Method for resolving error in communication system

Abstract

A method comprising: providing a reference set of multi-protocol message streams executed in a first communication system, where the reference set comprises a plurality of reference message streams for various high-level message stream scenarios; obtaining a first message flow executed in the first or second communication system; extracting a protocol specific message from the first message stream; identifying a protocol-specific message of the first message stream based on a protocol-specific feature in the message; correlating protocol-specific messages of the first message stream into the first message stream sequence; matching the first message stream sequence with at least one reference message stream; and in response to detecting a deviation between the first message stream sequence and the at least one reference message stream, determining that the first message stream sequence potentially has an error.

Description

Technical Field

[0001] The present invention relates to resolving error conditions in communication systems. Background Art

[0002] Communication flows (i.e., call / message flows) in communication networks (such as in 5G networks) are always prone to errors. The communication network is provided with a network monitoring system, which enables the user (i.e., operator) of the network monitoring system to detect various error conditions in the network and perform corrective measures.

[0003] In modern communication networks, calls / message flows across various parts of the network and network elements are often carried out using multiple protocols along the path of the call / message flow. However, concurrent network monitoring systems are usually only able to track packets within a single protocol flow, or in some cases within fixed protocol hierarchies that have the same key to match messages of the protocol.

[0004] This is particularly problematic in the case of randomly occurring or sporadic errors in a message flow, especially in the case where it occurs in a message flow involving multiple protocols, a so-called multi-protocol message flow. Sporadic errors are difficult to detect by statistical methods, and concurrent network monitoring systems are unable to track errors across multiple protocols and correlate them to the same call flow. Summary of the invention

[0005] Now, an improved method and a technical device for implementing the method have been invented, by which the above problems can be alleviated. Various aspects include a system, a plurality of devices and a non-transitory computer-readable medium, including a computer program or a signal stored therein, which are characterized by what is described in the independent claims. Various details of the embodiments are disclosed in the dependent claims and the corresponding figures and descriptions.

[0006] The scope of protection sought by various embodiments of the present invention is set out by the independent claims. Embodiments and features described in this specification that do not belong to the scope of the independent claims (if any) should be interpreted as examples that help understand the various embodiments of the present invention.

[0007] According to a first aspect, a method is provided, comprising: providing a reference set of multi-protocol message flows executed in a first communication system, wherein the reference set includes multiple reference message flows for various high-level message flow scenarios; obtaining a first message flow executed in a first or second communication system; extracting a protocol-specific message from the first message flow; identifying the protocol-specific message of the first message flow based on protocol-specific features in the message; correlating the protocol-specific message of the first message flow into a first message flow sequence; matching the first message flow sequence with at least one reference message flow; and determining that the first message flow sequence is potentially erroneous in response to detecting a deviation between the first message flow sequence and the at least one reference message flow.

[0008] According to the second aspect, the apparatus includes: a component for providing a reference set of multi-protocol message flows executed in a first communication system, wherein the reference set includes multiple reference message flows for various high-level message flow scenarios; a component for obtaining a first message flow executed in a first or second communication system; a component for extracting protocol-specific messages from the first message flow; a component for identifying protocol-specific messages of the first message flow based on protocol-specific features in the messages; a component for correlating the protocol-specific messages of the first message flow into a first message flow sequence; a component for matching the first message flow sequence with at least one reference message flow; and a component for determining that the first message flow sequence is potentially erroneous in response to detecting a deviation between the first message flow sequence and the at least one reference message flow.

[0009] According to one embodiment, the means for extracting protocol specific messages from the first message stream comprises means for decoding the protocol specific messages by means of a corresponding protocol specific decoder; means for determining fields of the protocol specific messages that can be used to identify a message stream sequence, and means for providing associated tags to the fields.

[0010] According to one embodiment, a portion of the identified field can be used as a cross-protocol tag.

[0011] According to one embodiment, the component for correlating protocol specific messages of a first message stream into a first message stream sequence includes a component for matching protocol specific messages of different protocols based on tags; and a component for arranging protocol specific messages of different protocols into the first message stream sequence based on a timestamp and / or sequence number of each protocol specific message.

[0012] According to one embodiment, the apparatus comprises means for determining a high-level message flow scenario for a first message flow sequence; and means for matching the first message flow sequence with at least one reference message flow having a corresponding high-level message flow scenario.

[0013] According to one embodiment, the means for determining a high-level message flow scenario for a first message flow sequence includes means for arranging the first message flow sequence into a structured data frame; and means for supplementing the structured data frame with fields associating different messages with the same message flow.

[0014] According to one embodiment, said means for matching the first sequence of message streams with at least one reference message stream comprises means for searching for a reference message stream providing a minimum similarity measure with the first sequence of message streams.

[0015] According to one embodiment, the apparatus comprises means for collecting a file set from one or more network interfaces between a plurality of network elements of a communication system, wherein the file set comprises packets of a multi-protocol message stream; and means for obtaining the first message stream from the file set.

[0016] According to one embodiment, the apparatus comprises a component for obtaining a plurality of message streams from the file collection; a component for correlating protocol-specific messages of the plurality of message streams into a plurality of message stream sequences; and a component for identifying a plurality of network elements of a communication system involved in the plurality of message stream sequences.

[0017] According to one embodiment, the apparatus comprises means for identifying roles of a plurality of network elements of the communication system involved in the plurality of message flow sequences.

[0018] According to one embodiment, the apparatus comprises means for adding a first sequence of message streams to said reference set of multi-protocol message streams.

