 3 As shown in the figure, for the matching inference chain [A, B, C], the code stream field A, field B and field C can be obtained from the code stream mapping rule ID list [A, F, B, G, K, C], and the message name, sending / destination network element, cell and other information corresponding to field A, field B and field C can be obtained through field extraction. Further, the process library is searched through the information of each field to obtain the process information corresponding to field A, field B and field C.

[0101] Specifically, during the retrieval process, the present application may use the RAG technology to perform process retrieval on the message name in the process library to obtain the first process retrieval result.

[0102] The network element information is searched in the process library using RAG technology to obtain a second process search result.

[0103] The cell information is searched in the process library using RAG technology to obtain the third process search result.

[0104] Further, a first process intersection of the first process search result, the second process search result and the third process search result is determined.

[0105] At the same time, after the message name, network element information and cell information are spliced, the RAG technology can be used to perform process retrieval in the process library to obtain the fourth process retrieval result.

[0106] Further, the first process intersection and the second process intersection of the fourth process search result are determined.

[0107] Furthermore, the processes in the second process intersection are reordered, and the most similar process information is obtained as the target process information by reordering.

[0108] This application is based on a retrieval method based on hybrid retrieval + reordering, which effectively improves the retrieval accuracy in special scenarios such as signaling analysis scenarios where the code stream field is inconsistent with the specification and the signaling name similarity is high.

[0109] Figure 4 is a schematic diagram of the overall flow of the signaling analysis method provided in the embodiment of the present application, such as Figure 4As shown, the present application firstly parses and processes the code stream file, and uses the processed code stream screening fields as the signaling data to be analyzed. Further, the service information summary is extracted from the signaling data to be analyzed by using the prompt word + large model to obtain the service information summary.

[0110] In addition, after the abnormal events are extracted and duplicated for the signaling data to be analyzed, the remaining abnormal events are matched with the abnormal message interpretation knowledge in the failure code library (i.e., the failure code knowledge base) through the process protocol, message name, failure code and other field information, and prompt words are further generated according to the abnormal message interpretation list formed by the abnormal message interpretation knowledge, and then the abnormal event analysis is performed on the signaling data to be analyzed through the large model + prompt words to obtain the abnormal event analysis results.

[0111] In addition, the code stream rule mapping is first performed, and a graph database is constructed based on the mapping coding table. Then, the reasoning rules can be matched through graph database retrieval, and the process library is searched according to the matched reasoning rules combined with the ID list and the corresponding fields to obtain the process information. Then, based on the process information, reasoning rules and related root causes as prompt words, logical reasoning is performed on the signaling data to be analyzed through the large model + prompt word method to obtain the reasoning result.

[0112] Finally, the overall analysis report of the code stream is composed of the business information summary, abnormal event analysis results and logical reasoning results.

[0113] The signaling analysis device provided in the present application is described below. The signaling analysis device described below and the signaling analysis method described above can be referenced to each other.

[0114] Furthermore, the present application also provides a signaling analysis device.

[0115] The signaling analysis device comprises: A determination module, used to determine the signaling data to be analyzed based on the input code stream file; A first processing module is used to extract a service information summary and analyze abnormal events based on the signaling data to be analyzed, and obtain a service information summary and abnormal event analysis results; The second processing module is used to perform logical reasoning based on the signaling data to be analyzed, in combination with a preset graph database, a target retrieval method and a process library, to obtain a logical reasoning result; the preset graph database stores a graph structure including at least one reasoning chain constructed based on at least one preset rule; the target retrieval method includes mixed retrieval and reordering; the process library stores sub-processes and business explanations in the business signaling process where each preset rule is located; A generation module is used to generate a signaling analysis result of the input code stream file based on the business information summary, the abnormal event analysis result and the logical reasoning result.

[0116] The signaling analysis device of the present application determines the signaling data to be analyzed based on the input code stream file, so that the service information summary extraction and abnormal event analysis can be performed based on the signaling data to be analyzed, and the service information summary and abnormal event analysis results can be obtained; and at least one reasoning chain is constructed based on at least one preset rule to form a graph structure and stored in a preset graph database, and the sub-processes and business interpretations in the service signaling process where each preset rule is located are stored in the process library, so that the signaling data to be analyzed can be combined with the preset graph database, the target retrieval method and the process library to perform logical reasoning to obtain the logical reasoning result; therefore, the signaling analysis result of the input code stream file can be generated based on the business information summary, the abnormal event analysis result and the logical reasoning result. The target retrieval method including hybrid retrieval and reordering is adopted to effectively improve the retrieval accuracy of special scenarios such as the inconsistency between the code stream field and the specification and the high similarity of the signaling name in the signaling analysis scenario; by constructing a graph database based on reasoning rules, the business meaning and logical relationship between the signaling process itself and the processes are fully considered, and the retrieval accuracy can also be improved; therefore, the accuracy of signaling analysis can be improved.

