Communication information anomaly detection method and system based on self-supervised learning

Abstract

The application provides a communication information anomaly detection method and system based on self-supervised learning, relates to the technical field of communication networks, and first collects communication information symbiotic units with mutual dependence transmission relationship; a feature symbiotic modeling structure is constructed based on self-supervised learning to capture the feature symbiotic relationship between communication information; the structure is used for self-supervised learning of historical symbiotic units to generate feature symbiotic trajectories; the real-time collected symbiotic units are matched with the feature symbiotic trajectories to establish an anchoring relationship; the deviation propagation process of the real-time symbiotic unit feature symbiotic relationship and the trajectory is tracked, a symbiotic deviation feature set is extracted, and an anomaly detection result is generated. The application improves the accuracy and reliability of communication information anomaly detection and guarantees the safe and stable transmission of communication networks.

Description

Technical Field

[0001] This application relates to the field of communication network technology, and more specifically, to a method and system for detecting communication information anomalies based on self-supervised learning. Background Technology

[0002] With the rapid development of communication technology, communication networks are expanding in scale and becoming increasingly complex, resulting in an explosive growth in communication information traffic. At the same time, various anomalies are also frequently occurring, such as network attacks, equipment failures, and signal interference. These anomalies can lead to the loss, alteration, or interruption of communication information, causing serious losses to individuals, businesses, and even nations.

[0003] Existing methods for detecting communication anomalies are mainly divided into two categories: supervised learning and unsupervised learning. Supervised learning requires a large number of labeled normal and abnormal communication data samples for training. However, in practical applications, obtaining a sufficient number of accurate anomaly samples is extremely difficult because the occurrence of anomalies is random and unpredictable, and many novel anomalies do not have corresponding labeled samples before their emergence. While unsupervised learning does not require labeled samples, traditional methods often only focus on the local features of the communication information itself, such as the length and frequency of data packets, ignoring the complex dependencies that exist in the communication information during transmission. Communication information in a communication network does not exist in isolation; during transmission, it naturally forms multiple communication information combinations with interdependent transmission relationships, i.e., communication information symbiotic units. Existing methods fail to fully utilize these symbiotic relationships to detect anomalies, resulting in low detection accuracy and real-time performance, making it difficult to meet the high requirements of modern communication networks for anomaly detection. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a communication information anomaly detection method and system based on self-supervised learning.

[0005] According to a first aspect of this application, a method for detecting communication information anomalies based on self-supervised learning is provided, the method comprising:

[0006] The communication information co-occurrence unit is a collection of communication information transmitted in the communication network. The communication information co-occurrence unit is a combination of multiple communication information that are naturally formed during the communication process and have interdependent transmission relationships. Each communication information co-occurrence unit contains multiple communication information and co-occurrence attribute information that have transmission dependencies.

[0007] Based on the unsupervised co-occurrence rules of self-supervised learning, a feature co-occurrence modeling structure is constructed. The feature co-occurrence modeling structure is used to capture the feature co-occurrence relationship between different communication information in the communication information co-occurrence unit. The feature co-occurrence relationship is a stable dependency state formed by communication information under normal transmission conditions.

[0008] The feature co-occurrence modeling structure is used to perform self-supervised learning on historical communication information co-occurrence units to generate feature co-occurrence trajectories for normal transmission of communication information. The feature co-occurrence trajectory is the path of change of feature co-occurrence relationships in communication information co-occurrence units as the transmission process progresses.

[0009] The co-occurrence units of real-time acquired communication information are co-occurred and matched with the feature co-occurrence trajectory to establish a co-occurrence anchoring relationship between the co-occurrence units of real-time acquired communication information and the feature co-occurrence trajectory.

[0010] Based on the symbiotic anchoring relationship, the deviation propagation process of the feature symbiotic relationship and the feature symbiotic trajectory in the real-time collected communication information symbiotic unit is tracked, and a symbiotic deviation feature set including the deviation start position, propagation path, change state and evolution direction is extracted. Based on the symbiotic deviation feature set, a communication information anomaly detection result is generated.

[0011] According to a second aspect of this application, a communication information anomaly detection system based on self-supervised learning is provided. The communication information anomaly detection system based on self-supervised learning includes a machine-readable storage medium and a processor. The machine-readable storage medium stores machine-executable instructions. When the processor executes the machine-executable instructions, the communication information anomaly detection system based on self-supervised learning implements the aforementioned communication information anomaly detection method based on self-supervised learning.

[0012] According to a third aspect of this application, a computer-readable storage medium is provided, wherein computer-executable instructions are stored therein, and when the computer-executable instructions are executed, the aforementioned communication information anomaly detection method based on self-supervised learning is implemented.

[0013] Based on any of the above aspects, the technical effect of this application is as follows:

[0014] By collecting communication information symbiotic units, this study considers multiple communication information combinations with interdependent transmission relationships naturally formed during the communication process and their symbiotic attribute information. Based on unsupervised symbiotic rules developed through self-supervised learning, a feature symbiotic modeling structure is constructed. This structure can accurately capture the feature symbiotic relationships between different communication information within the communication information symbiotic units. These feature symbiotic relationships reflect the stable dependency state formed by communication information under normal transmission conditions. The feature symbiotic trajectory generated by self-supervised learning of historical communication information symbiotic units through the feature symbiotic modeling structure presents the changing path of feature symbiotic relationships within communication information symbiotic units as the transmission process progresses. By performing symbiotic matching between real-time collected communication information symbiotic units and feature symbiotic trajectories and establishing symbiotic anchoring relationships, the study can accurately track the deviation propagation process of feature symbiotic relationships and feature symbiotic trajectories within real-time communication information symbiotic units. The extracted symbiotic deviation feature set contains key information such as the deviation starting position, propagation path, change state, and evolution direction. The communication information anomaly detection results generated based on this information have higher accuracy and reliability, enabling timely detection of anomalies in the communication network, ensuring the safe and stable transmission of communication information, and effectively improving the operational quality and security of the communication network. Attached Figure Description

[0015] Figure 1 A flowchart illustrating the communication information anomaly detection method based on self-supervised learning provided in an embodiment of this application is shown.

[0016] Figure 2 This illustration shows a schematic diagram of the component structure of a communication information anomaly detection system based on self-supervised learning, provided in an embodiment of this application, for implementing the above-described communication information anomaly detection method based on self-supervised learning. Detailed Implementation

[0017] Figure 1 This paper illustrates a flowchart of a communication information anomaly detection method and system based on self-supervised learning provided in an embodiment of this application. The detailed steps include:

[0018] Step S110: Collect communication information co-occurrence units transmitted in the communication network. The communication information co-occurrence unit is a combination of multiple communication information that are naturally formed during the communication process and have interdependent transmission relationships. Each communication information co-occurrence unit contains multiple communication information that have transmission dependencies and co-occurrence attribute information.

[0019] In this embodiment, the description focuses on a core network data transmission scenario. First, a data packet acquisition module deployed at the core network edge collects all data packets from all transmission links within the core network, covering both control plane signaling packets and user plane data packets. This acquisition module obtains link data via port mirroring, avoiding bandwidth consumption or delays on existing transmission links. Simultaneously, the collected data packets undergo desensitization processing, removing sensitive information such as user identifiers and terminal hardware identifiers. The desensitization method combines character replacement and field nulling to ensure that private data is not leaked.

[0020] In this embodiment, each collected communication information co-occurrence unit consists of at least three communication information messages with transmission dependencies. For example, during a VoLTE call, there are three communication information messages: a session initiation protocol signaling packet, a media gateway control protocol signaling packet, and a real-time transmission protocol data packet. The transmission of these three communication information messages has a strict sequential dependency: the session initiation protocol signaling packet completes session establishment first, the media gateway control protocol signaling packet completes media resource allocation, and finally the real-time transmission protocol data packet performs voice data transmission. The co-occurrence attribute information of each communication information co-occurrence unit includes a unique identifier of the co-occurrence unit, a timestamp of the co-occurrence unit generation, the number of communication information messages constituting the co-occurrence unit, the transmission priority of each communication information message, the transmission protocol type of each communication information message, the source address prefix of each communication information message, and the destination address prefix of each communication information message. The above co-occurrence attribute information is stored in key-value pair format, and each record corresponds to one communication information co-occurrence unit.

[0021] Step S120: Based on the unsupervised co-occurrence rules of self-supervised learning, construct a feature co-occurrence modeling structure. The feature co-occurrence modeling structure is used to capture the feature co-occurrence relationship between different communication information in the communication information co-occurrence unit. The feature co-occurrence relationship is a stable dependency state formed by communication information under normal transmission conditions.

[0022] In this embodiment, based on the transmission characteristics of the core network data transmission scenario, an unsupervised symbiosis rule for self-supervised learning is first defined: if communication information within the same communication session in the core network maintains a fixed transmission order, a fixed transmission interval range, and a fixed data packet length ratio over multiple consecutive transmission cycles, then a stable feature symbiosis relationship exists between the aforementioned communication information. Based on the above rule, the core logic of constructing the feature symbiosis modeling structure is to decompose the communication information symbiosis unit into a multi-dimensional symbiosis relationship network, and capture the most stable symbiosis relationship nodes through dynamic anchor points, while simultaneously achieving cross-dimensional symbiosis relationship association.

[0023] Step S121: Extract the transmission attribute content of each communication information in the communication information co-existence unit. The transmission attribute content is the specific information that the communication information carries in the network transmission to characterize its own transmission status.

[0024] In this embodiment, for each communication message, the extracted transmission attribute content includes the protocol type, transmission port number, data packet length, transmission timestamp, time-to-live (TTL) value, service type field value, source address prefix, destination address prefix, data payload encryption identifier, retransmission identifier, fragmentation identifier, etc. The above transmission attribute content is extracted from the header fields and payload description fields of the collected raw data packets. Each communication message corresponds to a set of transmission attribute content, where each element is a key-value pair for an attribute. For example, the key-value pair corresponding to the protocol type is "protocol_type: SIP", and the key-value pair corresponding to the data packet length is "packet_length: L", where L is the specific value of the data packet length. All transmission attribute content has been standardized to eliminate the influence of dimensions, ensuring dimensional consistency in subsequent calculations.

[0025] Step S122: Divide the transmission attribute content of all communication information into symbiotic dimensions, and divide them into multiple symbiotic dimensions that reflect the symbiotic relationship of features. Each symbiotic dimension corresponds to a dependency state of a type of transmission attribute content.

[0026] In this embodiment, a clustering algorithm based on attribute correlation is used to divide the transmission attribute content of all communication information into co-occurrence dimensions. First, the correlation degree between every two transmission attribute contents is calculated. The correlation degree is calculated by statistically analyzing the frequency of the simultaneous occurrence of two attributes in the same communication information co-occurrence unit, and the synchronicity of the value changes of the two attributes. The synchronicity is determined by statistically analyzing the proportion of the number of times the values ​​of the two attributes change simultaneously within a continuous transmission cycle to the total number of transmission cycles. Then, transmission attribute contents with a correlation degree higher than a preset threshold are divided into the same co-occurrence dimension. The final co-occurrence dimensions include signaling interaction co-occurrence dimension, data transmission co-occurrence dimension, address mapping co-occurrence dimension, and quality of service co-occurrence dimension. Among them, the signaling interaction co-occurrence dimension corresponds to transmission attribute contents related to signaling interaction, such as protocol type, transmission port number, and retransmission flag; the data transmission co-occurrence dimension corresponds to transmission attribute contents related to data transmission, such as data packet length, data payload encryption flag, and fragmentation flag; the address mapping co-occurrence dimension corresponds to transmission attribute contents related to address mapping, such as source address prefix and destination address prefix; and the quality of service co-occurrence dimension corresponds to transmission attribute contents related to quality of service, such as time-to-live value, service type field value, and transmission priority. Each symbiotic dimension corresponds to a dependency state of a type of transmission attribute content. For example, the dependency state of the signaling interaction symbiotic dimension is a fixed correspondence between the protocol type, transmission port number, and retransmission identifier of signaling communication information.

[0027] Step S123: For each symbiotic dimension, extract the symbiotic support content of all communication information under that symbiotic dimension. The symbiotic support content is the core transmission attribute combination that maintains the feature symbiotic relationship under that symbiotic dimension.

[0028] In this embodiment, for each symbiotic dimension, a frequent itemset mining algorithm is used to extract the symbiotic support content of all communication information under that symbiotic dimension. Taking the signaling interaction symbiotic dimension as an example, firstly, the transmission attribute content of all communication information under this dimension is converted into a transaction set, with each transaction corresponding to a set of transmission attribute content for a communication information. Then, by traversing the transaction set, the frequency of each transmission attribute combination appearing in the transaction set is counted. The frequency is calculated as the proportion of the number of transactions containing that transmission attribute combination to the total number of transactions. Transmission attribute combinations with a frequency higher than a preset threshold are determined as the symbiotic support content of that symbiotic dimension. For example, the symbiotic support content of the signaling interaction symbiotic dimension is "Protocol type: SIP, Transmission port number: P1, Retransmission flag: 0", "Protocol type: MGCP, Transmission port number: P2, Retransmission flag: 0", etc. The above transmission attribute combinations appear very frequently in the normal transmission scenario of the core network and are the core attribute combinations that maintain the characteristic symbiotic relationship between signaling interaction communication information.

[0029] Step S124: Based on the symbiotic support content under the same symbiotic dimension, construct the intra-dimensional symbiotic network corresponding to the symbiotic dimension. Each node in the intra-dimensional symbiotic network corresponds to a communication information, and the connection between nodes corresponds to the specific stable dependency state of the feature symbiotic relationship.

[0030] In this embodiment, the specific method for constructing the intra-dimensional symbiotic network for each symbiotic dimension is as follows: First, each communication information under the symbiotic dimension is mapped to a node in the network. The attributes of each node include a unique identifier of the communication information, a set of transmission attribute contents of the communication information, and an identifier of the symbiotic supporting content of the communication information. Then, based on the symbiotic supporting content of the symbiotic dimension, the connection rules between nodes are determined: if the transmission attribute contents of two communication information both contain the same symbiotic supporting content, and the two communication information have a transmission dependency relationship in the same communication information symbiotic unit, then a connection is established between the two nodes. The connection attributes between nodes include a unique identifier of the connection, an identifier of the symbiotic supporting content corresponding to the connection, and the stability of the connection. The stability of the connection is determined by statistically analyzing the proportion of the number of times the two communication information appear simultaneously in historical transmission data and meet the transmission dependency relationship to the total number of transmissions. The stability of all connections has been standardized to eliminate the influence of dimensions. Taking the signaling interaction symbiosis dimension as an example, the nodes in the symbiotic network within the dimension include Session Initiation Protocol (SIP) signaling packet nodes, Media Gateway Control Protocol (MTCP) signaling packet nodes, Session Description Protocol (SMAP) signaling packet nodes, etc. The connection between the SIP signaling packet node and the MTCP signaling packet node has the corresponding symbiotic support content as a combination of "Protocol Type: SIP, Transmission Port Number: P1, Retransmission Flag: 0" and "Protocol Type: MGCP, Transmission Port Number: P2, Retransmission Flag: 0". The stability of the connection is the proportion of the number of times the above two communication information appear simultaneously in the historical transmission data and meet the session establishment dependency relationship to the total number of session establishments.

