A method for anomaly detection and fault location in 5G signaling traffic

Abstract

This invention discloses a method for 5G signaling traffic anomaly detection and fault location, belonging to the technical field of traffic anomaly detection and fault location. It includes step-by-step fault sample collection, time-series data acquisition and feature extraction, dynamic graph construction of endogenous context, dynamic association learning, graph-level representation generation and multi-head decision-making, and multi-stage pre-training and micro-processing. Compared with existing technologies, this invention has significant advantages in terms of real-time performance, sensitivity, accuracy, and intelligent analysis capabilities in 5G signaling traffic anomaly detection. Through innovative data processing methods, this invention fundamentally overcomes the inherent anomalies of existing technologies at the data source level. Through a unique model architecture and training strategy, this invention enhances intelligent analysis capabilities. It effectively overcomes the anomalies of low sensitivity, slow response, insufficient intelligence, and heavy reliance on expert experience in existing 5G signaling traffic anomaly detection technologies.

Description

Technical Field

[0001] This invention belongs to the field of traffic anomaly detection and fault location technology, and particularly relates to a method for 5G signaling traffic anomaly detection and fault location. Background Technology

[0002] In 5G traffic analysis systems, existing 5G signaling traffic anomaly detection is still mainly based on experience-driven operation and maintenance. It usually issues alarms by setting static thresholds for key indicators (such as correlation rate), supplemented by related indicators such as packet loss rate and signaling traffic size, and ultimately relies on expert experience to locate faults.

[0003] In existing technologies, the commonly used correlation rate statistics methods typically only count 5G signaling carrying correlation information, making them unsuitable for detecting anomalies in 5G signaling traffic. This is because such signaling occurs infrequently in 5G networks, usually only in specific scenarios such as terminal power-on and reattachment. This results in a prolonged "warm-up period" and sluggish performance of the correlation rate after a system cold start, leading to two major problems:

[0004] 1) Long fault exposure period: During the correlation rate climb, it is impossible to effectively determine whether a fault exists. For faults that occur after the system has been running stably, especially those with minor impact, the changes in indicators are not obvious due to the "dilution" of accumulated normal signaling, resulting in slow problem detection and long repair cycles.

[0005] 2) Reliance on expert experience: The final determination of fault type relies heavily on expert experience, lacking a unified standard for automated identification. This not only affects the accuracy and timeliness of anomaly detection but also limits the scalability and intelligence of the system in complex 5G network environments. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a method for detecting and locating 5G signaling traffic anomalies in order to overcome the shortcomings of the prior art. This method effectively overcomes the problems of low sensitivity, slow response, insufficient intelligence, and heavy reliance on expert experience in the detection of 5G signaling traffic anomalies in the prior art.

[0007] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0008] A method for detecting and locating abnormal 5G signaling traffic, specifically including the following steps;

[0009] Step 1, Fault Sample Collection: Combining the production environment and the mirror bypass environment, systematically collect and label various known fault sample data, including normal samples, through manual simulation triggering.

[0010] Step 2, Time Series Data Acquisition and Feature Extraction: Periodically acquire non-uniform interval time series data of multiple preset indicators within a preset time window, and process the heterogeneous time series data of each indicator using a temporal convolutional network (TCN) configured independently for it, and extract the unique deep temporal feature vector of each indicator.

[0011] Step 3, Dynamic Graph Construction of Endogenous Context: Construct a graph neural network (GNN) input graph that uses temporal context as endogenous nodes; the GNN input graph contains multiple index nodes and one context node;

[0012] The initial features of each indicator node are the deep temporal feature vectors output by the corresponding temporal convolutional network TCN in step 2; the context node is a time node, and its initial features are generated by the learnable embedding vectors corresponding to the current time information and date type information.

[0013] Step 4, Dynamic Association Learning: The graph containing time nodes constructed in Step 3 is processed using a graph neural network (GNN). Each node is learned and updated through a message passing mechanism to generate node features that integrate spatiotemporal dynamic association information.

[0014] Step 5, Graph-level representation generation and multi-head decision-making: Perform graph readout operation on the node features output in Step 4 to generate a graph-level feature vector representing the current state of the entire graph; feed the graph-level feature vector into at least two independent decision heads in parallel;

[0015] The classification head is used to classify samples into multiple known abnormal categories, including normal.

[0016] An anomaly detection head is used to calculate the anomaly score of a sample to determine whether it is an unknown anomaly.

[0017] Step 6, Multi-stage pre-training and fine-tuning: A strategy including TCN self-supervised pre-training, GNN graph contrastive learning pre-training, separate warm-up of anomaly detection head and classification head, and multi-task fusion fine-tuning is adopted to ensure the gradual unlocking and collaborative optimization of model capabilities.

[0018] As a further preferred embodiment of the 5G signaling traffic anomaly detection and fault location method of the present invention, in step 1, a mirror environment is built and fault samples are supplemented by artificial simulation, specifically including the following steps:

[0019] Step 1.1: Collect operational knowledge of the production environment: Determine whether the data is normal based on the correlation rate index, which will be used for subsequent unlabeled pre-training and anomaly detection head training;

[0020] Step 1.2, set up the mirror experimental environment: add a splitter to the front end of the aggregation and splitting platform, mirror a copy of the input traffic of the aggregation platform to the mirror environment, and set up a software and hardware mirror environment that is exactly the same as the production environment.

[0021] Step 1.3, Actively trigger faults and generate fault samples: In the mirror environment, write an automated script to generate faults according to the table below, record the fault start time and end time, and collect fault logs; In order to increase the generalization ability of the model, the fault severity and fault duration are randomized during fault simulation; The fault logs are labeled according to the recorded fault type and fault duration.

[0022] As a further preferred embodiment of the 5G signaling traffic anomaly detection and fault location method of the present invention, in step 2, sample preprocessing: when performing fault identification, the complex log information is structured into multi-dimensional features usable by the model. The specific implementation steps are as follows:

[0023] Step 2.1, Non-uniform sampling of time series data: A non-uniform time series sampling strategy is adopted to replace the multi-dimensional analysis model;

[0024] Step 2.2, extract key performance indicators (KPIs): extract five key performance indicators (KPIs) from the sampled data as input to the subsequent Temporal Convolutional Network (TCN);

[0025] Step 2.3, Extract context information: Extract the context information corresponding to the detection time to construct the time nodes in the graph;

[0026] Step 2.4, Data Labeling: Based on the timestamp of the current detection time, find the recorded fault type-fault duration information, and label the sample with the corresponding fault tag, including link traffic overflow or normal.

[0027] As a further preferred embodiment of the 5G signaling traffic anomaly detection and fault location method of the present invention, the five key performance indicators (KPIs) specifically include:

[0028] 1) TCP packet loss ratio: used to reflect the quality of the signaling transmission link;

[0029] 2) Signaling plane to user plane traffic ratio: used to measure the load balancing relationship between the control plane and the data plane.

