User position analysis anchoring method and system based on communication interface

Abstract

The invention relates to the technical field of communication network data processing, and provides a user position analyzing and anchoring method and system based on a communication interface, and the user position analyzing and anchoring method based on the communication interface automatically processes a communication interface message in communication by using a Python script, extracts real-time position data of a user through analyzing a PCAP package capturing file, and improves the user position analyzing and anchoring efficiency. Comprising a user identifier, a base station ID and longitude and latitude, an Excel report is automatically generated, and the message analysis efficiency is improved. According to the invention, the efficiency problem of communication network data analysis is solved, and the original message is converted into the structured geographic position information.

Description

Technical Field

[0001] This application relates to the field of communication network data processing technology, specifically to a user location parsing and anchoring method and system based on a communication interface. Background Technology

[0002] Currently, the analysis of PCAP files typically relies on general network analysis tools, but traditional methods have the following drawbacks: Inefficient manual parsing: PCAP files are usually very large (e.g., GB in size), and manually parsing them using Wireshark is time-consuming and error-prone, especially when specific protocol fields (such as base station ID, user location latitude and longitude) need to be extracted.

[0003] Data filtering is difficult: The raw communication interface messages contain a large amount of user location data, but manual extraction is inefficient and prone to errors (such as chaotic timestamp formats and inconsistent user identifiers).

[0004] Report generation is cumbersome: analysis results need to be converted into structured reports (such as Excel), and manual operation cannot meet the needs of rapid iteration, affecting the timeliness of network optimization. Summary of the Invention

[0005] To help solve the above-mentioned technical problems, this application provides a user location parsing and anchoring method and system based on a communication interface.

[0006] Firstly, this application provides a user location parsing and anchoring method based on a communication interface, employing the following technical solution: A user location parsing and anchoring method based on a communication interface, wherein the method includes the following steps: S1: Define the paths to the communication interface PCAP file, user list file, and tshark command-line tool, create the corresponding directory structure, and parse the command-line parameters entered by the user; S2: By calling the tshark command-line tool of Wireshark and based on protocol filtering rules, extract the target fields in the communication interface message. The target fields include frame time field, user number field, base station ID field, longitude field and latitude field. S3: Parse the frame time field using regular expressions and a predefined month mapping table, and convert it into a standard time format. By using regular expressions to remove non-numeric characters from the user number field and uniformly removing the country code prefix, the user number field is standardized to a pure numeric format. The longitude and latitude fields are converted from strings to floating-point numbers and null values ​​are handled. S4: Based on the user list, match the standardized user number field, and filter the frame time field in combination with the time range to select target data. Then, automatically generate a report based on the filtered target data using the pandas library. The report includes user location information and base station ID.

[0007] Preferably, step S1 includes: verifying the existence of the communication interface message file, the user list file, and the tshark command-line tool file; if the path of any file is incorrect, the process is terminated.

[0008] Preferably, S1 includes: parsing command-line parameters input by the user, the command-line parameters including start time command-line parameters, end time command-line parameters and enable debug mode command-line parameters, the start time and end time are used to define the time range for analyzing communication interface messages, and the enable debug mode command-line parameter is used to start debug mode.

[0009] Preferably, step S1 includes: converting the start time command-line parameter and end time command-line parameter in string format into datetime objects to verify the validity of the time format.

[0010] Preferably, step S1 includes: reading a user list file and loading the user list, and standardizing the user numbers in the user list to be compatible with different formats of user number input.

[0011] Preferably, S2 includes: saving the raw output file of the tshark command-line tool for debugging.

[0012] Secondly, this application provides a user location parsing and anchoring system based on a communication interface, which adopts the following technical solution: A user location resolution and anchoring system based on a communication interface, wherein the user location resolution and anchoring method based on a communication interface as described in any of the first aspects is employed, the system comprising: The configuration file management module is used to define the communication interface PCAP file path, user list file path, and tshark command-line tool path, and to create the corresponding directory structure. The command-line argument parsing module is used to parse command-line arguments entered by the user. The data extraction module is used to call the tshark command-line tool of Wireshark to extract target fields from communication interface packets based on protocol filtering rules. The target fields include frame time field, user number field, base station ID field, longitude field and latitude field. The data processing module is used to parse the frame time field using regular expressions and a predefined month mapping table, and convert it into a standard time format; remove non-numeric characters from the user number field and uniformly remove the country code prefix using regular expressions, and standardize the user number field into a pure numeric format; and perform string-to-floating-point conversion and null value handling on the longitude and latitude fields. The data filtering and report generation module is used to match the standardized user number field based on the user list, filter the frame time field in combination with the time range, select target data, and automatically generate a report based on the filtered target data using the pandas library. The report includes user location information and base station ID.