[0031] Step S125: Extract common symbiotic content of communication information symbiotic units in different symbiotic dimensions across symbiotic dimensions. The common symbiotic content is a combination of supporting transmission attributes shared by the feature symbiotic relationship under different symbiotic dimensions.

[0032] In this embodiment, the specific method for extracting common symbiotic content across symbiotic dimensions is as follows: First, the symbiotic support content of each symbiotic dimension is converted into a set of attribute combinations. Then, the intersection operation is performed on the attribute combination sets of all symbiotic dimensions to extract the transmission attribute combinations that exist in at least two symbiotic dimension attribute combination sets. Simultaneously, the frequency of the above transmission attribute combinations appearing simultaneously in communication information symbiotic units across different symbiotic dimensions is statistically analyzed. The frequency is calculated as the proportion of the number of communication information symbiotic units containing the transmission attribute combination to the total number of communication information symbiotic units. Transmission attribute combinations with a frequency higher than a preset threshold are identified as common symbiotic content. For example, the transmission attribute combination "symbiotic unit generation timestamp: T, transmission priority: High" exists in the symbiotic support content of the signaling interaction symbiotic dimension, data transmission symbiotic dimension, and quality of service symbiotic dimension, and appears with extremely high frequency in the normal core network transmission scenario. Therefore, it is identified as common symbiotic content. The above transmission attribute combination is the core attribute combination that maintains the shared characteristic symbiotic relationship across different symbiotic dimensions.

[0033] Step S126: Based on the common symbiotic content, a cross-dimensional symbiotic link is built. The cross-dimensional symbiotic link is used to connect the intra-dimensional symbiotic networks of different symbiotic dimensions to realize the association and transmission of symbiotic relationships of features in different dimensions.

[0034] In this embodiment, the specific method for building cross-dimensional symbiotic links based on common symbiotic content is as follows: First, in the symbiotic network within each dimension, nodes containing common symbiotic content are identified, and these nodes are determined as cross-dimensional connection nodes. Then, links are established between the cross-dimensional connection nodes in the symbiotic networks of different dimensions. The attributes of the link include the unique identifier of the link, the identifier of the common symbiotic content corresponding to the link, and the number of association transmissions of the link. The number of association transmissions of the link is determined by counting the number of interactions between communication information containing the aforementioned common symbiotic content in the communication information symbiotic units within different dimensions. Taking the common symbiotic content "Symbiotic Unit Generation Timestamp: T, Transmission Priority: High" as an example, in the symbiotic network within the signaling interaction symbiotic dimension, the Session Initiation Protocol (SIP) signaling packet node contains the above common symbiotic content. In the symbiotic network within the data transmission symbiotic dimension, the Real-Time Transmission Protocol (RTT) data packet node contains the above common symbiotic content. Therefore, a cross-dimensional symbiotic link is established between the Session Initiation Protocol (SIP) signaling packet node and the Real-Time Transmission Protocol (RTT) data packet node. The number of associated transmissions of the above link is the number of interactions between the Session Initiation Protocol (SIP) signaling packet and the Real-Time Transmission Protocol (RTT) data packet during all VoLTE calls in the core network.

[0035] Step S127: Generate intra-dimensional symbiotic anchors based on the node transmission frequency of the symbiotic network in each dimension, and generate cross-dimensional symbiotic anchors based on the number of transmission interactions in the cross-dimensional symbiotic link. The intra-dimensional symbiotic anchors are the nodes with the most stable feature symbiotic relationships in the intra-dimensional symbiotic network, and the cross-dimensional symbiotic anchors are the nodes with the most frequent association transmission in the cross-dimensional symbiotic link.

[0036] In this embodiment, the generation of intra-dimensional symbiotic anchor points and cross-dimensional symbiotic anchor points is based on node transmission frequency and link transmission interaction number, and is combined with the compatibility verification of symbiotic support content and common symbiotic content. The specific implementation logic is described in steps S1271 to S12710.

[0037] Step S1271: Count the number of times the communication information corresponding to each node in the symbiotic network within each dimension is transmitted and interacted with the communication information corresponding to other nodes, forming the node transmission frequency of each node;

[0038] In this embodiment, for nodes in the symbiotic network within each dimension, the node transmission frequency is statistically analyzed as follows: The total number of transmission interactions between the communication information corresponding to the node and the communication information corresponding to all other nodes in the symbiotic network within the same communication information symbiotic unit is counted. The criteria for determining a transmission interaction are that the transmission timestamp interval between the two communication messages is within a preset range, and the transmission dependency relationship between the two communication messages conforms to the dependency rules of the corresponding symbiotic dimension. After the statistics are completed, the number of transmission interactions for each node is standardized by dividing the number of transmission interactions for that node by the maximum value of the number of transmission interactions for all nodes in the symbiotic network within the dimension. The result is the node transmission frequency for that node. The transmission frequencies of all nodes range from 0 to 1, eliminating the influence of dimensions.

[0039] Step S1272: Count the number of transmission interactions of each connection line in each cross-dimensional symbiotic link per unit time to form the link interaction frequency of each connection line;

[0040] In this embodiment, the link interaction frequency for each cross-dimensional symbiotic link is calculated as follows: The total number of transmission interactions occurring per unit time is calculated for the communication information corresponding to nodes in the two different symbiotic networks connected by the link. The criteria for determining a transmission interaction are that the unique identifiers of the symbiotic units of the two communication information pieces are identical, and the transmission attribute content of both communication information pieces contains the common symbiotic content of the corresponding cross-dimensional symbiotic link. After the statistics are completed, the number of transmission interactions for each link is standardized by dividing the number of transmission interactions for that link by the maximum value of the number of transmission interactions for all cross-dimensional symbiotic links. The result is the link interaction frequency for that link. The value range of all link interaction frequencies is between 0 and 1, eliminating the influence of dimensions.

[0041] Step S1273: Sort the transmission frequency of nodes in the symbiotic network within each dimension, and select the top X nodes as candidate symbiotic anchor points within the dimension.

[0042] In this embodiment, for each dimension's symbiotic network, the node transmission frequency of all nodes is sorted in descending order. After sorting, the top X nodes in the sorted results are selected as candidate symbiotic anchor points within the dimension, where X is a preset number of candidate nodes. The number of candidate nodes is determined based on the total number of nodes in the symbiotic network within the dimension; the larger the total number of nodes, the larger the number of candidate nodes. Taking the symbiotic network within the signaling interaction symbiotic dimension as an example, if the total number of nodes in this symbiotic network is M, then X is one-tenth of M. One-tenth of the nodes with the highest node transmission frequency in M ​​are selected as candidate symbiotic anchor points within the dimension.

[0043] Step S1274: Sort the link interaction frequency in each cross-dimensional symbiotic link, and select the endpoint nodes of the top Y connection lines as candidate cross-dimensional symbiotic anchor points.

[0044] In this embodiment, the link interaction frequency of all cross-dimensional symbiotic links is sorted in descending order. After sorting, the top Y cross-dimensional symbiotic links are selected, and the two endpoint nodes of these links are used as candidate cross-dimensional symbiotic anchor points. Y is a preset number of candidate links, which is determined based on the total number of cross-dimensional symbiotic links; the more links there are, the larger the number of candidate links. If the total number of cross-dimensional symbiotic links in the core network is N, then Y is one-tenth of N, and the endpoint nodes of the links with the highest link interaction frequency, which is one-tenth of N, are selected as candidate cross-dimensional symbiotic anchor points.

[0045] Step S1275: Extract the transmission attribute content of the communication information corresponding to the co-occurring anchor point within the candidate dimension, and verify the degree of fit between the transmission attribute content and the co-occurring support content of the corresponding co-occurring dimension;

[0046] In this embodiment, the verification method for the degree of fit for each candidate dimension's symbiotic anchor point is as follows: The number of symbiotic supporting contents of the corresponding symbiotic dimension contained in the transmission attribute content of the communication information corresponding to the candidate node is counted, and then divided by the total number of symbiotic supporting contents of the corresponding symbiotic dimension. The result is the degree of fit, which ranges from 0 to 1. Taking the symbiotic anchor point within the candidate dimension of the signaling interaction symbiotic dimension as an example, if the total number of symbiotic supporting contents of this symbiotic dimension is K, and the transmission attribute content of the communication information corresponding to the candidate node contains K1 symbiotic supporting contents, then the degree of fit is K1 divided by K.

[0047] Step S1276: Extract the transmission attribute content of the communication information corresponding to the candidate cross-dimensional symbiotic anchor point, and verify the degree of fit between the transmission attribute content and the cross-dimensional common symbiotic content;

[0048] In this embodiment, the verification method for the degree of fit for each candidate cross-dimensional symbiotic anchor point is as follows: count the number of cross-dimensional common symbiotic contents contained in the transmission attribute content of the communication information corresponding to the candidate node, divide the result by the total number of cross-dimensional common symbiotic contents, and the result is the degree of fit. The degree of fit ranges from 0 to 1. If the total number of cross-dimensional common symbiotic contents is P, and the transmission attribute content of the communication information corresponding to the candidate node contains P1 common symbiotic contents, then the degree of fit is P1 divided by P.

[0049] Step S1277: Retain candidate intra-dimensional co-occurring anchors whose fit reaches a preset threshold, and determine them as the final intra-dimensional co-occurring anchors;

[0050] In this embodiment, the preset threshold is the minimum acceptable value for the degree of fit, ranging from 0 to 1. In this embodiment, the preset threshold is set to 0.8. For each candidate symbiotic anchor point within a dimension, if its degree of fit is greater than or equal to 0.8, the candidate node is retained and determined as the final symbiotic anchor point within the dimension; if its degree of fit is less than 0.8, the candidate node is removed. Taking the candidate symbiotic anchor points within the signaling interaction symbiotic dimension as an example, if the degree of fit of a candidate node is 0.9, which is greater than the preset threshold of 0.8, then the candidate node is determined as the final symbiotic anchor point within the dimension.

[0051] Step S1278: Retain candidate cross-dimensional symbiotic anchor points whose fit reaches a preset threshold, and determine them as the final cross-dimensional symbiotic anchor points;

[0052] In this embodiment, the preset threshold is also set to 0.8. For each candidate cross-dimensional symbiotic anchor point, if its fit is greater than or equal to 0.8, the candidate node is retained and determined as the final cross-dimensional symbiotic anchor point; if its fit is less than 0.8, the candidate node is removed. If the fit of a candidate cross-dimensional symbiotic anchor point is 0.85, which is greater than the preset threshold of 0.8, then the candidate node is determined as the final cross-dimensional symbiotic anchor point.

[0053] Step S1279: Record the position of each final intra-dimensional symbiotic anchor point in the intra-dimensional symbiotic network and the corresponding node transmission frequency;

[0054] In this embodiment, the position of each final intra-dimensional symbiotic anchor point in the intra-dimensional symbiotic network is recorded by the unique identifier of the node, and the node transmission frequency corresponding to the node is also recorded. All records are stored in key-value pairs, such as "node_id: SIP_001, node_transmission_frequency: 0.95", where SIP_001 is the unique identifier of the session initiation protocol signaling packet node, and 0.95 is the node transmission frequency of the node.

[0055] Step S12710: Record the position of each final cross-dimensional symbiotic anchor point in the cross-dimensional symbiotic link and the corresponding link interaction frequency, and complete the generation of intra-dimensional symbiotic anchor points and cross-dimensional symbiotic anchor points;

[0056] In this embodiment, the position of each final cross-dimensional symbiotic anchor point in the cross-dimensional symbiotic link is recorded using the unique identifier of the link and the unique identifier of the node. The link interaction frequency corresponding to that link is also recorded. All records are stored in key-value pairs, for example, "link_id: Cross_001, source_node_id: SIP_001, target_node_id: RTP_001, link_interaction_frequency: 0.92", where Cross_001 is the unique identifier of the cross-dimensional symbiotic link, SIP_001 is the unique identifier of the node within the signaling interaction symbiotic dimension, RTP_001 is the unique identifier of the node within the data transmission symbiotic dimension, and 0.92 is the link interaction frequency of that link. This completes the generation of the intra-dimensional symbiotic anchor point and the cross-dimensional symbiotic anchor point.

[0057] Step S128: Based on the changes in the feature symbiotic relationship of the newly collected communication information symbiotic unit, a dynamic adjustment operation for symbiotic anchor points is established. Through this dynamic adjustment operation, the positions of symbiotic anchor points within the dimension and cross-dimensional symbiotic anchor points and the corresponding stable dependency state of feature symbiotic relationships are updated in real time.

[0058] In this embodiment, the construction of the symbiotic anchor point dynamic adjustment operation is based on the characteristic symbiotic relationship changes of the newly collected communication information symbiotic units. The specific implementation logic is described through steps S1281 to S12810.

[0059] Step S1281: Receive newly acquired communication information co-occurrence units in real time, and determine the co-occurrence dimension to which the newly acquired communication information co-occurrence unit belongs through the co-occurrence dimension division rules in the initial feature co-occurrence modeling structure;

[0060] In this embodiment, after receiving newly acquired communication information co-existing units in real time, the transmission attribute content of all communication information in the co-existing unit is extracted. Then, based on the range of transmission attribute content corresponding to the co-existing dimensions already divided in the initial feature co-existing modeling structure, the co-existing dimension to which the co-existing unit belongs is determined. The determination method is to count the number of transmission attribute content ranges corresponding to each co-existing dimension in the transmission attribute content of the communication information of the co-existing unit. The co-existing dimension with the most such ranges is the co-existing dimension to which the co-existing unit belongs. For example, if 70% of the transmission attribute content in the newly acquired communication information co-existing units belongs to the range corresponding to the signaling interaction co-existing dimension, then the co-existing unit is determined to belong to the signaling interaction co-existing dimension.

[0061] Step S1282: Extract the symbiotic support content and common symbiotic content from the newly collected communication information symbiotic unit, and compare them with the existing symbiotic support content and common symbiotic content in the corresponding symbiotic dimension;

[0062] In this embodiment, the method for extracting symbiotic support content and common symbiotic content from the newly collected communication information symbiotic unit is consistent with the method for extracting symbiotic support content and common symbiotic content in steps S123 and S125. Then, the extracted symbiotic support content is compared with the existing symbiotic support content in the corresponding symbiotic dimension, and the extracted common symbiotic content is compared with the existing common symbiotic content. The comparison method is to determine whether the extracted content already exists in the existing content set; if it does not exist, it is determined to be new content.

[0063] Step S1283: Identify the newly added symbiotic support content and common symbiotic content in the newly collected communication information symbiotic unit, and record the specific attributes and transmission status of the newly added content;

[0064] In this embodiment, the newly added symbiotic support content and common symbiotic content are identified based on the comparison results of step S1282. The specific attributes of the newly added content include attribute name, attribute value, and symbiotic dimension. The transmission status includes the frequency of occurrence of the newly added content in the newly collected communication information symbiotic unit and the transmission priority of the communication information corresponding to the newly added content. All recorded content is stored in key-value pairs, for example, "new_support_content: protocol_type: Diameter, transmission_port: P3, retransmission_flag: 0, symbiosis_dimension: Signaling_Interaction, occurrence_frequency: 0.8, transmission_priority: High", where protocol_type: Diameter is the attribute name and value of the newly added symbiotic support content, Signaling_Interaction is the symbiotic dimension, 0.8 is the occurrence frequency, and High is the transmission priority.

[0065] Step S1284: Determine the impact of the newly added symbiotic support content on the node transmission frequency in the symbiotic network within the corresponding symbiotic dimension, recalculate the node transmission frequency of the affected nodes, and adjust the node transmission frequency sorting.