[0030] 3) Number of active bearer nodes and user nodes: This provides a macro view of the current network load and traffic composition, and provides contextual information for the model to determine whether the current network state includes high load or low load;

[0031] 4) Added TEID correlation rate to user plane downlink data: used to detect whether the current user has signaling loss and the severity of signaling loss;

[0032] 5) Distributed correlation rate distribution index group: used to overcome the shortcomings of a single global correlation rate in reflecting local fault anomalies, and to characterize the spatial distribution characteristics of faults in the network topology through statistical methods.

[0033] As a further preferred embodiment of the 5G signaling traffic anomaly detection and fault location method of the present invention, in step 3, a parallel multi-head output model based on TCN+GNN network is adopted to fully learn the temporal characteristics and intrinsic correlations of the fault; the parallel multi-head output model based on TCN+GNN network includes a temporal feature extraction and fusion module, a graph association learning module, and a readout and multi-head decision module.

[0034] The temporal feature extraction and fusion module receives temporal sequences formed by non-uniform sampling of various KPIs and extracts their deep temporal features through a hierarchical processing structure. Each KPI generates a feature vector, providing high-quality node input for the subsequent graph neural network (GNN). It includes two stages: parallel independent temporal feature extraction and hierarchical feature fusion.

[0035] The graph association learning module is used to learn the dynamic and complex relationships between nodes in the entire graph, including time nodes; it includes four stages: dynamic graph construction, graph structure definition, graph attention network (GAT), and information propagation.

[0036] Readout and Multi-Head Decision Module: This module consists of two stages: graph-level readout and parallel decision heads.

[0037] As a further preferred embodiment of the 5G signaling traffic anomaly detection and fault location method of the present invention, in step 4, a four-stage pre-training and fine-tuning strategy of multi-task fusion is adopted. By making full use of unlabeled data for self-supervised learning, the problem of scarce labeled real fault samples and the complex and ever-changing real environment is solved. Specifically, it includes the following stages:

[0038] Phase 1: Temporal self-supervised pre-training of Temporal Convolutional Network (TCN): Five independent TCN networks are pre-trained on massive amounts of unlabeled historical monitoring data using a temporal mask reconstruction task to enable them to master general temporal patterns.

[0039] Phase 2, Graph Contrast Learning Pre-training: Freeze the Temporal Convolutional Network (TCN) and pre-train the Graph Neural Network (GNN) and the Temporal Embedding Layer;

[0040] Phase 3: Separate warm-up of the anomaly detection head and the classification head:

[0041] Anomaly detection head training: Freeze the pre-trained Temporal Convolutional Network (TCN) and Graph Neural Network (GNN) backbone networks;

[0042] Training is performed using normal samples from unlabeled data, employing One-Class loss. To minimize the representation z(x) of all normal samples to the center point The average distance is used to define the boundaries of normal data patterns;

[0043] After warming up the classification head, the Temporal Convolutional Network (TCN), the Graph Neural Network (GNN) backbone network, and the anomaly detection head are frozen. The Softmax classification head is trained separately using rare, real-label fault sample data.

[0044] Phase Four, Full Model Fusion Fine-Tuning: Integrate and collaboratively optimize the capabilities of all modules; unfreeze all modules, use real-labeled fault sample data, and perform end-to-end fine-tuning using a weighted multi-task loss function:

[0045] ;in It is the cross-entropy loss of the classification head. It's a loss of the One-Class header. It is a hyperparameter used to balance the importance of two tasks.

[0046] As a further preferred embodiment of the 5G signaling traffic anomaly detection and fault location method of the present invention, in step 5, the trained model is quantized and converted using the ONNX format; by converting the model to the ONNX format, the dependence on a specific deep learning framework is eliminated, and hardware-accelerated inference is achieved in the CPU environment using the ONNX Runtime.

[0047] Compared with the prior art, the present invention, employing the above technical solution, has the following technical effects:

[0048] 1. This invention provides a method for detecting and locating 5G signaling traffic anomalies. Compared with existing technologies, it has significant advantages in terms of real-time performance, sensitivity, accuracy, and intelligent analysis capabilities in 5G signaling traffic anomaly detection. Specifically, these advantages are reflected in the following aspects:

[0049] I. Effects at the Data and Feature Processing Level: This invention, through innovative data processing methods, fundamentally overcomes the inherent anomalies of existing technologies at the data source level;

[0050] 1) Significantly shortens the fault exposure cycle: Existing technologies rely on low-frequency signaling to calculate the correlation rate, which means that it takes several days for the indicator to stabilize; This invention adopts a new correlation rate calculation method based on user plane traffic increments. By utilizing high-frequency user plane traffic, a stable correlation rate baseline can be established within 30 minutes after system startup or the start of any monitoring point, shortening the fault detection cycle from days to minutes.

[0051] 2) Improved sensitivity of anomaly detection: The correlation rate calculation of existing technologies dilutes the fault signal due to the accumulation of a large number of historical normal signaling, resulting in insensitivity to occasional and transient faults; the present invention calculates the correlation rate only for newly added DLF-TEIDs, so that the failure of any newly added DLF-TEID correlation can directly and significantly affect the index value, thereby greatly improving the response speed to various faults, especially transient faults.

[0052] 3) Provides a clear judgment of the existence of faults, reducing the diagnostic complexity of downstream models: The correlation rate curve of the existing technology has a normal climbing process, which requires the expert experience to judge whether it is abnormal. The new correlation rate of the present invention is stable at a level close to 100% when there is no fault. Any significant drop in the indicator clearly indicates the existence of faults, providing high-quality binary (normal / abnormal) prior input for subsequent AI models, enabling them to focus more on identifying specific fault types.

[0053] 4) Reduced system overhead: Existing technologies typically require deep parsing of signaling to extract complex user three-code information in order to obtain associated information, which consumes a lot of resources. This invention only needs to extract lightweight DLF-TEID information from user plane traffic, which significantly reduces the additional occupation of system performance.

[0054] II. Effects at the model algorithm level:

[0055] This invention enhances intelligent analysis capabilities through a unique model architecture and training strategy;

[0056] 1) Achieved high-precision detection of unknown faults: Traditional supervised learning models can only identify fault types already present in the training set, and are ineffective against unknown "zero-day" anomalies; this invention adopts a parallel dual-decision-head (classification head + anomaly detection head) output architecture, which can effectively defend against unknown anomalies while identifying known faults; as shown in the experimental results, its unknown anomaly detection F1 score reaches 0.91, while controlling the false alarm rate to 2.5%;

[0057] 2) Modeling of dynamic relationships between indicators: Existing technologies can usually only learn static, averaged relationships between indicators; This invention innovatively introduces learnable time nodes into the graph neural network (GNN), enabling the model to learn how time context (such as business peak / valley, holidays) adjusts the intrinsic relationship between indicators. As shown in the ablation experiment, the design significantly improves the performance of the model in complex scenarios.