[0013] Preferably, the data extraction module further includes a raw output saving submodule for saving the raw output files of the tshark command-line tool to support debugging.

[0014] Preferably, the report generation module also supports generating summary reports including base station IDs and latitude and longitude information, and provides map visualization options.

[0015] Preferably, the command-line parameter parsing module supports parsing the following parameters: start time, end time, and enable debug mode, wherein the start time and end time are used to define the time range for analyzing communication interface messages.

[0016] In summary, this application solves the technical problems of traditional technologies by designing Python scripts to automatically parse communication network data, and has the following advantages: 1. In existing technologies, tshark is commonly used for general network analysis, but this solution uses it for the communication interface protocol (cnv_tc_xd_si1). Through predefined filtering rules, it extracts only location-related fields (such as frame.time, msisdn, 3g_cell_id, Longitude, Latitude), reducing processing load, avoiding full file parsing, and compressing hourly tasks to minute or even second-level tasks. This solves the efficiency bottleneck of network big data parsing, supports real-time anchoring of user location, improves network optimization speed, and can be applied to multiple fields such as mobile networks, IoT, and satellite networks.

[0017] 2. In the prior art, timestamp processing is usually simple formatting, while network packets often contain non-standard formats (such as "May 25, 2025 23:46:40.424439000") and the network is deployed across time zones, resulting in high timestamp disorder. The adaptive processing of the present invention solves the data inconsistency problem, avoids location anchoring deviation, and improves the accuracy of location data.

[0018] 3. In existing technologies, user identification processing often ignores prefixes (such as "86"), but users may come from different regions. This invention achieves dynamic standardization, supports input from multiple sources (such as users with international codes), ensures strong compatibility during filtering, avoids missing key users, and improves the coverage and reliability of user location anchoring. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating an embodiment of a user location parsing and anchoring method based on a communication interface according to this application. Detailed Implementation

[0020] The present application will be further described below with reference to the accompanying drawings. The structure and principle of the present application are very clear to those skilled in the art. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

[0021] Figure 1 This is a flowchart illustrating an embodiment of a user location parsing and anchoring method based on a communication interface according to this application.

[0022] The user location parsing and anchoring method based on the communication interface in this application includes the following steps: S1: Defines the paths to the communication interface PCAP file, user list file, and tshark command-line tool, creates the corresponding directory structure, and parses the command-line arguments input by the user. S1 also includes verifying the existence of the communication interface message file, user list file, and tshark command-line tool file; if any file path is incorrect, the process terminates. It parses the user-input command-line arguments, including start time, end time, and enable debug mode. The start and end times define the time range for analyzing communication interface messages, and the enable debug mode command-line argument initiates debug mode. It converts the string-formatted start and end time command-line arguments into datetime objects to verify the validity of the time format. It reads and loads the user list file, standardizing the user numbers in the list to accommodate different user number input formats.

[0023] In step S1, Script initialization paths (such as BASE_PATH, PCAP_FILE), logging system (logging.basicConfig), and external tool paths (such as TSHARK_PATH).

[0024] Use argparse to parse command-line arguments (such as time range --start, --end, debug mode --debug), and support runtime customization.

[0025] Check file existence (e.g., os.path.exists) to avoid invalid input.

[0026] It should be noted that the PCAP file processed by this method is a data file obtained in advance through legal and compliant means. The system in this application does not involve the active collection or collection of user data, but only parses and processes existing messages; the PCAP file is input data, and the system itself does not contain a data collection module.

