Signaling process analysis method and device, electronic equipment, storage medium and computer program product
By converting the signaling process into a hash table and using the hash model for weighted summing and locally sensitive hash calculations, the problem of low efficiency and poor accuracy of signaling process analysis is solved, and fast and accurate abnormality detection and positioning is achieved.
Patent Information
- Application Number
- CN202510549763.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-28
- Publication Date
- 2025-07-04
AI Technical Summary
In the prior art, signaling process analysis is inefficient, and it is difficult to accurately judge the abnormal processes caused by changes in network environment and business status updates. There are errors and misjudgments in artificial analysis. The information matching algorithm based on keywords or strings is computationally large and the abnormal process is slow.
The signaling process to be tested is input into the trained hash model and converted into a hash table that is easy for computers to understand. Anomaly detection is performed through locally sensitive hash calculation and weighted summing methods, and similarity calculation and exception detection are performed using the trained hash model and reference hash table library.
It improves the efficiency and accuracy of signaling process analysis, simplifies calculation parameters, reduces human error, and can quickly locate the location of abnormal signaling, solving the judgment drift caused by network environment changes and service status updates.
Smart Images
Figure CN120263622A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of artificial intelligence technology, and particularly to a method, device, electronic device, storage medium and computer program product for analyzing signaling processes. Background Art
[0002] In the related art, in field test tasks, testers will conduct static or dynamic tests in various network environments to ensure as much coverage of different types of network environments as possible, so as to improve the adaptability of the terminal to different complex network environments. Summary of the Invention
[0003] The purpose of the present application is to provide a method, device, electronic device, storage medium and computer program product for analyzing signaling processes, which can improve the efficiency of signaling process analysis.
[0004] According to the first aspect of the embodiments of the present application, a method for analyzing a signaling process is provided, including: Inputting a signaling process to be tested into a trained hash model to obtain a hash table to be tested of the signaling process to be tested; Calculating the similarity between the hash table to be tested and each reference hash table in a reference hash table library to obtain a corresponding target similarity value; wherein, the reference hash table library includes N normal signaling process hash tables and M abnormal signaling process hash tables, the reference hash table is the normal signaling process hash table or the abnormal signaling process hash table, N is a positive integer, and M is a positive integer; Performing weighted summation on the target similarity values according to the weights of the reference hash tables to obtain a sum value; Performing abnormal detection processing on the sum value and a first threshold value to obtain a first abnormal detection result, where the first abnormal detection result indicates whether the signaling process to be tested is normal or abnormal.
[0005] In one implementation, the calculating the similarity between the hash table to be tested and each reference hash table in the reference hash table library to obtain a corresponding target similarity value includes: Performing locality-sensitive hashing calculation on the hash table to be tested and each reference hash table in the reference hash table library to obtain a corresponding target similarity value.
[0006] In one implementation, the performing locality-sensitive hashing calculation on the hash table to be tested and each reference hash table in the reference hash table library to obtain a corresponding target similarity value includes: Dividing the hash table to be tested into L segments according to the signaling process to be tested to obtain L sub-hash tables to be tested; wherein, the signaling process to be tested includes L stages, and L is an integer greater than 1; Divide the reference hash table into L segments according to the signaling process to be measured, obtaining L reference hash sub-tables; For each of the hash sub-tables to be measured, perform locality-sensitive hashing calculation on the hash sub-table to be measured and the corresponding reference hash sub-table, obtaining a corresponding intermediate similarity value; Calculate the target similarity value based on the L intermediate similarity values.
[0007] In one implementation, after performing anomaly detection processing on the sum value and the first threshold to obtain a first anomaly detection result, it further includes: When the first anomaly detection result indicates that the signaling process to be measured is abnormal, determine the position of the abnormal signaling in the signaling process to be measured.
[0008] In one implementation, the performing locality-sensitive hashing calculation on the hash table to be measured and each reference hash table in the reference hash table library to obtain a corresponding target similarity value further includes: Perform anomaly detection processing on the intermediate similarity value and the second threshold to obtain a second anomaly detection result; wherein, the second anomaly detection result indicates whether the hash sub-table to be measured corresponding to the intermediate similarity value is normal or abnormal; When the second anomaly detection result indicates that the hash sub-table to be measured is abnormal, add an anomaly mark to the hash sub-table to be measured; The determining the position of the abnormal signaling in the signaling process to be measured includes: Determine the abnormal hash sub-table to be measured according to the anomaly mark; Determine the position of the abnormal signaling in the signaling process to be measured according to the position of the abnormal hash sub-table to be measured in the hash table to be measured.
[0009] In one implementation, before inputting the signaling process to be measured into the trained hash model to obtain the hash table to be measured of the signaling process to be measured, it further includes: Train the untrained hash model with training data to generate a hash mapping function, obtaining the trained hash model; wherein, the training data includes normal signaling processes of different services and different normal signaling processes of the same service.
[0010] In one implementation, the training the untrained hash model with training data to generate a hash mapping function, obtaining the trained hash model includes: Based on the training data, perform hash learning on the untrained hash model using a linear hash function to generate the hash mapping function, obtaining the trained hash model.
[0011] In one embodiment, before training the untrained hash model with the training data to generate a hash mapping function and obtain the trained hash model, the following steps are further included: Construct the training data.
[0012] In one embodiment, the constructing the training data includes: Obtain a plurality of normal signaling processes; Add service category labels to each of the normal signaling processes to divide the plurality of normal signaling processes into normal signaling processes of different services; Assign corresponding weights to each of the normal signaling processes and each signaling in the normal signaling process to form the training data; wherein, the weight of the normal signaling process indicates the importance degree of the normal signaling process, and the weight of the signaling indicates the proportion of the signaling in the normal signaling process; when the reference hash table is the normal signaling process hash table, the weight of the reference hash table is the weight of the normal signaling process, and the normal signaling process hash table is the hash table of the normal signaling process.
[0013] In one embodiment, before calculating the similarity between the to-be-tested hash table and each reference hash table in the reference hash table library to obtain the corresponding target similarity value, the following steps are further included: Input the training data into the trained hash model so that the hash model outputs the normal signaling process hash table; Input the abnormal signaling processes of different services and different abnormal signaling processes of the same service into the trained hash model so that the hash model outputs the abnormal signaling process hash table; Construct the reference hash table library according to the normal signaling process hash table and the abnormal signaling process hash table.
