Abnormal signaling detection method, device and equipment and readable storage medium

Abstract

Provided are an abnormal signaling detection method, apparatus and device, and a readable storage medium, the method comprising: acquiring a signaling data set of at least one terminal, the signaling data set comprising a plurality of signaling records, the signaling records being used for recording connection interaction information between the terminal and a connected base station; according to at least two adjacent signaling records in the plurality of signaling records, calculating a switching distance of switching between the base stations connected with the terminal, and calculating a switching angle of switching between the base stations connected with the terminal; wherein the plurality of signaling records are arranged in sequence according to a time sequence; and performing anomaly detection on the at least two adjacent signaling records according to the switching distance and the switching angle. According to the embodiment of the invention, the abnormal signaling is detected through the switching distance and the switching angle of the signaling, so that misjudgment is effectively avoided, and the accuracy of abnormal signaling detection is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an abnormal signaling detection method, apparatus, device and readable storage medium. Background Art

[0002] Mobile phone signaling data records the connection interactions and timestamps between a user's mobile terminal and a communication base station. Since each base station covers a specific spatial service area, and mobile terminals typically interact with their nearest base station, the location of the base station to which the terminal is connected reflects the user's current location. Continuous signaling data, in turn, reflects the user's spatiotemporal activity trajectory. This type of signaling data, characterized by its large user base and strong spatiotemporal continuity, can be used in areas such as network quality optimization, crowd activity analysis, national spatial planning, and smart city development. However, this type of signaling data is also characterized by high data volume and high noise. The raw signaling data often contains a large number of anomalies, meaning that the location of the base station to which the user terminal is connected deviates significantly from the user's actual location. This can be caused by errors in the latitude and longitude fields in the base station's engineering parameter data, or by long-distance signal drift due to weather and environmental factors. These anomalies can severely impact data accuracy. Therefore, in practical applications, it is necessary to first detect these anomalies and then remove or repair them to reduce noise and improve signaling data quality.

[0003] Existing technical solutions mainly use the switching speed indicator to detect abnormal signaling. The signaling switching speed is obtained by calculating the switching time and base station distance between two adjacent signalings, and then the records with switching speed greater than the set threshold (such as the upper limit of travel speed in urban traffic) are marked as abnormal.

[0004] However, the existing technical solution regards the signaling switching speed as the terminal user's moving speed and then sets an upper threshold to detect abnormal signaling data, which is prone to misjudgment. In addition, the signaling switching speed upper threshold mainly relies on manual setting, which is highly subjective and lacks basis. Summary of the Invention

[0005] The purpose of the present invention is to provide a method, apparatus, device and readable storage medium for detecting abnormal signaling, so as to solve the problem of low detection accuracy of abnormal signaling in the prior art.

[0006] In order to solve the above technical problems, an embodiment of the present invention provides a method for detecting abnormal signaling, including:

[0007] Acquire a signaling data set of at least one terminal, the signaling data set including a plurality of signaling records, the signaling records being used to record connection interaction information between the terminal and a connected base station;

[0008] Calculating a handover distance between base stations to which the terminal is connected, and calculating a handover angle between base stations to which the terminal is connected, based on at least two adjacent signaling records among the plurality of signaling records; wherein the plurality of signaling records are arranged in chronological order;

[0009] Anomaly detection is performed on the at least two adjacent signaling records according to the switching distance and the switching angle.

[0010] Optionally, calculating a handover distance for handover between base stations to which the terminal is connected, and calculating a handover angle for handover between base stations to which the terminal is connected, includes:

[0011] Calculating a first handover distance for the terminal to be handed over from a first base station to which it is connected to to a second base station;

[0012] Calculating a second handover distance for the terminal to be handed over from the second base station to which it is connected to to a third base station;

[0013] A handover angle for the terminal to be handed over from the first base station to which it is connected, first to the second base station and then to the third base station is calculated.

[0014] Optionally, performing abnormality detection on the at least two adjacent signaling records according to the switching distance and the switching angle includes:

[0015] When the following conditions are met, it is determined that the state of the signaling record recording the connection between the terminal and the second base station is abnormal:

[0016] The first switching distance is greater than a first threshold;

[0017] The second switching distance is greater than a second threshold;

[0018] The switching angle is smaller than a third threshold.

[0019] Optionally, the method further includes:

[0020] Calculating a set of handover distances corresponding to each of the base stations according to at least two adjacent signaling records among the plurality of signaling records;

[0021] Calculating the spatial service range of the corresponding base station based on the set of handover distances and the quartile method;

[0022] Determining the first threshold according to the spatial service range of the first base station and the spatial service range of the second base station;

[0023] The second threshold is determined according to the spatial service range of the second base station and the spatial service range of the third base station.