[0066] In this embodiment, firstly, in the symbiotic network within the corresponding symbiotic dimension, nodes whose transmission attribute content includes newly added symbiotic support content are identified; these nodes are the affected nodes. Then, the node transmission frequencies of the affected nodes are recalculated, using the same method as in step S1271, but with the transmission data of the newly added communication information symbiotic units included in the statistics. Finally, the node transmission frequencies of all nodes in the symbiotic network within the corresponding symbiotic dimension are reordered, using the same method as in step S1273, resulting in a new node transmission frequency ranking.

[0067] Step S1285: Determine the impact of the newly added common symbiotic content on the link interaction frequency in the cross-dimensional symbiotic link, re-count the link interaction frequency of the affected connection lines, and adjust the link interaction frequency ranking.

[0068] In this embodiment, firstly, cross-dimensional symbiotic links whose transmission attribute content contains newly added common symbiotic content are identified; these links are the affected links. Then, the link interaction frequencies of the affected links are recalculated, using the same method as in step S1272, but with the transmission data of the newly added communication information symbiotic units included in the statistics. Finally, the link interaction frequencies of all cross-dimensional symbiotic links are reordered, using the same method as in step S1274, resulting in a new ranking of link interaction frequencies.

[0069] Step S1286: Based on the adjusted node transmission frequency sorting, reselect the co-occurring anchor points within the candidate dimensions and replace the original co-occurring anchor points within the candidate dimensions affected by the new content;

[0070] In this embodiment, the method of reselecting symbiotic anchor points within the candidate dimension based on the adjusted node transmission frequency ranking is the same as in step S1273. Then, the newly selected symbiotic anchor points within the candidate dimension are compared with the original symbiotic anchor points within the candidate dimension. Nodes whose node transmission frequency ranking has dropped to outside the preset range due to the influence of newly added symbiotic support content are identified as affected nodes. These affected nodes are then replaced with newly selected candidate nodes to obtain a new set of symbiotic anchor points within the candidate dimension.

[0071] Step S1287: Based on the adjusted link interaction frequency ranking, reselect candidate cross-dimensional symbiotic anchor points and replace the original candidate cross-dimensional symbiotic anchor points affected by the new content;

[0072] In this embodiment, the method of reselecting candidate cross-dimensional symbiotic anchor points based on the adjusted link interaction frequency ranking is the same as in step S1274. Then, the newly selected candidate cross-dimensional symbiotic anchor points are compared with the original candidate cross-dimensional symbiotic anchor points to identify nodes in the original candidate cross-dimensional symbiotic anchor points whose link interaction frequency ranking has dropped to outside the preset range due to the influence of newly added common symbiotic content. These nodes are identified as affected nodes, and the newly selected candidate nodes replace the affected nodes to obtain a new set of candidate cross-dimensional symbiotic anchor points.

[0073] Step S1288: Compare the transmission attribute differences between the newly selected candidate symbiotic anchor points in the dimension and the original symbiotic anchor points in the dimension, and adjust the stable dependency state of the feature symbiotic relationship of the symbiotic anchor points in the dimension according to the differences.

[0074] In this embodiment, for each newly selected symbiotic anchor point within a candidate dimension, if the candidate node is a newly added node, its corresponding stable dependency state of the feature symbiotic relationship is the dependency state corresponding to the symbiotic support content of the corresponding symbiotic dimension; if the candidate node is an existing node, but its transmission attribute content changes due to the influence of the newly added symbiotic support content, then the transmission attribute content before and after the change is compared, and its corresponding stable dependency state of the feature symbiotic relationship is adjusted according to the difference. The adjustment method is to include the newly added transmission attribute content in the determination condition of the stable dependency state. For example, if the original node's transmission attribute content is "protocol_type: SIP, transmission_port: P1, retransmission_flag: 0", and after adding symbiotic support content, the transmission attribute content becomes "protocol_type: SIP, transmission_port: P1, retransmission_flag: 0, service_type: Premium", then its corresponding stable dependency state of the feature symbiotic relationship is adjusted to a dependency state that includes the attribute "service_type: Premium".

[0075] Step S1289: Compare the transmission attribute differences between the newly selected candidate cross-dimensional symbiotic anchor points and the original cross-dimensional symbiotic anchor points, and adjust the stable dependency state of the feature symbiotic relationship of the cross-dimensional symbiotic anchor points according to the differences.

[0076] In this embodiment, for each newly selected candidate cross-dimensional symbiotic anchor point, if the candidate node is a newly added node, its corresponding stable dependency state of feature symbiosis is the dependency state corresponding to the cross-dimensional common symbiotic content; if the candidate node is an existing node, but its transmission attribute content changes due to the influence of the newly added common symbiotic content, then the transmission attribute content before and after the change is compared, and its corresponding stable dependency state of feature symbiosis is adjusted according to the difference. The adjustment method is to include the newly added transmission attribute content in the determination condition of the stable dependency state. For example, if the original node's transmission attribute content is "symbiosis_unit_timestamp: T, transmission_priority: High", and after adding common symbiotic content, the transmission attribute content becomes "symbiosis_unit_timestamp: T, transmission_priority: High, encryption_flag: Enabled", then its corresponding stable dependency state of feature symbiosis is adjusted to a dependency state that includes the attribute "encryption_flag: Enabled".

[0077] Step S12810: Record the adjustment content of intra-dimensional symbiotic anchor points and cross-dimensional symbiotic anchor points, including candidate replacement situations and adjustment situations of stable dependency states of feature symbiotic relationships, form anchor point adjustment records, and build dynamic adjustment operations for symbiotic anchor points based on the anchor point adjustment records;

[0078] In this embodiment, the anchor point adjustment record includes the adjustment time, the set of candidate anchor points before adjustment, the set of candidate anchor points after adjustment, the unique identifier of the node to be replaced, and the adjustment content of the stable dependency state of the feature symbiotic relationship. All record content is stored in structured data form, such as JSON format. Based on the above anchor point adjustment record, a dynamic adjustment operation for symbiotic anchor points is built. The trigger condition for the above operation is that for every preset number of newly collected communication information symbiotic units received, or at every preset time period, the above steps S1281 to S1289 are automatically executed to update the position of symbiotic anchor points within the dimension and cross-dimensional symbiotic anchor points and the corresponding stable dependency state of the feature symbiotic relationship in real time.

[0079] Step S129: Integrate all intra-dimensional symbiotic networks, cross-dimensional symbiotic links, intra-dimensional symbiotic anchors, cross-dimensional symbiotic anchors, and dynamic adjustment operations of symbiotic anchors to form the initial feature symbiotic modeling structure;

[0080] In this embodiment, the integration method involves storing the structured data of all intra-dimensional symbiotic networks, cross-dimensional symbiotic links, intra-dimensional symbiotic anchors, and cross-dimensional symbiotic anchors, as well as the execution logic of dynamic adjustment operations for symbiotic anchors, in the same data model. The data model is stored using a graph database, where intra-dimensional symbiotic networks and cross-dimensional symbiotic links serve as edges of the graph, intra-dimensional symbiotic anchors and cross-dimensional symbiotic anchors serve as nodes of the graph, and dynamic adjustment operations for symbiotic anchors serve as attribute update rules for the graph. This forms the initial feature symbiotic modeling structure.

[0081] Step S1210: Based on the subsequent input communication information co-generation units, perform structural parameter adaptation operation on the initial feature co-generation modeling structure to form the final feature co-generation modeling structure;

[0082] In this embodiment, the specific method of structural parameter adaptation is as follows: The subsequent input communication information co-existence units are input into the initial feature co-existence modeling structure. The feature co-existence relationships output by the initial feature co-existence modeling structure are extracted and then compared with the actual feature co-existence relationships of the subsequent input communication information co-existence units. The actual feature co-existence relationships are determined by statistically analyzing the transmission dependency relationships of each communication information in the subsequent input communication information co-existence units. The matching degree between the output feature co-existence relationships and the actual feature co-existence relationships is calculated. The matching degree is calculated by counting the number of output feature co-existence relationships that match the actual feature co-existence relationships, dividing the result by the total number of actual feature co-existence relationships. If the matching degree is lower than a preset threshold, the parameters in the initial feature co-existence modeling structure, such as the co-existence dimension division rule, the co-existence support content extraction threshold, and the common co-existence content extraction threshold, are adjusted. The adjustment method is to gradually increase or decrease the parameter values ​​until the matching degree reaches the preset threshold. Repeat the above process until the matching degree of multiple subsequent input communication information co-existing units reaches the preset threshold. The feature co-existing modeling structure at this time is the final feature co-existing modeling structure. The above structure can accurately capture the feature co-existing relationship of communication information co-existing units in the core network data transmission scenario.

[0083] Step S130: Perform self-supervised learning on the historical communication information co-occurrence unit through the feature co-occurrence modeling structure to generate the feature co-occurrence trajectory of normal transmission of communication information. The feature co-occurrence trajectory is the path of change of feature co-occurrence relationship in communication information co-occurrence unit with the transmission process.

[0084] In this embodiment, based on the final feature co-occurrence modeling structure, self-supervised learning is performed on the historical communication information co-occurrence units accumulated in the core network to generate feature co-occurrence trajectories. The core logic is to divide the historical communication information co-occurrence units into multiple stages in chronological order, extract the feature co-occurrence relationship changes and co-occurrence path changes in each stage, and then perform temporal correlation and fusion to form a complete normal transmission trajectory. The specific implementation logic is described in steps S131 to S1310.

[0085] Step S131: Collect historical communication information co-existing units accumulated during the long-term operation of the communication network. The historical communication information co-existing units are communication information combinations that have been verified by actual transmission and have no abnormalities in the characteristic co-existence relationship.

[0086] In this embodiment, the collected historical communication information co-occurrence units are normal transmission data stored in the core network database that has undergone anomaly detection and verification. The anomaly detection and verification method involves using the core network's existing anomaly detection system to detect historical transmission data and confirm communication information co-occurrence units without signaling interaction anomalies, data transmission anomalies, or service quality anomalies. The time range of the collected historical communication information co-occurrence units covers multiple consecutive transmission cycles in the past. The duration of each transmission cycle is determined based on the core network's traffic volume, and the number of historical communication information co-occurrence units is at least 100,000 sets to ensure sufficient data support for subsequent self-supervised learning.

[0087] Step S132: Divide the historical communication information co-occurrence units into multiple historical co-occurrence stages according to the transmission time sequence. Each historical co-occurrence stage contains multiple historical communication information co-occurrence units within a continuous time period.

[0088] In this embodiment, historical communication information co-occurrence units are divided into multiple historical co-occurrence stages using a time window approach. The duration of the time window is determined based on the core network's service fluctuations. For example, core network service volume fluctuates significantly during weekday morning, noon, and evening peak hours; therefore, the time window duration is set to one hour, while the duration of the off-peak time window is set to two hours. Each historical co-occurrence stage contains all historical communication information co-occurrence units collected within that time window. For instance, a historical co-occurrence stage during the morning peak period contains all historical communication information co-occurrence units collected between 8:00 AM and 9:00 AM. The number of historical communication information co-occurrence units corresponding to each historical co-occurrence stage is determined based on service volume, with more units collected during the morning peak period than during the off-peak period.

[0089] Step S133: Input the historical communication information co-existence unit of each historical co-existence stage into the feature co-existence modeling structure, and extract the co-existence evolution features of each historical co-existence stage through the intra-dimensional co-existence network and cross-dimensional co-existence links in the structure. The co-existence evolution features are the set of changing states of feature co-existence relationships within the historical co-existence stage.

[0090] In this embodiment, after inputting the historical communication information co-existence units of each historical co-existence stage into the final feature co-existence modeling structure, the intra-dimensional co-existence network in the feature co-existence modeling structure will statistically analyze the transmission frequency changes of each node and the stability changes of the connections between nodes within that stage. The cross-dimensional co-existence link will statistically analyze the changes in the number of associated transmissions and the frequency changes of the links within that stage. The above-mentioned change data is integrated into co-existence evolution features. The specific form of the co-existence evolution features is a dictionary structure, where each key corresponds to a co-existence dimension or cross-dimensional link, and each value corresponds to the set of change states of the corresponding co-existence dimension or cross-dimensional link. The set of change states includes transmission frequency change values, stability change values, associated transmission number change values, and interaction frequency change values, etc. All change values ​​have been standardized to eliminate the influence of dimensions. For example, the set of changing states corresponding to the signaling interaction coexistence dimension is “node_transmission_frequency_change: ΔF1, link_stability_change: ΔS1, cross_link_interaction_frequency_change: ΔL1”, where ΔF1 is the average change value of node transmission frequency, ΔS1 is the average change value of the stability of the connection between nodes, and ΔL1 is the change value of the interaction frequency of cross-dimensional links.

[0091] Step S134: Based on the unsupervised learning method of self-supervised learning, perform temporal correlation processing on the symbiotic evolution characteristics of different historical symbiotic stages, extract the continuous change state of the feature symbiotic relationship in different historical symbiotic stages, and form a temporal symbiotic change set;

[0092] In this embodiment, the specific implementation logic of temporal correlation processing based on the unsupervised learning method of self-supervised learning is described through steps S1341 to S13410.

[0093] Step S1341: Arrange the symbiotic evolution characteristics of all historical symbiotic stages in chronological order to form a temporal queue of symbiotic evolution characteristics;

[0094] In this embodiment, based on the start timestamp of each historical symbiotic stage, the symbiotic evolution features of all historical symbiotic stages are arranged sequentially in chronological order to form a temporal queue of symbiotic evolution features. Each element in the queue is a dictionary structure of symbiotic evolution features for a historical symbiotic stage, and the length of the queue is equal to the number of historical symbiotic stages. For example, if there are Z historical symbiotic stages, the length of the temporal queue of symbiotic evolution features is Z, the first element in the queue is the symbiotic evolution feature of the earliest historical symbiotic stage, and the last element is the symbiotic evolution feature of the latest historical symbiotic stage.

[0095] Step S1342: Divide the temporal queue of the co-evolutionary features into sliding windows, with each sliding window containing co-evolutionary features of multiple consecutive historical co-evolutionary stages;

[0096] In this embodiment, the size of the sliding window is determined based on the number of historical symbiotic stages and the periodicity of business fluctuations. For example, if the number of historical symbiotic stages is Z and the period of business fluctuations is one day, then the size of the sliding window is set to 24 historical symbiotic stages (assuming the duration of each historical symbiotic stage is one hour). The sliding step size of the sliding window is set to one historical symbiotic stage, that is, the sliding window moves forward one historical symbiotic stage each time until the entire symbiotic evolution feature time sequence is covered. Each sliding window contains symbiotic evolution features of 24 consecutive historical symbiotic stages, used to analyze the daily periodic variation pattern of feature symbiotic relationships.

[0097] Step S1343: Extract the common feature content of all co-evolutionary features within each sliding window to form the window common features of each sliding window;

[0098] In this embodiment, for each sliding window, the common features of the window are extracted as follows: Among all co-evolutionary features within the window, those features that appear more than half the number of historical co-evolutionary stages within the window are considered common features. For example, if there are 24 historical co-evolutionary stages within the sliding window, and a certain feature appears in 15 of these features, then that feature is identified as a common feature of the window. The specific form of the common features is a dictionary structure, where each key corresponds to a co-evolutionary dimension or cross-dimensional link, and each value corresponds to a shared change state of that co-evolutionary dimension or cross-dimensional link.