[0027] S2: By invoking the Wireshark tshark command-line tool and based on protocol filtering rules, target fields are extracted from the communication interface packets. These target fields include frame time, subscriber number, base station ID, longitude, and latitude. S2 also includes saving the raw output file of the tshark command-line tool for debugging. The tshark command-line tool is invoked (via subprocess.run) to execute parsing commands, extracting fields including frame.time (time), msisdn (subscriber number), 3g_cell_id (base station ID), Longitude (longitude), and Latitude (latitude). The raw output is saved to a file (tshark_raw_output.txt) for debugging. The function extract_info_from_pcap handles timeouts and errors (such as TimeoutExpired).

[0028] It should be noted that in step S2: 1. Execute a customized tshark command using subprocess.run() to extract fields including frame.time (time), msisdn (user number), 3g_cell_id (base station ID), Longitude (longitude), and Latitude (latitude), as shown in the code below: tshark_cmd = [ TSHARK_PATH, # Path to the tshark executable "-r", PCAP_FILE, # Specifies the input PCAP file "-Y", "cnv_tc_xd_si1", # Filter communication interface protocol messages "-T", "fields", # Specifies that the output is in field format "-e", "frame.time", # Time field "-e", "msisdn", # User number field "-e", "3g_cell_id", # Base station ID field "-e", "Longitude", # Longitude field "-e", "Latitude", # Latitude field "-E", "separator=#", # Use # as the field separator "-E", "header=n", # Do not output the header "-n" # Disable name resolution (speeds up processing) ] 2. Error handling mechanism: Truncation warning handling: Log the warning but continue execution if result.stderr contains "cut short in the middle of a packet". # Handling truncation warnings if "cut short in the middle of a packet" in result.stderr: logger.warning("Truncation warning detected, ignored") Timeout handling: Catch the subprocess.TimeoutExpired exception and terminate the process. except subprocess.TimeoutExpired: logger.error("tshark parsing timed out") return None except Exception as e: logger.error(f"An error occurred during parsing: {str(e)}") return None 3. Original data backup, used for debugging. raw_output_path = os.path.join(BASE_PATH, "tshark_raw_output.txt") with open(raw_output_path, "w", encoding="utf-8") as f: f.write(result.stdout) # Save the original parsed result S3: Parses the frame time field using regular expressions and a predefined month mapping table, and converts it into a standard time format. By using regular expressions to remove non-numeric characters from the user number field and uniformly removing the country code prefix, the user number field is standardized to a pure numeric format. Perform string-to-float conversion and null value handling for longitude and latitude fields.

[0029] In step S3, Timestamp parsing: The parse_timestamp function uses regular expressions (re.sub) and a mapping table (month_map) to standardize the time format (such as English month and China Standard Time) while preserving millisecond precision.

[0030] MSISDN filtering: The process_pcap_lines function removes non-numeric characters (re.sub(r'\D', '',msisdn)) and unifies them to a format without the "86" prefix to ensure compatibility.

[0031] Latitude and longitude conversion: Converts strings to floating-point numbers (or preserves the original value), and handles null values.

[0032] Filter invalid data: Skip records with blank rows or insufficient fields (skipped_count statistics), and support time range filtering (start_time / end_time).

[0033] In step S3: 1. Timestamp parsing (parse_timestamp function) Remove time zone identifiers, standardize spaces, and support multiple format parsing: # English Format Analysis month_map = {'Jan':1, 'Feb':2, ...} # Month mapping table match = re.match(r'([A-Za-z]{3}) (\d{1,2}), (\d{4})(\d{2}):(\d{2}):(\d{2})\.(\d{9})', clean_str) if match: millis = micros[:2] # Take the first two digits as milliseconds dt_obj = datetime(int(year), month_map[month_str], ...) # ISO Format Analysis else: datetime_part, micros_part = clean_str.split('.', 1) millis_part = micros_part[:2].ljust(2, '0') # Normalize milliseconds dt_obj = datetime.strptime(f"{datetime_part}.{millis_part}", "%Y-%m-%d %H:%M:%S.%f") 2. MSISDN standardization (process_pcap_lines function) # Remove non-numeric characters clean_msisdn = re.sub(r'\D', '', msisdn) # Unified prefix processing if clean_msisdn.startswith('86'): formatted_msisdn = clean_msisdn[2:] else: formatted_msisdn = clean_msisdn 3. Latitude and longitude conversion # Processing latitude and longitude try: lon_float = float(longitude) if longitude else None except (ValueError, TypeError): lon_float = None try: lat_float = float(latitude) if latitude else None except (ValueError, TypeError): lat_float = None 4. Null value filtering Skip blank lines: if not line.strip(): continue The `skipped_count` function records the amount of invalid data. S4: Match the standardized user number field based on the user list, and filter the frame time field in combination with the time range to select target data. Use the pandas library to automatically generate a report based on the filtered target data. The report includes user location information and base station ID.