[0117] In one embodiment, the determining module is specifically used to: Parse the input code stream file to obtain the signaling plain text; Performing protocol screening on the signaling plain text to obtain screened signaling information; The signaling information is filtered to obtain signaling data to be analyzed.

[0118] In one embodiment, the first processing module is specifically configured to: The signaling data to be analyzed is input into a second largest language model to obtain business summary information output by the second largest language model; a first preset prompt word is set in the second largest language model; the first preset prompt word includes target extraction information, extraction rules, data processing rules and output format.

[0119] In one embodiment, the first processing module is further configured to: Inputting the signaling data to be analyzed into a third language model to obtain an abnormal event output by the third language model; a second preset prompt word is set in the third language model; and the second preset prompt word is generated based on an abnormal event retrieval rule; Based on the process protocol, message name and failure code description of the corresponding fields of the abnormal event, a target search method is used to search in the preset failure code knowledge base to obtain an abnormal information interpretation list; Generate a second prompt word according to the abnormal information interpretation list and build a fourth language model based on the second prompt word; input the signaling data to be analyzed into the fourth language model to obtain the abnormal event analysis result output by the fourth language model.

[0120] In one embodiment, the second processing module is specifically configured to: Based on the signaling data to be analyzed, reasoning chain matching is performed in a preset graph database to obtain a target reasoning chain and its business interpretation; Determine the message name, network element information and cell information of the fields corresponding to the target reasoning chain; Based on the message name, the network element information and the information element information, a process search is performed in the process library in a target search mode to obtain target process information; Generate a first prompt word based on the target process information, the target reasoning chain and its business interpretation, and build a first language model based on the first prompt word; The signaling data to be analyzed is input into the first large language model to obtain a logical reasoning result output by the first large language model.

[0121] In one embodiment, the second processing module includes a retrieval unit, and the retrieval unit is used to: Perform process retrieval on the message name, the network element information and the information element information in the process library respectively to obtain corresponding first process retrieval results, second process retrieval results and third process retrieval results; Determine a first process intersection of the first process search result, the second process search result, and the third process search result; After the message name, the network element information and the information element information are concatenated, a process search is performed in a process library to obtain a fourth process search result; Determine a second process intersection of the first process intersection and the fourth process search result; Reorder the processes in the intersection of the second processes to obtain target process information.

[0122] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the following method: determine the signaling data to be analyzed based on the input code stream file; Based on the signaling data to be analyzed, service information summary extraction and abnormal event analysis are performed respectively to obtain service information summary and abnormal event analysis results; Based on the signaling data to be analyzed, logical reasoning is performed in combination with a preset graph database, a target retrieval method and a process library to obtain a logical reasoning result; the preset graph database stores a graph structure including at least one reasoning chain constructed based on at least one preset rule; the target retrieval method includes mixed retrieval and reordering; the process library stores sub-processes and business explanations in the business signaling process where each preset rule is located; Based on the business information summary, the abnormal event analysis result and the logical reasoning result, a signaling analysis result of the input code stream file is generated.

[0123] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0124] In another aspect, an embodiment of the present application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method provided by each of the above embodiments is implemented, for example, including: determining the signaling data to be analyzed based on the input code stream file; Based on the signaling data to be analyzed, service information summary extraction and abnormal event analysis are performed respectively to obtain service information summary and abnormal event analysis results; Based on the signaling data to be analyzed, logical reasoning is performed in combination with a preset graph database, a target retrieval method and a process library to obtain a logical reasoning result; the preset graph database stores a graph structure including at least one reasoning chain constructed based on at least one preset rule; the target retrieval method includes mixed retrieval and reordering; the process library stores sub-processes and business explanations in the business signaling process where each preset rule is located; Based on the business information summary, the abnormal event analysis result and the logical reasoning result, a signaling analysis result of the input code stream file is generated.

[0125] In another aspect, an embodiment of the present application further provides a computer program product having a computer program stored thereon, and when the computer program is executed by a processor, the method provided by each of the above embodiments is implemented, for example, including: determining the signaling data to be analyzed based on the input code stream file; Based on the signaling data to be analyzed, service information summary extraction and abnormal event analysis are performed respectively to obtain service information summary and abnormal event analysis results; Based on the signaling data to be analyzed, logical reasoning is performed in combination with a preset graph database, a target retrieval method and a process library to obtain a logical reasoning result; the preset graph database stores a graph structure including at least one reasoning chain constructed based on at least one preset rule; the target retrieval method includes mixed retrieval and reordering; the process library stores sub-processes and business explanations in the business signaling process where each preset rule is located; Based on the business information summary, the abnormal event analysis result and the logical reasoning result, a signaling analysis result of the input code stream file is generated.

[0126] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0127] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution can be essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.