[0024] Optionally, the method further includes:

[0025] Calculating, based on at least two adjacent signaling records among the plurality of signaling records within a preset time, fourth handover distances respectively corresponding to each other between the target base station and a plurality of fourth base stations, wherein the fourth base stations are base stations with which the target base station has a handover relationship;

[0026] Determining a state of the target base station according to a distribution rule of the fourth handover distance corresponding to the target base station;

[0027] For the target base station in a normal state, constructing the signaling data set according to the signaling record corresponding to the target base station;

[0028] For the target base station in an abnormal state, it is determined that the state of the signaling record corresponding to the target base station is abnormal.

[0029] Optionally, the calculating, according to at least two adjacent signaling records among the multiple signaling records, fourth handover distances respectively corresponding to the target base station and multiple fourth base stations includes:

[0030] Determining, according to at least two adjacent signaling records among the plurality of signaling records within a preset time, a plurality of fourth base stations that have a handover relationship with the target base station;

[0031] Acquire spatial location information of the target base station and spatial location information of the fourth base station;

[0032] Fourth handover distances respectively corresponding to each of the target base station and a plurality of the fourth base stations are calculated according to the spatial location information of the target base station and the spatial location information of the fourth base station.

[0033] Optionally, determining the state of the corresponding target base station according to a distribution rule of the fourth handover distance corresponding to the target base station includes:

[0034] In order of the plurality of fourth handover distances corresponding to the target base station from near to far, selecting the kth fourth handover distance as the distance threshold of the corresponding target base station, where k is an integer greater than 0;

[0035] When an average of the plurality of fourth handover distances corresponding to the target base station is greater than the distance threshold, and a median of the plurality of fourth handover distances is greater than the distance threshold, determining that the state of the corresponding target base station is abnormal;

[0036] When the average of the multiple fourth switching distances corresponding to the target base station is less than or equal to the distance threshold, or the median of the multiple fourth switching distances is less than or equal to the distance threshold, it is determined that the status of the corresponding target base station is normal.

[0037] An embodiment of the present invention further provides an abnormal signaling detection device, comprising:

[0038] A first acquisition module is configured to acquire a signaling data set of at least one terminal, where the signaling data set includes a plurality of signaling records, where the signaling records are used to record connection interaction information between the terminal and a connected base station;

[0039] a first calculation module, configured to calculate, based on at least two adjacent signaling records among the plurality of signaling records, a handover distance for handover between base stations to which the terminal is connected, and a handover angle for handover between base stations to which the terminal is connected; wherein the plurality of signaling records are arranged in chronological order;

[0040] The first detection module is configured to perform anomaly detection on the at least two adjacent signaling records according to the switching distance and the switching angle.

[0041] An embodiment of the present invention further provides a network device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program implements the abnormal signaling detection method as described above when executed by the processor.

[0042] An embodiment of the present invention further provides a readable storage medium, comprising: a program stored on the readable storage medium, and when the program is executed by a processor, the steps of the abnormal signaling detection method as described in any one of the above items are implemented.

[0043] An embodiment of the present invention further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of any of the above methods for detecting abnormal signaling.

[0044] At least one of the above technical solutions of the present invention has the following beneficial effects:

[0045] In the above scheme, first, a signaling data set of at least one terminal is obtained, wherein the signaling data set includes multiple signaling records, and the signaling records are used to record the connection interaction information between the terminal and the connected base station; then, based on at least two adjacent signaling records in the signaling records, the switching distance between the base stations connected to the terminal and the switching angle between the base stations connected to the terminal are calculated; wherein the multiple signaling records are arranged in chronological order; finally, based on the switching distance and the switching angle, the signaling is detected for abnormalities. Specifically, when the switching distance and the switching angle both meet certain conditions, the corresponding signaling abnormality is determined. In the embodiment of the present invention, the detection of abnormal signaling is achieved through the objective switching characteristics (switching distance and switching angle) of the signaling itself, effectively avoiding misjudgment and improving the accuracy of abnormal signaling detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 Schematic diagram of a flow chart of an abnormal signaling detection method according to an embodiment of the present invention;

[0047] Figure 2 A schematic diagram of handover distances and handover angles for handovers between base stations corresponding to a plurality of adjacent signaling records according to an embodiment of the present invention;

[0048] Figure 3a A schematic diagram of a user in a resident state according to an embodiment of the present invention, in which a base station in a signaling record is suddenly switched to a distant base station and then switched back;

[0049] Figure 3b This is a schematic diagram of a user in a mobile state according to an embodiment of the present invention, in which a base station in a signaling record is suddenly switched to a distant base station and then switched back;

[0050] Figure 3c This is a schematic diagram of a case where a user in an embodiment of the present invention moves a long distance while the user's phone is turned off or no signal is received, causing the base station in the signaling record to be represented as a long-distance handover;

[0051] Figure 3d This is a schematic diagram of a user in an embodiment of the present invention moving quickly (such as taking a high-speed train) causing continuous long-distance handovers of base stations in signaling records;

[0052] Figure 4 This is a statistical diagram of the distribution of the fourth handover distance corresponding to a normal base station according to an embodiment of the present invention;