[0099] Step S1344: Compare the common features of two adjacent sliding windows, and record the newly added features, disappeared features, and modified features among the common features of adjacent windows;

[0100] In this embodiment, for each pair of adjacent sliding windows, the common features are compared as follows: It is determined whether each feature content in the common features of the preceding sliding window exists in the common features of the following sliding window. If not, it is identified as a disappeared feature content. It is also determined whether each feature content in the common features of the following sliding window exists in the common features of the preceding sliding window. If not, it is identified as a newly added feature content. If the value of a feature content changes, it is identified as a modified feature content. For example, if the common features of the preceding sliding window include "node_transmission_frequency_change: ΔF1", and the common features of the following sliding window include "node_transmission_frequency_change: ΔF2", and ΔF1 is not equal to ΔF2, then this feature content is a modified feature content.

[0101] Step S1345: Based on the newly added feature content, disappeared feature content, and modified feature content of the common features of adjacent windows, a feature change association network is built. The feature change association network records the change path of the common features of the windows as the sliding window changes.

[0102] In this embodiment, the nodes of the feature change association network are the common features of each sliding window. The edges between nodes represent the change relationships between the common features of adjacent sliding windows. The attributes of the edges include specific information about added features, disappeared features, and modified features. For example, node 1 corresponds to the common features of the first sliding window, and node 2 corresponds to the common features of the second sliding window. The attributes of the edge between node 1 and node 2 are "added_features: {cross_link_interaction_frequency_change: ΔL2}, removed_features: {link_stability_change: ΔS1}, modified_features: {node_transmission_frequency_change: ΔF1—ΔF2}", where ΔL2 is the added feature, ΔS1 is the disappeared feature, and ΔF1—ΔF2 are the value changes of the modified feature.

[0103] Step S1346: Extract patterns from the feature change association network using an unsupervised learning method based on self-supervised learning, and identify recurring feature change paths in the feature change association network;

[0104] In this embodiment, a graph embedding algorithm is used to extract patterns from the feature change association network. The graph embedding algorithm converts each node and edge in the feature change association network into a low-dimensional vector, and then a clustering algorithm is used to cluster the low-dimensional vectors to identify combinations of nodes and edges with high vector similarity. These combinations are the recurring feature change paths. For example, if the low-dimensional vectors of multiple sliding windows that share common features have high similarity, and the attributes of their corresponding edges are also similar, then the path formed by these node and edge combinations is a recurring feature change path. This path corresponds to the periodic change pattern of core network service fluctuations.

[0105] Step S1347: Arrange the extracted recurring feature change paths in a temporal sequence to establish the sequential transmission relationship between different recurring feature change paths;

[0106] In this embodiment, the paths are sequentially arranged according to the time order of the sliding windows corresponding to the recurring feature change paths. Then, the number of connections between different paths is counted. This count is determined by the number of times the end time of the last sliding window of the preceding path is consecutive to the start time of the first sliding window of the following path, and by the correlation degree of the feature content between the two paths. The correlation degree is calculated by the proportion of identical features in the feature content of the two paths to the total number of features. Two paths with both the number of connections and the correlation degree exceeding a preset threshold are established as having a sequential transmission relationship. For example, if path A corresponds to the feature change path during the morning rush hour, and path B corresponds to the feature change path during the afternoon rush hour, and the end time of path A is consecutive to the start time of path B, and the correlation degree of the feature content of the two paths is high, then a sequential transmission relationship from path A to path B is established.

[0107] Step S1348: Based on the sequential transmission relationship between different recurring feature change paths, a feature change logic chain is constructed, wherein the feature change logic chain records the continuous transmission order of the recurring feature change paths.

[0108] In this embodiment, the nodes of the feature change logic chain are recurring feature change paths, and the edges between nodes represent the sequential transmission relationships between paths. The attributes of the edges are specific information about the number of connections and the correlation degree. For example, the nodes of the feature change logic chain include morning peak path nodes, noon peak path nodes, evening peak path nodes, and off-peak path nodes. The edge between the morning peak path node and the noon peak path node has the attribute "connection_count: C1, correlation_degree: D1", where C1 is the number of connections and D1 is the correlation degree. The feature change logic chain completely records the continuous transmission order of recurring feature change paths, reflecting the periodic change pattern of core network service fluctuations.

[0109] Step S1349: Extract the feature change content corresponding to each logical node in the feature change logic chain, and retain the feature content that reflects the core changes of the feature symbiotic relationship;

[0110] In this embodiment, for each logical node in the feature change logic chain, all feature content in its corresponding feature change path is extracted. Then, feature content reflecting the core change in the feature symbiosis relationship is retained through importance assessment. The importance assessment method is to statistically analyze the frequency of the feature content in the symbiotic evolution features of all historical symbiotic stages, and the degree of influence of the change of the feature content on the feature symbiotic relationship. The degree of influence is determined by statistically analyzing the proportion of times the feature symbiotic relationship becomes abnormal when the feature content changes out of the total number of changes. Feature content with both frequency and influence exceeding a preset threshold is identified as feature content reflecting the core change in the feature symbiotic relationship. For example, the feature content "node_transmission_frequency_change:ΔF" has an extremely high frequency of occurrence in the symbiotic evolution features of all historical symbiotic stages, and the proportion of times the feature symbiotic relationship becomes abnormal when it changes is also relatively high. Therefore, it is retained as core feature content.

[0111] Step S13410: Integrate the retained feature content that reflects the core changes of the feature symbiosis relationship according to the time sequence and transmission relationship to form the continuous change state of the feature symbiosis relationship in different historical symbiosis stages, and output it as a time-series symbiosis change set;

[0112] In this embodiment, the retained core feature content is integrated according to the chronological order of its corresponding historical symbiotic stage and the transmission relationship in the feature change logic chain. The integration method is to arrange the core feature content of each historical symbiotic stage in chronological order, and mark its position and sequential transmission relationship in the feature change logic chain. The final output time-series symbiotic change set is a structured data, where each element corresponds to the core feature content of a historical symbiotic stage and its associated information, such as "timestamp: T1, core_features: {node_transmission_frequency_change: ΔF1, cross_link_interaction_frequency_change: ΔL1}, logical_chain_position: Peak_Morning, next_position: Peak_Noon", where T1 is the timestamp of the historical symbiotic stage, ΔF1 and ΔL1 are the values ​​of the core feature content, Peak_Morning is its position in the feature change logic chain, and Peak_Noon is its next position in the feature change logic chain. This completes the generation of the time-series symbiotic change set.

[0113] Step S135: Based on the time-series symbiotic change set, construct a feature symbiotic evolution structure, which is used to record the change path and intrinsic relationship of feature symbiotic relationship in different historical symbiotic stages;

[0114] In this embodiment, the feature symbiotic evolution structure is stored using a graph database. Nodes represent the core feature content of each historical symbiotic stage, and their attributes include the timestamp of the historical symbiotic stage, the value of the core feature content, and its position in the feature change logic chain. Edges represent the intrinsic relationships between the core feature content of different historical symbiotic stages, and their attributes include correlation degree and transmission relationship. For example, node 1 corresponds to the core feature content of the historical symbiotic stage during the morning rush hour, and node 2 corresponds to the core feature content of the historical symbiotic stage during the afternoon rush hour. The edge between node 1 and node 2 has the attributes "correlation_degree: D1, transmission_relation: Successive", where D1 is the correlation degree of the core feature content of the two nodes, and Successive indicates that the transmission relationship between the two nodes is sequential and continuous. The feature symbiotic evolution structure completely records the change path and intrinsic relationships of feature symbiotic relationships in different historical symbiotic stages.

[0115] Step S136: Iteratively adjust the feature symbiotic evolution structure through dynamic adjustment of symbiotic anchor points, incorporating the update status of intra-dimensional and cross-dimensional symbiotic anchor points in each historical symbiotic stage, so that the feature symbiotic evolution structure conforms to the actual changes in historical feature symbiotic relationships;

[0116] In this embodiment, the iterative adjustment is performed as follows: First, the anchor point adjustment records generated by the dynamic adjustment operation of the symbiotic anchor points in each historical symbiotic stage are extracted. These records include the positional changes of intra-dimensional and cross-dimensional symbiotic anchor points, and adjustments to the stable dependency state of the feature symbiotic relationship. Then, these anchor point adjustment records are integrated into the feature symbiotic evolution structure. This integration is achieved by adding the anchor point adjustment records as additional attributes to the nodes in the corresponding historical symbiotic stage. Simultaneously, based on the content of the anchor point adjustment records, the correlation and transmission relationships of the edges in the feature symbiotic evolution structure are adjusted. For example, if the symbiotic anchor point changes within a dimension of a historical symbiotic stage, the additional attributes of the node corresponding to that historical symbiotic stage are updated with "anchor_adjustment: {node_id: SIP_001, old_frequency: 0.95, new_frequency: 0.97, stability_adjustment: Addedservice_type: Premium}". Simultaneously, the correlation between the nodes and their adjacent nodes is adjusted. If the change in the anchor point enhances the stability of the feature symbiotic relationship, the correlation of the edges increases; conversely, it decreases. This process is repeated iteratively to adjust the feature symbiotic evolution structure for all historical symbiotic stages until the change in the feature symbiotic relationship output by the feature symbiotic evolution structure matches the actual change in the feature symbiotic relationship of the historical communication information symbiotic units to a preset threshold. At this point, the feature symbiotic evolution structure closely matches the actual changes in the historical feature symbiotic relationship.

[0117] Step S137: Extract the co-existence path features of communication information in each historical communication information co-existence unit. The co-existence path features are the path states formed by the transmission of communication information in the intra-dimensional co-existence network and the cross-dimensional co-existence link.

[0118] In this embodiment, the method for extracting the co-existence path features of communication information in each historical communication information co-existence unit is as follows: for each piece of communication information in each historical communication information co-existence unit, its transmission path in the intra-dimensional co-existence network is tracked, i.e., the node sequence and edge sequence from the source node to the target node, and its transmission path in the cross-dimensional co-existence link, i.e., the link sequence and node sequence from one intra-dimensional co-existence network to another intra-dimensional co-existence network. The above path states are integrated into co-existence path features, which are specifically in the form of a list structure, where each element is the information of a path segment. The information of the path segment includes the type of the path segment (intra-dimensional or cross-dimensional), the node sequence of the path segment, the edge sequence of the path segment, the transmission time of the path segment, the transmission priority of the path segment, etc. For example, the co-existence path characteristics of the session initiation protocol signaling packet in a certain historical communication information co-existence unit are "[{path_type: Intra_Dimension, node_sequence: [SIP_001, MGCP_001], link_sequence: [Link_001], transmission_time: T1, transmission_priority: High}, {path_type: Cross_Dimension, node_sequence: [MGCP_001, RTP_001], link_sequence: [Cross_001], transmission_time: T2, transmission_priority: High}]", where Intra_Dimension represents the path segment within the dimension, Cross_Dimension represents the path segment across dimensions, SIP_001, MGCP_001, and RTP_001 are unique identifiers of nodes, Link_001 and Cross_001 are unique identifiers of edges, T1 and T2 are transmission times, and High is the transmission priority.

[0119] Step S138: Perform temporal integration of the symbiotic path features of all historical symbiotic stages to form a symbiotic path evolution sequence, wherein the symbiotic path evolution sequence is a set of continuous changes in symbiotic path features with historical symbiotic stages;

[0120] In this embodiment, the temporal integration method is to arrange the co-occurrence path characteristics of all communication information in each historical co-occurrence stage according to the time order of the historical co-occurrence stage, and at the same time, to count the common content of the co-occurrence path characteristics in each historical co-occurrence stage. The common content includes the most frequently occurring path segment sequence, the average change in transmission time, the distribution of transmission priority, etc. The specific form of the symbiotic path evolution sequence is a dictionary structure, where each key corresponds to a historical symbiotic stage, and each value corresponds to the set of symbiotic path features and common content of the corresponding historical symbiotic stage. For example, "timestamp: T1, path_features: [Path_Feature_001, Path_Feature_002, ...], common_content: {most_frequent_path_sequence: [SIP_001, MGCP_001, RTP_001], average_transmission_time_change: ΔT, transmission_priority_distribution: {High: 0.7, Medium: 0.2, Low: 0.1}}", where T1 is the timestamp of the historical symbiotic stage, Path_Feature_001, etc. are symbiotic path features, most_frequent_path_sequence is the sequence of path segments with the highest frequency, ΔT is the average change in transmission time, and transmission_priority_distribution is the distribution ratio of transmission priority.

[0121] Step S139: Merge the feature symbiotic evolution structure with the symbiotic path evolution sequence to build a full-scene normal symbiotic structure. The full-scene normal symbiotic structure contains the complete association of feature symbiotic relationship changes and symbiotic path changes in all historical symbiotic stages.

[0122] In this embodiment, the fusion of the feature co-evolutionary structure and the co-evolutionary path sequence is described through steps S1391 to S1399.

[0123] Step S1391: Perform hierarchical decomposition on the feature symbiotic relationship changes in the feature symbiotic evolution structure, and divide it into intra-dimensional symbiotic evolution levels and cross-dimensional symbiotic evolution levels, which correspond to the feature symbiotic relationship changes within and across dimensions, respectively;

[0124] In this embodiment, the hierarchical decomposition is based on the symbiotic dimensions corresponding to the nodes and edges in the feature symbiotic evolution structure, dividing it into intra-dimensional symbiotic evolution levels and cross-dimensional symbiotic evolution levels. Intra-dimensional symbiotic evolution levels include all nodes and edges corresponding to a single symbiotic dimension, such as nodes and edges in the signaling interaction symbiotic dimension, data transmission symbiotic dimension, etc.; cross-dimensional symbiotic evolution levels include all nodes and edges corresponding to multiple symbiotic dimensions, such as nodes and edges corresponding to cross-dimensional symbiotic links, common symbiotic content, etc. The attributes of nodes and edges in each level remain unchanged; the hierarchical decomposition is merely a logical division to facilitate subsequent correspondence with the symbiotic path evolution sequence.

[0125] Step S1392: Perform hierarchical decomposition on the symbiotic path changes in the symbiotic path evolution sequence, and divide them into intra-dimensional path evolution levels and cross-dimensional path evolution levels, which correspond to intra-dimensional and cross-dimensional symbiotic path changes, respectively.

[0126] In this embodiment, the hierarchical splitting method is to divide the path segments in the symbiotic path evolution sequence into intra-dimensional path evolution levels and cross-dimensional path evolution levels based on their types. The intra-dimensional path evolution level includes all path segments whose type is an intra-dimensional symbiotic path feature, such as path segments within a signaling interaction symbiotic dimension or a data transmission symbiotic dimension. The cross-dimensional path evolution level includes all path segments whose type is a cross-dimensional symbiotic path feature, such as path segments between a signaling interaction symbiotic dimension and a data transmission symbiotic dimension, or between a data transmission symbiotic dimension and a quality of service symbiotic dimension. The attributes of the symbiotic path features at each level remain unchanged; the hierarchical splitting is merely a logical division to facilitate subsequent correspondence with the feature symbiotic evolution structure.