[0019] A device according to a third aspect comprises at least one processor and at least one memory, wherein the at least one memory stores computer program code, and the at least one memory and the computer program code are configured to, together with the at least one processor, cause the device to at least perform: providing a reference set of multi-protocol message flows executed in a first communication system, wherein the reference set includes multiple reference message flows for various high-level message flow scenarios; obtaining a first message flow executed in a first or second communication system; extracting protocol-specific messages from the first message flow; identifying protocol-specific messages of the first message flow based on protocol-specific features in the messages; correlating the protocol-specific messages of the first message flow into a first message flow sequence; matching the first message flow sequence with at least one reference message flow; and determining that the first message flow sequence is potentially erroneous in response to detecting a deviation between the first message flow sequence and the at least one reference message flow.

[0020] According to a further aspect, a computer-readable storage medium includes code for use by an apparatus, which, when executed by a processor, causes the apparatus to perform the functions described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] For a more complete understanding of example embodiments, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:

[0022] Figure 1 shows the high-level architecture of 5G / 6G networks;

[0023] Figure 2 An example architecture of a 5G / 6G generation network is shown;

[0024] Figure 3 An IMS network in an illustrative embodiment is shown;

[0025] Figure 4 shows a flow chart of a method according to an embodiment;

[0026] Figure 5 shows the logical architecture of the apparatus according to the embodiment;

[0027] Figure 6a -6e shows an example UI presentation of a network monitoring system according to an embodiment;

[0028] Figure 7 shows different user / network element interfaces along possible call / message flows; and

[0029] Figure 8 A block diagram of an apparatus according to an embodiment is shown. DETAILED DESCRIPTION

[0030] Suitable means and possible mechanisms for resolving error conditions in a communication network are described in further detail below.Before discussing the present embodiment in more detail, a brief reference to related art is given.

[0031] Figure 1The high-level architecture of a 5G / 6G network 100 described in the 3rd Generation Partnership Project (3GPP) TR 23.799 (v14.0.0) is shown. The next-generation network 100 includes a next-generation (Next-Gen) core network 102, and a next-generation access network and / or radio access network ((R)AN) 104. (R)AN 104 can support Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) access, wireless local area network (WLAN) access, fixed access, satellite radio access, new radio access technology (RAT), etc. The core network 102 interconnects the (R)AN 104 with a data network (DN) 106. The data network 106 can be an operator-external public or private data network, or an operator-internal data network (e.g., for IMS services). A next-generation user equipment (UE) 108 is configured to connect to the (R)AN 104 to access services from the core network 102.

[0032] Figure 2 A non-roaming architecture 200 for a 5G / 6G generation network is shown. Figure 2 The architecture in FIG. 2 shows a non-roaming architecture 200 for a 5G / 6G generation network. Figure 2 The architecture in is a reference point representation, as further described in 3GPP TS23.501 (v1.5.0). The architecture 200 includes network functions (NFs) for the core network 102, which can be implemented as network elements on dedicated hardware, software instances running on dedicated hardware, or virtualized functions instantiated on an appropriate platform (e.g., cloud infrastructure). The network functions for the control plane are separated from the user plane. The control plane of the core network 102 includes an authentication server function (AUSF) 210, a unified data management (UDM) 212, a network slice selection function (NSSF) 213, an access and mobility management function (AMF) 214, a session management function (SMF) 216, a policy control function (PCF) 218, and an application function (AF) 220. The user plane of the core network 102 includes one or more user plane functions (UPFs) 224 that communicate with the data network (DN) 106. UE108 is able to access the control plane and user plane of the core network 102 through the (R)AN 104.

[0033] The AUSF 210 is configured to support authentication of the UE 108. The UDM 212 is configured to store subscription data / information for the UE 108. The UDM 212 may store three types of user data: subscriptions, policies, and session-related context (e.g., UE location). The AMF 214 is configured to provide UE-based authentication, authorization, mobility management, etc. The SMF 216 is configured to provide the following functions: session management (SM), UE Internet Protocol (IP) address allocation and management, selection and control of (multiple) UPFs, termination of the interface towards the PCF 218, policy enforcement and control part of quality of service (QoS), lawful interception, termination of the SM part of NAS messages, downlink data notification (DDN), roaming functions, handling local enforcement to apply QoS for service level agreements (SLAs), charging data collection and charging interfaces, etc. If the UE 108 has multiple sessions, different SMFs may be assigned to each session to manage them separately, and different functions may be provided per session. The PCF 218 is configured to support a unified policy framework to govern network behavior and provide policy rules to the control plane functions to implement QoS enforcement, charging, access control, traffic routing, etc. The AF 220 provides information about packet flows to the PCF 218. Based on this information, the PCF 218 is configured to determine policy rules about mobility and session management to enable the AMF 214 and SMF 216 to operate normally.

[0034] The UPF 224 supports various user plane operations and functions, such as packet routing and forwarding, traffic processing (e.g., QoS enforcement), anchor points for intra-RAT / inter-RAT mobility (when applicable), packet inspection and policy rule enforcement, lawful interception (UP collection), traffic accounting and reporting, etc. The data network 106 is not part of the core network 102 and provides Internet access, operator services, third-party services, etc. For example, the International Telecommunication Union (ITU) has classified 5G mobile network services into three categories: enhanced mobile broadband (eMBB), ultra-reliable and low-latency communications (uRLLC), and massive machine type communications (mMTC) or massive Internet of Things (MIoT). eMBB focuses on services with high bandwidth requirements, such as HD video, virtual reality (VR), and augmented reality (AR). uRLLC focuses on latency-sensitive services, such as autonomous driving and remote management. mMTC and MIoT focus on services that include high requirements for connection density, such as smart cities and smart agriculture. The data network 106 can be configured to provide these and other services.