[0053] Figure 5 This is a statistical diagram of the distribution of the fourth handover distance corresponding to the abnormal base station according to an embodiment of the present invention;

[0054] Figure 6 A schematic diagram of base station distribution in an area with dense base station distribution according to an embodiment of the present invention;

[0055] Figure 7 A schematic diagram of base station distribution in an area where base stations are sparsely distributed according to an embodiment of the present invention;

[0056] Figure 8 A schematic diagram of an original signaling trace of a user terminal indicated by a signaling record within an area according to an embodiment of the present invention;

[0057] Figure 9 For Figure 8 Schematic diagram of the signaling trace after signaling record anomaly detection and processing of the original signaling trace of the user terminal in;

[0058] Figure 10 Schematic diagram of the structure of an abnormal signaling detection device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention and not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0060] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0061] like Figure 1 As shown, an embodiment of the present invention provides a method for detecting abnormal signaling, including:

[0062] Step S101: Acquire a signaling data set of at least one terminal, where the signaling data set includes a plurality of signaling records, where the signaling records are used to record connection interaction information between the terminal and a connected base station;

[0063] In step S101, one terminal corresponds to one signaling data set, and the signaling data set includes multiple signaling records. Each time the terminal switches the connection with the base station, a new signaling record is generated. Specifically, the signaling record is collected by the communication operator and records the connection interaction information between the terminal and the connected base station. The connection interaction information includes but is not limited to the identity identification number (Identity Document, ID) of the user terminal, the ID of the base station connected to the user terminal, a timestamp (time), and the spatial location information of the connected base station, wherein the spatial location information includes but is not limited to longitude and latitude. The multiple signaling records in the signaling data set are sorted according to the timestamp. Specifically, the data format of the signaling record is shown in Table 1:

[0064] Field Field Type Field Name Remark uid Int User ID Discretized user ID, starting from 1 cid Int Base station ID Discretized base station ID, starting from 1 lon Double longitude lat Double latitude time Long Timestamp Signaling record generation time

[0065] Table 1.

[0066] Step S102, calculating a handover distance for handover between base stations to which the terminal is connected, and calculating a handover angle for handover between base stations to which the terminal is connected, based on at least two adjacent signaling records among the plurality of signaling records; wherein the plurality of signaling records are arranged in chronological order;

[0067] In step S102, for a terminal, different signaling records correspond to different base stations. For two signaling records that are adjacent in time, the switching relationship of the base station connected to the terminal is: the base station corresponding to the previous signaling record is switched to the base station corresponding to the next signaling record. Therefore, according to the spatial position information of the connected base stations recorded respectively in the signaling at adjacent times, the switching distance between the base stations connected to the terminal can be obtained; an angle will be formed between the base stations recorded respectively in the three signaling records at adjacent times. Therefore, according to the spatial position information of the connected base stations recorded respectively in the three signaling records at adjacent times, the switching angle between the base stations corresponding to the three signalings can be obtained.

[0068] Step S103: performing anomaly detection on the at least two adjacent signaling records according to the switching distance and the switching angle.

[0069] In an embodiment of the present invention, first, a signaling data set of at least one terminal is obtained, wherein the signaling data set includes multiple signaling records, and the signaling records are used to record the connection interaction information between the terminal and the connected base station. Then, based on at least two adjacent signaling records in the signaling records, the switching distance for switching between the base stations to which the terminal is connected, and the switching angle for switching between the base stations to which the terminal is connected are calculated; wherein the multiple signaling records are arranged in chronological order; finally, based on the switching distance and the switching angle, the signaling is detected for abnormalities. Specifically, when the switching distance and the switching angle both meet certain conditions, the corresponding signaling abnormality is determined. In an embodiment of the present invention, the detection of abnormal signaling is achieved through the objective switching characteristics (switching distance and switching angle) of the signaling itself, which effectively avoids misjudgment and improves the accuracy of abnormal signaling detection.

[0070] Optionally, calculating a handover distance for handover between base stations to which the terminal is connected, and calculating a handover angle for handover between base stations to which the terminal is connected, includes:

[0071] Calculating a first handover distance for the terminal to be handed over from a first base station to which it is connected to to a second base station;

[0072] Calculating a second handover distance for the terminal to be handed over from the second base station to which it is connected to to a third base station;

[0073] A handover angle for the terminal to be handed over from the first base station to which it is connected, first to the second base station and then to the third base station is calculated.

[0074] In an embodiment of the present invention, a method for calculating a handover distance between base stations corresponding to two temporally adjacent signaling records is provided based on spatial location information of the base stations. The formula is as follows:

[0075] d j,j-1 =2sin -1 a j,j-1 ×6378173;

[0076]

[0077] Among them, d j,j-1 is the handover distance between the base stations corresponding to the j-1th signaling record and the jth signaling record in the terminal's signaling data set, lat j is the latitude of the base station recorded in the jth signaling record in the terminal's signaling data set, lat j-1 is the latitude of the base station recorded in the j-1th signaling record in the terminal's signaling data set, lon j is the longitude of the base station recorded in the jth signaling record in the terminal's signaling data set, lon j-1is the longitude of the base station recorded in the j-1th signaling record in the signaling data set of the terminal.