[0127] Step S1393: Establish the correspondence between the symbiotic evolution level and the path evolution level within the dimension, and record the transmission dependency relationship between the changes in the symbiotic relationship of features within the dimension and the changes in the symbiotic path within the dimension;

[0128] In this embodiment, the correspondence is established as follows: For each node in the symbiotic evolution hierarchy within the dimension, the frequency of corresponding symbiotic path changes in the path evolution hierarchy within the dimension is counted when a change in the feature symbiotic relationship corresponding to that node occurs. The frequency is calculated as the proportion of the number of times the corresponding symbiotic path change occurs when the feature symbiotic relationship change occurs to the total number of times the feature symbiotic relationship change occurs. A correspondence is established between feature symbiotic relationship changes with frequencies higher than a preset threshold and symbiotic path changes, and their transmission dependency associations are recorded. The association content includes the type of feature symbiotic relationship change, the type of symbiotic path change, and the frequency of occurrence. For example, if the feature co-occurrence relationship change "node_transmission_frequency_change: ΔF1" in the intra-dimensional co-occurrence evolution level occurs, and the occurrence frequency of the co-occurrence path change "path_sequence: [SIP_001, MGCP_001]" in the intra-dimensional path evolution level is 0.9, then establish the correspondence between the two and record their transmission dependency association as "feature_change_type: Node_Frequency_Change, path_change_type: Intra_Path_Sequence, occurrence_frequency: 0.9".

[0129] Step S1394: Establish the correspondence between the cross-dimensional symbiotic evolution hierarchy and the cross-dimensional path evolution hierarchy, and record the transmission dependency relationship between changes in cross-dimensional feature symbiotic relationship and changes in cross-dimensional symbiotic path.

[0130] In this embodiment, the method of establishing the correspondence is the same as in step S1393. For each node in the cross-dimensional symbiotic evolution level, the frequency of occurrence of the corresponding symbiotic path change in the cross-dimensional path evolution level is counted when the feature symbiotic relationship change corresponding to the node occurs. A correspondence is established between the feature symbiotic relationship change with a frequency higher than a preset threshold and the symbiotic path change, and their transmission dependency association is recorded. For example, if the feature symbiotic relationship change "cross_link_interaction_frequency_change: ΔL1" in the cross-dimensional symbiotic evolution level occurs, and the frequency of occurrence of the symbiotic path change "path_sequence: [MGCP_001, RTP_001]" in the cross-dimensional path evolution level is 0.85, then a correspondence is established between the two, and their transmission dependency association is recorded as "feature_change_type: Cross_Link_Frequency_Change, path_change_type: Cross_Path_Sequence, occurrence_frequency: 0.85".

[0131] Step S1395: Extract the triggering transmission conditions of the symbiotic evolution level and the path evolution level within the dimension. The triggering transmission conditions are the specific transmission scenarios that cause changes in the symbiotic relationship and symbiotic path within the dimension.

[0132] In this embodiment, the method for extracting the triggering transmission conditions is as follows: Simultaneous changes in the symbiotic relationship at the symbiotic evolution level within the statistical dimension and changes in the symbiotic path at the path evolution level within the statistical dimension are considered in the transmission scenarios where they occur. Transmission scenarios include service type, transmission time period, transmission priority, and user group. The proportion of simultaneous occurrences of changes in symbiotic relationships and symbiotic paths in each transmission scenario is calculated, and transmission scenarios with proportions exceeding a preset threshold are identified as triggering transmission conditions. For example, in a transmission scenario where the service type is VoLTE call, the transmission time period is morning peak, and the transmission priority is High, if the proportion of simultaneous occurrences of changes in symbiotic relationships and symbiotic paths within the dimension is 0.8, then this transmission scenario is identified as a triggering transmission condition.

[0133] Step S1396: Extract the triggering transmission conditions of the cross-dimensional symbiotic evolution level and the cross-dimensional path evolution level. The triggering transmission conditions are the specific transmission scenarios that cause changes in cross-dimensional feature symbiotic relationships and symbiotic paths.

[0134] In this embodiment, the method for extracting the triggering transmission conditions is the same as in step S1395. Transmission scenarios where changes in the symbiotic relationship at the cross-dimensional symbiotic evolution level and changes in the symbiotic path at the cross-dimensional path evolution level occur simultaneously are statistically analyzed. Transmission scenarios with a proportion exceeding a preset threshold are identified as triggering transmission conditions. For example, in a transmission scenario where the service type is high-definition video call, the transmission time is during the evening peak, and the transmission priority is High, if the proportion of simultaneous occurrences of changes in cross-dimensional feature symbiotic relationships and cross-dimensional symbiotic paths is 0.75%, then this transmission scenario is identified as a triggering transmission condition.

[0135] Step S1397: Based on the extracted intra-dimensional and cross-dimensional triggering transmission conditions, construct an evolutionary triggering association structure, wherein the evolutionary triggering association structure records the corresponding associations between triggering transmission conditions and changes in feature symbiotic relationships and symbiotic path changes;

[0136] In this embodiment, the evolution trigger association structure is stored using a dictionary structure, where each key corresponds to a trigger transmission condition, and each value corresponds to a set of feature symbiotic relationship changes and symbiotic path changes under the trigger transmission condition. For example, the set of feature symbiotic relationship changes and symbiotic path changes corresponding to the trigger transmission condition "service_type: VoLTE, time_slot: Morning_Peak, transmission_priority: High" is "feature_changes: [Node_Frequency_Change: ΔF1], path_changes: [Intra_Path_Sequence: [SIP_001, MGCP_001]]". The evolution trigger association structure completely records the corresponding association between the trigger transmission condition and the feature symbiotic relationship changes and symbiotic path changes.

[0137] Step S1398: Based on the hierarchical correspondence within and across dimensions, triggering transmission conditions, and evolution triggering association structure, construct the initial full-scene normal symbiotic structure;

[0138] In this embodiment, the initial full-scene normal symbiotic structure is constructed as follows: the correspondence between the symbiotic evolution level within a dimension and the path evolution level within a dimension, the correspondence between the symbiotic evolution level across dimensions and the path evolution level across dimensions, and the evolution trigger association structure are integrated into the same data model. The data model is stored using a graph database, where nodes represent trigger transmission conditions, changes in feature symbiotic relationships, and changes in symbiotic paths, and edges represent the corresponding associations between the above nodes. The attributes of the edges include occurrence frequency, association degree, etc. For example, node 1 is the trigger transmission condition "service_type: VoLTE, time_slot: Morning_Peak, transmission_priority: High", node 2 is the feature co-occurrence relationship change "Node_Frequency_Change: ΔF1", and node 3 is the co-occurrence path change "Intra_Path_Sequence: [SIP_001, MGCP_001]". The edge between node 1 and node 2 has the attribute "occurrence_frequency: 0.8", the edge between node 1 and node 3 has the attribute "occurrence_frequency: 0.8", and the edge between node 2 and node 3 has the attribute "correlation_degree: 0.9". Thus, the initial normal co-occurrence structure for the entire scenario is constructed.

[0139] Step S1399: Add the transmission transition associations between different levels in the initial full-scene normal symbiotic structure, integrate the anchor point adjustment records of the dynamic adjustment operation of the symbiotic anchor points, and form a full-scene normal symbiotic structure;

[0140] In this embodiment, the transmission transition association is added as follows: transition edges are added between intra-dimensional symbiotic evolution levels and cross-dimensional symbiotic evolution levels, and between intra-dimensional path evolution levels and cross-dimensional path evolution levels. The attributes of the transition edges include transition frequency and transition conditions. The transition frequency is the proportion of cross-level transmissions to the total number of transmissions, and the transition condition is the scenario that triggers cross-level transmissions. Then, the anchor point adjustment records of the symbiotic anchor point dynamic adjustment operation are added as additional attributes to the corresponding nodes in the initial full-scenario normal symbiotic structure. For example, the anchor point adjustment record of a certain historical symbiotic stage is added to the feature symbiotic relationship change node corresponding to that historical symbiotic stage. The final full-scenario normal symbiotic structure contains the complete association of feature symbiotic relationship changes and symbiotic path changes across all historical symbiotic stages, comprehensively reflecting the feature symbiotic rules of normal communication information transmission in the core network data transmission scenario.

[0141] Step S1310: Based on the full-scene normal symbiotic structure, generate normal feature symbiotic segments corresponding to each historical symbiotic stage, and connect all normal feature symbiotic segments in sequence according to the historical symbiotic stages to form a feature symbiotic trajectory for normal transmission of communication information.

[0142] In this embodiment, the normal feature symbiotic segment corresponding to each historical symbiotic stage is generated as follows: Information such as changes in feature symbiotic relationships, changes in symbiotic paths, triggering transmission conditions, and anchor point adjustment records corresponding to that historical symbiotic stage are extracted from the normal symbiotic structure of the entire scenario and integrated into a structured data segment. This segment contains complete information on all normal feature symbiotic relationships and symbiotic paths within that historical symbiotic stage. Then, all normal feature symbiotic segments are concatenated in chronological order according to the historical symbiotic stages to form a feature symbiotic trajectory for normal communication information transmission. The specific form of the feature symbiotic trajectory is an ordered list, where each element is a normal feature symbiotic segment. The feature symbiotic trajectory completely records the path of change in feature symbiotic relationships during normal communication information transmission in the core network data transmission scenario.

[0143] Step S140: Perform co-occurrence matching between the real-time acquired communication information co-occurrence unit and the feature co-occurrence trajectory to establish a co-occurrence anchoring relationship between the real-time acquired communication information co-occurrence unit and the feature co-occurrence trajectory;

[0144] In this embodiment, the specific method of symbiotic matching is as follows: First, extract the symbiotic attribute information and transmission attribute content of the real-time collected communication information symbiotic unit, and then match it with all normal feature symbiotic segments in the feature symbiotic trajectory. The matching method is to calculate the similarity between the symbiotic attribute information and transmission attribute content of the real-time collected communication information symbiotic unit and the corresponding information of each normal feature symbiotic segment. The similarity is calculated by counting the proportion of the number of identical attribute values ​​in the real-time collected information and the information of the normal feature symbiotic segment to the total number of attributes, and the matching degree between the feature symbiotic relationship of the real-time collected information and the feature symbiotic relationship of the normal feature symbiotic segment. The matching degree is calculated by counting the proportion of the number of feature symbiotic relationships that match the normal feature symbiotic segment to the total number of feature symbiotic relationships in the feature symbiotic relationship of the real-time collected information. The normal feature co-occurring segment with the highest similarity and matching degree is identified as the target segment for matching. Then, a co-occurrence anchoring relationship is established between the real-time acquired communication information co-occurrence unit and the target segment. The specific form of the co-occurrence anchoring relationship is a key-value pair structure, which includes information such as real-time co-occurrence unit identifier, target segment identifier, similarity, and matching degree. For example, "real_time_unit_id: RT_001, target_segment_id: TS_001, similarity: 0.95, matching_degree: 0.93", where RT_001 is the unique identifier of the real-time acquired communication information co-occurrence unit, TS_001 is the unique identifier of the matched normal feature co-occurrence segment, 0.95 is the similarity, and 0.93 is the matching degree. This completes the establishment of the co-occurrence anchoring relationship.

[0145] Step S150: Based on the symbiotic anchoring relationship, track the deviation propagation process of the feature symbiotic relationship and the feature symbiotic trajectory in the real-time collected communication information symbiotic unit, extract the symbiotic deviation feature set including the deviation start position, propagation path, change state and evolution direction, and generate communication information anomaly detection results based on the symbiotic deviation feature set;

[0146] In this embodiment, the core logic of tracking the deviation propagation process and extracting the symbiotic deviation feature set based on the symbiotic anchoring relationship is as follows: First, determine the standard of the target normal symbiotic segment, then identify the deviation point in the symbiotic unit of the real-time collected communication information, then track the transmission and diffusion process of the deviation point, and finally extract the symbiotic deviation feature set containing the key information of the deviation. The specific implementation logic is described in steps S151 to S1510.

[0147] Step S151: Based on the symbiotic anchoring relationship, determine the target normal symbiotic segment corresponding to the communication information symbiotic unit collected in real time from the feature symbiotic trajectory, and extract the symbiotic evolution standard and symbiotic path standard from the target normal symbiotic segment;

[0148] In this embodiment, based on the matching target segment identifier in the symbiotic anchoring relationship, the corresponding target normal symbiotic segment is extracted from the feature symbiotic trajectory. Then, symbiotic evolution criteria and symbiotic path criteria are extracted from the target normal symbiotic segment. The symbiotic evolution criteria are the normal variation range of the feature symbiotic relationship in the target segment, including the normal range of node transmission frequency, the normal range of connection stability, and the normal range of link interaction frequency. The normal range is determined by statistically analyzing the mean and standard deviation of the corresponding attribute values ​​in the target segment, with the value range being the mean plus or minus three times the standard deviation. The symbiotic path criteria are the normal sequence and normal transmission parameters of the symbiotic path in the target segment, including the normal node sequence, the normal edge sequence, the normal transmission time range, and the normal transmission priority. The normal sequence is determined by statistically analyzing the path sequence that appears most frequently in the target segment, and the normal transmission parameters are determined by statistically analyzing the value range of the corresponding parameters in the target segment. For example, the co-evolution criterion is "node_transmission_frequency_range: [F_min, F_max], link_stability_range: [S_min, S_max], cross_link_interaction_frequency_range: [L_min, L_max]", and the co-evolution path criterion is "normal_path_sequence: [SIP_001, MGCP_001, RTP_001], normal_transmission_time_range: [T_min, T_max], normal_transmission_priority: High".

[0149] Step S152: Extract the real-time symbiotic evolution features and real-time symbiotic path features of the real-time acquired communication information symbiotic units, compare the real-time symbiotic evolution features with the symbiotic evolution standard point by point, and identify the initial symbiotic deviation points in the real-time symbiotic evolution features that are inconsistent with the symbiotic evolution standard;

[0150] In this embodiment, the method for extracting the real-time symbiotic evolution features and real-time symbiotic path features of the real-time acquired communication information symbiotic units is consistent with the method for extracting the symbiotic evolution features and symbiotic path features in steps S133 and S137. Then, the real-time symbiotic evolution features are compared point by point with the symbiotic evolution standard. The comparison method is to determine whether the value of each attribute in the real-time symbiotic evolution features is within the normal range corresponding to the symbiotic evolution standard. If it is not within the normal range, it is determined as the initial symbiotic deviation point. For example, the node transmission frequency in the real-time co-evolution feature is F. If F is less than F_min or greater than F_max, then the feature corresponding to that node is the initial co-evolution deviation point. The specific information of the initial co-evolution deviation point includes the unique identifier of the deviation point, the attribute type of the deviation, the value of the deviation, and the degree of deviation (the absolute value of the difference between the deviation value and the normal range), such as "deviation_point_id: DP_001, attribute_type: Node_Transmission_Frequency, deviation_value: F, deviation_degree: |F-F_mean| / F_std", where F_mean is the mean of the normal range and F_std is the standard deviation of the normal range.