[0058] 3) This invention provides an effective model training scheme for scenarios where real-world fault samples are scarce: the performance of traditional data-driven models is severely limited by rare and expensive labeled fault samples; this invention adopts a four-stage training strategy that includes self-supervised pre-training and multi-task fine-tuning, which significantly reduces the dependence on labeled samples by making full use of massive amounts of unlabeled data. As shown in the ablation experiments, this strategy is crucial for ensuring model performance and generalization ability.

[0059] 4) Enhanced model interpretability, providing assistance for fault root cause localization: Many deep learning models are "black boxes" and it is difficult to explain their decision-making basis; the learnable adjacency matrix in the GNN of this invention can quantitatively reveal the strength of the interaction between time and each KPI after training, providing a decision reference for fault localization analysis. Attached Figure Description

[0060] Figure 1 This is a schematic diagram of the key components of a 5G signaling traffic anomaly detection and fault location method according to the present invention.

[0061] Figure 2 This is a schematic diagram of the mirrored experimental environment built according to the present invention;

[0062] Figure 3 This is a flowchart of the 5G signaling anomaly detection model of the present invention;

[0063] Figure 4 This is a schematic diagram comparing the climbing speed of the new correlation rate of this invention with that of the traditional correlation rate. Detailed Implementation

[0064] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings:

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention. The present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments. The purpose and effects of the present invention will become clearer. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention.

[0066] The purpose of this invention is to overcome the problems of low sensitivity, slow response, insufficient intelligence, and heavy reliance on expert experience in the detection of abnormal 5G signaling traffic in the prior art.

[0067] Therefore, this invention aims to provide a highly sensitive and intelligent real-time 5G signaling traffic anomaly detection method and fault location method. On the one hand, this method fundamentally improves the real-time performance and sensitivity of 5G signaling traffic anomaly detection by proposing a novel correlation rate calculation method. On the other hand, this invention provides a complete intelligent 5G signaling traffic anomaly detection scheme based on machine learning. This scheme achieves automated and high-precision detection of signaling link faults by systematically constructing a fault knowledge sample library in a bypass environment and using this knowledge sample library to train a deep learning model capable of accurately identifying faults.

[0068] like Figure 1 As shown, based on the fault knowledge base information, the key links of the system and the location information of high-incidence faults are statistically analyzed as follows:

[0069] Step 1: a) Incomplete forwarding rules configured on the traffic aggregation platform lead to abnormal signaling traffic; b) Excessive traffic overflow at the output port of the traffic aggregation platform leads to abnormal signaling traffic; c) A malfunction at the output port of the traffic aggregation platform leads to abnormal signaling traffic.

[0070] Step 2: The signaling traffic forwarded by the traffic aggregation platform is usually distributed to multiple receivers via optical splitting. When the light intensity at the output of splitter 2 is too strong or too weak, the signaling traffic received by the receivers may contain incorrect packets, resulting in abnormal signaling traffic.

[0071] Step 3: When the signaling traffic exceeds the link capacity, a link traffic overflow occurs, resulting in abnormal signaling traffic.

[0072] Step 4: Software failure in the traffic analysis system leads to abnormal signaling traffic.

[0073] This invention provides a systematic solution. First, based on the characteristics of 5G signaling, we propose a new, more sensitive method for calculating the correlation rate index. Simultaneously, to obtain sufficiently realistic fault knowledge sample data, a complete bypass environment is built to simulate fault triggering. Then, a non-uniform temporal sampling method is employed to efficiently capture multi-dimensional features. To fully respect the heterogeneity of each index, an independent TCN network is configured for each sampling sequence to extract high-quality, personalized temporal features. Next, these temporal features are combined with a learnable time node to construct a graph, enabling the GNN to learn complex correlations that dynamically change over time. Then, to address the challenge of coexisting known and unknown faults in operation and maintenance, a parallel multi-head output architecture is designed. Finally, to ensure successful training of this complex model on real, sparse data, we propose a complete four-stage pre-training and fine-tuning strategy.

[0074] The method specifically includes the following steps:

[0075] Step 1: Fault Sample Collection. Combining the production environment and the mirror bypass environment, systematically collect and label various known fault sample data, including normal samples, through manual simulated triggering.

[0076] Step 2: Time-series data acquisition and feature extraction. Periodically acquire non-uniformly spaced time-series data of multiple preset indicators within a preset time window, and process the heterogeneous time-series data of each indicator using a temporal convolutional network (TCN) configured independently for it, to extract the unique deep temporal feature vector of each indicator.

[0077] Step 3: Dynamic Graph Construction of Endogenous Context. Construct a graph neural network (GNN) input graph that uses temporal context as endogenous nodes. This graph contains multiple indicator nodes and one context node; the initial features of each indicator node are the deep temporal feature vectors output by the corresponding TCN in Step 2; the context node is a "time node," and its initial features are generated from the learnable embedding vectors corresponding to the current time information and date type information.

[0078] Step 4: Dynamic Association Learning. Using the graph neural network (GNN), the graph containing time nodes constructed in Step 3 is processed. Each node is learned and updated through a message passing mechanism to generate node features that integrate spatiotemporal dynamic association information.

[0079] Step 5: Graph-level Representation Generation and Multi-head Decision Making. The node features output from Step 4 are subjected to graph readout operations to generate a graph-level feature vector representing the current state of the entire graph. This graph-level feature vector is then fed in parallel into at least two independent decision heads. One is a classification head, used to classify samples into multiple known anomaly categories, including "normal." The other is an anomaly detection head, used to calculate the anomaly score of a sample to determine whether it is an unknown anomaly.

[0080] Step Six: Multi-stage pre-training and fine-tuning. A strategy is adopted that includes TCN self-supervised pre-training, GNN graph contrastive learning pre-training, separate warm-up of anomaly detection head and classification head, and final multi-task fusion fine-tuning to ensure the gradual unlocking and collaborative optimization of model capabilities.

[0081] This invention provides a method for detecting and locating 5G signaling traffic anomalies. Its specific implementation requires first combining the production environment and the mirror environment to collect fault samples, then performing sample preprocessing, determining the model, determining the training strategy, and finally deploying and applying the model.