[0014] In one embodiment, before inputting the abnormal signaling processes of different services and different abnormal signaling processes of the same service into the trained hash model so that the hash model outputs the abnormal signaling process hash table, the following steps are further included: Obtain a plurality of abnormal signaling processes; Add service category labels to each of the abnormal signaling processes to divide the plurality of abnormal signaling processes into abnormal signaling processes of different services; Assign corresponding weights to each of the abnormal signaling processes and each signaling in the abnormal signaling process; wherein, the weight of the abnormal signaling process indicates the importance of the abnormal signaling process, and the weight of the signaling indicates the proportion of the signaling in the abnormal signaling process; when the reference hash table is the abnormal signaling process hash table, the weight of the reference hash table is the weight of the abnormal signaling process.
[0015] In one implementation, after performing abnormal detection processing on the sum value and the first threshold to obtain a first abnormal detection result, it further includes: When the first abnormal detection result indicates that the signaling process to be measured is normal, compare the target similarity value between the to-be-measured hash table and each of the normal signaling process hash tables in the reference hash table library with a third threshold to obtain a comparison result, where the comparison result indicates that the to-be-measured hash table is the same as one of the N normal signaling process hash tables or the to-be-measured hash table is different from any one of the N normal signaling process hash tables; When the comparison result indicates that the to-be-measured hash table is the same as one of the N normal signaling process hash tables, keep the hash model unchanged; When the comparison result indicates that the to-be-measured hash table is different from any one of the N normal signaling process hash tables, add the to-be-measured signaling process to the training data to obtain the updated training data; Train the hash model using the updated training data to obtain the updated hash model.
[0016] In one implementation, before inputting the signaling process to be measured into the trained hash model to obtain the to-be-measured hash table of the to-be-measured signaling process, it further includes: Add a service category label to the to-be-measured signaling process to mark the service category of the to-be-measured signaling process; Assign corresponding weights to the to-be-measured signaling process and each signaling in the to-be-measured signaling process; wherein, the weight of the to-be-measured signaling process indicates the importance of the to-be-measured signaling process, and the weight of the signaling indicates the proportion of the signaling in the to-be-measured signaling process.
[0017] According to the second aspect of the embodiments of the present application, there is provided an analysis device for a signaling process, including: A first acquisition module, configured to input a signaling process to be measured into a trained hash model to obtain a to-be-measured hash table of the to-be-measured signaling process; A second acquisition module, configured to calculate the similarity between the to-be-tested hash table and each reference hash table in the reference hash table library to obtain a corresponding target similarity value; wherein, the reference hash table library includes N normal signaling process hash tables and M abnormal signaling process hash tables, the reference hash table is the normal signaling process hash table or the abnormal signaling process hash table, N is a positive integer, and M is a positive integer; A third acquisition module, configured to perform weighted summation on the target similarity values according to the weights of the reference hash tables to obtain a sum value; A detection module, configured to perform abnormal detection processing based on the sum value and a first threshold to obtain a first abnormal detection result, where the first abnormal detection result indicates whether the to-be-tested signaling process is normal or abnormal.
[0018] According to a third aspect of the embodiments of the present application, there is provided an electronic device, including a memory and a processor, where the memory is used to store a computer program executable by the processor; the processor is used to execute the computer program in the memory to implement the above method.
[0019] According to a fourth aspect of the embodiments of the present application, there is provided a computer-readable storage medium, on which a computer program is stored, and characterized in that when the executable computer program in the storage medium is executed by a processor, the above method can be implemented.
[0020] According to a fifth aspect of the embodiments of the present application, there is provided a computer program product, including a computer program, and when the computer program is executed by a processor, the above method is implemented.
[0021] Compared with the prior art, the beneficial effects of the present application are as follows: By inputting the signaling process to be tested into a trained hash model, a hash table to be tested for the signaling process to be tested is obtained. Then, similarity calculations are performed between the hash table to be tested and each reference hash table in the reference hash table library to obtain corresponding target similarity values. Among them, the reference hash table library includes N normal signaling process hash tables and M abnormal signaling process hash tables. The reference hash table is a normal signaling process hash table or an abnormal signaling process hash table. N is a positive integer, and M is a positive integer. Then, the target similarity values are weighted and summed according to the weights of the reference hash tables to obtain a sum value. Finally, based on the sum value and a first threshold value, abnormal detection processing is performed to obtain a first abnormal detection result, and the first abnormal detection result indicates whether the signaling process to be tested is normal or abnormal. By converting the literal signaling process to be tested into a hash table to be tested (binary encoding) that is easy for a computer to understand before performing abnormal detection on the signaling process to be tested, and using binary encoding that is easy for a computer to understand and calculate in the subsequent abnormal detection process, the calculation parameters for abnormal detection are simplified and the calculation efficiency is improved, thereby improving the efficiency of signaling process analysis. Description of the Drawings
[0022] Figure 1 is a flowchart of an analysis method for a signaling process shown according to an exemplary embodiment.
[0023] Figure 2 is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0024] Figure 3 is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0025] Figure 4 is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0026] Figure 5 is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0027] Figure 6 is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0028] Figure 7 is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0029] Figure 8 is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0030] Figure 9It is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0031] Figure 10 It is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0032] Figure 11 It is a flowchart of an analysis method for a signaling process shown according to another exemplary embodiment.
[0033] Figure 12 It is a block diagram of an analysis device for a signaling process shown according to an exemplary embodiment.
[0034] Figure 13 It is a block diagram of an electronic device shown according to an exemplary embodiment. Detailed implementation manners
[0035] Unless otherwise defined, the technical terms or scientific terms used in this specification and the claims shall have the ordinary meanings understood by those of ordinary skill in the technical field to which the present invention belongs. The following will describe the specific implementation manners of the present invention with reference to the accompanying drawings. It should be noted that in the process of the specific description of these implementation manners, for the sake of concise description, this specification cannot describe all the features of the actual implementation manners in detail. Without departing from the spirit and scope of the present invention, those skilled in the art can modify and replace the implementation manners of the present invention, and the obtained implementation manners are also within the protection scope of the present invention.
[0036] In the related art, in the field test task, testers will perform static or dynamic tests in various network environments to ensure as much coverage of different types of network environments as possible, so as to improve the adaptability of the terminal to different complex network environments. Due to the differences in network environments and the requirements of network signaling interaction for latency, there are often significant differences in the signaling processes between different locations and at different times at the same location, which will bring certain difficulties in time and judgment accuracy to testers in analyzing abnormal processes.