[0034] In step S4, a DataFrame (pandas) is created, with columns including time, user number, 3G cell ID, longitude, and latitude.

[0035] Generate two Excel files: 1. Detailed data report: Includes all extracted fields, with customizable column widths (e.g., 25 characters for the time column).

[0036] 2. Base station location and latitude / longitude summary report: Deduplicated base station IDs, longitudes, and latitudes for geographic analysis.

[0037] File names should include timestamps (e.g., Location Analysis Report_20250812_153000.xlsx) to avoid overwriting.

[0038] Specifically, the communication interface mentioned in the embodiments of this application is the 3G Internet interface.

[0039] Communication interface message: Call detail records (CDRs) output by the signaling component after parsing Internet signaling. This invention mainly obtains the user's MSISDN, base station ID, Longitude, and Latitude.

[0040] MSISDN (Mobile International ISDN Number) is a standard number developed by the International Telephone Equipment Manufacturers Association (ITMA) to uniquely identify mobile users. It consists of a country code, a domestic network access code, and a subscriber number. Number structure: Country code: 86 for China.

[0041] Domestic network access codes: assigned by operators, such as China Mobile using number segments 134~139, 150~152, 188, etc., and China Unicom using 130~132, 185~186, etc.

[0042] User number: Usually 11 digits, after removing the country code, it is the mobile phone number used daily.

[0043] Latitude and longitude: a spherical coordinate system that uses a three-dimensional sphere to define space on Earth, capable of marking any location on Earth.

[0044] Length of each field: MSISDN: 8 bytes; Base station ID: 8 bytes; Longitude: 4 bytes; Latitude: 4 bytes; based on Figure 1 The following process will be introduced: 1. Initialization Configuration The logging system is initialized via `logging.basicConfig`, with the log level set to DEBUG. The format includes a timestamp, level, and message, and outputs to `parse_log.log`. `BASE_PATH` is the working directory, `PCAP_FILE` is the input path, and `TSHARK_PATH` is the tool path. A `debug` subdirectory is created (using `os.makedirs(..., exist_ok=True)`) to store debug files.

[0045] 2. Command line argument parsing After parsing the three command-line parameters entered by the user, such as start time (--start), end time (--end), and enable debug mode (--debug), the program directly proceeds to the file inspection stage.

[0046] 3. Environmental Validation File verification: Check if PCAP_FILE, user list file, and TSHARK_PATH exist. If not, log the error and exit.

[0047] 4. Time range processing Format conversion: Supports two time formats: English month format: Converted by matching the month mapping table using regular expressions.

[0048] ISO format: directly use datetime.strptime for parsing.

[0049] After time processing, the user list is loaded.

[0050] 5. Loading the user list Read user files and standardize the format to be compatible with different formats of user number input.

[0051] 6. Core Process of File Parsing Execute customized commands to extract communication interface fields (time, MSISDN, base station ID, latitude and longitude), using # to separate fields, and disabling header output and name resolution. After parsing, save the raw output to the debug directory and proceed to the data processing stage.

[0052] 7. Data Processing This includes intelligent timestamp parsing (multi-format compatibility), user number standardization processing, latitude and longitude type conversion, and time range filtering.

[0053] 8. Report Generation: Create a structured data framework to generate professionally formatted reports.

[0054] This application also proposes a user location resolution and anchoring system based on a communication interface, employing the aforementioned user location resolution and anchoring method based on a communication interface. The system includes: The configuration file management module is used to define the communication interface PCAP file path, user list file path, and tshark command-line tool path, and to create the corresponding directory structure. The command-line argument parsing module is used to parse command-line arguments entered by the user. The data extraction module is used to call Wireshark's tshark command-line tool to extract target fields from communication interface packets based on protocol filtering rules. The target fields include frame time field, user number field, base station ID field, longitude field, and latitude field. The data processing module is used to parse the frame time field using regular expressions and a predefined month mapping table, and convert it into a standard time format; it uses regular expressions to remove non-numeric characters from the user number field and uniformly removes the country code prefix, standardizing the user number field into a pure numeric format; and it performs string-to-floating-point conversion and null value handling for the longitude and latitude fields. The data filtering and report generation module is used to match the standardized user number field based on the user list, filter the frame time field in combination with the time range, filter out the target data, and automatically generate a report based on the filtered target data using the pandas library. The report includes user location information and base station ID.