[0078] A method is also provided for calculating the handover angle formed by the lines between the base stations corresponding to three temporally adjacent signaling records based on the handover distance between the base stations. The formula is as follows:

[0079]

[0080] Among them, θ j is the handover angle formed by the connection lines between the base stations corresponding to the j-1th signaling record, the jth signaling record, and the j+1th signaling record in the signaling data set of the terminal, d j,j-1 is the handover distance between the base stations corresponding to the j-1th signaling record and the jth signaling record in the terminal's signaling data set, d j,j+1 is the handover distance between the base stations corresponding to the j+1th signaling record and the jth signaling record in the terminal's signaling data set, d j-1,j+1 is the handover distance between the base stations corresponding to the j-1th signaling record and the j+1th signaling record in the signaling data set of the terminal.

[0081] Using the above formula for calculating the switching distance, for two signaling records at adjacent times, the first switching distance of the terminal switching from the first base station connected to the previous signaling record to the second base station connected to the next signaling record is calculated, and the second switching distance of the terminal switching from the second base station connected to the previous signaling record to the third base station connected to the next signaling record is calculated. Using the above formula for calculating the switching angle, for three signaling records at adjacent times, the switching angle formed by the terminal switching from the first base station connected to the adjacent first signaling record to the second base station connected to the second signaling record and then to the third base station connected to the third signaling record is calculated.

[0082] Specifically, if Figure 2 As shown, the base stations corresponding to the three signaling records at adjacent times are the first base station a, the second base station b, and the third base station c, respectively. The first switching distance D1 of the terminal switching from the connected first base station a to the second base station b, the second switching distance D2 of the terminal switching from the connected second base station b to the third base station c, and the switching angle θ of the terminal switching from the connected first base station a to the second base station b and then to the third base station c are calculated.

[0083] Optionally, performing abnormality detection on the at least two adjacent signaling records according to the switching distance and the switching angle includes:

[0084] When the following conditions are met, it is determined that the state of the signaling record recording the connection between the terminal and the second base station is abnormal:

[0085] The first switching distance is greater than a first threshold;

[0086] The second switching distance is greater than a second threshold;

[0087] The switching angle is smaller than a third threshold.

[0088] In the embodiment of the present invention, in the abnormal signaling record, the base station to which the user terminal is connected deviates greatly from the actual location of the user, which is manifested in the data as a sudden long-distance handover of the signaling. Figures 3a to 3d Several signaling records show long-distance handovers of base stations. Figure 3a When a user is in the resident state, the base station in the signaling record suddenly switches to a distant base station and then switches back. In this case, the status of the signaling record corresponding to the distant base station is determined to be abnormal; Figure 3b This is the phenomenon that when a user is on the move, the base station in the signaling record suddenly switches to a distant base station and then switches back. In this case, the status of the signaling record corresponding to the distant base station is also determined to be abnormal; Figure 3c When a user moves a long distance while the phone is turned off or no signal is received, the base station in the signaling record shows a long-distance handover. The status of this type of signaling record is determined to be normal. Figure 3d In the case where the user moves quickly (such as taking a high-speed train) and causes continuous long-distance signaling switching, the status of such signaling records is also determined to be non-abnormal.

[0089] Based on the analysis of the above situations, the abnormal signaling detection rule based on switching distance and angle can be constructed as follows: for a certain signaling record (P j ), if the previous signaling (P j-1 ) to the current signaling (P j ) between base stations (d j-1,j ) is greater than the first threshold, the current signaling (P j ) to the next signaling (P j+1 ) between base stations (d j,j+1 ) is greater than the second threshold, and the switching angle (θ j ) is less than the third threshold, the signaling record is determined to be abnormal. This ensures the detection of abnormally far-flung signaling while avoiding misjudgment of non-abnormally far-flung signaling. It should be noted that the third threshold is generally set to 60 degrees, but this is not limited to this in the present invention and can be set according to actual circumstances.

[0090] Optionally, the method further includes:

[0091] Calculating a set of handover distances corresponding to each of the base stations according to at least two adjacent signaling records among the plurality of signaling records;

[0092] Calculating the spatial service range of the corresponding base station based on the set of handover distances and the quartile method;

[0093] Determining the first threshold according to the spatial service range of the first base station and the spatial service range of the second base station;

[0094] The second threshold is determined according to the spatial service range of the second base station and the spatial service range of the third base station.