[0035] The architecture 200 includes the following reference points. The N1 reference point is implemented between the UE 108 and the AMF 214. The N2 reference point is implemented between the (R)AN 104 and the AMF 214. The N3 reference point is implemented between the (R)AN 104 and the UPF 224. The N4 reference point is implemented between the SMF 216 and the UPF 224. The N5 reference point is implemented between the PCF 218 and the AF 220. The N6 reference point is implemented between the UPF 224 and the data network 106. The N7 reference point is implemented between the SMF 216 and the PCF 218. The N8 reference point is implemented between the UDM 212 and the AMF 214. The N9 reference point is implemented between the two UPFs 224. The N10 reference point is implemented between the UDM 212 and the SMF 216. The N11 reference point is implemented between the AMF 214 and the SMF 216. The N12 reference point is implemented between the AMF 214 and the AUSF 210. The N13 reference point is implemented between the UDM 212 and the AUSF 210. The N14 reference point is implemented between two AMFs. In case of a non-roaming scenario, the N15 reference point is implemented between the PCF 218 and the AMF 214. The N22 reference point is implemented between the NSSF 213 and the AMF 214.

[0036] IP Multimedia Subsystem (IMS) is a network solution that delivers rich real-time communication or telecommunication services for both consumer and enterprise users over any access network and for any device type, including smartphones, tablets, wearables, laptops, and landline phones. Examples of IMS communication services include HD voice, Wi-Fi calling, rich messaging, rich calling with pre-call information, video calling, HD video conferencing, VoD, web communications, etc. IMS provides a common system for IP-based communication services.

[0037] Figure 3An IMS network 300 in an illustrative embodiment is shown. The IMS network 300 is a collection of different functions linked by standardized interfaces. For example, the IMS network 300 includes a home subscriber server (HSS) 302, a proxy call session control function (P-CSCF) 304, an inquiry CSCF (I-CSCF) 306, and a service CSCF (S-CSCF) 308 of the control layer (or control plane). The IMS network 300 also includes an application server (AS) 310 and a media server (MS) 312 of the application layer (or user plane). The entities of the control layer process signaling messages (e.g., Session Initiation Protocol (SIP)) to support sessions. For example, HSS 302 is a database that stores subscription-related information or subscriber profiles for users of IMS terminals (also referred to as UEs or IMS UEs). P-CSCF 304 is a SIP proxy that is the first contact point for IMS terminals. P-CSCF 304 is assigned to the IMS terminal before registration and is located on the signaling path to check the signaling messages. The I-CSCF 306 queries the HSS 302 for the address of the S-CSCF 308 and forwards the request / response to the S-CSCF 308. The S-CSCF 308 is the central node of the signaling plane. The S-CSCF 308 has knowledge of the services subscribed by the user and is responsible for enabling the services by contacting the appropriate application server 310. The entities of the application layer process data, store data, and provide services to IMS terminals. The application server 310 is part of the service / application plane and hosts and executes IMS specific services such as IP telephony and multimedia services. The IMS is designed to be access independent, which means that service delivery is achieved regardless of the device and access medium, so the UE and the access network are not in the same network. Figure 3 is displayed.

[0038] Communication flows (i.e., call / message flows) in communication networks (such as 5G networks) are always prone to errors. Communication networks are provided with network monitoring systems that enable users (also known as operators) of the network monitoring systems to detect various error conditions in the network and perform corrective measures, as well as collect and store low-level packet traces. Concurrent network monitoring systems typically input call / message flows as files, which are generally referred to as packet capture (PCAP) files.

[0039] The file may include the time of packet capture (absolute or relative), the source and destination addresses of the packet (e.g., IP addresses), headers of different layers of the protocol stack, and the content of the packet including, for example, encapsulated higher layer protocols. Based on the information about the call / message flow, concurrent network monitoring systems typically detect error conditions by statistical methods such as log file analysis or KPI anomaly detection.

[0040] In modern communication networks, calls / message flows across various parts and network elements of the network are usually carried out using multiple protocols on the path of the call / message flow. For example, in the IP Multimedia Subsystem (IMS), the network elements involving multiple (connection) protocols in their mutual communication include, for example, different types of call session control functions (CSCFs), border gateways (BGWs), telephony application servers (TASs), media gateways (MGWs), media resource functions (MRFs), HSS / HLRs (home subscriber servers / home location registers), where the relevant protocols involve at least the session initiation protocol (SIP), DIAMETER, real-time transport (control) protocol RT(C)P, radio access network application part (RANAP), etc.

[0041] Concurrent network monitoring systems typically include decoders to decode and analyze most relevant protocols, including IP, UDP, TCP, SIP; RTP; HTTP, DIAMETER, S1AP, RANAP, etc. However, they are typically only able to track packets within a single protocol flow, or in some cases, within a fixed protocol hierarchy with messages that have the same key to match the protocol.

[0042] This is particularly problematic in the case of randomly occurring or sporadic errors in a message flow, especially in the case where it occurs in a message flow involving multiple protocols, i.e., in a so-called multi-protocol message flow. Sporadic errors are difficult to detect by statistical methods, and concurrent network monitoring systems are unable to track errors across multiple protocols and correlate them to the same call flow.

[0043] Using the traditional process, the user / operator of the network monitoring system would download the packet files into a packet processing tool and try to filter out irrelevant packets, then analyze different fields in the content of the packets to identify potential errors based on his / her experience with previous events. This process is time-consuming and laborious for the user / operator and requires in-depth expertise in the network. Delays in resolving these issues can cause poor customer and end-user experience.

[0044] Therefore, there is a need for a method and related apparatus for more quickly resolving randomly occurring error conditions in a network.

[0045] Below, enhanced methods and apparatus for addressing randomly occurring error conditions in a network will be described in more detail according to various embodiments.