[0151] Step S153: Compare the real-time symbiotic path features with the symbiotic path standard point by point to identify auxiliary symbiotic deviation points in the real-time symbiotic path features that are inconsistent with the symbiotic path standard;

[0152] In this embodiment, the method of comparing the real-time co-occurrence path features with the co-occurrence path standard point by point is as follows: it is determined whether the path sequence in the real-time co-occurrence path features is consistent with the normal path sequence in the co-occurrence path standard. If they are inconsistent, it is determined that the path sequence is deviated; it is determined whether the transmission time in the real-time co-occurrence path features is within the normal transmission time range in the co-occurrence path standard. If they are not, it is determined that the transmission time is deviated; it is determined whether the transmission priority in the real-time co-occurrence path features is consistent with the normal transmission priority in the co-occurrence path standard. If they are inconsistent, it is determined that the transmission priority is deviated. The feature points corresponding to the above deviations are identified as auxiliary symbiotic deviation points. The specific information of the auxiliary symbiotic deviation points includes the unique identifier of the deviation point, the type of deviation, the content of the deviation, and the degree of deviation. For example, "deviation_point_id: DP_002, deviation_type: Path_Sequence, deviation_content: [SIP_001, RTP_001], deviation_degree: 1-(matching_nodes / total_nodes)", where matching_nodes is the number of nodes that match in the real-time path sequence and the normal path sequence, and total_nodes is the total number of nodes in the normal path sequence.

[0153] Step S154: Associate the initial symbiotic deviation point with the auxiliary symbiotic deviation point to establish a transmission dependency relationship between them, forming an initial symbiotic deviation combination;

[0154] In this embodiment, the association processing method is as follows: The frequency of initial symbiotic deviation points and auxiliary symbiotic deviation points appearing simultaneously in the same communication information symbiotic unit is statistically analyzed, along with the transmission dependency relationship between their corresponding communication information. The transmission dependency relationship is determined by judging whether two communication information pieces belong to the same symbiotic unit and whether there is a transmission sequence or interactive relationship. Initial symbiotic deviation points with a frequency higher than a preset threshold and a transmission dependency relationship are associated with auxiliary symbiotic deviation points to establish a transmission dependency relationship association. The association content includes the associated deviation point identifier, transmission dependency relationship type, association frequency, etc. Then, all associated deviation points are combined to form an initial symbiotic deviation combination. The specific form of the initial symbiotic deviation combination is a list structure, where each element is an associated deviation point pair, for example, "[{initial_deviation_point:DP_001,auxiliary_deviation_point:DP_002,transmission_dependency:Successive,association_frequency:0.9}]", where "Successive" indicates that the transmission dependency relationship of the communication information corresponding to the two deviation points is sequential, and 0.9 is the frequency of their simultaneous occurrence.

[0155] Step S155: Based on the intra-dimensional symbiotic network and cross-dimensional symbiotic link in the feature symbiotic modeling structure, track the transmission and diffusion process of the initial symbiotic deviation combination in the real-time acquired communication information symbiotic unit, record the order and interaction form of the initial symbiotic deviation combination spreading from the initial communication information to other communication information, and form a symbiotic deviation propagation sequence.

[0156] In this embodiment, the specific implementation logic for tracking the transmission and diffusion process and forming a symbiotic deviation propagation sequence is described through steps S1551 to S15510.

[0157] Step S1551: Uniquely identify all communication information in the real-time collected communication information co-existence unit to form a communication information identifier list, with each identifier corresponding to a specific communication information;

[0158] In this embodiment, the unique identifier is generated by using a globally unique identifier algorithm. A unique identifier is generated for each communication information in the real-time collected communication information co-occurrence unit. The format of the identifier is a prefix plus a random character. The prefix corresponds to the protocol type of the communication information. For example, the unique identifier of the session initialization protocol signaling packet is "SIP_xxxxxx", and the unique identifier of the real-time transmission protocol data packet is "RTP_xxxxxx". The communication information identifier list is an ordered list, where each element is a unique identifier of a communication information and its corresponding protocol type, for example, "[{id: SIP_001, protocol_type: SIP}, {id: MGCP_001, protocol_type: MGCP}, {id: RTP_001, protocol_type: RTP}]".

[0159] Step S1552: Based on the intra-dimensional symbiotic network and cross-dimensional symbiotic links in the feature symbiotic modeling structure, a real-time symbiotic relationship network is built. The real-time symbiotic relationship network records the associated communication information and the stable dependency state of the feature symbiotic relationship corresponding to each communication information.

[0160] In this embodiment, the real-time symbiotic relationship network is constructed as follows: each communication information in the real-time collected communication information symbiotic unit is mapped to the corresponding node in the intra-dimensional symbiotic network and cross-dimensional symbiotic link in the feature symbiotic modeling structure. Then, based on the node connection relationship and link connection relationship in the feature symbiotic modeling structure, a real-time symbiotic relationship network is established. The nodes in the real-time symbiotic relationship network are unique identifiers of the real-time collected communication information, and the edges represent the feature symbiotic relationships between the communication information. The attributes of the edges include the stable dependency state of the feature symbiotic relationship and the number of transmission interactions. For example, the attributes of the edge "SIP_001-MGCP_001" in the real-time symbiotic relationship network are "stability_state: Stable, interaction_count: C1", where Stable indicates that the feature symbiotic relationship is stable, and C1 is the number of transmission interactions between the two communication information.

[0161] Step S1553: Extract the communication information identifiers corresponding to the initial symbiotic deviation point and the auxiliary symbiotic deviation point from the initial symbiotic deviation combination, and determine them as the deviation start identifier;

[0162] In this embodiment, for each pair of deviation points in the initial symbiotic deviation combination, the unique identifiers of the communication information corresponding to the initial symbiotic deviation point and the auxiliary symbiotic deviation point are extracted. For example, the communication information identifier corresponding to the initial symbiotic deviation point DP_001 is “SIP_001”, and the communication information identifier corresponding to the auxiliary symbiotic deviation point DP_002 is “RTP_001”. Then, “SIP_001” and “RTP_001” are determined as deviation start identifiers.

[0163] Step S1554: Monitor the transmission and interaction process between the communication information corresponding to the deviation from the starting identifier and the associated communication information, and record the occurrence time and content of each transmission and interaction.

[0164] In this embodiment, the transmission interaction process is monitored as follows: the real-time traffic monitoring module of the core network tracks the data packet transmission between the communication information corresponding to the deviation from the starting identifier and the associated communication information in real time. The associated communication information is obtained from the real-time symbiotic relationship network. The occurrence time of each transmission interaction is recorded as the timestamp of the data packet. The interaction content includes the communication information identifier of the interaction, the protocol type of the interaction, the data packet length of the interaction, the transmission priority of the interaction, etc. The recorded content is stored in the form of structured data, such as "[{interaction_time:T1,source_id:SIP_001,target_id:MGCP_001,protocol_type:SIP,packet_length:L1,transmission_priority:High}]".

[0165] Step S1555: Identify the communication information identifier corresponding to the associated communication information that has deviated from the transmission interaction process, and determine it as a first-level deviation identifier;

[0166] In this embodiment, the method for identifying associated communication information that has deviated from its normal state is as follows: the transmission attribute content of the associated communication information is compared with the co-evolution standard and co-evolution path standard in the feature co-evolution trajectory. If the transmission attribute content of the associated communication information is not within the normal range, or its co-evolution path does not conform to the standard path, then the associated communication information is determined to have deviated from its normal state, and its corresponding communication information identifier is determined as a first-level deviation identifier. For example, if the transmission port number of the associated communication information MGCP_001 is not within the normal range of the co-evolution standard, then its corresponding communication information identifier "MGCP_001" is determined as a first-level deviation identifier.

[0167] Step S1556: Monitor the transmission and interaction process between the communication information corresponding to the first-level deviation identifier and its associated communication information, identify the communication information identifier corresponding to the associated communication information of the newly emerging deviation state, and determine it as the second-level deviation identifier;

[0168] In this embodiment, the monitoring and identification method is consistent with steps S1554 and S1555. For the communication information corresponding to the first-level deviation identifier, the transmission and interaction process between it and its associated communication information is monitored. Then, the transmission attribute content of its associated communication information is compared with the co-evolution standard and the co-evolution path standard to identify the associated communication information that has newly deviated from the standard state, and its corresponding communication information identifier is determined as the second-level deviation identifier. For example, if the co-evolution path of the associated communication information SDP_001 of the first-level deviation identifier MGCP_001 does not conform to the standard path, then its corresponding communication information identifier "SDP_001" is determined as the second-level deviation identifier.

[0169] Step S1557: Arrange the deviation start marker, first-level deviation marker, second-level deviation marker, and subsequent deviation markers in the order of their occurrence to form a deviation marker sequence;

[0170] In this embodiment, the deviation start identifier, first-level deviation identifier, second-level deviation identifier, and subsequent deviation identifiers are arranged in the order of the deviation state occurrence, i.e., the order of the transmission timestamps of the communication information corresponding to the deviation identifier, to form a deviation identifier sequence. The specific form of the deviation identifier sequence is an ordered list, such as "[SIP_001, RTP_001, MGCP_001, SDP_001]", where SIP_001 and RTP_001 are deviation start identifiers, MGCP_001 is a first-level deviation identifier, and SDP_001 is a second-level deviation identifier.

[0171] Step S1558: Identify the transmission interaction form between the communication information corresponding to each adjacent deviation identifier, and record the specific way in which the deviation state is transmitted from one communication information to another;

[0172] In this embodiment, the method for identifying the transmission interaction form is as follows: analyze the data packet transmission content between the communication information corresponding to adjacent deviation identifiers to determine the specific method of deviation state transmission. The specific method includes signaling-triggered transmission, data-carrying transmission, and service quality impact transmission. For example, between the communication information corresponding to adjacent deviation identifiers SIP_001 and MGCP_001, the transmission of the media gateway control protocol signaling packet is triggered by the session initiation protocol signaling packet, and the deviation state is transmitted through signaling triggering. Then, its transmission interaction form is recorded as "Signaling_Triggered".

[0173] Step S1559: Based on the deviation identifier sequence and the corresponding transmission interaction form, build a deviation propagation basic framework, wherein the deviation propagation basic framework records the propagation order and transmission method of the deviation state;

[0174] In this embodiment, the deviation propagation framework is stored using a graph structure. Nodes represent each deviation identifier in the deviation identifier sequence, and their attributes include the deviation identifier, deviation state type, and deviation degree. Edges represent the transmission interaction forms between adjacent deviation identifiers, and their attributes include the interaction form, interaction time, and interaction frequency. For example, if node 1 is the deviation identifier SIP_001 and node 2 is the deviation identifier MGCP_001, the edge between node 1 and node 2 has the attributes "interaction_form: Signaling_Triggered, interaction_time: T1, interaction_frequency: C1". The deviation propagation framework completely records the propagation order and transmission method of the deviation state.

[0175] Step S15510: Supplement the missing deviation identifiers and transmission interaction forms in the basic framework of deviation propagation, and incorporate all communication information that has deviated into the framework to form a symbiotic deviation propagation sequence;

[0176] In this embodiment, the missing deviation identifiers and transmission interaction forms are supplemented as follows: all communication information in the real-time acquired communication information co-existence unit is traversed again to check whether there is any communication information in a deviation state that has not been included in the deviation propagation basic framework. If so, its corresponding deviation identifier is added to the deviation identifier sequence, and the transmission interaction form between it and other deviation identifiers is identified and added to the edges of the deviation propagation basic framework. The final co-existence deviation propagation sequence is a complete graph structure that includes the propagation order and transmission mode of all communication information in a deviation state, which can comprehensively reflect the transmission and diffusion process of the initial co-existence deviation combination in the real-time acquired communication information co-existence unit.

[0177] Step S156: Identify the deviation state corresponding to each propagation node in the symbiotic deviation propagation sequence, extract the continuous change content of the deviation state with the propagation process, and form a deviation change feature set;

[0178] In this embodiment, the method for identifying the deviation state corresponding to each propagation node is as follows: the transmission attribute content of the communication information corresponding to each propagation node is compared with the co-evolution standard and co-evolution path standard in the feature co-evolution trajectory to determine the type of its deviation state, including node transmission frequency deviation, connection stability deviation, link interaction frequency deviation, co-evolution path deviation, etc.; at the same time, its deviation degree is calculated. The deviation degree is calculated by dividing the absolute value of the difference between the deviation value and the normal range by the standard deviation of the normal range. Then, the continuous changes in the deviation state during the propagation process are extracted, including changes in the type of deviation state, changes in the degree of deviation, and the time sequence of the occurrence of the deviation state. The above content is integrated into a deviation change feature set. The specific form of the deviation change feature set is a list structure, where each element is the deviation state information of a propagation node, for example, "[{node_id: SIP_001, deviation_type: Node_Frequency_Deviation, deviation_degree: D1, deviation_time: T1}, {node_id: MGCP_001, deviation_type: Link_Stability_Deviation, deviation_degree: D2, deviation_time: T2}]", where D1 and D2 are the degree of deviation, and T1 and T2 are the time when the deviation state occurs.

[0179] Step S157: Based on the propagation order of the symbiotic deviation transmission chain and the changes in the deviation change feature set, determine the possible change direction and propagation range of the initial symbiotic deviation combination in the subsequent transmission process, and form deviation evolution direction information;

[0180] In this embodiment, the specific implementation logic for determining the deviation from the evolution direction information is described through steps S1571 to S15710.

[0181] For example, step S1571: extract the propagation order of the deviation state in the symbiotic deviation propagation chain, and determine the direction of the deviation state propagating from one communication information to another communication information;

[0182] In this embodiment, the symbiotic deviation propagation chain is extracted from the symbiotic deviation propagation sequence and represents the main path of deviation state propagation, i.e., the propagation path with the highest frequency and the greatest degree of deviation. The propagation order of the deviation states in the extracted symbiotic deviation propagation chain is the order of the deviation identifiers, such as "SIP_001—MGCP_001—SDP_001". Then, the direction state of the deviation state is determined according to the propagation order. The direction state includes propagation from control plane signaling to user plane data, propagation from high-priority services to low-priority services, and propagation from the core network edge to the core network interior. For example, the direction state corresponding to the above propagation order is "Control_Plane_to_User_Plane", which means propagation from control plane signaling to user plane data.

[0183] Step S1572: Analyze the changes in each deviation state in the deviation change feature set, and statistically analyze the magnitude and form of the deviation state changes during the propagation process;

[0184] In this embodiment, the statistical method for the magnitude of change is as follows: calculate the difference between the deviation degree of each propagation node and the deviation degree of the previous propagation node. A positive difference indicates an increase in the deviation degree, and a negative difference indicates a decrease in the deviation degree. The average of the absolute values ​​of all differences is determined as the magnitude of the change in the deviation state during the propagation process. The statistical method for the form of change is as follows: statistically analyze the changes in the deviation state type during the propagation process, including whether the deviation state type changes and the frequency of change. For example, if the frequency of the deviation state type changing from node transmission frequency deviation to connection stability deviation is 0.8, then the change form is "Type_Changed".

[0185] Step S1573: Combining the directional state and the magnitude of change, construct the deviation propagation derivation structure, which is used to simulate the propagation path of the deviation state in the subsequent transmission process;

[0186] In this embodiment, the deviation propagation derivation structure is built using a Markov chain model. The state of the Markov chain model represents the deviation state type of the propagation node, and the state transition probability is the probability that the deviation state propagates from one node to another. The state transition probability is determined based on the direction state and the magnitude of change. For example, if the direction state is propagation from control plane signaling to user plane data, and the magnitude of change is large, then the state transition probability from the control plane node to the user plane node is set to a higher value. The deviation propagation derivation structure can simulate possible subsequent propagation paths based on the current deviation state.