[0095] In the embodiment of the present invention, since the distance of the switching distance corresponding to the signaling records adjacent in time depends on the spatial service range of the base station, and the spatial service ranges of different base stations are different, the spatial service ranges of some base stations are 200-500 meters, and the spatial service ranges of some base stations can reach more than 1 kilometer, the spatial service range of the base station determines the farthest switching distance of all signaling linked to the base station, but due to the influence of signal drift, the switching distance of a small number of signaling may exceed the service range. Therefore, the embodiment of the present invention is based on the statistical distribution of the signaling switching distance of a single base station, uses the idea of outlier detection, and uses quartiles to determine the abnormal switching distance, thereby determining the spatial service radius of the base station, and then dynamically setting the switching distance threshold. Specifically:

[0096] The first step is to extract, for each base station, all signaling records that have a switching relationship with the currently processed base station within a preset time range based on at least two adjacent signaling records in multiple signaling records, specifically including signaling records of switching from other base stations to the currently processed base station and signaling records of switching from the currently processed base station to other base stations.

[0097] The second step is to calculate the distribution of multiple other base stations that have a handover relationship with the currently processed base station based on the spatial location information of other base stations recorded in the extracted signaling records that have a handover relationship with the currently processed base station, and generate a set of handover distances corresponding to the currently processed base station, for example Figure 4 As shown;

[0098] The third step is to determine the spatial service range of each base station using the quartile method based on the set of handover distances corresponding to each base station. For a single base station, the quartile method is used to calculate the first quartile (Q1) and third quartile (Q3) of the handover distances based on the set of handover distances corresponding to that base station. The interquartile range (IQR) of the handover distance for that base station is then calculated by calculating the difference between Q1 and Q3. Finally, based on the IQR, the spatial service radius of that base station is determined as Q3 + 1.5 × IQR.

[0099] The fourth step is to determine the handover distance threshold based on the spatial service radius of the base station. Assume that the spatial service radius of base station A corresponding to the previous signaling record is d A , the spatial service radius of base station B corresponding to the previous signaling record is d B , then the handover distance threshold between base stations A and B is d A +d B .

[0100] Therefore, in an embodiment of the present invention, the switching distance threshold corresponding to the first base station and the second base station, that is, the first threshold, is: the sum of the spatial service radius of the first base station and the spatial service radius of the second base station; the switching distance threshold corresponding to the second base station and the third base station, that is, the second threshold, is: the sum of the spatial service radius of the second base station and the spatial service radius of the third base station.

[0101] In addition, since the calculation of quartiles is highly robust, it can accurately reflect the data distribution characteristics even when there is a certain degree of deviation in the data distribution, obtain the base station spatial service radius, and improve accuracy. Compared with the prior art method of determining the switching distance threshold as a fixed value, the method provided by this application can effectively avoid misjudgment and make signaling anomaly detection more accurate.

[0102] Optionally, the method further includes:

[0103] Calculating, based on at least two adjacent signaling records among the plurality of signaling records within a preset time, fourth handover distances respectively corresponding to each other between the target base station and a plurality of fourth base stations, wherein the fourth base stations are base stations with which the target base station has a handover relationship;

[0104] Determining a state of the target base station according to a distribution rule of the fourth handover distance corresponding to the target base station;

[0105] For the target base station in a normal state, constructing the signaling data set according to the signaling record corresponding to the target base station;

[0106] For the target base station in an abnormal state, it is determined that the state of the signaling record corresponding to the target base station is abnormal.

[0107] In the embodiment of the present invention, before step S101, it is necessary to first determine the abnormality of each base station. For abnormal base stations, all signaling records corresponding to the abnormal base stations are determined to be abnormal. For normal (non-abnormal) base stations, their corresponding signaling records are added to the signaling data set of the corresponding terminal, and the method of steps S101-S103 is executed to perform signaling anomaly detection. Therefore, an embodiment of the present invention provides a base station anomaly detection method, which is specifically as follows:

[0108] First, for each target base station that needs to be detected, all signaling records that have a switching relationship with the target base station within a preset time range are extracted based on at least two adjacent signaling records among multiple signaling records, and the base station that has a switching relationship with the target base station is recorded as the fourth base station, specifically including signaling records of switching from the fourth base station to the target base station and signaling records of switching from the target base station to the fourth base station.

[0109] Then, according to the extracted spatial position information of the fourth base station, the fourth handover distances between the target base station and the corresponding fourth base station are calculated, and the distribution pattern of the fourth handover distances is counted.

[0110] Finally, according to the distribution law of the fourth handover distance, the state of the corresponding target base station is determined. Specifically, for a normal base station, the distribution of the fourth handover distance is as follows: Figure 4 As shown in Figure 2, the signaling ratio decreases as the distance increases; for base stations with abnormal locations due to errors in longitude and latitude entry, the fourth handover distance corresponding to most of their signaling is very far, which is consistent with the Figure 5 Therefore, abnormal base stations can be identified by comparing and analyzing the distribution statistics of the fourth handover distance corresponding to the target base station in the target area with the distribution statistics of base stations around the target base station.

[0111] Optionally, the calculating, according to at least two adjacent signaling records among the multiple signaling records, fourth handover distances respectively corresponding to the target base station and multiple fourth base stations includes:

[0112] Determining, according to at least two adjacent signaling records among the plurality of signaling records within a preset time, a plurality of fourth base stations that have a handover relationship with the target base station;

[0113] Acquire spatial location information of the target base station and spatial location information of the fourth base station;

[0114] Fourth handover distances respectively corresponding to each of the target base station and a plurality of the fourth base stations are calculated according to the spatial location information of the target base station and the spatial location information of the fourth base station.