[0037] The inventors of the present application found that in the related art, there are many methods for judging signaling anomalies, but most of them are for judging signaling anomaly data, and the judgment of anomalies in the signaling process is relatively lacking and there is a certain degree of challenge. Specifically, there are the following three aspects of challenges: 1. Different services, such as audio and video calls, short message and multimedia message, and Internet access, have different signaling processes. Additionally, the same service also has different service logics. For example, VoNR (Voice over New Radio) and EPSFB (Efficient packet switching frame buffer) calls are both call services, but their signaling processes are very different. Moreover, when testers manually analyze abnormal processes, there are problems such as slow log loading, a large amount of time and effort required to extract, analyze, and judge valid information from massive log data, and certain errors and misjudgments in manual analysis. Therefore, it is somewhat difficult to rely solely on testers to analyze the signaling processes of all services and make abnormal judgments.
[0038] 2. In field cellular testing, the interactive signaling process between the UE (User Equipment) and the network changes with the network environment, that is, the process is not unique. Using a fixed normal signaling process as the standard for abnormal judgment will inevitably lead to misjudgments caused by a certain message being sent twice in the middle, thus unable to solve the judgment drift problem caused by network environment changes and service status updates.
[0039] 3. Due to the large number of different signaling processes resulting from different service processes or network environments, information matching algorithms based on keywords or strings have problems such as large computational complexity and slow identification of abnormal processes. That is, if a non - numerical comparison analysis algorithm is adopted, that is, the binary code "010101…" which is not easy for the computer to understand and calculate, from the perspective of the computer, there will be problems such as the need for translation and a relatively long calculation time. Therefore, the calculation duration of the algorithm is also an issue that needs to be considered and solved by the system for automatically analyzing abnormal processes.
[0040] To solve the above - mentioned technical problems, the present application proposes an analysis method, device, electronic device, storage medium, and computer program product for signaling processes, which can improve the efficiency and accuracy of signaling process analysis and effectively solve the problem of process drift that is normal but affects judgment caused by network environment changes and service status updates.
[0041] An embodiment of the present application provides an analysis method for signaling processes. This analysis method for signaling processes can be executed by a terminal, or by a chip or chip module with signaling process analysis capabilities, or by a chip or chip module with data - processing capabilities. The terminal in this embodiment can be a mobile phone, a computer, a laptop, or a tablet. Please refer to Figure 1 This analysis method for signaling processes may include the following steps 101 to 104: Step 101: Input the signaling process to be tested into the trained hash model to obtain the hash table to be tested of the signaling process to be tested.
[0042] Step 102: Calculate the similarity between the hash table to be tested and each reference hash table in the reference hash table library to obtain the corresponding target similarity value. Among them, the reference hash table library includes N normal signaling process hash tables and M abnormal signaling process hash tables. The reference hash table is a normal signaling process hash table or an abnormal signaling process hash table. N is a positive integer, and M is a positive integer.
[0043] Step 103: Perform weighted summation on the target similarity values according to the weights of the reference hash tables to obtain a sum value.
[0044] Step 104: Perform abnormal detection processing based on the sum value and the first threshold value to obtain a first abnormal detection result, and the first abnormal detection result indicates whether the signaling process to be tested is normal or abnormal.
[0045] In this embodiment, before performing abnormal detection on the signaling process to be tested, the literal signaling process to be tested is converted into a hash table to be tested (binary code) that is convenient for the computer to understand. And in the subsequent abnormal detection process, binary codes that are convenient for the computer to understand and calculate are used for calculation, which simplifies the calculation parameters of abnormal detection and improves the calculation efficiency, thereby improving the efficiency of signaling process analysis.
[0046] Moreover, when performing abnormal detection on the signaling process to be tested, the hash model has been trained, and the reference hash table library is ready, which can save a lot of time and avoid problems such as errors and misjudgments in manual analysis.
[0047] In one embodiment, the signaling process to be tested can be, for example, the signaling process of services such as voice calls, text messages, or network registration, but is not limited thereto.
[0048] In one embodiment, the trained hash model is used to map the input signaling process to be tested into the Hamming space and convert it into the corresponding hash table to be tested. The hash table to be tested is binary code, which is convenient for the computer to understand and calculate. Among them, the trained hash model can be a hash mapping function.
[0049] In one embodiment, the reference hash table library can be prepared in advance before step 102. The reference hash table library includes N normal signaling process hash tables and M abnormal signaling process hash tables. The N normal signaling process hash tables and M abnormal signaling process hash tables are used as reference hash tables for comparison with the hash table to be tested. Therefore, the reference hash table is a normal signaling process hash table or an abnormal signaling process hash table. Among them, N can be 10, 100, 200, or 500, but is not limited thereto. M can be 10, 100, 200, or 500, but is not limited thereto.
[0050] In one embodiment, a trained hash model can be used to convert N normal signaling processes into corresponding N normal signaling process hash tables, and a trained hash model can be used to convert M abnormal signaling processes into corresponding M abnormal signaling process hash tables. Among them, the N normal signaling processes and the M abnormal signaling processes are used as reference signaling processes for the signaling process to be measured, and are used to compare with the signaling process to be measured to detect whether the signaling process to be measured is abnormal.
[0051] In one embodiment, the target similarity value can be weighted and summed according to the weights of the reference hash tables to obtain a sum value. Among them, the weights of the reference hash tables can be pre-configured, and they can be equal to the weights of the corresponding normal signaling processes or abnormal signaling processes. The weights of the normal signaling processes or abnormal signaling processes can be pre-configured.
[0052] In one embodiment, the above sum value can be subjected to abnormal detection processing with a first threshold value to obtain a first abnormal detection result, and the first abnormal detection result indicates whether the signaling process to be measured is normal or abnormal. Among them, when the sum value is greater than the first threshold value, the first abnormal detection result indicates that the signaling process to be measured is normal, and when the sum value is less than the first threshold value, the first abnormal detection result indicates that the signaling process to be measured is abnormal. The first threshold value, for example, can be 0.5, but is not limited thereto.
[0053] The above briefly introduced the analysis method of the signaling process in this application. Next, the analysis method of the signaling process in this application will be introduced in detail.
[0054] Another embodiment of this application provides an analysis method for a signaling process. The main difference between this embodiment and the above embodiment is that, on the basis of the above embodiment, in this embodiment, when the first abnormal detection result indicates that the signaling process to be measured is abnormal, the position of the abnormal signaling in the signaling process to be measured is also determined. Please refer to Figure 2 In this embodiment, the analysis method of the signaling process may include the following steps 201 to 205: Step 201, input the signaling process to be measured into the trained hash model to obtain the measured hash table of the signaling process to be measured.
[0055] In this embodiment, the signaling process to be measured that needs to be subjected to abnormal detection is input into the trained hash model to obtain the corresponding measured hash table. The measured hash table is binary encoded, which is convenient for the computer to understand and calculate. Among them, the trained hash model can be a hash mapping function.
[0056] Step 202, calculate the similarity between the measured hash table and each reference hash table in the reference hash table library to obtain the corresponding target similarity value.