[0046] A method according to one aspect of the present invention comprises: Figure 4As shown, a reference set of multi-protocol message flows executed in a first communication system is provided (400), wherein the reference set includes multiple reference message flows for various high-level message flow scenarios; a first message flow executed in a first or second communication system is obtained (402); a protocol-specific message is extracted (404) from the first message flow; based on protocol-specific features in the message, the protocol-specific message of the first message flow is identified (406); the protocol-specific message of the first message flow is correlated (408) into a first message flow sequence; the first message flow sequence is matched with at least one reference message flow (412); and in response to detecting a deviation between the first message flow sequence and the at least one reference message flow, it is determined (414) that the first message flow sequence is potentially erroneous.

[0047] Therefore, in order to address multi-protocol message flows, a reference set of multi-protocol message flows executed in a communication system is provided. The reference set may include multiple reference message flows for various high-level message flow scenarios, such as VoLTE to VoLTE calls, call transfers, conference calls, etc. Note that the reference set can be obtained from the same communication system as the message flow to be analyzed or from another communication system. For any message flow to be analyzed, all messages of the flow using various protocols are extracted. Protocol-specific messages include protocol-specific features, based on which protocol-specific messages of the message flow are identified.

[0048] Based on data fields in the protocol specific messages that identify message flows across multiple protocols, all messages belonging to the same flow are correlated into a single message flow sequence or flow. The analyzed message flow sequence is matched with at least one reference message flow. If a deviation is noted between the analyzed message flow sequence and the at least one reference message flow, the analyzed message flow sequence is determined to be potentially erroneous.

[0049] Thus, in a network monitoring application of a network operator or network provider, message flow sequences that are potentially erroneous can be easily highlighted. While conventional network monitoring applications using statistical methods can effectively address common error situations in message flows, the methods now introduced are particularly useful in detecting more randomly occurring or sporadic errors in message flows. Thus, message flow sequences that are potentially erroneous can be presented to a user of the application (i.e., an operator) on a graphical user interface (GUI) of the application, and the operator can then more thoroughly check whether the highlighted message flow sequence is indeed erroneous, and if so, take necessary measures to correct the error.

[0050] According to one embodiment, extracting the protocol specific message from the first message stream includes: decoding the protocol specific message by a corresponding protocol specific decoder; determining a field of the protocol specific message that can be used to identify a message stream sequence, and providing an associated tag for the field.

[0051] Therefore, due to the multi-protocol message flow, messages of different protocols are decoded by their corresponding protocol-specific decoders. The protocol-specific decoder identifies and extracts relevant message fields from each message that can be used to identify the message flow sequence. For example, in the SIP protocol, such fields include at least to, from, Cseq, Call-Id, P-Charging-Vector, IMSI, MSISDNID message fields, but are not limited to these. The relevant fields that may be used to decode the message are tagged for further processing.

[0052] Protocol specific features can be exploited when identifying message fields that can be used to identify the message flow sequence. Some protocols have a simple request / response type of dialog, where each request message is answered with a success (e.g., confirmation) message or an error message. Other protocols (such as SIP) have a more complex state-oriented dialog, where not every message requires an immediate response, and (call) state information also needs to be maintained between network elements, and not all messages are allowed in every state.

[0053] According to one embodiment, a portion of the identified field may be used as a cross-protocol tag.

[0054] Some fields that may be used in related messages in a specific protocol may also appear in other protocols. For example, the MSISDNID and IMSI fields may also appear in DIAMETER messages, etc. Therefore, these fields can be provided with labels that can be used as cross-protocol labels to facilitate identification of message flows between other network elements and other protocol types.

[0055] According to one embodiment, associating the protocol-specific messages of the first message stream into the first message stream sequence includes matching the protocol-specific messages of different protocols based on tags; and arranging the protocol-specific messages of different protocols into the first message stream sequence based on the timestamp and / or sequence number of each protocol-specific message.

[0056] Thus, messages of different protocols belonging to the same message flow are matched using the available tagged (cross-)protocol fields and brought into the correct sequence using the timestamps and / or sequence numbers of the messages.

[0057] According to one embodiment, the method includes determining a high-level message flow scenario for a first message flow sequence; and matching the first message flow sequence with at least one reference message flow having a corresponding high-level message flow scenario.

[0058] Therefore, the high-level message flow scenario is identified for the analyzed message flow sequence with the same level of accuracy as the reference message flow. The analyzed message flow sequence is matched with at least one reference message flow having the corresponding high-level message flow scenario. Thus, the number of reference messages to be matched and the processing time are significantly reduced.

[0059] According to one embodiment, determining a high-level message flow scenario for the first message flow sequence includes arranging the first message flow sequence into a structured data frame; and supplementing the structured data frame with fields associating different messages with the same message flow.

[0060] Before matching messages of different protocols belonging to the same message flow to the correct sequence, the extracted messages may be arranged into a predefined structured data frame. Previously identified message fields that may be used to identify the message flow sequence (and therefore relevant for scenario identification and matching) may be filled into predefined fields of the structured data frame. Arranging the messages into the structured data frame may include, for example, filling in specific (error) codes and matching different call legs belonging to the same call flow.

[0061] The data fields of multiple structured data frames can be further arranged in the data entity matrix with the extraction features of call flow. This matrix can be used for high-level scenario detection later. In addition, unavailable message streams can be filtered out at this stage. For example, incomplete message streams or other conversations that cannot be correctly matched for them according to reference cases because some messages have not yet been correctly captured can be removed. In addition, structured data frames and / or matrix can collect statistics about the message streams found, which helps the user / operator of network monitoring application to select the correct scenario for matching. Structured data frames can also be supplied with additional fields that are not directly available in the message, for example, origin / termination user / network interface (ouni, onni, tnni, tuni) and access network type.