[0115] In an embodiment of the present invention, first, for each target base station that needs to be detected, based on at least two adjacent signaling records among multiple signaling records, all signaling records that have a switching relationship with the target base station within a preset time range are extracted, and the base station that has a switching relationship with the target base station is recorded as the fourth base station, specifically including the signaling record of switching from the fourth base station to the target base station and the signaling record of switching from the target base station to the fourth base station. Then, the spatial location information of the target base station and the spatial location information of multiple fourth base stations are obtained respectively. Finally, according to the calculation formula of the switching distance, the fourth switching distances corresponding to each of the target base station and the multiple fourth base stations are calculated. The formula is as follows:

[0116] d M,N =2sin -1 a M,N ×6378173;

[0117]

[0118] Among them, d M,N is the fourth handover distance between the target base station and the fourth base station, lat M is the latitude of the target base station, lat N is the latitude of the fourth base station, lon M is the longitude of the target base station, lon N is the longitude of the fourth base station.

[0119] Optionally, determining the state of the corresponding target base station according to a distribution rule of the fourth handover distance corresponding to the target base station includes:

[0120] In order of the plurality of fourth handover distances corresponding to the target base station from near to far, selecting the kth fourth handover distance as the distance threshold of the corresponding target base station, where k is an integer greater than 0;

[0121] When an average of the plurality of fourth handover distances corresponding to the target base station is greater than the distance threshold, and a median of the plurality of fourth handover distances is greater than the distance threshold, determining that the state of the corresponding target base station is abnormal;

[0122] When the average of the plurality of fourth switching distances corresponding to the target base station is less than or equal to the distance threshold, or the median of the plurality of fourth switching distances is less than or equal to the distance threshold, it is determined that the status of the corresponding target base station is normal.

[0123] In the embodiment of the present invention, for each target base station in the target area, the fourth switching distance is sorted from near to far, and the fourth switching distance corresponding to the k-th adjacent base station is selected to reflect the base station distribution around the single base station, and the fourth switching distance corresponding to the k-th adjacent base station is determined as the distance threshold. The smaller the distance threshold, the denser the distribution of base stations in the area, and the larger the distance threshold, the sparser the distribution of base stations in the area. Figure 6 As shown in FIG, a base station distribution diagram is shown in FIG. Figure 7 FIG. 1 shows a schematic diagram of base station distribution in an area where base stations are sparsely distributed.

[0124] Based on this, an embodiment of the present invention proposes a specific method for detecting base station abnormalities as follows:

[0125] The first step is to calculate the mean and median of multiple fourth handover distances corresponding to the currently processed target base station;

[0126] The second step is to select the fourth handover distance, ie, the kth neighboring distance, of the kth neighboring base station (e.g., k=5) around the currently processed target base station, and determine it as the distance threshold;

[0127] In the third step, the distance threshold is compared with the mean and median of the fourth switching distance. If the mean and median of the fourth switching distance are both greater than or equal to the distance threshold, it is determined that the state of the corresponding target base station is abnormal; if the mean of the fourth switching distance is less than the distance threshold, or the median of the fourth switching distance is less than the distance threshold, it is determined that the state of the corresponding target base station is normal.

[0128] The following provides a specific embodiment to illustrate the abnormal signaling detection process:

[0129] Example 1:

[0130] The first step is to group the signaling records by corresponding user terminals. Each user terminal corresponds to one signaling data set, where the multiple signaling data in each signaling data set are sorted by timestamp.

[0131] In the second step, for each user terminal, starting from the second signaling record in the signaling data set, each signaling record is traversed to determine whether it meets the following conditions:

[0132] 1. The handover distance from the previous base station to the current base station is greater than the sum of the service radius of the previous base station and the current base station;

[0133] 2. The handover distance from the current base station to the next base station is greater than the sum of the service radius of the current base station and the next base station;

[0134] 3. A handover angle formed by the connection lines between the current base station, the previous base station, and the next base station is smaller than a third threshold.

[0135] In the third step, if all three conditions in the second step are met, the signaling record is determined to be abnormal; if at least one condition is not met, the signaling record is determined to be normal.

[0136] After traversing all signaling, the abnormal marking results are output for subsequent abnormal filtering or repair. Figure 8 and Figure 9 As shown, Figure 8 is the original signaling trace of the user terminal indicated by the signaling record in an area, Figure 9 In order to use the abnormal signaling detection method provided by this application Figure 8 The signaling records in the UE are detected for anomalies, and after filtering or repairing the detected abnormal signaling records, the signaling trace corresponding to the user terminal is generated. It can be seen that the abnormal signaling detection method provided by the present application has a high recognition accuracy and can effectively reduce the impact of abnormal signaling.