[0082] 4.1 Fault Sample Collection: Analysis of the fault knowledge base revealed certain similarities in the statistics of the same fault information. For example, a fault in the output port of the traffic aggregation platform would lead to a slow decrease in signaling traffic, an increase in the TCP packet loss ratio (TCP sequence continuity statistics), and a gradual decrease in user correlation rate, but it would eventually remain at a high value (e.g., 85% or above). However, with numerous system components and massive amounts of log data, establishing an accurate mapping between faults and log statistics requires collecting a large amount of fault sample data. Fault data from the production environment cannot generate sufficient fault samples; therefore, this patent uses a mirrored environment and manual simulation to supplement the fault samples. The specific steps are as follows:

[0083] Step 1: Collect operational knowledge of the production environment. Because it is impossible to accurately label fault types, we only judge whether the data is normal based on the correlation rate indicator. Data labeled as abnormal may still be normal, but we can guarantee that data labeled as normal is normal. This information is used for subsequent unlabeled pre-training and anomaly detection head training.

[0084] Step 2: Set up the mirrored experimental environment. For example... Figure 2 As shown, a splitter is added to the front end of the aggregation and distribution platform to mirror the input traffic of the aggregation platform to the mirror environment. A hardware and software mirror environment identical to the production environment is then built. The statistical logs of the traffic analysis system are analyzed to ensure that the input and output of the mirror environment are completely consistent with the production environment.

[0085] Step 3: Proactively trigger faults to generate fault samples. To avoid impacting the production environment, an automated script is written in the mirror environment according to the table below to generate faults, record the start and end times of the faults, and collect fault logs. To increase the model's generalization ability, the fault severity and duration are randomized during fault simulation. The fault logs are labeled according to the recorded fault type and duration, as shown in Table 1.

[0086] Table 1

[0087]

[0088] 4.2 Sample Preprocessing: Structuring the complex log information into multi-dimensional features usable by the model is a crucial step in achieving automated and intelligent anomaly detection during fault identification. This invention employs an advanced preprocessing method designed to adapt to the model structure proposed in this invention. The specific implementation steps are as follows:

[0089] Step 1: Non-uniform sampling of time-series data. This invention employs a direct and efficient non-uniform time-series sampling strategy to replace traditional complex multi-dimensional analysis models. For each time point to be detected, the system backtracks the raw monitoring data from the past 2 hours, measured in minutes (according to the fault knowledge base, the duration of fault changes does not exceed 2 hours). From these 120 data points, a fixed-length sequence (e.g., 32 points) is sampled. The sampling rule for this sequence is: dense sampling is performed every minute in time periods close to the current detection point (e.g., the most recent 15 minutes) to capture the instantaneous details of the fault; while sparse sampling is performed in time periods far from the current detection point (e.g., sampling one point every 5 or 10 minutes) to capture long-term baselines and trends. This method achieves the effect of a complex multi-dimensional model with a simple single-scale model input, greatly simplifying the subsequent model structure and improving efficiency. Sampling is performed every 5 minutes as one sample.

[0090] Step 2: Extract Key Performance Indicators (KPIs). From the sampled data, extract multiple core KPIs (5 categories in total) required by the model as input for the subsequent TCN module:

[0091] 1) TCP packet loss ratio. This metric directly reflects the quality of the signaling transmission link. By statistically analyzing the sequence discontinuity at the TCP protocol layer, the packet loss caused by network congestion, hardware failure, and other reasons can be accurately quantified, making it one of the most direct bases for judging the health of the link.

[0092] 2) Signaling plane to user plane traffic ratio (signaling / user traffic ratio). This metric measures the load balancing relationship between the control plane and the data plane. Under normal circumstances, the traffic of the two should be maintained within a relatively stable ratio range. If this ratio is abnormal (such as signaling traffic being much greater or much less than the normal ratio), it may indicate deeper problems such as control plane signaling loss, user plane traffic loss, or service anomalies.

[0093] 3) Number of active bearer nodes and user nodes. User nodes correspond to active 5G users, measured by the number of active IMSIs; bearer nodes correspond to the APN / DNN of the 4G / 5G network. Ordinary users typically activate two PDU sessions using different APNs / DNNs: one using IMS for IMS communication (e.g., VoLTE / VoNR), and the other using CMNET (or 3GNET) for internet access. For IoT users, there is generally only one APN / DNN, such as cmiot5g. This set of metrics provides a macroscopic view of the current network load and traffic composition, providing necessary contextual information for the model to determine the current network state (e.g., high load, low load).

[0094] 4) User Plane Downlink Data TEID Association Rate. In 5G traffic analysis systems, the traditional association rate is defined as the proportion of user plane data carrying key signaling information. However, in actual system deployment, this indicator typically takes 1 to 3 days to stabilize because only a portion of the signaling carries key information. To improve the timeliness of anomaly detection, this patent proposes a user plane downlink data TEID association rate, defined as the proportion of newly added downlink DLF-TEID data in the user plane that can be used to query signaling information. By collecting and dynamically maintaining (deleting based on control plane or timeout, and adding based on user plane) all DLF-TEIDs in user plane downlink traffic, over 99% of active users can be covered within a short time window (e.g., 30 minutes), thus constructing a nearly complete baseline set of "surviving DLF-TEIDs." This set is updated in real-time based on control plane signaling (e.g., base station handover, session release, etc.). Subsequent user plane data is queried from this set based on DL F-TEID. The TEID correlation rate of downlink user plane data is calculated based on whether signaling can be queried (compared to the traditional correlation rate which requires querying IMSI / IMEI / MSISDN information). DL F-TEID changes very frequently in 5G signaling. Signaling carrying DL F-TEID is triggered when a 5G terminal initiates base station handover signaling, An release signaling, or service request signaling. Therefore, this indicator can sensitively detect whether a user is experiencing signaling loss and the severity of that loss.

[0095] 5) Distributed Correlation Rate Distribution Index Group. This index group aims to overcome the limitation of a single global correlation rate in reflecting local fault anomalies, and to characterize the spatial distribution characteristics of faults in the network topology through statistical methods. In 5G network transmission links, there are complex strategies such as traffic filtering and load balancing. The impact of some network faults (such as port overflow) is often limited to specific base stations or core network elements. Since directly modeling massive numbers of nodes independently is not feasible in terms of computation and storage, this method effectively extracts the spatial variation pattern of the correlation rate by statistically analyzing the distribution ratio of nodes in different performance ranges, thereby efficiently characterizing the features of local faults. The process is executed in two steps: First, KPI stratified statistics are performed, calculating the real-time downlink TEID correlation rate for each node using base station IP as the dimension. Second, interval division and proportion calculation are performed, mapping the correlation rate of each node to one of six preset performance intervals ([99%, 100%], [95%, 99%), [80%, 95%), [50%, 80%), [20%, 50%), [0%, 20%), and calculating the proportion of nodes in each interval to the total number of nodes in that dimension. Through this process, six new independent KPIs can be generated for each base station IP dimension. These KPIs together constitute a "distributed correlation rate distribution index group," which can intuitively reflect the spatial distribution pattern of local anomalies in the network.