[0057] In this embodiment, local sensitive hashing calculations can be performed on the hash table to be measured and each reference hash table in the reference hash table library to obtain corresponding target similarity values.
[0058] In this embodiment, as Figure 3 shown, step 202 may include the following steps 301 to 304: Step 301: Divide the hash table to be measured into L segments according to the signaling process to be measured, obtaining L sub-hash tables to be measured; wherein, the signaling process to be measured includes L stages, and L is an integer greater than 1.
[0059] Step 302: Divide the reference hash table into L segments according to the signaling process to be measured, obtaining L sub-reference hash tables.
[0060] Step 303: For each sub-hash table to be measured, perform local sensitive hashing calculations on the sub-hash table to be measured and the corresponding sub-reference hash table to obtain corresponding intermediate similarity values.
[0061] Step 304: Calculate the target similarity value based on the L intermediate similarity values.
[0062] In this embodiment, L is 3, and the signaling process to be measured may include a start stage, an in-progress stage, and an end stage. Therefore, the hash table to be measured can be divided into 3 segments according to the signaling process to be measured, obtaining 3 sub-hash tables to be measured. In other embodiments, the value of L may also be 4, 5, 6, and other numbers, not limited to the above values, and the signaling process to be measured may also include other stages, not limited to the above stages.
[0063] Similarly, in this embodiment, the reference hash table can be divided into 3 segments according to the signaling process to be measured, obtaining 3 sub-reference hash tables.
[0064] Then, for each sub-hash table to be measured, perform local sensitive hashing calculations on the sub-hash table to be measured and the corresponding sub-reference hash table to obtain corresponding intermediate similarity values. For example, for the sub-hash table to be measured in the start stage, perform local sensitive hashing calculations on the sub-hash table to be measured and the sub-reference hash table in the start stage to obtain the intermediate similarity value in the start stage. Similarly, the intermediate similarity value in the in-progress stage and the intermediate similarity value in the end stage can be obtained, totaling 3 intermediate similarity values.
[0065] Then, calculate the target similarity value based on the 3 intermediate similarity values. For example, the average of the 3 intermediate similarity values can be calculated as the target similarity value. It should be noted that the method of calculating the target similarity value based on the 3 intermediate similarity values is not limited to this.
[0066] In this embodiment, as Figure 4As shown, the above step 202 may further include the following steps 401 to 402: Step 401, perform anomaly detection processing based on the intermediate similarity value and the second threshold to obtain a second anomaly detection result; wherein, the second anomaly detection result indicates whether the to-be-tested hash sub-table corresponding to the intermediate similarity value is normal or abnormal.
[0067] Step 402, when the second anomaly detection result indicates that the to-be-tested hash sub-table is abnormal, add an anomaly mark to the to-be-tested hash sub-table.
[0068] In this embodiment, for each intermediate similarity value, perform anomaly detection processing based on the intermediate similarity value and the second threshold to obtain a second anomaly detection result; wherein, when the intermediate similarity value is greater than the second threshold, the second anomaly detection result indicates that the corresponding to-be-tested hash sub-table is normal, and when the intermediate similarity value is less than the second threshold, the second anomaly detection result indicates that the corresponding to-be-tested hash sub-table is abnormal. The second threshold may be, for example, 0.5, but is not limited thereto.
[0069] For example, for the intermediate similarity value in the starting stage, perform anomaly detection processing based on the intermediate similarity value in the starting stage and the second threshold to obtain a second anomaly detection result; wherein, when the intermediate similarity value in the starting stage is greater than the second threshold, the second anomaly detection result indicates that the to-be-tested hash sub-table in the starting stage is normal, and when the intermediate similarity value is less than the second threshold, the second anomaly detection result indicates that the to-be-tested hash sub-table in the starting stage is abnormal.
[0070] In this embodiment, when the second anomaly detection result indicates that the to-be-tested hash sub-table is abnormal, add an anomaly mark to the to-be-tested hash sub-table. For example, when the second anomaly detection result indicates that the to-be-tested hash sub-table in the starting stage is abnormal, add an anomaly mark to the to-be-tested hash sub-table in the starting stage.
[0071] Step 203, perform weighted summation on the target similarity value according to the weights of the reference hash table to obtain a sum value.
[0072] In this embodiment, step 203 is similar to the above step 103 and will not be elaborated here.
[0073] Step 204, perform anomaly detection processing based on the sum value and the first threshold to obtain a first anomaly detection result, and the first anomaly detection result indicates whether the to-be-tested signaling process is normal or abnormal.
[0074] In this embodiment, step 204 is similar to the above step 104 and will not be elaborated here.
[0075] Step 205, when the first anomaly detection result indicates that the to-be-tested signaling process is abnormal, determine the position of the abnormal signaling in the to-be-tested signaling process.
[0076] In this embodiment, as Figure 5 shown, determining the position of the abnormal signaling in the signaling process to be measured may include the following steps 501 to 502: Step 501: Determine the abnormal hash sub-table to be measured according to the abnormal mark.
[0077] Step 502: Determine the position of the abnormal signaling in the signaling process to be measured according to the position of the abnormal hash sub-table to be measured in the hash table to be measured.
[0078] In this embodiment, when the first abnormal detection result indicates that the signaling process to be measured is abnormal, the abnormal hash sub-table to be measured can be determined according to the above abnormal mark, and the position of the abnormal signaling in the signaling process to be measured can be determined according to the position of the abnormal hash sub-table to be measured in the hash table to be measured. For example, when the first abnormal detection result indicates that the signaling process to be measured is abnormal, if the abnormal hash sub-table to be measured determined according to the above abnormal mark is the hash sub-table to be measured in the starting stage, then the position of the abnormal signaling in the signaling process to be measured is determined to be the starting stage according to the position of the hash sub-table to be measured in the starting stage in the hash table to be measured.
[0079] In this embodiment, during the process of performing locality-sensitive hashing calculation on the hash table to be measured and each reference hash table in the reference hash table library, an abnormal mark can be made on the abnormal local calculation result, and then, when the first abnormal detection result indicates that the signaling process to be measured is abnormal, the position of the abnormal signaling in the signaling process to be measured can be determined according to the abnormal mark. Therefore, in this embodiment, the position of the abnormal signaling in the signaling process to be measured can be located, which can help the test analyst quickly locate the position of the abnormal signaling in the signaling process to be measured.