[0062] like Figure 7As shown, the originating network (on) refers to a network element managed by the provider of the calling party, and the terminating network (tn) refers to a network element belonging to the network provider of the called party. In IMS, end-to-end connectivity can be established using a back-to-back user agent that terminates SIP communications (e.g., to the user) and establishes separate communications to other network elements. In addition, messages can be exchanged with other network elements in the network. In order to simplify the correlation between different tags, different connections that identify the same call flow are supported, including the interfaces they are serving, such as the originating / terminating user / network interfaces (ouni, onni, tnni, tuni). Different access network types (5G, 4G, VoWifi...) can also be labeled because they define related network elements that may involve different protocols belonging to the same call flow.

[0063] According to one embodiment, matching the first message flow sequence with at least one reference message flow having a corresponding high-level message flow scenario comprises searching for a reference message flow that provides a minimum similarity measure with the first message flow sequence.

[0064] Thus, the messages of the message stream sequence are finally matched with one or more reference cases to find those cases for which a minimum similarity measure is found. For example, a minimum string distance between a reference message stream and a tested call stream can be searched. Here, for example, the generalized Wagner-Fischer algorithm can be used, but other string comparisons can also be used, as well as various solutions based on artificial neural networks (ANN). It should be noted that the distance has nothing to do with the complete message content, since only those fields that are almost unchanged in both call streams are compared.

[0065] According to one embodiment, the method comprises: collecting a file set from one or more network interfaces between a plurality of network elements of a communication system, wherein the file set comprises packets of a multi-protocol message stream; and obtaining the first message stream from the file set.

[0066] As mentioned above, in many network monitoring applications, message streams are arranged and processed in packet capture (PCAP) files. PCAP files may include a single file collected at a unique network interface on which packets between involved network elements pass, or multiple files collected at different network elements. Multiple files can be merged into the PCAP file using the timestamps in the packet capture so that the correct sequence flow of the relevant protocol messages can be restored. Therefore, any one or more message streams to be analyzed can be obtained from the PCAP file and supplied to a protocol-specific decoder. According to one embodiment, repeated messages captured at different network elements can be identified and filtered out.

[0067] According to one embodiment, the method includes: obtaining a plurality of message flows from the file collection; correlating protocol specific messages of the plurality of message flows into a plurality of message flow sequences; and identifying a plurality of network elements of the communication system involved in the plurality of message flow sequences.

[0068] Multiple message flows from a PCAP file can be used to identify network elements involved in the message flows. For example, by correlating protocol-specific messages from multiple message flows with multiple message flow sequences, network elements involved in the multiple message flow sequences can be identified.

[0069] According to one embodiment, the method comprises identifying roles of a plurality of network elements of the communication system involved in the plurality of message flow sequences.

[0070] The same network address (e.g., IP address of a host / network element) can have different roles. For example, an application server can host different roles on different ports. Network elements and their roles can be identified, for example, by network names visible in DNS messages, specific message fields (e.g., in SIP fields such as Route, RecordRoute, To, From, etc.), well-known ports unique to a specific network element, dedicated messages sent to a network element, etc.

[0071] Thus, a list of identified network elements and their specific roles in the network configuration can be obtained to support identification of messages associated with a specific flow, thereby better identifying potential error issues in the message / call flow. The list can be obtained by, for example, performing analysis on protocol / port dependencies, or performing analysis on host names and other parameters that can be derived from the decoded traffic.

[0072] According to one embodiment, the method includes adding the first message stream sequence to a reference set of multi-protocol message streams.

[0073] Once a message flow sequence has been parsed, it can be added to a reference set of multi-protocol message flows. Thus, the reference set ends up being larger, and it can cover a wider variety of multi-protocol message flow sets that can be compared. If the comparison is performed as an AI / ML (artificial intelligence / machine learning) process, one or more parsed message flow sequences can be used as training data for an AI / ML model.

[0074] Implementation example reference of the embodiment Figure 5 The embodiments may be implemented as computer-implemented software in an apparatus, the apparatus comprising at least one processor and at least one memory having computer program code stored thereon, the at least one memory and the computer program code being configured to, together with the at least one processor, cause the apparatus to perform the embodiments.

[0075] exist Figure 5 In the example, the SW architecture is logically divided into three units, an input unit 500, a data pre-processing unit 510, and a comparison unit 530, which can be implemented as an AI / ML model or a process utilizing a statistical algorithm, for example.

[0076] The input unit 500 includes collecting call (message) flows for analysis. This can be implemented as a collection of relevant packet capture (PCAP) files 502. The PCAP file can include a single file collected at the network interface between the network elements involved, or multiple files collected at different network elements. The input unit 500 also includes a reference set 504 of multi-protocol message flows, which can also include PCAP files collected from call (message) flows previously executed in the same or another communication system.

[0077] The PCAP file includes packets in the correct order, which can be passed to a protocol analysis unit 512, which includes an extensible set of protocol specific decoders 512a that identify and extract 512b all relevant fields from each message. This can also include labeling relevant potential message fields that can be used in each decoded message. The PCAP file can then be exported 512c, for example, in a text format (txt).

[0078] From the output of the protocol analysis unit 512, the protocol specific messages of the first message flow are correlated into the first message flow sequence, wherein messages of different protocols are matched using available tag protocol fields and brought into the correct message flow sequence, for example, using timestamps and / or sequence numbers of the messages. Thus, a selected call flow list 514 is obtained, which includes one or more call (message) flows arranged into, for example, a text format. Here, alternative formats may also be used, such as a json structure or a comma separated value (csv).