[0096] Step 3: Extract Contextual Information. Extract the contextual information corresponding to the detection time to construct the "time nodes" in the graph. First, construct a time slice index, dividing a 24-hour day into 288 5-minute time slices (the detection interval is 5 minutes), with an index range of 0-287. Second, construct a date type, using 0 to represent weekdays and 1 to represent holidays or weekends. This contextual node can significantly improve the model's classification accuracy during specific time periods (such as rush hour, work hours, and rest periods).

[0097] Step 4: Data Labeling. Based on the timestamp of the current detection time, find the "Fault Type - Fault Duration" information recorded in Step 4.1, and label the sample with the corresponding fault tag (such as "Link Traffic Overflow" or "Normal").

[0098] 4.3 Model Selection

[0099] This invention employs a parallel multi-head output model based on TCN+GNN networks to fully learn the temporal characteristics and intrinsic correlations of faults.

[0100] The 5G signaling anomaly detection model of the present invention is as follows: Figure 3 As shown, the data preprocessed in step 4.2 is received as input. The model consists of a temporal feature extraction module (5 independent TCNs), a graph association learning module (a graph containing time nodes), and a readout and parallel multi-head output module (classification head and detection head).

[0101] Module 1: Temporal Feature Extraction and Fusion Module (TCN Module). This module receives temporal sequences formed by non-uniform sampling of various KPIs and extracts their deep temporal features through a hierarchical processing structure. Finally, a feature vector is generated for each KPI class, providing high-quality node input for subsequent Graph Neural Networks (GNNs). This module consists of two stages:

[0102] Phase 1: Parallel Independent Temporal Feature Extraction. Independent Weight Design: This module configures a Temporal Convolutional Network (TCN) sub-network with the same structure but completely independent and non-shared weights for each group of KPIs (including all indicators in the list above). This design fully respects the heterogeneity of different indicators and can extract high-quality and personalized temporal features for indicators with different dynamic patterns. TCN Internal Structure and Output: Each TCN sub-network is composed of multiple residual blocks stacked together, containing causal convolutions, dilated convolutions, and residual connections. It receives an input sequence of a preset length (e.g., 32 points) and outputs a high-dimensional temporal feature vector h_tcn with a fixed dimension (e.g., 64 dimensions).

[0103] Phase Two: Hierarchical Feature Fusion. After the first phase, the model obtains a high-dimensional time-series feature vector for each KPI. To further learn the combination relationships within the relevant indicator groups, this fusion phase is set up, which includes multiple parallel fusion groups:

[0104] Group 1: Distributed correlation rate feature fusion. Base station dimension fusion: The six high-dimensional feature vectors h_tcn corresponding to the six KPIs related to the base station dimension are concatenated and then fused and reduced in dimensionality through a fully connected neural network layer to generate a fused feature vector representing the overall health status of the base station network.

[0105] Group 2: Network Scale Feature Fusion. The two high-dimensional feature vectors h_tcn corresponding to the KPIs "Number of Supporting Nodes" and "Number of User Nodes" are concatenated. The concatenated vector is then input into a dedicated fully connected neural network layer for information fusion, ultimately generating a fused feature vector that characterizes the overall network scale and state.

[0106] Group 3: Final Output of the Module. The final output of this module is a set of feature vectors, which will be used to initialize the features of the corresponding nodes in the GNN. This includes three types of vectors: first, independent time-series feature vectors from various "basic performance metrics" (such as TCP packet loss ratio, signaling traffic volume, etc.); second, a fused feature vector representing the "distributed correlation rate state" after hierarchical fusion; and third, a fused feature vector representing the "network scale state" after hierarchical fusion.

[0107] Module 3: Graph Association Learning Module (GNN Module). This module aims to learn the dynamic and complex relationships between nodes in the entire graph, including time nodes. It consists of the following stages:

[0108] Phase 1: Dynamic Graph Construction. This module extracts subtle interaction features between various features and incorporates time nodes to learn dynamic temporal relationships. The system constructs a heterogeneous graph containing 6 nodes. Five of these are indicator nodes, whose initial feature vectors are the five vectors extracted and fused by the TCN network described above. One node is a time node, whose initial feature vector is generated using learnable embeddings. The system maintains a time slice embedding matrix (e.g., embedding dimensions can be set to 32 to 128) and a date type embedding matrix (e.g., embedding dimensions can be set to 8 to 32). Based on the current context information, the corresponding embedding vector is found and concatenated to form the initial features of the time node.

[0109] Phase Two: Graph Structure Definition. The connections between nodes are defined by a learnable graph. The adjacency matrix A is defined. After the model training is completed, this matrix can be sparsified, for example, by setting elements whose absolute weights are below a certain preset threshold λ (for example, λ can be between 0.05 and 0.2) to 0, for use in interpretability analysis.

[0110] Phase 3: Graph Attention Network (GAT). This embodiment uses GAT as the specific implementation of GNN, and its network layer count can be set to 2 to 4 layers to balance feature propagation and oversmoothing issues. Each GAT layer employs a multi-head attention mechanism (e.g., the number of attention heads can be set to 4 to 8) to capture rich relationships between nodes from different subspaces.

[0111] Phase Four: Information Propagation. After message passing through multiple layers of GAT, the final output features of each node deeply integrate information from its neighboring nodes and dynamic interaction information with time nodes.

[0112] Module Four: Readout and Multi-head Decision Module. This module is the core of realizing the dual detection capability of this invention. It is divided into two stages:

[0113] Phase 1: Graph-level Readout. Global Average Pooling is performed on the final feature representations of the 6 nodes output by GAT to obtain a fixed-dimensional graph-level feature vector z representing the overall state of the entire graph.

[0114] Phase Two: Parallel Decision Heads. The graph-level feature vector z is simultaneously fed into two parallel processing heads. One is a classification head, used to identify known anomaly types. Its structure is a standard multilayer perceptron (MLP) (e.g., containing 1 to 3 hidden layers), followed by a softmax layer, outputting a probability distribution representing the sample's belonging to each known anomaly category (including the "normal" category). The other is an anomaly detection head, employing Deep Support Vector Data Description (Deep SVDD), a one-class learning algorithm, used to identify unknown anomalies. Its structure is a neural network (e.g., one or two linear layers), aiming to learn a transformation that tightly maps all "normal" sample data representations z to a minimum volume hypersphere. During inference, this head calculates the Euclidean distance between the input sample representation z and the pre-learned normal pattern center c; this distance is the anomaly score. When this score exceeds a preset threshold, even if the classification head judges it as "normal," it can still be classified as an unknown anomaly.

[0115] 4.4 Model Training Strategy:

[0116] This invention proposes a complete four-stage pre-training and fine-tuning strategy for multi-task fusion. This strategy addresses the scarcity of labeled real-world fault samples and the complex and ever-changing nature of real-world environments by fully utilizing unlabeled data for self-supervised learning.