[0137] like Figure 10 As shown, an embodiment of the present invention further provides an abnormal signaling detection device, comprising:

[0138] A first acquisition module 1001 is configured to acquire a signaling data set of at least one terminal, where the signaling data set includes multiple signaling records, and the signaling records are used to record connection interaction information between the terminal and the connected base station;

[0139] A first calculation module 1002 is configured to calculate a handover distance for handover between base stations to which the terminal is connected, and a handover angle for handover between base stations to which the terminal is connected, based on at least two adjacent signaling records among the plurality of signaling records; wherein the plurality of signaling records are arranged in chronological order;

[0140] The first detection module 1003 is configured to perform anomaly detection on the at least two adjacent signaling records according to the switching distance and the switching angle.

[0141] Optionally, the first calculation module 1002 includes:

[0142] A first calculation unit is configured to calculate a first handover distance for the terminal to be handed over from the first base station to which it is connected to to the second base station;

[0143] a second calculating unit, configured to calculate a second handover distance for the terminal to be handed over from the second base station to which it is connected to to a third base station;

[0144] The third calculation unit is configured to calculate a switching angle for the terminal to switch from the first base station to which it is connected to first to the second base station and then to the third base station.

[0145] Optionally, the first detection module 1003 includes:

[0146] The first detection unit is configured to determine that the state of the signaling record recording the connection between the terminal and the second base station is abnormal when the following conditions are met:

[0147] The first switching distance is greater than a first threshold;

[0148] The second switching distance is greater than a second threshold;

[0149] The switching angle is smaller than a third threshold.

[0150] Optionally, the device further comprises:

[0151] A second calculation module is configured to calculate a set of handover distances corresponding to each of the base stations based on at least two adjacent signaling records in the plurality of signaling records;

[0152] A third calculation module is used to calculate the spatial service range of the corresponding base station based on the set of handover distances and the quartile method;

[0153] A first determining module, configured to determine the first threshold according to the spatial service range of the first base station and the spatial service range of the second base station;

[0154] The second determination module is configured to determine the second threshold according to the spatial service range of the second base station and the spatial service range of the third base station.

[0155] Optionally, the device further comprises:

[0156] a fourth calculation module, configured to calculate, based on at least two adjacent signaling records among the plurality of signaling records within a preset time, fourth handover distances respectively corresponding to the target base station and a plurality of fourth base stations, wherein the fourth base stations are base stations with which the target base station has a handover relationship;

[0157] A third determining module is configured to determine the state of the target base station according to a distribution rule of the fourth handover distance corresponding to the target base station;

[0158] A first constructing module is configured to construct the signaling data set according to the signaling record corresponding to the target base station in a normal state;

[0159] The fourth determining module is configured to determine, for the target base station in an abnormal state, that the state of the signaling record corresponding to the target base station is abnormal.

[0160] Optionally, the fourth calculation module includes:

[0161] A first determining unit is configured to determine, based on at least two adjacent signaling records among the plurality of signaling records within a preset time, a plurality of fourth base stations that have a handover relationship with the target base station;

[0162] A first acquiring unit, configured to acquire the spatial location information of the target base station and the spatial location information of the fourth base station;

[0163] The fourth calculation unit is configured to calculate fourth handover distances respectively corresponding to each of the target base station and the plurality of fourth base stations according to the spatial location information of the target base station and the spatial location information of the fourth base station.

[0164] Optionally, the third determining module includes:

[0165] A first selection unit is configured to select, in order from near to far of the plurality of fourth handover distances corresponding to the target base station, the kth fourth handover distance as the distance threshold of the corresponding target base station, where k is an integer greater than 0;

[0166] A second determining unit is configured to determine that the state of the corresponding target base station is abnormal when an average of the plurality of fourth handover distances corresponding to the target base station is greater than the distance threshold and a median of the plurality of fourth handover distances is greater than the distance threshold;

[0167] The third determination unit is used to determine that the status of the corresponding target base station is normal when the average of the multiple fourth switching distances corresponding to the target base station is less than or equal to the distance threshold, or the median of the multiple fourth switching distances is less than or equal to the distance threshold.

[0168] It should be noted that the embodiment of the device is a device corresponding to the embodiment of the above method, and all implementation methods in the embodiment of the above method are applicable to the embodiment of the device and can achieve the same technical effect.

[0169] An embodiment of the present invention also provides a network device, comprising: a processor, a memory, and a program stored in the memory and runnable on the processor. When the program is executed by the processor, it implements the abnormal signaling detection method as described in any one of the above items and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0170] An embodiment of the present invention further provides a readable storage medium, comprising: a program stored on the readable storage medium, wherein when the program is executed by a processor, the program implements the steps of the abnormal signaling detection method as described in any of the above items, and can achieve the same technical effect. To avoid repetition, the details are not described here. The readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0171] An embodiment of the present invention also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, the steps of the abnormal signaling detection method as described in any of the above items are implemented, and the same technical effects can be achieved. To avoid repetition, they will not be described here.