[0080] Another embodiment of the present application provides a method for analyzing a signaling process. The main difference between this embodiment and the above embodiment is that, on the basis of the above embodiment, in this embodiment, when the first abnormal detection result indicates that the signaling process to be measured is normal, the hash model is updated using the signaling process to be measured. Please refer to Figure 6 In this embodiment, the method for analyzing the signaling process may include the following steps 601 to 608: Step 601: Input the signaling process to be measured into the trained hash model to obtain the hash table to be measured of the signaling process to be measured.
[0081] In this embodiment, step 601 is similar to step 101 above and will not be elaborated here.
[0082] In this embodiment, before step 601, as Figure 7 shown, the following steps 701 to 702 are further included: Step 701, construct training data; wherein, the training data includes normal signaling processes of different services and different normal signaling processes of the same service.
[0083] Step 702, use the training data to train the untrained hash model to generate a hash mapping function, and obtain the trained hash model.
[0084] In this embodiment, first construct the training data, and then use the training data to train the untrained hash model to generate a hash mapping function, and obtain the trained hash model. Since the training data includes normal signaling processes of different services and different normal signaling processes of the same service, in this way, it is equivalent to using a non-fixed template to compare with the signaling process to be tested for anomaly detection. Compared with using a fixed template, it can effectively solve the problem of process drift that is normal but affects judgment caused by changes in the network environment and updates of service status, and can improve the accuracy of process analysis.
[0085] In this embodiment, based on the training data, a linear hash function can be used to perform hash learning on the untrained hash model to generate a hash mapping function, and obtain the trained hash model. That is, bring the training data into the untrained hash model to train the hash function learning, and a linear hash method can be used to generate the hash mapping function. Among them, the function expression of linear hash is: Y = (H(key) + di) MOD m (1) In the formula, Y is the hash table, H(key) is the hash mapping function, H is the hash value, key is the input data, and the input data here is the training data, m is the length of the hash table, and di is the increment sequence when a conflict occurs, i = 1, 2,..., k, and k is a positive integer.
[0086] In this embodiment, using a linear hash function to perform hash learning on the untrained hash model can map all normal signaling processes to a value of 0 in the Hamming space, and map all abnormal signaling processes to a value of 1 in the Hamming space.
[0087] In one embodiment, through the ASCII code comparison table or the coding table, map all normal signaling processes to the Hamming space to generate Hamming codes (also called hash codes or hash tables).
[0088] In this embodiment, as Figure 8 shown, step 701 may include the following steps 801 to step 803: Step 801, obtain multiple normal signaling processes.
[0089] Step 802, add service category labels to each normal signaling process to divide the multiple normal signaling processes into normal signaling processes of different services.
[0090] Step 803: Assign corresponding weights to each normal signaling process and each signaling in the normal signaling process to form training data. Among them, the weight of the normal signaling process indicates the importance of the normal signaling process, and the weight of the signaling indicates the proportion of the signaling in the normal signaling process. When the reference hash table is the normal signaling process hash table, the weight of the reference hash table is the weight of the normal signaling process, and the normal signaling process hash table is the hash table of the normal signaling process.
[0091] For 4G (Fourth Generation Mobile Communication Technology) / 5G (Fifth Generation Mobile Communication Technology) terminals, during the testing process, about 1GB of log files can be generated in one minute, which cover the signaling process information of all services. Therefore, before analyzing the signaling process, we need to extract the required information according to the specific service, that is, extract all logs by category. Moreover, different process data of a large number of the same services are collected from different log files to enrich the sample library and improve robustness.
[0092] In this embodiment, in step 801, multiple normal signaling processes can be obtained by the following method: decompress a large number of log files with different services and different signaling processes of the same service and normal processes. Among them, the above different services can include services such as voice calls, text messages, and network registration. Different signaling processes of the same service, for example, the voice call service can include radio interface signaling processes such as VONR, EPSFB, CSFB (CS Fall Back), for example, handover (handover signaling), Invite (session establishment signaling), update (non-terminal response signaling), 183 (non-terminal response signaling), 200 (acknowledgment message signaling), ack (acknowledgment message signaling), bye (end call session signaling), etc.
[0093] After step 801 and before step 802, the multiple normal signaling processes obtained can be normalized.
[0094] In this embodiment, in step 802, a service category label can be added to each normal signaling process to divide the multiple normal signaling processes into normal signaling processes of different services. The service category label can be, for example, a category label for services such as voice calls, text messages, and network registration. Adding a service category label to each normal signaling process can make the classification of the normal signaling process clearer and the string length shorter.
[0095] In this embodiment, in step 803, corresponding weights can be assigned to each normal signaling process and each signaling in the normal signaling process to form training data. Among them, the weight of the normal signaling process indicates the importance of the normal signaling process, and the weight of the signaling in the normal signaling process indicates the proportion of the signaling in the normal signaling process. The weight of the signaling is generally a non-zero value.
[0096] For example, when the terminal is executing the signaling process of a voice call service, the terminal also executes the signaling process of a short message service. In the obtained signaling process of the voice call service, the signaling process of the short message service is also included. When configuring the weights, a larger weight value is configured for the signaling process of the voice call service, and a smaller weight value is configured for the signaling process of the short message service, that is, the weight of the signaling process of the voice call service is greater than the weight of the signaling process of the short message service. Moreover, the weight of the signaling in the signaling process of the short message service is configured as a non-zero and relatively small weight value, and the signaling of the short message service in the signaling process of the voice call service is retained. In this way, the sample library can be enriched and the robustness can be improved.
[0097] In this embodiment, when the reference hash table in the reference hash table library is the normal signaling process hash table, the weight of the reference hash table is the weight of the normal signaling process, and the above normal signaling process hash table is the hash table of the normal signaling process. The method for obtaining the normal signaling process hash table is: input the normal signaling process into the trained hash model, and the trained hash model outputs the normal signaling process hash table.
[0098] In this embodiment, assigning corresponding weights to each normal signaling process and each signaling in the normal signaling process can improve the accuracy of anomaly detection. Because, if an important signaling is missing or incorrect, the magnitude of the weight at that place will greatly affect the judgment of the final result.
[0099] In this embodiment, before step 601, as Figure 9 shown, the following steps 901 to step 902 are further included: Step 901, add a service category label to the signaling process to be measured to mark the service category of the signaling process to be measured.
[0100] Step 902, assign corresponding weights to the signaling process to be measured and each signaling in the signaling process to be measured; among them, the weight of the signaling process to be measured indicates the importance of the signaling process to be measured, and the weight of the signaling indicates the proportion of the signaling in the signaling process to be measured.
[0101] In this embodiment, step 901 is similar to the above step 802 and will not be elaborated here.
[0102] In this embodiment, the signaling process to be measured, for example, can be IMS (IP Multimedia Subsystem) air interface signaling such as "Invite, update (signaling for updating session parameters or status), 183, 200, ack, bye, etc." in a volte (Voice over Long-Term Evolution) call, but is not limited thereto.