[0117] Phase 1: Self-supervised pre-training of TCN temporal data. On massive amounts of unlabeled historical monitoring data, a "temporal mask reconstruction" task was used to pre-train five independent TCN networks, enabling them to master general temporal patterns.

[0118] Phase Two: Graph Contrast Learning Pre-training. The TCN is frozen, and the GNN and temporal embedding layer are pre-trained. This phase uniformly adopts Graph Contrast Learning (GraphCL) as the core task. Two independent random data augmentations (such as node dropping, edge modification, and temporal perturbation) are performed on each graph to generate two views. The model is then trained using contrastive loss (such as InfoNCE) to enable it to learn high-quality, generalizable graph-level representations.

[0119] Phase 3: Separate warm-up of the anomaly detection head and classification head. For anomaly detection head training, first, the pre-trained TCN and GNN backbone networks are frozen. Then, training is performed using normal samples from unlabeled data, employing One-Class loss (e.g., ...). To minimize the representation z(x) of all normal samples to the center point. The average distance is used to define the boundary of the "normal" data pattern; the classification head is warmed up, the TCN, GNN backbone network and anomaly detection head are frozen, and the Softmax classification head is trained separately using rare fault sample data with real labels (containing only known categories).

[0120] Phase Four: Full Model Fusion Fine-Tuning (Final Phase). This phase aims to integrate and collaboratively optimize the capabilities of all modules. First, all modules are unfrozen. Using fault sample data with real labels (containing only known categories), end-to-end fine-tuning is performed using a weighted multi-task loss function: .in It is the cross-entropy loss of the classification head. It's a loss of the One-Class header. This is a hyperparameter used to balance the importance of the two tasks. This stage uses a small learning rate for training until the model converges.

[0121] 4.5 Model Deployment and Application:

[0122] After model training is complete, to achieve efficient CPU deployment and reduce resource consumption, this invention uses the ONNX (Open Neural Network Exchange) format to quantize and convert the trained model. By converting the model to ONNX format, the dependency on specific deep learning frameworks can be eliminated, and hardware-accelerated inference can be achieved in a CPU environment using the ONNX Runtime.

[0123] 1) Performance and resource consumption. The quantized model is small in size, with extremely low memory consumption (less than 100MB) and extremely fast CPU inference speed (less than 50 milliseconds for a single inference on a standard server CPU). This extremely low performance consumption allows the model of this invention to be directly deployed on business machines, with real-time reading and analysis of runtime logs, without any performance impact on core business operations.

[0124] 2) Real-time Inference Process. The system collects data at a preset interval (e.g., every 5 minutes), preprocesses it, and then feeds it into the quantized ONNX model for inference. Since the model's inference speed is much faster than the data collection cycle, it fully meets the requirements for real-time detection. For each data point to be detected, the model first calculates its anomaly score. If the score is higher than a preset threshold, it is directly classified as an unknown anomaly (unknown anomalies can be converted into known faults through knowledge updates). If the score is lower than the threshold, it is then determined whether it is normal or a known fault based on the output of the classification head.

[0125] 3) Alarm System Linkage. Upon detecting any fault (including known faults and unknown anomalies), the system will immediately push alarm information to the fault alarm system. The alarm information not only includes the type of fault (such as "traffic aggregation platform port overflow" or "unknown anomaly"), but also includes the current values ​​and snapshots of various key indicators that led to this judgment, greatly shortening the time for fault location and handling.

[0126] To verify the effectiveness of the method described in this invention, a comprehensive performance evaluation was conducted on the complete model by comparing the climbing speed of the new correlation rate with that of the traditional correlation rate, and a series of ablation experiments were carried out to verify the contribution of various technical features.

[0127] 1) A diagram comparing the rate of increase of the new correlation rate and the traditional correlation rate is shown below. Figure 4 As shown.

[0128] The new correlation rate can stably reach 99% within 30 minutes under normal link conditions, while the traditional correlation rate calculation method takes several days to climb to 99%.

[0129] Complete Model Performance Evaluation Details: To comprehensively measure the performance of the complete model proposed in this invention on two parallel tasks, we adopted multiple evaluation metrics, and the specific results are shown in Table 2:

[0130] Table 2

[0131]

[0132] 3) Comparison of ablation experiments on model components:

[0133] To further demonstrate the necessity of each innovative module in this invention, we designed the following ablation experiment. As shown in Table 3, the experimental results clearly demonstrate that each innovative module of this invention makes a significant positive contribution to the final performance.

[0134] Table 3

[0135]

[0136] This invention provides a method, system, and apparatus for 5G signaling traffic anomaly detection and fault location. It utilizes user plane traffic to construct and maintain a live set of downlink forwarding tunnel endpoint identifiers (DL F-TEIDs) baselines in real time. New downlink user plane DL F-TEIDs appearing outside this baseline set are identified. This efficiently captures the association success rate of newly added DL F-TEIDs in control plane signaling.

[0137] Design a unique network architecture. This includes: an independent temporal feature extraction module, consisting of separate temporal networks (e.g., TCNs) configured for multiple heterogeneous key performance indicators (KPIs) with non-shared weights; a dynamic graph association learning module, which incorporates temporal information (e.g., time slices, holiday types) as learnable nodes into a graph neural network (GNN); and a parallel dual-decision-head module, which designs and constructs a classification head and an anomaly detection head in parallel, simultaneously outputting known fault categories and unknown anomaly scores.

[0138] To address the scarcity of labeled samples, a mirrored environment and automated scripts are used to trigger faults, thereby obtaining accurate fault samples. In the self-supervised pre-training phase, temporal networks (such as TCNs) for extracting temporal features and graph neural networks (GNNs) for learning associations are pre-trained on unlabeled data. In the decision head warm-up phase, the pre-trained backbone network is frozen, and an anomaly detection head is trained using normal samples, while a classification head is trained using known fault samples. In the full model fine-tuning phase, all network modules are unfrozen, and a multi-task loss function is used to perform end-to-end joint optimization of the entire model.

[0139] From the base station dimension, the correlation rate is calculated separately; the correlation rate of each dimension is quantified into multiple preset intervals, and the proportion of nodes falling into each interval is calculated to form a feature vector representing the spatial distribution of faults; the feature vector is used as input for downstream machine learning models.

[0140] A method for calculating correlation ratios and a weighted distributed feature extraction method are combined, and the results of the calculation and extraction are used as input to an anomaly detection model.

[0141] Compared with existing technologies, the method and system proposed in this invention have significant advantages in terms of real-time performance, sensitivity, accuracy, and intelligent analysis capabilities in 5G signaling traffic anomaly detection, specifically in the following aspects:

[0142] I. Results at the Data and Feature Processing Level:

[0143] This invention overcomes the inherent anomalies of existing technologies at the data source level through innovative data processing methods.