[0172] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0173] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A method for detecting abnormal signaling, characterized in that: include: Acquire a signaling data set of at least one terminal, the signaling data set including a plurality of signaling records, the signaling records being used to record connection interaction information between the terminal and a connected base station; Calculating a handover distance between base stations to which the terminal is connected, and calculating a handover angle between base stations to which the terminal is connected, based on at least two adjacent signaling records among the plurality of signaling records; wherein the plurality of signaling records are arranged in chronological order; Anomaly detection is performed on the at least two adjacent signaling records according to the switching distance and the switching angle.

2. The abnormal signaling detection method according to claim 1, characterized in that: Calculating a handover distance for handover between base stations to which the terminal is connected, and calculating a handover angle for handover between base stations to which the terminal is connected, comprising: Calculating a first handover distance for the terminal to be handed over from a first base station to which it is connected to to a second base station; Calculating a second handover distance for the terminal to be handed over from the second base station to which it is connected to to a third base station; A handover angle for the terminal to be handed over from the first base station to which it is connected to, first to the second base station and then to the third base station is calculated.

3. The abnormal signaling detection method according to claim 2, characterized in that: Performing anomaly detection on the at least two adjacent signaling records according to the switching distance and the switching angle includes: When the following conditions are met, it is determined that the state of the signaling record recording the connection between the terminal and the second base station is abnormal: The first switching distance is greater than a first threshold; The second switching distance is greater than a second threshold; The switching angle is smaller than a third threshold.

4. The abnormal signaling detection method according to claim 3, characterized in that: The method further comprises: Calculating a set of handover distances corresponding to each of the base stations according to at least two adjacent signaling records among the plurality of signaling records; Calculating the spatial service range of the corresponding base station based on the set of handover distances and the quartile method; Determining the first threshold according to the spatial service range of the first base station and the spatial service range of the second base station; The second threshold is determined according to the spatial service range of the second base station and the spatial service range of the third base station.

5. The abnormal signaling detection method according to claim 1, characterized in that: The method further comprises: Calculating, based on at least two adjacent signaling records among the plurality of signaling records within a preset time, fourth handover distances respectively corresponding to each other between the target base station and a plurality of fourth base stations, wherein the fourth base stations are base stations with which the target base station has a handover relationship; Determining a state of the target base station according to a distribution rule of the fourth handover distance corresponding to the target base station; For the target base station in a normal state, constructing the signaling data set according to the signaling record corresponding to the target base station; For the target base station in an abnormal state, it is determined that the state of the signaling record corresponding to the target base station is abnormal.

6. The abnormal signaling detection method according to claim 5, characterized in that: The calculating, according to at least two adjacent signaling records among the plurality of signaling records, fourth handover distances respectively corresponding to each other between the target base station and a plurality of fourth base stations, includes: Determining, according to at least two adjacent signaling records among the plurality of signaling records within a preset time, a plurality of fourth base stations that have a handover relationship with the target base station; Acquire spatial location information of the target base station and spatial location information of the fourth base station; Fourth handover distances respectively corresponding to each of the target base station and a plurality of the fourth base stations are calculated according to the spatial location information of the target base station and the spatial location information of the fourth base station.

7. The abnormal signaling detection method according to claim 5, characterized in that: The determining, according to a distribution rule of the fourth handover distance corresponding to the target base station, a state of the corresponding target base station includes: In order of the plurality of fourth handover distances corresponding to the target base station from near to far, selecting the kth fourth handover distance as the distance threshold of the corresponding target base station, where k is an integer greater than 0; When an average of the plurality of fourth handover distances corresponding to the target base station is greater than the distance threshold, and a median of the plurality of fourth handover distances is greater than the distance threshold, determining that the state of the corresponding target base station is abnormal; When the average of the plurality of fourth switching distances corresponding to the target base station is less than or equal to the distance threshold, or the median of the plurality of fourth switching distances is less than or equal to the distance threshold, it is determined that the status of the corresponding target base station is normal.

8. An abnormal signaling detection device, characterized in that: include: A first acquisition module is configured to acquire a signaling data set of at least one terminal, where the signaling data set includes a plurality of signaling records, where the signaling records are used to record connection interaction information between the terminal and a connected base station; a first calculation module, configured to calculate, based on at least two adjacent signaling records among the plurality of signaling records, a handover distance for handover between base stations to which the terminal is connected, and a handover angle for handover between base stations to which the terminal is connected; wherein the plurality of signaling records are arranged in chronological order; The first detection module is configured to perform anomaly detection on the at least two adjacent signaling records according to the switching distance and the switching angle.

9. A network device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the abnormal signaling detection method according to any one of claims 1 to 7.

10. A readable storage medium, characterized in that: include: The readable storage medium stores a program, and when the program is executed by a processor, the steps of the abnormal signaling detection method according to any one of claims 1 to 7 are implemented.

11. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the abnormal signaling detection method according to any one of claims 1 to 7.

Images