[0187] Step S1574: Input the real-time symbiotic relationship network into the deviation propagation derivation structure to obtain the predicted propagation path output by the structure;

[0188] In this embodiment, the real-time symbiotic relationship network is used as the input to the deviation propagation derivation structure. The input includes information such as nodes, edges, and attributes of the real-time symbiotic relationship network. Based on the input real-time symbiotic relationship network and the state transition probability, the deviation propagation derivation structure outputs a predicted propagation path. The specific form of the predicted propagation path is an ordered list, where each element is a predicted propagation node identifier, such as "[SDP_001, RTP_001, PCRF_001]", where PCRF_001 is the unique identifier of the policy and billing rule function node.

[0189] Step S1575: Analyze the stable dependency state and symbiotic attribute content of the characteristic symbiotic relationship of each communication information on the predicted propagation path, and determine the transmission hindrance content and transmission promotion content of the deviation state on the predicted propagation path;

[0190] In this embodiment, the method for determining transmission-obstructing content is as follows: Analyze and predict the stable dependency state of the characteristic symbiotic relationship of each communication information along the propagation path. If the stable dependency state of the characteristic symbiotic relationship of the communication information is highly stable, then its transmission obstruction to the deviation state is significant, and it is determined as transmission-obstructing content. If the symbiotic attribute content of the communication information includes anti-diffusion attributes, such as retransmission restriction or traffic shaping, then its transmission obstruction to the deviation state is significant, and it is determined as transmission-obstructing content. The method for determining transmission-promoting content is as follows: If the stable dependency state of the characteristic symbiotic relationship of the communication information is low stable, then its transmission promotion to the deviation state is significant, and it is determined as transmission-promoting content. If the symbiotic attribute content of the communication information includes easily diffused attributes, such as high-bandwidth transmission or high-priority transmission, then its transmission promotion to the deviation state is significant, and it is determined as transmission-promoting content. For example, if the characteristic symbiotic relationship of node RTP_001 on the predicted propagation path is in a low-stability stable dependency state and its symbiotic attribute content includes a large-bandwidth transmission attribute, then it is identified as transmission-promoting content; if the characteristic symbiotic relationship of node PCRF_001 is in a high-stability stable dependency state and its symbiotic attribute content includes a traffic shaping attribute, then it is identified as transmission-impeding content.

[0191] Step S1576: Based on the transmission hindering content and transmission promoting content, adjust the output result of the deviation from the propagation derivation structure and correct the specific direction of the predicted propagation path;

[0192] In this embodiment, the output results are adjusted as follows: based on the degree of influence of transmission-impeding and transmission-enhancing content, the state transition probability deviating from the propagation derivation structure is adjusted. For example, if a node is transmission-impeding content, the state transition probability from that node to other nodes is reduced; if a node is transmission-enhancing content, the state transition probability from that node to other nodes is increased. Then, the deviation from the propagation derivation structure is rerun to obtain the corrected predicted propagation path. The corrected predicted propagation path better reflects the actual situation of real-time transmission scenarios. For example, if the PCRF_001 node is transmission-impeding content, the state transition probability from the SDP_001 node to the PCRF_001 node is reduced, and the corrected predicted propagation path may become "[SDP_001, RTP_001, PGW_001]", where PGW_001 is the unique identifier of the packet data gateway node.

[0193] Step S1577: Extract the communication information with the largest deviation from the state change in the corrected predicted propagation path, and determine the transmission time and co-occurrence attribute conditions corresponding to the communication information;

[0194] In this embodiment, the communication information with the largest deviation state change is determined as follows: The absolute value of the difference between the deviation degree of each communication information on the corrected predicted propagation path and the deviation degree of the previous communication information is calculated. The communication information with the largest absolute value of the difference is the communication information with the largest deviation state change. Then, the transmission time corresponding to this communication information is determined as the timestamp of its data packet, and the co-occurrence attribute condition is determined as the key attributes in its transmission attribute content, including service type, transmission priority, encryption status, etc. For example, if the absolute value of the deviation degree difference of the RTP_001 node on the corrected predicted propagation path is the largest, then its corresponding transmission time is T3, and the co-occurrence attribute condition is "service_type: VoLTE, transmission_priority: High, encryption_flag: Enabled".

[0195] Step S1578: Determine the trend of the deviation from the state after the communication information is received, and judge the subsequent trend of the deviation from the state.

[0196] In this embodiment, the trend of the deviation magnitude is determined as follows: The stable dependency state and symbiotic attribute content of the characteristic symbiotic relationship of the communication information are analyzed. If it is transmission-promoting content, the subsequent trend of the deviation magnitude is increasing; if it is transmission-impeding content, the subsequent trend of the deviation magnitude is decreasing. Simultaneously, the subsequent trend of the deviation is determined by combining the service type and time period of the core network. The trend includes continued diffusion, gradual convergence, and abrupt change. For example, if node RTP_001 is transmission-promoting content, and the current time period is the morning peak, then the subsequent trend of the deviation is determined to be continued diffusion, with the trend of the deviation magnitude increasing.

[0197] Step S1579: Combine the corrected predicted propagation path, the communication information with the largest deviation from the state change, and the subsequent change trend to form a basic description of the deviation from the evolution direction;

[0198] In this embodiment, the basic description of the deviation from the evolution direction is a structured text, which includes the corrected predicted propagation path, the identifier and attributes of the communication information with the largest deviation from the state, the subsequent change trend and magnitude trend of the deviation state, etc. For example, the basic description is "Corrected predicted propagation path: SDP_001—RTP_001—PGW_001; Communication information with the largest deviation from the state: RTP_001, transmission time: T3, co-occurrence attribute conditions: service_type: VoLTE, transmission_priority: High, encryption_flag: Enabled; Subsequent change trend: continued propagation; magnitude trend: increasing".

[0199] Step S15710: Supplement the details of the deviation state under different transmission times and different symbiotic attributes in the basic description, record the specific changes and propagation range of the deviation state, and form information on the direction of deviation evolution;

[0200] In this embodiment, the details of the deviation state are supplemented as follows: The specific changes in the deviation state under different transmission times and symbiotic attributes are analyzed, including changes in the type of deviation state, the specific value of the degree of deviation, and the propagation speed; the propagation range of the deviation state is recorded, including the number of affected communication messages, the affected symbiotic dimensions, and the affected service types. These supplementary contents are added to the basic description to ultimately form the deviation evolution direction information. This information fully records the possible changes and propagation range of the initial symbiotic deviation combination in subsequent transmission processes.

[0201] Step S158: Trace the starting propagation node of the symbiotic deviation propagation chain, determine the communication information identifier and symbiotic attribute content corresponding to the starting propagation node, and form deviation starting position information;

[0202] In this embodiment, the method for tracing the starting propagation node is as follows: starting from the first node of the symbiotic deviation propagation chain, trace its transmission source backward until the starting propagation node of the deviation state is found. The starting propagation node is the first communication information to show a deviation state. Then, determine the communication information identifier and symbiotic attribute content corresponding to the starting propagation node. The symbiotic attribute content includes protocol type, transmission port number, data packet length, transmission priority, symbiotic unit generation timestamp, etc. The above information is integrated into deviation start position information. The specific form of the deviation start position information is a key-value pair structure, such as "[{start_node_id: SIP_001, protocol_type: SIP, transmission_port: P1, packet_length: L1, transmission_priority: High, symbiosis_unit_timestamp: T1}]", where SIP_001 is the unique identifier of the starting propagation node, and T1 is the symbiotic unit generation timestamp.

[0203] Step S159: Collect the initial symbiotic deviation combination, symbiotic deviation propagation sequence, deviation change feature set, symbiotic deviation transmission chain, deviation start position information and deviation evolution direction information, and use them as elements to jointly construct a symbiotic deviation feature set containing deviation start position, propagation path, change state and evolution direction;

[0204] In this embodiment, the initial symbiotic deviation combination, symbiotic deviation propagation sequence, deviation change feature set, symbiotic deviation transmission chain, deviation initiation position information, and deviation evolution direction information are integrated into a structured data set. This set contains all the key information regarding the deviation initiation position, propagation path, change state, and evolution direction, which is the symbiotic deviation feature set. The specific form of the symbiotic deviation feature set is a dictionary structure, where each key corresponds to an element, and each value corresponds to the specific content of that element.

[0205] Step S1510: Based on the co-occurrence deviation feature set, generate communication information anomaly detection results;

[0206] In this embodiment, the method for generating communication information anomaly detection results is as follows: Analyze all information in the symbiotic deviation feature set to determine the type of anomaly, including signaling interaction anomalies, data transmission anomalies, service quality anomalies, and cross-dimensional symbiotic anomalies; determine the severity of the anomaly, which is comprehensively evaluated based on factors such as the degree of deviation, propagation range, and evolution direction. The evaluation method involves assigning weights to the impact of the degree of deviation, propagation range, and evolution direction, and then calculating a weighted score; the higher the score, the higher the anomaly severity. Simultaneously, anomaly handling suggestions are generated, including isolating abnormal communication information, adjusting transmission paths, and optimizing resource allocation. The final generated communication information anomaly detection result is a structured report containing anomaly type, anomaly severity, anomaly details, and anomaly handling suggestions, thus completing the generation of the communication information anomaly detection result.

[0207] Figure 2 This illustration shows a communication information anomaly detection system 100 based on self-supervised learning, as provided in an embodiment of this application. The system includes a processor 1001, a memory 1003, and program code stored in the memory 1003. The processor 1001 executes the program code to implement the steps of the communication information anomaly detection method based on self-supervised learning. The processor 1001 and the memory 1003 are connected, for example, via a bus 1002. Optionally, the communication information anomaly detection system 100 may further include a transceiver 1004, which can be used for data interaction between the self-supervised learning-based communication information anomaly detection system and other self-supervised learning-based communication information anomaly detection systems, such as sending and / or receiving data. It should be noted that in actual scheduling, the transceiver 1004 is not limited to one, and the structure of this communication information anomaly detection system 100 does not constitute a limitation on the embodiments of this application. The memory 1003 stores the program code for executing the embodiments of this application and is controlled by the processor 1001. The processor 1001 is used to execute program code stored in the memory 1003 to implement the steps shown in the foregoing method embodiments.

[0208] This application provides a computer-readable storage medium storing program code, which, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.

[0209] The above description is only an optional implementation method for some implementation scenarios of this application. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this application, without departing from the technical concept of this application, also fall within the protection scope of the embodiments of this application.

Claims

1. A method for communication information anomaly detection based on self-supervised learning, characterized in that, The method includes: The communication information co-occurrence unit is a collection of communication information transmitted in the communication network. The communication information co-occurrence unit is a combination of multiple communication information that are naturally formed during the communication process and have interdependent transmission relationships. Each communication information co-occurrence unit contains multiple communication information and co-occurrence attribute information that have transmission dependencies. Based on the unsupervised co-occurrence rules of self-supervised learning, a feature co-occurrence modeling structure is constructed. The feature co-occurrence modeling structure is used to capture the feature co-occurrence relationship between different communication information in the communication information co-occurrence unit. The feature co-occurrence relationship is a stable dependency state formed by communication information under normal transmission conditions. The feature co-occurrence modeling structure is used to perform self-supervised learning on historical communication information co-occurrence units to generate feature co-occurrence trajectories for normal transmission of communication information. These feature co-occurrence trajectories are the paths through which the feature co-occurrence relationships in the communication information co-occurrence units change during the transmission process. The co-occurrence units of real-time acquired communication information are co-occurred and matched with the feature co-occurrence trajectory to establish a co-occurrence anchoring relationship between the co-occurrence units of real-time acquired communication information and the feature co-occurrence trajectory. Based on the symbiotic anchoring relationship, the deviation propagation process of the feature symbiotic relationship and the feature symbiotic trajectory in the real-time collected communication information symbiotic unit is tracked, and a symbiotic deviation feature set including the deviation start position, propagation path, change state and evolution direction is extracted. Based on the symbiotic deviation feature set, a communication information anomaly detection result is generated. 2.The communication information anomaly detection method based on self-supervised learning according to claim 1, wherein, The unsupervised co-occurrence rules based on self-supervised learning construct a feature co-occurrence modeling structure. This structure is used to capture the feature co-occurrence relationships between different communication information in a communication information co-occurrence unit, including: Extract the transmission attribute content of each communication information in the communication information co-existence unit. The transmission attribute content is the specific information that the communication information carries in the network transmission, which represents its own transmission status. The transmission attribute content of all communication information is divided into symbiotic dimensions, and multiple symbiotic dimensions that reflect the symbiotic relationship of features are divided. Each symbiotic dimension corresponds to a dependency state of a type of transmission attribute content. For each symbiotic dimension, the symbiotic support content of all communication information under that symbiotic dimension is extracted. The symbiotic support content is the core transmission attribute combination that maintains the feature symbiotic relationship under that symbiotic dimension. Based on the symbiotic support content under the same symbiotic dimension, an intra-dimensional symbiotic network corresponding to the symbiotic dimension is constructed. Each node in the intra-dimensional symbiotic network corresponds to a communication information, and the connection between nodes corresponds to the specific stable dependency state of the feature symbiotic relationship. The common symbiotic content of communication information symbiotic units in different symbiotic dimensions is extracted across symbiotic dimensions. The common symbiotic content is a combination of supporting transmission attributes shared by the feature symbiotic relationship under different symbiotic dimensions. Based on the aforementioned common symbiotic content, a cross-dimensional symbiotic link is constructed. This cross-dimensional symbiotic link is used to connect intra-dimensional symbiotic networks of different symbiotic dimensions, thereby realizing the association and transmission of symbiotic relationships of features in different dimensions. Intra-dimensional symbiotic anchors are generated based on the node transmission frequency of the symbiotic network in each dimension, and cross-dimensional symbiotic anchors are generated based on the number of transmission interactions in the cross-dimensional symbiotic link. The intra-dimensional symbiotic anchors are the nodes with the most stable feature symbiotic relationships in the intra-dimensional symbiotic network, and the cross-dimensional symbiotic anchors are the nodes with the most frequent association transmission in the cross-dimensional symbiotic link. Based on the changes in the feature symbiotic relationship of the newly collected communication information symbiotic units, a dynamic adjustment operation for symbiotic anchor points is established. This dynamic adjustment operation updates the position of intra-dimensional and cross-dimensional symbiotic anchor points and the corresponding stable dependency state of feature symbiotic relationships in real time. All intradimensional symbiotic networks, cross-dimensional symbiotic links, intra-dimensional symbiotic anchors, cross-dimensional symbiotic anchors, and dynamic adjustment operations of symbiotic anchors are integrated to form an initial feature symbiotic modeling structure; Based on the communication information co-generation units of subsequent inputs, the initial feature co-generation modeling structure is subjected to structural parameter adaptation operations to form the final feature co-generation modeling structure. 3.The self-supervised learning based communication information anomaly detection method according to claim 1, characterized in that, The step of performing self-supervised learning on historical communication information co-occurrence units through the feature co-occurrence modeling structure to generate feature co-occurrence trajectories for normal transmission of communication information includes: Collect historical communication information co-existing units accumulated during the long-term operation of the communication network. The historical communication information co-existing units are communication information combinations that have been verified by actual transmission and have no abnormalities in the characteristic co-existence relationship. The historical communication information co-existence units are divided into multiple historical co-existence stages according to the transmission time sequence, and each historical co-existence stage contains multiple historical communication information co-existence units within a continuous time period; The historical communication information co-existence unit of each historical co-existence stage is input into the feature co-existence modeling structure. Through the intra-dimensional co-existence network and cross-dimensional co-existence link in the structure, the co-existence evolution features of each historical co-existence stage are extracted. The co-existence evolution features are the set of changing states of feature co-existence relationships within the historical co-existence stage. Based on self-supervised learning, an unsupervised learning approach is used to perform temporal correlation processing on the symbiotic evolution characteristics of different historical symbiotic stages, extract the continuous change state of the feature symbiotic relationship in different historical symbiotic stages, and form a temporal symbiotic change set. Based on the aforementioned temporal symbiotic change set, a feature symbiotic evolution structure is constructed. This feature symbiotic evolution structure is used to record the change path and intrinsic relationship of feature symbiotic relationships at different historical symbiotic stages. The feature symbiotic evolution structure is iteratively adjusted by dynamically adjusting the symbiotic anchor points, incorporating the update status of intra-dimensional and cross-dimensional symbiotic anchor points in each historical symbiotic stage, so that the feature symbiotic evolution structure conforms to the actual changes in historical feature symbiotic relationships. Extract the co-existence path features of communication information in each historical communication information co-existence unit. The co-existence path features are the path states formed by the transmission of communication information in the intra-dimensional co-existence network and the cross-dimensional co-existence link. The symbiotic path characteristics of all historical symbiotic stages are integrated temporally to form a symbiotic path evolution sequence, which is a set of continuous changes in symbiotic path characteristics with historical symbiotic stages. The feature symbiotic evolution structure is fused with the symbiotic path evolution sequence to build a normal symbiotic structure for the entire scenario. The normal symbiotic structure for the entire scenario contains the complete association between the changes in feature symbiotic relationships and the changes in symbiotic paths in all historical symbiotic stages. Based on the normal symbiotic structure of the entire scenario, normal feature symbiotic segments corresponding to each historical symbiotic stage are generated, and all normal feature symbiotic segments are connected in sequence according to the historical symbiotic stages to form a feature symbiotic trajectory for normal transmission of communication information.