[0103] Before step 901, the following steps are further included: Obtain the signaling process to be measured, and the method is: decompress the log file to be measured, extract the service process data, and obtain the signaling process to be measured.
[0104] After step 901 and before step 902, the signaling process to be measured can be normalized.
[0105] In this embodiment, in step 902, corresponding weights can be assigned to the signaling process to be measured and each signaling in the signaling process to be measured. Among them, the weight of the signaling process to be measured indicates the importance of the signaling process to be measured, and the weight of the signaling in the signaling process to be measured indicates the proportion of the signaling in the signaling process to be measured.
[0106] Step 602, perform similarity calculation on the hash table to be measured and each reference hash table in the reference hash table library to obtain the corresponding target similarity value.
[0107] In this embodiment, step 602 is similar to the above step 102 and will not be elaborated here.
[0108] In this embodiment, as Figure 10 shown, before step 602, the following steps 1001 to 1003 can further be included: Step 1001, input the training data into the trained hash model so that the hash model outputs the normal signaling process hash table.
[0109] Step 1002, input the abnormal signaling processes of different services and different abnormal signaling processes of the same service into the trained hash model so that the hash model outputs the abnormal signaling process hash table.
[0110] Step 1003, construct a reference hash table library according to the normal signaling process hash table and the abnormal signaling process hash table.
[0111] In this embodiment, the training data is input into the trained hash model, and the trained hash model outputs a hash table of the normal signaling process. The abnormal signaling processes of different services and different abnormal signaling processes of the same service are input into the trained hash model, and the trained hash model outputs a hash table of the abnormal signaling process. Then, the obtained hash table of the normal signaling process and the hash table of the abnormal signaling process are incorporated into the reference hash table library.
[0112] It should be noted that the execution order of step 1001 and step 1002 can be interchanged.
[0113] In this embodiment, as Figure 11 shown, before step 1002, the following steps 1101 to 1103 may be included: Step 1101, obtain a plurality of abnormal signaling processes.
[0114] Step 1102, add service category labels to each abnormal signaling process to divide the plurality of abnormal signaling processes into abnormal signaling processes of different services.
[0115] Step 1103, assign corresponding weights to each abnormal signaling process and each signaling in the abnormal signaling process; wherein, the weight of the abnormal signaling process indicates the importance degree of the abnormal signaling process, and the weight of the signaling indicates the proportion of the signaling in the abnormal signaling process; when the reference hash table is the hash table of the abnormal signaling process, the weight of the reference hash table is the weight of the abnormal signaling process.
[0116] In this embodiment, in step 1101, a plurality of abnormal signaling processes can be obtained by the following method: decompress a large number of log files with abnormal processes of different services and different signaling processes of the same service. This step is similar to step 801 above and will not be elaborated here.
[0117] After step 1101 and before step 1102, the plurality of obtained abnormal signaling processes can be normalized.
[0118] In this embodiment, in step 1102, service category labels can be added to each abnormal signaling process to divide the plurality of abnormal signaling processes into abnormal signaling processes of different services. The service category labels can be, for example, category labels of services such as voice calls, text messages, and network residence.
[0119] In this embodiment, in step 1103, corresponding weights can be assigned to each abnormal signaling process and each signaling in the abnormal signaling process. Among them, the weight of the abnormal signaling process indicates the importance degree of the abnormal signaling process, and the weight of the signaling in the abnormal signaling process indicates the proportion of the signaling in the abnormal signaling process. When the reference hash table is the hash table of the abnormal signaling process, the weight of the reference hash table is the weight of the abnormal signaling process.
[0120] It should be noted that the execution order of step 1101 and step 1102 can be swapped.
[0121] Step 603: Weighted sum the target similarity values according to the weights of the reference hash table to obtain a sum value.
[0122] In this embodiment, step 603 is similar to the above-mentioned step 103, and will not be elaborated here.
[0123] Step 604: Perform anomaly detection processing based on the sum value and the first threshold value to obtain a first anomaly detection result, and the first anomaly detection result indicates whether the signaling process to be measured is normal or abnormal.
[0124] In this embodiment, step 604 is similar to the above-mentioned step 104, and will not be elaborated here.
[0125] Step 605: When the first anomaly detection result indicates that the signaling process to be measured is normal, compare the target similarity value between the hash table to be measured and each normal signaling process hash table in the reference hash table library with a third threshold value to obtain a comparison result, and the comparison result indicates that the hash table to be measured is the same as one of the N normal signaling process hash tables or the hash table to be measured is different from any one of the N normal signaling process hash tables.
[0126] Step 606: When the comparison result indicates that the hash table to be measured is the same as one of the N normal signaling process hash tables, keep the hash model unchanged.
[0127] Step 607: When the comparison result indicates that the hash table to be measured is different from any one of the N normal signaling process hash tables, add the signaling process to be measured to the training data to obtain updated training data.
[0128] Step 608: Train the hash model with the updated training data to obtain an updated hash model.
[0129] In this embodiment, when the first anomaly detection result indicates that the signaling process to be measured is normal, for the target similarity value between the hash table to be measured and each normal signaling process hash table in the reference hash table library, compare the target similarity value with a third threshold value to obtain a comparison result, where the comparison result indicates that the hash table to be measured is the same as one of the N normal signaling process hash tables or the hash table to be measured is different from any one of the N normal signaling process hash tables. Among them, the third threshold value can be 0.9 or 0.99, but is not limited thereto.
[0130] For example, when the target similarity value between the hash table to be tested and one of the N normal signaling process hash tables is greater than 0.9, the comparison result indicates that the hash table to be tested is the same as one of the N normal signaling process hash tables. When the target similarity values between the hash table to be tested and all of the N normal signaling process hash tables are less than 0.9, the comparison result indicates that the hash table to be tested is different from any one of the N normal signaling process hash tables.
[0131] In this embodiment, when the comparison result indicates that the hash table to be tested is the same as one of the N normal signaling process hash tables, the hash model is kept unchanged, that is, the hash mapping function is not updated.
[0132] In this embodiment, when the comparison result indicates that the hash table to be tested is different from any one of the N normal signaling process hash tables, the signaling process to be tested is added to the training data to obtain updated training data. Then, the updated training data is used to train the hash model to obtain an updated hash model, that is, an updated hash mapping function. In this way, the accuracy of the hash model can be improved.