[0079] The output of the protocol analysis unit 512 can also be used to obtain a list of identified network elements 516 and their specific roles in the network configuration to support the user in better identifying potential problems. For example, the list can be obtained by performing analysis on protocol / port dependencies, or performing analysis on host names and other parameters that can be derived from the decoded traffic.

[0080] Selected call flow list 514 and identified network element list 516 are provided to call flow extraction pipeline 518 .

[0081] The data frame extraction unit 518a arranges the extracted message into a structured data frame and fills in different message fields, which are related to the scenario identification and matching. This can include, for example, filling in specific (error) codes and matching different call legs belonging to the same call flow.

[0082] The feature engineering unit 518b can filter out incomplete message flows, for example, because some messages have not been correctly captured, or other conversations for which the reference case cannot be correctly matched. In addition, the feature engineering unit 518b can collect statistics about the found call flows to help the user / operator of the network monitoring application to select the correct scenario for matching. The feature engineering unit 518b can also add additional fields that are not directly available in the message, such as the originating / terminating user / network interface (ouni, onni, tnni, tuni) and, for example, the access network type.

[0083] Then, the call flow sequence extraction unit 518c correlates the protocol specific messages of the analyzed message flow to the extracted message flow sequence, for which the high-level message flow scenario is determined. Then, the extracted message flow sequence (also referred to as the client call flow sequence 520) is supplied to the comparison unit 530.

[0084] It should be noted that all the steps described so far are performed not only for the potential erroneous flows, but also for the obtained reference flows 504. This results in an extracted reference message flow sequence (also referred to as reference call flow sequence 522), which is also supplied to the comparison unit 530. Therefore, the reference call flow and the customer-provided call flow have the same format, which is then used in the comparison phase to match the unknown call flow with the pre-trained reference cases.

[0085] In the high level scenario detector 532, the high level message flow scenario of the analyzed message flow is detected. In the call flow sequence matching unit 534, one or more reference call flows having preferably the same or at least the same high level message flow scenario are acquired for comparison. The analyzed message flow sequence is matched with one or more reference messages, and the expected call flow sequence 536 is output as the result of the matching. Deviations from the expected content are marked. If it is noted that there is a deviation between the analyzed message flow sequence and the at least one reference message flow, the analyzed message flow sequence is determined to be potentially erroneous.

[0086] Thus, potentially erroneous message flow sequences can be presented to a user (also known as an operator) of the network monitoring application on a graphical user interface (GUI) of the application. For example, a list of best matches can be identified, which can then be presented as a side-by-side comparison on the GUI, for example. Identified differences between the reference call flow and the customer call flow can be highlighted to enable the user / operator to easily further analyze the cause of the potential problem.

[0087] To emphasize the benefits gained by illustratively presenting analysis results on a network monitoring application's GUI, some exemplary UI presentations are shown.

[0088] Figure 6a An example of a file upload page is shown where a user / operator can upload (multiple) PCAP files that should be processed. By adding the PCAP file in question, each file will be loaded onto the server. Multiple files can be loaded simultaneously. The user can also add specific reference files to match the PCAP in question. After all files have been uploaded, analysis can be started.

[0089] During the analysis, which may take some time, depending on the size of the PCAP file, a status page regarding the progress may be presented to the user. Upon completion, a box indicating success or failure will be presented, such as Figure 6b The user can then proceed directly to the identified call flow list.

[0090] Figure 6c An example of a call flow list is shown. The call flow list presents all identified call flows to the user. Potentially problematic flows are highlighted, for example, in red. For example, flows containing error messages may be highlighted in red, while flows containing potential error messages may be highlighted in yellow. When a message sequence diagram of the corresponding flow is opened, the messages are marked in the corresponding color. Figure 6c In this case, the first call flow is highlighted as potentially faulty because a network element cannot perform a specific operation. By opening this call flow using the button on the right, the user can examine the flow in more detail.

[0091] The user can choose to inspect details using the multi-protocol ladder diagram of all relevant messages belonging to the flow, such as Figure 6d or side-by-side with the best matching reference stream, as shown in Figure 6e The user can select the protocols and network elements that should be compared. This helps the user focus on the most relevant issues.

[0092] Therefore, the method and apparatus and related embodiments can be used to quickly isolate anomalies in network traffic during system integration, and can also be used in real-time networks. If the execution is fast enough for real-time processing, the method and apparatus and related embodiments also enable post-processing of collected errors and online analysis in an operating network. While it helps to resolve errors observed in the network at a much faster rate, it also allows the concept to be extended to predictive maintenance of the network.

[0093] According to one aspect, an apparatus includes: a component for providing a reference set of multi-protocol message flows executed in a first communication system, wherein the reference set includes multiple reference message flows for various high-level message flow scenarios; a component for obtaining a first message flow executed in a first or second communication system; a component for extracting protocol-specific messages from the first message flow; a component for identifying protocol-specific messages of the first message flow based on protocol-specific features in the messages; a component for correlating the protocol-specific messages of the first message flow into a first message flow sequence; a component for matching the first message flow sequence with at least one reference message flow; and a component for determining that the first message flow sequence is potentially erroneous in response to detecting a deviation between the first message flow sequence and the at least one reference message flow.

[0094] According to one embodiment, the means for extracting protocol specific messages from the first message stream comprises means for decoding the protocol specific messages by means of a corresponding protocol specific decoder; means for determining fields of the protocol specific messages that can be used to identify a message stream sequence, and means for providing associated tags for the fields.

[0095] According to one embodiment, a portion of the identified field may be usable as a cross-protocol label.

[0096] According to one embodiment, the component for correlating protocol specific messages of a first message stream into a first message stream sequence includes a component for matching protocol specific messages of different protocols based on tags; and a component for arranging protocol specific messages of different protocols into the first message stream sequence based on a timestamp and / or sequence number of each protocol specific message.