[0144] 1) Significantly shortens the fault exposure cycle. Existing technologies rely on low-frequency signaling to calculate correlation rates, resulting in the index taking several days to stabilize. This invention adopts a novel correlation rate calculation method based on incremental user plane traffic. Utilizing high-frequency user plane traffic, a stable correlation rate baseline can be established within 30 minutes after system startup or the start of any monitoring point, reducing the fault detection cycle from days to minutes.

[0145] 2) Improved sensitivity of anomaly detection. Existing correlation rate calculations "dilute" fault signals due to the accumulation of a large number of historical normal signaling, resulting in insensitivity to occasional and transient faults. This invention calculates the correlation rate only for newly added DL F-TEIDs, so that any failure to correlate a newly added DL F-TEID directly and significantly affects the indicator value, thereby greatly improving the response speed to various faults, especially transient faults.

[0146] 3) It provides a clear indication of fault existence, reducing the diagnostic complexity of downstream models. Existing technologies exhibit a normal upward trend in correlation rate curves, requiring expert experience to determine anomalies. The novel correlation rate of this invention remains stable at nearly 100% in the absence of faults; any significant drop in the indicator clearly indicates the presence of a fault, providing high-quality binary (normal / abnormal) prior input for subsequent AI models, allowing them to focus more on identifying specific fault types.

[0147] 4) Reduced system overhead. Existing technologies typically require deep parsing of signaling to extract complex user three-code information in order to obtain associated information, which consumes significant resources. This invention only needs to extract lightweight DLF-TEID information from user plane traffic, significantly reducing the additional burden on system performance.

[0148] II. Effects at the model algorithm level:

[0149] This invention enhances intelligent analysis capabilities through a unique model architecture and training strategy.

[0150] 1) High-precision detection of unknown faults is achieved. Traditional supervised learning models can only identify fault types already present in the training set and are ineffective against unknown "zero-day" anomalies. This invention adopts a parallel dual-decision-head (classification head + anomaly detection head) output architecture, which can effectively defend against unknown anomalies while identifying known faults. As shown in the experimental results, its F1 score for unknown anomaly detection reaches 0.91, while controlling the false alarm rate to 2.5%.

[0151] 2) This invention enables the modeling of dynamic relationships between indicators. Existing technologies typically only learn static, averaged relationships between indicators. This invention innovatively introduces learnable "time nodes" into Graph Neural Networks (GNNs), allowing the model to learn how temporal contexts (such as business peaks / off-peaks, holidays) adjust the intrinsic relationships between indicators. As shown in ablation experiments, this design significantly improves the model's performance in complex scenarios.

[0152] 3) This invention provides an effective model training scheme for scenarios where real-world fault samples are scarce. The performance of traditional data-driven models is severely limited by the scarcity and high cost of labeled fault samples. This invention employs a four-stage training strategy that includes self-supervised pre-training and multi-task fine-tuning. By fully utilizing massive amounts of unlabeled data, it significantly reduces the dependence on labeled samples. As shown in the ablation experiments, this strategy is crucial for ensuring model performance and generalization ability.

[0153] 4) Enhanced model interpretability, providing assistance for fault root cause localization. Many deep learning models are "black boxes," making it difficult to explain their decision-making basis. The learnable adjacency matrix in the GNN of this invention can quantitatively reveal the strength of the interaction between time and each KPI after training, providing a decision reference for fault localization analysis.

[0154] The solution proposed in this invention is the result of a selection based on the integration of comprehensive engineering systems and technical proficiency; however, some modules do indeed have alternative technical paths. This section aims to analyze these alternative solutions and further demonstrate the superiority and inventiveness of the solution selected in this invention.

[0155] 1) Analysis of alternative solutions for the time-series feature extraction module:

[0156] Existing technologies: In the field of time series modeling, in addition to TCN, commonly used technologies include recurrent neural networks (RNNs) such as LSTM / GRU.

[0157] This invention employs time-series models such as RNNs, and after experimental comparison, TCN was selected. TCNs offer better parallel computing capabilities (convolution operations can be parallelized) and more stable gradients (avoiding the vanishing / exploding gradient problem of RNNs). More importantly, unlike existing TCN+GNN solutions such as MTGNN, this invention designs an independent TCN network for each heterogeneous KPI, coupled with non-uniform sampling. This is a depth-specific optimization for the problems in this field, and as demonstrated in our ablation experiments (variant E), this design significantly improves performance.

[0158] 2) Analysis of alternative solutions for context information fusion:

[0159] Existing techniques: Integrating temporal information into graph neural networks, a common approach is to enhance the attributes of nodes or edges through timestamp embedding or temporal attention mechanisms (such as TGAT, TGN).

[0160] To more deeply model the global and regulatory impact of time on the overall network state, we employed a "time node" scheme. This is a deeper level of "structural" fusion that allows GNNs to explicitly learn the interactions between time and other metrics. As demonstrated in our ablation experiments (variant A), this scheme significantly outperforms traditional fusion methods.

[0161] 3) Analysis of alternative solutions for anomaly detection heads:

[0162] Existing technologies: In the field of single-class anomaly detection, besides Deep SVDD, there are other methods based on reconstruction errors using autoencoders or energy-based models. This invention prefers Deep SVDD because its training objective (mapping normal samples to a minimum volume hypersphere) aligns closely with the task of "defining the boundary of normal patterns," making its objective more direct. Furthermore, it can be seamlessly integrated into our end-to-end deep learning framework and forms an efficient multi-task learning mechanism with the classification head.

[0163] It will be understood by those skilled in the art that the above descriptions are merely preferred examples of the invention and are not intended to limit the invention. Although the invention has been described in detail with reference to the foregoing examples, those skilled in the art can still modify the technical solutions described in the foregoing examples or make equivalent substitutions for some of the technical features. All modifications and equivalent substitutions made within the spirit and principles of the invention should be included within the scope of protection of the invention. All technical features in this embodiment can be freely combined according to actual needs.