[0133] The technical solution provided by this application converts the text-based signaling process into a binary code that is easy for a computer to understand and calculate through hash encoding before detecting signaling process anomalies, thereby further simplifying the calculation parameters for anomaly detection and improving the calculation efficiency. Moreover, by using a non-fixed template comparison to detect anomalies, it can effectively solve the problem of normal but judgment-affecting process drift caused by changes in the network environment and updates in the service state. In summary, the technical solution provided by this application can effectively ensure the accuracy of testers' analysis of signaling processes and greatly improve the timeliness of testers' analysis of whether anomalies occur in different service signaling processes.
[0134] Figure 12 is a block diagram of an analysis device for a signaling process shown according to an exemplary embodiment. As Figure 12 shown, in this embodiment, the analysis device for the signaling process includes: A first acquisition module 121 configured to input the signaling process to be tested into a trained hash model to obtain a hash table to be tested for the signaling process to be tested; A second acquisition module 122 configured to calculate the similarity between the hash table to be tested and each reference hash table in a reference hash table library to obtain a corresponding target similarity value; wherein, the reference hash table library includes N normal signaling process hash tables and M abnormal signaling process hash tables, the reference hash table is the normal signaling process hash table or the abnormal signaling process hash table, N is a positive integer, and M is a positive integer; A third acquisition module 123, configured to perform weighted summation on the target similarity value according to the weights of the reference hash table to obtain a sum value; A detection module 124, configured to perform anomaly detection processing on the basis of the sum value and a first threshold value to obtain a first anomaly detection result, where the first anomaly detection result indicates whether the signaling process to be measured is normal or abnormal.
[0135] In this embodiment, the analysis device for the signaling process may be a chip, a chip module, or a terminal.
[0136] Regarding the various modules included in the various devices and products described in the above embodiments, they may be software modules, hardware modules, or may be partially software modules and partially hardware modules. For example, for the various devices and products applied to or integrated into a chip, the various modules included therein may all be implemented in a hardware manner such as circuits, or at least some of the modules may be implemented in the form of software programs that run on a processor integrated inside the chip, and the remaining (if any) part of the modules may be implemented in a hardware manner such as circuits; for the various devices and products applied to or integrated into a chip module, the various modules included therein may all be implemented in a hardware manner such as circuits, and different modules may be located in the same component (such as a chip, a circuit module, etc.) or different components of the chip module, or at least some of the modules may be implemented in the form of software programs that run on a processor integrated inside the chip module, and the remaining (if any) part of the modules may be implemented in a hardware manner such as circuits; for the various devices and products applied to or integrated into a terminal, the various modules included therein may all be implemented in a hardware manner such as circuits, and different modules may be located in the same component (such as a chip, a circuit module, etc.) or different components inside the terminal, or at least some of the modules may be implemented in the form of software programs that run on a processor integrated inside the terminal, and the remaining (if any) part of the modules may be implemented in a hardware manner such as circuits.
[0137] An embodiment of the present application further provides an electronic device, including a processor and a memory; the memory is used to store a computer program executable by the processor; the processor is used to execute the computer program in the memory to implement the analysis method for the signaling process in any of the above embodiments.
[0138] An embodiment of the present application further provides a computer-readable storage medium, which, when the executable computer program stored therein is executed by a processor, can implement the analysis method for the signaling process in any of the above embodiments.
[0139] An embodiment of the present application further provides a computer program product, including a computer program, where the computer program, when executed by a processor, implements the analysis method for the signaling process in any of the above embodiments.
[0140] Regarding the device in the above embodiments, the specific manner in which the processor performs operations has been described in detail in the embodiments related to the method, and will not be elaborated herein.
[0141] Figure 13 is a block diagram of an electronic device shown in accordance with an exemplary embodiment. For example, the electronic device 1300 may be provided as a server. Referring to Figure 13 , the device 1300 includes a processing component 1322, which further includes one or more processors, and memory resources represented by a memory 1332 for storing instructions executable by the processing component 1322, such as application programs. The application programs stored in the memory 1332 may include one or more modules each corresponding to a set of instructions. In addition, the processing component 1322 is configured to execute instructions to perform the above-described analysis method for signaling processes.
[0142] The device 1300 may also include a power component 1326 configured to perform power management of the device 1300, a wired or wireless network interface 1350 configured to connect the device 1300 to a network, and an input / output (I / O) interface 1358. The device 1300 may operate based on an operating system stored in the memory 1332, such as Windows ServerTM, MacOS XTM, UnixTM, LinuxTM, FreeBSDTM, or the like.
[0143] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as the memory 1332 including instructions, and the above instructions may be executed by the processing component 1322 of the device 1300 to complete the above method. For example, the non-transitory computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.
[0144] In the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The term "plurality" refers to two or more, unless otherwise clearly defined.
[0145] The above description of the embodiments is intended to enable those of ordinary skill in the art to understand and apply the present application. Those skilled in the art can obviously make various modifications to these embodiments easily and apply the general principles described herein to other embodiments without creative efforts. Therefore, the present application is not limited to the embodiments herein, and the improvements and modifications made by those skilled in the art based on the content disclosed in the present application without departing from the scope and spirit of the present application fall within the scope of the present application.
Claims
1. A method for analyzing a signaling process, characterized in that, Including: Inputting the signaling process to be measured into a trained hash model to obtain the hash table to be measured of the signaling process to be measured; Calculating the similarity between the hash table to be measured and each reference hash table in the reference hash table library to obtain the corresponding target similarity value; wherein, the reference hash table library includes N normal signaling process hash tables and M abnormal signaling process hash tables, the reference hash table is the normal signaling process hash table or the abnormal signaling process hash table, N is a positive integer, and M is a positive integer; Performing weighted summation on the target similarity values according to the weights of the reference hash tables to obtain a sum value; Performing abnormal detection processing on the sum value and a first threshold value to obtain a first abnormal detection result, where the first abnormal detection result indicates whether the signaling process to be measured is normal or abnormal.
2. The analysis method of the signaling process according to claim 1, wherein The calculating the similarity between the hash table to be measured and each reference hash table in the reference hash table library to obtain the corresponding target similarity value includes: Performing locality-sensitive hashing calculation on the hash table to be measured and each reference hash table in the reference hash table library to obtain the corresponding target similarity value.
3. The analysis method of the signaling process according to claim 2, wherein The performing locality-sensitive hashing calculation on the hash table to be measured and each reference hash table in the reference hash table library to obtain the corresponding target similarity value includes: Dividing the hash table to be measured into L segments according to the signaling process to be measured to obtain L hash sub-tables to be measured; wherein, the signaling process to be measured includes L stages, and L is an integer greater than 1; Dividing the reference hash table into L segments according to the signaling process to be measured to obtain L reference hash sub-tables; For each hash sub-table to be measured, performing locality-sensitive hashing calculation on the hash sub-table to be measured and the corresponding reference hash sub-table to obtain the corresponding intermediate similarity value; Calculating the target similarity value according to the L intermediate similarity values.