[0097] According to one embodiment, the apparatus comprises means for determining a high-level message flow scenario for a first message flow sequence; and means for matching the first message flow sequence with at least one reference message flow having a corresponding high-level message flow scenario.

[0098] According to one embodiment, the means for determining a high-level message flow scenario for a first message flow sequence includes means for arranging the first message flow sequence into a structured data frame; and means for supplementing the structured data frame with fields associating different messages to the same message flow.

[0099] According to one embodiment, said means for matching the first sequence of message streams with at least one reference message stream comprises means for searching for a reference message stream providing a minimum similarity measure with the first sequence of message streams.

[0100] According to one embodiment, the apparatus comprises means for collecting a file set from one or more network interfaces between a plurality of network elements of a communication system, wherein the file set comprises packets of a multi-protocol message stream; and means for obtaining the first message stream from the file set.

[0101] According to one embodiment, the apparatus comprises a component for obtaining a plurality of message streams from the file collection; a component for correlating protocol-specific messages of the plurality of message streams into a plurality of message stream sequences; and a component for identifying a plurality of network elements of a communication system involved in the plurality of message stream sequences.

[0102] According to one embodiment, the apparatus comprises means for identifying roles of a plurality of network elements of the communication system involved in the plurality of message flow sequences.

[0103] According to one embodiment, the apparatus comprises means for adding a first sequence of message streams to a reference set of multi-protocol message streams.

[0104] According to one embodiment, the device includes at least one processor and at least one memory, on which computer program code is stored, and the at least one memory and the computer program code are configured to, together with the at least one processor, cause the device to at least perform: providing a reference set of multi-protocol message flows executed in a first communication system, wherein the reference set includes multiple reference message flows for various high-level message flow scenarios; obtaining a first message flow executed in a first or second communication system; extracting protocol-specific messages from the first message flow; identifying protocol-specific messages of the first message flow based on protocol-specific features in the messages; correlating the protocol-specific messages of the first message flow into a first message flow sequence; matching the first message flow sequence with at least one reference message flow; and determining that the first message flow sequence is potentially erroneous in response to detecting a deviation between the first message flow sequence and the at least one reference message flow.

[0105] According to one embodiment, the code configured to cause the device to extract the protocol specific message from the first message stream includes code configured to cause the device to perform the following: decode the protocol specific message by a corresponding protocol specific decoder; determine a field of the protocol specific message that can be used to identify a message stream sequence; and provide an associated tag for the field.

[0106] According to one embodiment, a portion of the identified field may be used as a cross-protocol label.

[0107] According to one embodiment, code configured to cause the device to correlate protocol specific messages of a first message stream into a first message stream sequence includes code configured to cause the device to: match protocol specific messages of different protocols based on tags; and arrange protocol specific messages of different protocols into the first message stream sequence based on a timestamp and / or sequence number of each protocol specific message.

[0108] According to one embodiment, the apparatus includes code configured to cause the apparatus to: determine a high-level message flow scenario for a first message flow sequence; and match the first message flow sequence with at least one reference message flow having a corresponding high-level message flow scenario.

[0109] According to one embodiment, code configured to cause the device to determine a high-level message flow scenario for a first message flow sequence includes code configured to cause the device to: arrange the first message flow sequence into a structured data frame; and supplement the structured data frame with fields that associate different messages with the same message flow.

[0110] According to one embodiment, code configured to cause the apparatus to match the first message stream sequence to at least one reference message stream includes code configured to cause the apparatus to search for a reference message stream that provides a minimum similarity measure to the first message stream sequence.

[0111] According to one embodiment, the device includes code configured to cause the device to: collect a file collection from one or more network interfaces between multiple network elements of a communication system, wherein the file collection includes packets of a multi-protocol message stream; and obtain the first message stream from the file collection.

[0112] According to one embodiment, the device includes code configured to cause the device to: obtain multiple message flows from the file collection; correlate protocol specific messages of the multiple message flows into multiple message flow sequences; and identify multiple network elements of the communication system involved in the multiple message flow sequences.

[0113] According to one embodiment, the apparatus comprises code configured to cause the apparatus to identify roles of a plurality of network elements of the communication system involved in the plurality of message flow sequences.

[0114] According to one embodiment, the apparatus includes code configured to cause the apparatus to add a first sequence of message streams to a reference set of multi-protocol message streams.

[0115] A further aspect relates to a computer program product stored on a non-transitory storage medium, comprising computer program code which, when executed by at least one processor, causes an apparatus to perform at least the steps.

[0116] Such a device may include, for example, a device for implementing the embodiments and / or a functional unit disclosed in the figures. Figure 8 An apparatus according to an embodiment is shown. The general structure of the apparatus will be explained in terms of the functional blocks of the system. If desired, multiple functions can be performed using a single physical device, for example, all computing processes can be performed in a single processor. Figure 8 In the example of FIG. 8 , the data processing system of the apparatus includes a main processing unit 800, a memory 802, a storage device 804, an input device 806, an output device 808, and a graphics subsystem 810, which are interconnected via a data bus 812. A client may be understood as a client device or a software client running on the apparatus.

[0117] The main processing unit 800 is a processing unit arranged to process data in a data processing system. The main processing unit 800 may include or be implemented as one or more processors or processor circuit systems. Memory 802, storage device 804, input device 806 and output device 808 may include other components recognized by those skilled in the art. Memory 802 and storage device 804 store data in the data processing system 800. Computer program code resides in memory 802 for implementing, for example, machine learning processes. Input device 806 inputs data into the system, and output device 808 receives data from the data processing system and forwards the data to, for example, a display. Although data bus 812 is shown as a single line, it can be any combination of the following: processor bus, PCI bus, graphics bus, ISA bus. Therefore, it is easy for technicians to recognize that the device can be any data processing device, such as a computer device, a personal computer or a server computer.