[0164] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting and locating abnormal 5G signaling traffic, characterized in that: Specifically, it includes the following steps; Step 1, Fault Sample Collection: Combining the production environment and the mirror bypass environment, systematically collect and label various known fault sample data, including normal samples, through manual simulation triggering. Step 2, Time Series Data Acquisition and Feature Extraction: Periodically acquire non-uniform interval time series data of multiple preset indicators within a preset time window, and process the heterogeneous time series data of each indicator using a temporal convolutional network (TCN) configured independently for it, and extract the unique deep temporal feature vector of each indicator. Step 3, Dynamic Graph Construction of Endogenous Context: Construct a graph neural network (GNN) input graph that uses temporal context as endogenous nodes; the GNN input graph contains multiple index nodes and one context node; The initial features of each indicator node are the deep temporal feature vectors output by the corresponding temporal convolutional network TCN in step 2; the context node is a time node, and its initial features are generated by the learnable embedding vectors corresponding to the current time information and date type information. Step 4, Dynamic Association Learning: The graph containing time nodes constructed in Step 3 is processed using a graph neural network (GNN). Each node is learned and updated through a message passing mechanism to generate node features that integrate spatiotemporal dynamic association information. Step 5, Graph-level representation generation and multi-head decision-making: Perform graph readout operation on the node features output in Step 4 to generate a graph-level feature vector representing the current state of the entire graph; feed the graph-level feature vector into at least two independent decision heads in parallel; The classification head is used to classify samples into multiple known abnormal categories, including normal. An anomaly detection head is used to calculate the anomaly score of a sample in order to determine whether it is an unknown anomaly. Step 6, Multi-stage pre-training and fine-tuning: A strategy including TCN self-supervised pre-training, GNN graph contrastive learning pre-training, separate warm-up of anomaly detection head and classification head, and multi-task fusion fine-tuning is adopted to ensure the gradual unlocking and collaborative optimization of model capabilities.

2. The method for 5G signaling traffic anomaly detection and fault location according to claim 1, characterized in that: In step 1, a mirror environment is built and fault samples are supplemented through manual simulation. The specific steps include the following: Step 1.1: Collect operational knowledge of the production environment: Determine whether the data is normal based on the correlation rate index, which will be used for subsequent unlabeled pre-training and anomaly detection head training; Step 1.2, set up the mirror experimental environment: add a splitter to the front end of the aggregation and splitting platform, mirror a copy of the input traffic of the aggregation platform to the mirror environment, and set up a software and hardware mirror environment that is exactly the same as the production environment. Step 1.3, Actively trigger faults and generate fault samples: In the mirror environment, write an automated script to generate faults according to the table below, record the fault start time and end time, and collect fault logs; In order to increase the generalization ability of the model, the fault severity and fault duration are randomized during fault simulation; The fault logs are labeled according to the recorded fault type and fault duration.

3. The method for 5G signaling traffic anomaly detection and fault location according to claim 1, characterized in that: In step 2, sample preprocessing: During fault identification, the complex log information is structured into multi-dimensional features usable by the model. The specific implementation steps are as follows: Step 2.1, Non-uniform sampling of time series data: A non-uniform time series sampling strategy is adopted to replace the multi-dimensional analysis model; Step 2.2, extract key performance indicators (KPIs): extract five key performance indicators (KPIs) from the sampled data as input to the subsequent Temporal Convolutional Network (TCN); Step 2.3, Extract context information: Extract the context information corresponding to the detection time to construct the time nodes in the graph; Step 2.4, Data Labeling: Based on the timestamp of the current detection time, find the recorded fault type and fault duration information, and label the sample with the corresponding fault tag, including link traffic overflow or normal.

4. The method for 5G signaling traffic anomaly detection and fault location according to claim 3, characterized in that: The five key performance indicators (KPIs) specifically include: 1) TCP packet loss ratio: used to reflect the quality of the signaling transmission link; 2) Signaling plane to user plane traffic ratio: used to measure the load balancing relationship between the control plane and the data plane; 3) Number of active bearer nodes and user nodes: This provides a macro view of the current network load and traffic composition, and provides contextual information for the model to determine whether the current network state includes high load or low load; 4) Added TEID correlation rate to user plane downlink data: used to detect whether the current user has signaling loss and the severity of signaling loss; 5) Distributed correlation rate distribution index group: used to overcome the shortcomings of a single global correlation rate in reflecting local fault anomalies, and to characterize the spatial distribution characteristics of faults in the network topology through statistical methods.

5. The method for 5G signaling traffic anomaly detection and fault location according to claim 1, characterized in that: In step 3, a parallel multi-head output model based on TCN+GNN network is adopted to fully learn the temporal features and intrinsic correlations of the fault; the parallel multi-head output model based on TCN+GNN network includes a temporal feature extraction and fusion module, a graph association learning module, and a readout and multi-head decision module; The temporal feature extraction and fusion module receives temporal sequences formed by non-uniform sampling of various KPIs and extracts their deep temporal features through a hierarchical processing structure. Each KPI generates a feature vector, providing high-quality node input for the subsequent graph neural network (GNN). It includes two stages: parallel independent temporal feature extraction and hierarchical feature fusion. The graph association learning module is used to learn the dynamic and complex relationships between nodes in the entire graph, including time nodes; it includes four stages: dynamic graph construction, graph structure definition, graph attention network (GAT), and information propagation. Readout and Multi-Head Decision Module: This module consists of two stages: graph-level readout and parallel decision heads.

6. The method for 5G signaling traffic anomaly detection and fault location according to claim 1, characterized in that: In step 4, a four-stage pre-training and fine-tuning strategy involving multi-task fusion is adopted. By fully utilizing unlabeled data for self-supervised learning, it addresses the issues of scarce labeled real-world fault samples and the complex and ever-changing real-world environment. Specifically, it includes the following stages: Phase 1: Temporal self-supervised pre-training of Temporal Convolutional Network (TCN): Five independent TCN networks are pre-trained on massive amounts of unlabeled historical monitoring data using a temporal mask reconstruction task to enable them to master general temporal patterns. Phase 2, Graph Contrast Learning Pre-training: Freeze the Temporal Convolutional Network (TCN) and pre-train the Graph Neural Network (GNN) and the Temporal Embedding Layer; Phase 3: Separate warm-up of the anomaly detection head and the classification head: Anomaly detection head training: Freeze the pre-trained Temporal Convolutional Network (TCN) and Graph Neural Network (GNN) backbone networks; Training is performed using normal samples from unlabeled data, employing One-Class loss. To minimize the representation z(x) of all normal samples to the center point The average distance is used to define the boundaries of normal data patterns; After warming up the classification head, the Temporal Convolutional Network (TCN), the Graph Neural Network (GNN) backbone network, and the anomaly detection head are frozen. The Softmax classification head is trained separately using rare, real-label fault sample data. Phase Four, Full Model Integration and Fine-tuning: Integrating and coordinating the capabilities of all modules; Unfreeze all modules, use real-labeled fault sample data, and fine-tune end-to-end using a weighted multi-task loss function: ;in It is the cross-entropy loss of the classification head. It's a loss of the One-Class header. It is a hyperparameter used to balance the importance of two tasks.

7. The method for 5G signaling traffic anomaly detection and fault location according to claim 1, characterized in that: In step 5, the trained model is quantized and converted using the ONNX format. By converting the model to the ONNX format, the dependence on a specific deep learning framework is eliminated, and hardware-accelerated inference is achieved in a CPU environment using the ONNX Runtime.

Images