[0055] The data extraction module also includes a raw output saving submodule, used to save the raw output files of the tshark command-line tool to support debugging. The report generation module also supports generating summary reports including base station IDs and latitude and longitude information, and provides map visualization options.

[0056] The command-line argument parsing module supports parsing the following parameters: start time, end time, and enable debug mode. The start time and end time are used to define the time range for analyzing communication interface messages.

Claims

1. A method for resolving an anchor of a user's location based on a communication interface, characterized in that, The method comprises the following steps: S1: defining the path of the communication interface PCAP file, the user list file, and the tshark command line tool, creating a corresponding directory structure, and parsing the user input command line parameters; S2: calling the tshark command line tool of Wireshark, and based on the protocol filtering rule, extracting the target fields in the communication interface message in the PCAP file, the target fields including the frame time field, the user number field, the base station ID field, the longitude field, and the latitude field; S3: parsing the frame time field through a regular expression and a predefined month mapping table, and uniformly converting it into a standard time format, removing non-numeric characters in the user number field through a regular expression and uniformly removing the country code prefix, and standardizing the user number field into a pure digital format, converting the longitude field and the latitude field from a string to a floating point number and processing the null value; S4: based on the user list, matching the standardized user number field, and combining the time range to filter the frame time field, screening out the target data, and automatically generating a report based on the screened target data through the pandas library, the report including user location information and base station ID.

2. The method of claim 1, wherein, The S1 comprises: verifying the existence of the communication interface message file, the user list file, and the tshark command line tool file, and terminating the process if the path of any file is incorrect.

3. The method of claim 1, wherein, The S1 comprises: parsing the user input command line parameters, the command line parameters including the start time command line parameter, the end time command line parameter, and the enable debug mode command line parameter, the start time and the end time being used to define the time range of analyzing the communication interface message, and the enable debug mode command line parameter being used to start the debug mode.

4. The method of claim 3, wherein, The S1 comprises: converting the start time command line parameter and the end time command line parameter in the string format into a datetime object to verify the validity of the time format.

5. The method of claim 1, wherein, The S1 comprises: reading the user list file and loading the user list, and performing standard format processing on the user number in the user list to be compatible with different formats of user number input.

6. The method of claim 1, wherein, The S2 comprises: saving the original output file of the tshark command line tool for debugging.

7. A communication interface based user location resolution anchoring system, characterized by, The system comprises: A configuration file management module for defining the path of the communication interface PCAP file, the path of the user list file, the path of the tshark command line tool, and creating a corresponding directory structure; A command line parameter parsing module for parsing the user input command line parameters; A data extraction module for calling the tshark command line tool of Wireshark, and based on the protocol filtering rule, extracting the target fields in the communication interface message, the target fields including the frame time field, the user number field, the base station ID field, the longitude field, and the latitude field; The data processing module is configured to parse the frame time field by using a regular expression and a predefined month mapping table, convert the frame time field into a standard time format, remove non-numeric characters in the user number field by using a regular expression, remove a country code prefix, and convert the user number field into a pure digital format; and convert the longitude field and the latitude field from strings to floating-point numbers and perform null value processing. The data filtering and report generation module is configured to match the standardized user number field based on a user list, filter the frame time field based on a time range, screen out target data, and automatically generate a report based on the screened target data by using a pandas library, wherein the report includes user location information and base station IDs.

8. The system of claim 7, wherein, The data extraction module further includes an original output saving submodule configured to save an original output file of the tshark command line tool to support debugging.

9. The system of claim 7, wherein, The report generation module further supports generating a summary report including base station IDs, longitude and latitude information, and providing a map visualization option.

10. The system of claim 7, wherein, The command line parameter analysis module supports analyzing the following parameters: a start time, an end time, and an enabled debugging mode, wherein the start time and the end time are used to define a time range for analyzing communication interface packets.

Images