[0118] In general, various embodiments of the present invention may be implemented in hardware or dedicated circuits or any combination thereof. Although various aspects of the present invention may be illustrated and described as block diagrams or using some other graphical representations, it is well understood that, as non-limiting examples, these blocks, devices, systems, techniques or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic, general purpose hardware or controllers or other computing devices or combinations thereof.

[0119] Embodiments of the present invention may be practiced in various components, such as integrated circuit modules. The design of integrated circuits is generally a highly automated process. Complex and powerful software tools are available to convert a logic level design into a semiconductor circuit design that is ready to be etched and formed on a semiconductor substrate.

[0120] Programs such as those offered by Synopsys Inc., Mountain View, Calif., and Cadence Design Inc., San Jose, Calif., use well-established design rules and a library of pre-stored design blocks to automatically route conductors and position components on a semiconductor chip. Once a design for a semiconductor circuit has been completed, the final design in a standardized electronic format (e.g., Opus, GDSII, etc.) can be sent to a semiconductor manufacturing facility or "fab" for fabrication.

[0121] The foregoing description has provided a complete and informative description of exemplary embodiments of the present invention by way of exemplary and non-limiting examples. However, various modifications and adaptations may become apparent to those skilled in the relevant arts in view of the foregoing description when read in conjunction with the accompanying drawings and accompanying examples. However, all such and similar modifications to the teachings of the present invention remain within the scope of the present invention.

Claims

1. An apparatus for communication, comprising at least one processor; and at least one memory storing computer code instructions, wherein when the computer code instructions are executed by the at least one processor, the apparatus performs at least the following: A reference set of multi-protocol message flows executed in a first communication system is provided, wherein the reference set includes: Multiple reference message flows for various high-level message flow scenarios; Obtaining a first message flow executed in the first communication system or in a second communication system; extracting protocol specific messages from said first message stream; identifying the protocol specific message of the first message flow based on a protocol specific feature in the message; correlating the protocol specific messages of the first message stream into a first message stream sequence; matching the first message stream sequence with at least one reference message stream; as well as In response to detecting a deviation between the first message stream sequence and the at least one reference message stream, the first message stream sequence is determined to be potentially erroneous.

2. The apparatus according to claim 1, wherein the apparatus is further configured to: Extracting the protocol specific message from the first message stream comprises: Decoding the protocol specific message by a corresponding protocol specific decoder; determining fields of the protocol specific message that can be used to identify a message flow sequence, and The field is provided with an associated label.

3. The apparatus of claim 2, wherein the portion of the identified field is capable of being used as a cross-protocol tag.

4. The apparatus of claim 2, wherein the correlating the protocol specific messages of the first message stream into the first message stream sequence comprises: Matching the protocol specific messages of different protocols based on the tags; as well as The protocol specific messages of different protocols are arranged into the first message flow sequence based on a timestamp and / or a sequence number of each protocol specific message.

5. The apparatus of claim 2, wherein the apparatus is further configured to: determining a high level message flow scenario for said first message flow sequence; and The first message flow sequence is matched with at least one reference message flow having a corresponding high level message flow scenario.

6. The apparatus of claim 5, wherein said determining the high-level message flow scenario for the first message flow sequence comprises: Arranging the first message stream sequence into a structured data frame; as well as The structured data frame is supplemented with fields that associate different messages with the same message stream.

7. The apparatus of claim 2, wherein matching the first message stream sequence with at least one reference message stream comprises: A reference message stream is searched for that provides a minimum similarity measure with said first sequence of message streams.

8. The apparatus of claim 2, wherein the apparatus is further configured to: collecting a collection of files from one or more network interfaces between a plurality of network elements of the communication system, wherein the collection of files includes packets of a multi-protocol message stream; and The first message stream is obtained from the file collection.

9. The apparatus of claim 8, wherein the apparatus is further configured to: Obtaining a plurality of message streams from the document set; correlating the protocol specific messages of the plurality of message flows into a plurality of message flow sequences; and A plurality of network elements of the communication system involved in the plurality of message flow sequences are identified.

10. The apparatus of claim 9, wherein the apparatus is further configured to: Roles of a plurality of network elements of the communication system involved in the plurality of message flow sequences are identified.

11. The apparatus of claim 2, wherein the apparatus is further configured to: The first message stream sequence is added to the reference set of multi-protocol message streams.

12. A method for communication, comprising: Providing a reference set of multi-protocol message flows executed in a first communication system, wherein the reference set includes: a plurality of reference message flows for various high-level message flow scenarios; Obtaining a first message flow executed in the first communication system or in a second communication system; extracting protocol specific messages from said first message stream; identifying the protocol specific message of the first message flow based on a protocol specific feature in the message; correlating the protocol specific messages of the first message stream into a first message stream sequence; matching the first message stream sequence with at least one reference message stream; and In response to detecting a deviation between the first message stream sequence and the at least one reference message stream, it is determined that the first message stream sequence is potentially erroneous.

13. The method of claim 12, wherein extracting protocol specific messages from the first message stream comprises: Decoding the protocol specific message by a corresponding protocol specific decoder; determining fields of the protocol specific message that can be used to identify a message flow sequence, and The field is provided with an associated label. The method of claim 13 , wherein the portion of the identified field is usable as a cross-protocol tag.

15. The method of claim 13, wherein said correlating said protocol specific messages of said first message flow into said first message flow sequence comprises: Matching the protocol specific messages of different protocols based on the tags; as well as The protocol specific messages of different protocols are arranged into the first message flow sequence based on a timestamp and / or a sequence number of each protocol specific message.

Images