4. The communication information anomaly detection method based on self-supervised learning according to claim 1, characterized in that, The process of tracking the deviation propagation of the feature symbiotic relationship and the feature symbiotic trajectory in the symbiotic communication information symbiotic unit based on the symbiotic anchoring relationship, and extracting a set of symbiotic deviation features including the deviation start position, propagation path, change state, and evolution direction, includes: Based on the symbiotic anchoring relationship, the target normal symbiotic segment corresponding to the communication information symbiotic unit collected in real time is determined from the feature symbiotic trajectory, and the symbiotic evolution standard and symbiotic path standard in the target normal symbiotic segment are extracted; Extract the real-time symbiotic evolution characteristics and real-time symbiotic path characteristics of the symbiotic units of the real-time collected communication information, compare the real-time symbiotic evolution characteristics with the symbiotic evolution standard point by point, and identify the initial symbiotic deviation points in the real-time symbiotic evolution characteristics that are inconsistent with the symbiotic evolution standard; The real-time symbiotic path features are compared point by point with the symbiotic path standard to identify auxiliary symbiotic deviation points in the real-time symbiotic path features that are inconsistent with the symbiotic path standard. The initial symbiotic deviation point and the auxiliary symbiotic deviation point are associated to establish a transmission dependency relationship between them, forming an initial symbiotic deviation combination. Based on the intra-dimensional symbiotic network and cross-dimensional symbiotic link in the feature symbiotic modeling structure, the transmission and diffusion process of the initial symbiotic deviation combination in the real-time acquired communication information symbiotic unit is tracked, and the order and interaction form of the initial symbiotic deviation combination spreading from the initial communication information to other communication information are recorded to form a symbiotic deviation propagation sequence. Identify the deviation state corresponding to each propagation node in the symbiotic deviation propagation sequence, extract the continuous change content of the deviation state with the propagation process, and form a deviation change feature set; Based on the propagation order of the symbiotic deviation transmission chain and the changes in the deviation change feature set, the possible change direction and propagation range of the initial symbiotic deviation combination in the subsequent transmission process are determined, forming deviation evolution direction information; The starting propagation node of the symbiotic deviation propagation chain is traced back to determine the communication information identifier and symbiotic attribute content corresponding to the starting propagation node, thereby forming deviation starting position information; Based on the propagation order of the symbiotic deviation transmission chain and the changes in the deviation change feature set, the possible change direction and propagation range of the initial symbiotic deviation combination in the subsequent transmission process are deduced, forming deviation evolution direction information; The initial symbiotic deviation combination, symbiotic deviation propagation sequence, deviation change feature set, symbiotic deviation transmission chain, deviation initiation position information, and deviation evolution direction information are collected and used as elements to jointly construct a symbiotic deviation feature set containing deviation initiation position, propagation path, change state, and evolution direction. 5.The self-supervised learning based communication information anomaly detection method according to claim 2, characterized in that, The process of generating intra-dimensional symbiotic anchor points based on the node transmission frequency of the symbiotic network in each dimension, and generating cross-dimensional symbiotic anchor points based on the number of transmission interactions in the cross-dimensional symbiotic link, includes: The number of times the communication information corresponding to each node in the symbiotic network within each dimension is transmitted and interacted with the communication information corresponding to other nodes is counted to form the node transmission frequency of each node. The number of transmission interactions per unit time for each connection in each cross-dimensional symbiotic link is counted to form the link interaction frequency of each connection. The transmission frequency of nodes in the symbiotic network within each dimension is sorted, and the top X nodes in the sorted list are selected as candidate symbiotic anchor points within the dimension. The link interaction frequency in each cross-dimensional symbiotic link is sorted, and the endpoint nodes of the top Y connection lines in the sorted list are selected as candidate cross-dimensional symbiotic anchor points. Extract the transmission attribute content of the communication information corresponding to the symbiotic anchor point within the candidate dimension, and verify the degree of fit between the transmission attribute content and the symbiotic support content of the corresponding symbiotic dimension; Extract the transmission attribute content of the communication information corresponding to the candidate cross-dimensional symbiotic anchor point, and verify the degree of fit between the transmission attribute content and the cross-dimensional common symbiotic content; Candidate dimensional co-occurring anchors that meet a preset threshold of fit are retained and determined as the final dimensional co-occurring anchors; Candidate cross-dimensional symbiotic anchor points whose fit reaches a preset threshold are retained and determined as the final cross-dimensional symbiotic anchor points; Record the position of each final intradimensional symbiotic anchor point in the intradimensional symbiotic network and the corresponding node transmission frequency; Record the position of each final cross-dimensional symbiotic anchor point in the cross-dimensional symbiotic link and the corresponding link interaction frequency to complete the generation of intra-dimensional symbiotic anchor points and cross-dimensional symbiotic anchor points. 6.The self-supervised learning based communication information anomaly detection method according to claim 3, characterized in that, The unsupervised learning method based on self-supervised learning performs temporal correlation processing on the symbiotic evolution characteristics of different historical symbiotic stages, mines the continuous change state of feature symbiotic relationships in different historical symbiotic stages, and forms a temporal symbiotic change set, including: All the symbiotic evolutionary characteristics of the historical symbiotic stages are arranged in chronological order according to the historical symbiotic stages to form a chronological sequence of symbiotic evolutionary characteristics; The temporal queue of the co-evolutionary features is divided into sliding windows, and each sliding window contains co-evolutionary features of multiple consecutive historical co-evolutionary stages; Extract the common feature content of all co-evolutionary features within each sliding window to form the window common feature of each sliding window; Compare the common features of two adjacent sliding windows, and record the newly added, disappeared, and modified features among the common features of adjacent windows; Based on the newly added, disappeared, and modified feature content of the common features of adjacent windows, a feature change association network is constructed. The feature change association network records the change path of the common features of the windows as the sliding window changes. Pattern extraction is performed on the feature change association network using a self-supervised learning unsupervised learning approach to identify recurring feature change paths in the feature change association network; The extracted recurring feature change paths are arranged in chronological order to establish the sequential transmission relationship between different recurring feature change paths; Based on the sequential transmission relationship between different recurring feature change paths, a feature change logic chain is constructed, which records the continuous transmission order of recurring feature change paths. Extract the feature change content corresponding to each logical node in the feature change logic chain, and retain the feature content that reflects the core changes of the feature symbiotic relationship. The retained feature content, which reflects the core changes in the feature symbiosis relationship, is integrated according to time sequence and transmission relationship to form a continuous change state of the feature symbiosis relationship in different historical symbiosis stages, and the output is a time-series symbiosis change set. 7.The self-supervised learning based communication information anomaly detection method according to claim 4, characterized in that, The intra-dimensional symbiotic network and cross-dimensional symbiotic links in the feature symbiotic modeling structure are used to track the transmission and diffusion process of the initial symbiotic deviation combination in the real-time acquired communication information symbiotic units, record the order and interaction form of the initial symbiotic deviation combination spreading from the initial communication information to other communication information, and form a symbiotic deviation propagation sequence, including: All communication information in the real-time collected communication information co-existing unit is uniquely identified to form a communication information identifier list, with each identifier corresponding to a specific communication information; Based on the intra-dimensional symbiotic network and cross-dimensional symbiotic links in the feature symbiotic modeling structure, a real-time symbiotic relationship network is built. The real-time symbiotic relationship network records the associated communication information and the stable dependency state of the feature symbiotic relationship corresponding to each communication information. The communication information identifiers corresponding to the initial symbiotic deviation point and the auxiliary symbiotic deviation point are extracted from the initial symbiotic deviation combination and determined as the deviation start identifier; Monitor the transmission and interaction process between the communication information corresponding to the deviation from the starting identifier and the associated communication information, and record the occurrence time and content of each transmission and interaction. The communication information identifier corresponding to the associated communication information that deviates during the transmission interaction process is identified and determined as a first-level deviation identifier; Monitor the transmission and interaction process between the communication information corresponding to the first-level deviation identifier and its associated communication information, identify the communication information identifier corresponding to the newly emerging deviation state, and determine it as the second-level deviation identifier; The deviation identifiers are arranged in the order of their occurrence, including the initial deviation identifier, the first-level deviation identifier, the second-level deviation identifier, and subsequent deviation identifiers, to form a deviation identifier sequence. Identify the transmission and interaction patterns between communication information corresponding to each adjacent deviation identifier, and record the specific way in which the deviation status is transmitted from one piece of communication information to another. Based on the deviation identifier sequence and the corresponding transmission interaction form, a basic framework for deviation propagation is built, which records the propagation order and transmission method of the deviation state; The missing deviation identifiers and transmission interaction forms in the aforementioned deviation propagation framework are supplemented, and all communication information that shows deviation states is incorporated into the framework to form a symbiotic deviation propagation sequence. 8.The self-supervised learning based communication information anomaly detection method according to claim 2, characterized in that, The dynamic adjustment operation of the symbiotic anchor point based on the changes in the characteristic symbiotic relationship of the newly acquired communication information symbiotic units includes: The system receives newly acquired communication information co-occurrence units in real time and determines the co-occurrence dimension to which the newly acquired communication information co-occurrence units belong by using the co-occurrence dimension division rules in the initial feature co-occurrence modeling structure. Extract the symbiotic support content and common symbiotic content from the newly collected communication information symbiotic units, and compare them with the existing symbiotic support content and common symbiotic content in the corresponding symbiotic dimension; Identify the newly added symbiotic support content and common symbiotic content in the newly collected communication information symbiotic units, and record the specific attributes and transmission status of the newly added content; Determine the impact of the newly added symbiotic support content on the node transmission frequency in the symbiotic network within the corresponding symbiotic dimension, recalculate the node transmission frequency of the affected nodes, and adjust the node transmission frequency ranking. Determine the impact of newly added common symbiotic content on the link interaction frequency in the cross-dimensional symbiotic link, re-count the link interaction frequency of the affected connection lines, and adjust the sorting of link interaction frequencies; Based on the adjusted node transmission frequency sorting, co-occurring anchor points within the candidate dimensions are reselected to replace the original co-occurring anchor points within the candidate dimensions affected by the new content. Based on the adjusted link interaction frequency ranking, candidate cross-dimensional symbiotic anchor points are reselected to replace the original candidate cross-dimensional symbiotic anchor points affected by the new content. Compare the transmission attribute differences between the newly selected candidate symbiotic anchors in the same dimension and the original symbiotic anchors in the same dimension, and adjust the stable dependency state of the feature symbiotic relationship of the symbiotic anchors in the same dimension according to the differences. Compare the transmission attribute differences between the newly selected candidate cross-dimensional symbiotic anchor points and the original cross-dimensional symbiotic anchor points, and adjust the stable dependency state of the feature symbiotic relationship of the cross-dimensional symbiotic anchor points according to the differences. The adjustment content of intra-dimensional and cross-dimensional symbiotic anchor points is recorded, including candidate replacement situations and adjustments to the stable dependency state of feature symbiotic relationships, forming an anchor point adjustment record. Based on the anchor point adjustment record, a dynamic adjustment operation for symbiotic anchor points is built. 9.The communication information anomaly detection method based on self-supervised learning according to claim 3, characterized in that, The step of fusing the feature co-evolutionary structure with the co-evolutionary path sequence to build a normal co-evolutionary structure for the entire scenario includes: The changes in feature symbiotic relationships in the aforementioned feature symbiotic evolution structure are hierarchically decomposed to divide them into intra-dimensional symbiotic evolution levels and cross-dimensional symbiotic evolution levels, which correspond to the changes in feature symbiotic relationships within and across dimensions, respectively. The symbiotic path changes in the symbiotic path evolution sequence are hierarchically decomposed to divide the path evolution levels within the dimension and the path evolution levels across the dimension, which correspond to the symbiotic path changes within the dimension and across the dimension, respectively. Establish the correspondence between the symbiotic evolution hierarchy and the path evolution hierarchy within the dimension, and record the transmission dependency relationship between changes in symbiotic relationships and changes in symbiotic paths within the dimension; Establish the correspondence between cross-dimensional symbiotic evolution levels and cross-dimensional path evolution levels, and record the transmission dependency relationship between changes in cross-dimensional feature symbiotic relationships and changes in cross-dimensional symbiotic paths; The triggering transmission conditions for the symbiotic evolution level and the path evolution level within the dimension are extracted. The triggering transmission conditions are the specific transmission scenarios that cause changes in the symbiotic relationship and symbiotic path within the dimension. The triggering transmission conditions of the cross-dimensional symbiotic evolution level and the cross-dimensional path evolution level are extracted. The triggering transmission conditions are the specific transmission scenarios that cause changes in cross-dimensional feature symbiotic relationships and symbiotic paths. Based on the extracted intra-dimensional and cross-dimensional triggering transmission conditions, an evolutionary triggering association structure is constructed. The evolutionary triggering association structure records the corresponding associations between triggering transmission conditions and changes in feature symbiotic relationships and symbiotic paths. Based on the hierarchical correspondence within and across dimensions, triggering transmission conditions, and evolution triggering association structure, an initial normal symbiotic structure for the entire scenario is constructed. Add the transmission transition associations between different levels in the initial full-scene normal symbiotic structure, and integrate the anchor point adjustment records of the dynamic adjustment operation of the symbiotic anchor points to form a full-scene normal symbiotic structure. 10.A system for communication information anomaly detection based on self-supervised learning, characterized in that, The method includes a processor and a computer-readable storage medium storing machine-executable instructions, which, when executed by the processor, implement the communication information anomaly detection method based on self-supervised learning as described in any one of claims 1-9.

Images