[0128] Finally, it should be noted that the above implementation modes are only used to illustrate the present application, rather than to limit the present application. Although the present application is described in detail with reference to the embodiments, a person skilled in the art should understand that various combinations, modifications or equivalent substitutions of the technical solutions of the present application do not depart from the spirit and scope of the technical solutions of the present application.

Claims

1. A signaling analysis method, characterized in that: include: Determine the signaling data to be analyzed based on the input code stream file; Based on the signaling data to be analyzed, service information summary extraction and abnormal event analysis are performed respectively to obtain service information summary and abnormal event analysis results; Based on the signaling data to be analyzed, logical reasoning is performed in combination with a preset graph database, a target retrieval method and a process library to obtain a logical reasoning result; the preset graph database stores a graph structure including at least one reasoning chain constructed based on at least one preset rule; the target retrieval method includes mixed retrieval and reordering; the process library stores sub-processes in the business signaling process where each preset rule is located and their business explanations; Based on the business information summary, the abnormal event analysis result and the logical reasoning result, a signaling analysis result of the input code stream file is generated.

2. The signaling analysis method according to claim 1, characterized in that: The logical reasoning is performed based on the signaling data to be analyzed, in combination with the preset graph database, the target retrieval method and the process library, to obtain the logical reasoning result, including: Based on the signaling data to be analyzed, performing reasoning chain matching in a preset graph database to obtain a target reasoning chain and its business interpretation; Determine the message name, network element information and cell information of the fields corresponding to the target reasoning chain; Based on the message name, the network element information and the information element information, a process search is performed in the process library in a target search mode to obtain target process information; Generate a first prompt word based on the target process information, the target reasoning chain and its business interpretation, and construct a first language model based on the first prompt word; The signaling data to be analyzed is input into the first large language model to obtain a logical reasoning result output by the first large language model.

3. The signaling analysis method according to claim 2, characterized in that: The process of searching the process library in a target search manner based on the message name, the network element information and the information element information to obtain the target process information includes: Perform process retrieval on the message name, the network element information and the information element information in the process library respectively to obtain corresponding first process retrieval results, second process retrieval results and third process retrieval results; Determine a first process intersection of the first process search result, the second process search result, and the third process search result; After the message name, the network element information and the information element information are concatenated, a process search is performed in a process library to obtain a fourth process search result; Determine a second process intersection of the first process intersection and the fourth process search result; Reorder the processes in the intersection of the second processes to obtain target process information.

4. The signaling analysis method according to claim 1, characterized in that: Extracting a summary of service information based on the signaling data to be analyzed to obtain a summary of service information includes: The signaling data to be analyzed is input into a second largest language model to obtain business summary information output by the second largest language model; a first preset prompt word is set in the second largest language model; the first preset prompt word includes target extraction information, extraction rules, data processing rules and output format.

5. The signaling analysis method according to claim 1, characterized in that: Performing abnormal event analysis based on the signaling data to be analyzed to obtain abnormal event analysis results includes: Inputting the signaling data to be analyzed into a third language model to obtain an abnormal event output by the third language model; a second preset prompt word is set in the third language model; and the second preset prompt word is generated based on an abnormal event retrieval rule; Based on the process protocol, message name and failure code description of the corresponding fields of the abnormal event, a target search method is used to search in the preset failure code knowledge base to obtain an abnormal information interpretation list; Generate a second prompt word according to the abnormal information interpretation list and build a fourth language model based on the second prompt word; input the signaling data to be analyzed into the fourth language model to obtain the abnormal event analysis result output by the fourth language model.

6. The signaling analysis method according to claim 1, characterized in that: The step of determining the signaling data to be analyzed based on the input code stream file includes: Parse the input code stream file to obtain the signaling plain text; Performing protocol screening on the signaling plain text to obtain screened signaling information; The signaling information is filtered to obtain signaling data to be analyzed.

7. A signaling analysis device, characterized in that: include: A determination module, used to determine the signaling data to be analyzed based on the input code stream file; A first processing module is used to extract a service information summary and analyze abnormal events based on the signaling data to be analyzed, and obtain a service information summary and abnormal event analysis results; The second processing module is used to perform logical reasoning based on the signaling data to be analyzed, in combination with a preset graph database, a target retrieval method and a process library, to obtain a logical reasoning result; the preset graph database stores a graph structure including at least one reasoning chain constructed based on at least one preset rule; the target retrieval method includes mixed retrieval and reordering; the process library stores sub-processes in the business signaling process where each preset rule is located and their business explanations; A generation module is used to generate a signaling analysis result of the input code stream file based on the business information summary, the abnormal event analysis result and the logical reasoning result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the signaling analysis method according to any one of claims 1 to 6 is implemented.

9. A storage medium, the storage medium being a non-transitory computer-readable storage medium, on which a computer program is stored, characterized in that: When the computer program is executed by a processor, the signaling analysis method as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the signaling analysis method according to any one of claims 1 to 6 is implemented.

Images