4. The analysis method of the signaling process according to claim 3, characterized in that, After the performing abnormal detection processing on the sum value and a first threshold value to obtain a first abnormal detection result, it further includes: When the first abnormal detection result indicates that the signaling process to be measured is abnormal, determining the position of the abnormal signaling in the signaling process to be measured.
5. The analysis method of the signaling process according to claim 4, characterized in that, The performing locality-sensitive hashing calculation on the hash table to be measured and each reference hash table in the reference hash table library to obtain the corresponding target similarity value further includes: Performing abnormal detection processing on the intermediate similarity value and a second threshold value to obtain a second abnormal detection result; wherein, the second abnormal detection result indicates whether the hash sub-table to be measured corresponding to the intermediate similarity value is normal or abnormal; When the second abnormal detection result indicates that the hash sub-table to be measured is abnormal, adding an abnormal mark to the hash sub-table to be measured; The determining the position of the abnormal signaling in the signaling process to be measured includes: Determining the abnormal hash sub-table to be measured according to the abnormal mark; Determining the position of the abnormal signaling in the signaling process to be measured according to the position of the abnormal hash sub-table to be measured in the hash table to be measured.
6. The analysis method of the signaling process according to claim 1, wherein Before the inputting the signaling process to be measured into a trained hash model to obtain the hash table to be measured of the signaling process to be measured, it further includes: Train the untrained hash model using training data to generate a hash mapping function and obtain the trained hash model; wherein, the training data includes normal signaling processes of different services and different normal signaling processes of the same service.
7. The analysis method of the signaling process according to claim 6, wherein The step of training the untrained hash model using training data to generate a hash mapping function and obtain the trained hash model includes: Based on the training data, perform hash learning on the untrained hash model using a linear hash function to generate the hash mapping function and obtain the trained hash model.
8. The analysis method of the signaling process according to claim 6, characterized in that Before training the untrained hash model using training data to generate a hash mapping function and obtain the trained hash model, it further includes: Construct the training data.
9. The analysis method of the signaling process according to claim 8, characterized in that, The step of constructing the training data includes: Obtain multiple normal signaling processes; Add service category labels to each of the normal signaling processes to divide the multiple normal signaling processes into normal signaling processes of different services; Assign corresponding weights to each of the normal signaling processes and each signaling in the normal signaling process to form the training data; wherein, the weight of the normal signaling process indicates the importance degree of the normal signaling process, and the weight of the signaling indicates the proportion of the signaling in the normal signaling process; when the reference hash table is the normal signaling process hash table, the weight of the reference hash table is the weight of the normal signaling process, and the normal signaling process hash table is the hash table of the normal signaling process.
10. The analysis method of the signaling process according to claim 6, wherein Before calculating the similarity between the to-be-tested hash table and each reference hash table in the reference hash table library to obtain the corresponding target similarity value, it further includes: Input the training data into the trained hash model to enable the hash model to output the normal signaling process hash table; Input abnormal signaling processes of different services and different abnormal signaling processes of the same service into the trained hash model to enable the hash model to output the abnormal signaling process hash table; Construct the reference hash table library according to the normal signaling process hash table and the abnormal signaling process hash table.
11. The analysis method of the signaling process according to claim 10, characterized in that, Before inputting abnormal signaling processes of different services and different abnormal signaling processes of the same service into the trained hash model to enable the hash model to output the abnormal signaling process hash table, it further includes: Obtain multiple abnormal signaling processes; Add service category labels to each of the abnormal signaling processes to divide the multiple abnormal signaling processes into abnormal signaling processes of different services; Assign corresponding weights to each of the abnormal signaling processes and each signaling in the abnormal signaling process; wherein, the weight of the abnormal signaling process indicates the importance degree of the abnormal signaling process, and the weight of the signaling indicates the proportion of the signaling in the abnormal signaling process; when the reference hash table is the abnormal signaling process hash table, the weight of the reference hash table is the weight of the abnormal signaling process.
12. The analysis method of the signaling process according to claim 1, wherein After performing abnormal detection processing based on the sum value and the first threshold value to obtain the first abnormal detection result, it further includes: When the first anomaly detection result indicates that the signaling process to be measured is normal, compare the target similarity value between the hash table to be measured and each normal signaling process hash table in the reference hash table library with a third threshold value to obtain a comparison result, where the comparison result indicates that the hash table to be measured is the same as one of the N normal signaling process hash tables or the hash table to be measured is different from any one of the N normal signaling process hash tables; When the comparison result indicates that the hash table to be measured is the same as one of the N normal signaling process hash tables, keep the hash model unchanged; When the comparison result indicates that the hash table to be measured is different from any one of the N normal signaling process hash tables, add the signaling process to be measured to the training data to obtain the updated training data; Train the hash model with the updated training data to obtain the updated hash model.
13. The analysis method of the signaling process according to claim 1, characterized in that, Before inputting the signaling process to be measured into the trained hash model to obtain the hash table to be measured of the signaling process to be measured, it further includes: Add a service category label to the signaling process to be measured to mark the service category of the signaling process to be measured; Assign corresponding weights to the signaling process to be measured and each signaling in the signaling process to be measured; where the weight of the signaling process to be measured indicates the importance of the signaling process to be measured, and the weight of the signaling indicates the proportion of the signaling in the signaling process to be measured.
14. An analysis device for a signaling process, characterized in that, It includes: A first acquisition module configured to input a signaling process to be measured into a trained hash model to obtain the hash table to be measured of the signaling process to be measured; A second acquisition module configured to perform a similarity calculation on the hash table to be measured and each reference hash table in the reference hash table library to obtain a corresponding target similarity value; where the reference hash table library includes N normal signaling process hash tables and M abnormal signaling process hash tables, the reference hash table is the normal signaling process hash table or the abnormal signaling process hash table, N is a positive integer, and M is a positive integer; A third acquisition module configured to perform a weighted sum of the target similarity values according to the weights of the reference hash tables to obtain a sum value; A detection module configured to perform an anomaly detection process based on the sum value and a first threshold value to obtain a first anomaly detection result, where the first anomaly detection result indicates that the signaling process to be measured is normal or abnormal.
15. An electronic device, characterized in that, It includes a memory and a processor, the memory is used to store a computer program executable by the processor; the processor is used to execute the computer program in the memory to implement the method according to any one of claims 1 to 13.
16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the executable computer program in the storage medium is executed by the processor, it can implement the method according to any one of claims 1 to 13.
17. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method according to any one of claims 1 to 13.