Signaling analysis method, system, device, medium and product

Abstract

The invention discloses a signaling analysis method, system and device, a medium and a product, and the method comprises the steps: responding to the received complaint information of a target user, and generating a first signaling data set based on network signaling data corresponding to the complaint information; identifying abnormal signaling from the first signaling data set based on a preset abnormal signaling feature library, and extracting signaling data in a preset time range from the first signaling data set based on a timestamp of the abnormal signaling to form a second signaling data set; matching the second signaling data set with a pre-constructed case rule base to determine a target case rule; extracting a signaling subset associated with the target case rule from the second signaling data set through semantic filtering; and performing case analysis on the signaling subset based on a preset analysis normal form to obtain an analysis result. According to the method, a standardized intelligent analysis process is constructed, so that the complaint analysis duration is greatly shortened, and the dependence on artificial experience is reduced.

Description

Technical Field

[0001] Applications generally relate to the field of Internet of Things (IoT) technology, and in particular to a signaling analysis method, system, device, medium, and product. Background Technology

[0002] With the large-scale deployment of 5G networks (5th Generation Network) and the evolution of the core network's service-oriented architecture, 5GC (5G Core Network) signaling analysis, which addresses user complaints, has become a crucial link in ensuring network service quality. Currently, related technologies typically rely on operations and maintenance experts manually tracing back the signaling process, combined with tools such as Wireshark to perform offline decoding and protocol analysis of the raw bitstream.

[0003] However, existing methods in related technologies suffer from significant drawbacks when dealing with massive and heterogeneous 5GC signaling data, including low analysis efficiency, insufficient intelligence, and high reliance on human expertise. Manual analysis can take several hours, hindering rapid responses to user complaints; furthermore, traditional tools cannot automatically identify and pinpoint the root causes of abnormal signaling, limiting the accuracy and scalability of operational responses. Therefore, achieving efficient, intelligent, and interpretable automated analysis in the complex and ever-changing 5GC signaling environment has become a pressing technical challenge for improving network operations and maintenance. Summary of the Invention In view of the above, this application provides a signaling analysis method, system, device, medium, and product to address some of the deficiencies mentioned in the background art.

[0004] In a first aspect, embodiments of this application provide a signaling analysis method, including: In response to receiving a complaint from a target user, a first signaling dataset is generated based on the network signaling data corresponding to the complaint information; Based on a preset abnormal signaling feature library, abnormal signaling is identified from the first signaling dataset, and based on the timestamps of the abnormal signaling, signaling data within a preset time range is extracted from the first signaling dataset to form a second signaling dataset. The second signaling dataset is matched with a pre-built case rule base to determine the target case rule; Semantic filtering is used to extract a subset of signaling associated with the target case rule from the second signaling dataset; The signaling subset is analyzed using a pre-defined analytical paradigm to obtain the analysis results.

[0005] In a second aspect, embodiments of this application provide a signaling analysis system, including: The complaint information parsing module is configured to: in response to receiving complaint information from a target user, generate a first signaling dataset based on network signaling data corresponding to the complaint information; The abnormal signaling determination module is configured to: identify abnormal signaling from the first signaling dataset based on a preset abnormal signaling feature library, and extract signaling data within a preset time range from the first signaling dataset based on the timestamp of the abnormal signaling to form a second signaling dataset; The case rule determination module is configured to match the second signaling dataset with a pre-built case rule library to determine the target case rule; The signaling subset generation module is configured to extract a signaling subset associated with the target case rule from the second signaling dataset through semantic filtering; The signaling analysis module is configured to perform case analysis on the signaling subset based on a preset analysis paradigm to obtain analysis results.

[0006] In a third aspect, this application provides a computer device including one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and executed by the one or more processors, and the one or more programs include instructions for performing the method described in the first aspect.

[0007] In a fourth aspect, this application provides a non-volatile computer-readable storage medium containing a computer program that, when executed by one or more processors, causes the one or more processors to perform the method described in the first aspect.

[0008] In a fifth aspect, this application provides a computer program product comprising one or more computer programs that, when executed by one or more processors, implement the method described in the first aspect.

[0009] The signaling analysis method, system, device, medium, and product provided in this disclosure, by constructing a complaint-driven closed-loop process for signaling analysis, can efficiently and automatically complete the intelligent analysis from raw signaling data to anomaly location results, achieving a significant improvement in the efficiency and intelligence level of signaling analysis in the fifth-generation core network. Attached Figure Description

[0010] Figure 1 A schematic flowchart of a signaling analysis method provided in an embodiment of this application is shown; Figure 2 A schematic flowchart of a signaling analysis process provided in an embodiment of this application is shown; Figure 3This paper shows a schematic diagram of the structure of a signaling analysis system provided in an embodiment of this application; Figure 4 A schematic diagram of a more specific electronic device hardware structure provided in this embodiment is shown. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0012] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0013] The term "in response to" as used herein refers to a state in which a corresponding event occurs or a condition is satisfied. It will be understood that the timing of subsequent actions performed in response to such event or condition is not necessarily strongly correlated with the time when the event occurs or the condition is met. For example, in some cases, subsequent actions may be performed immediately upon the occurrence of the event or the fulfillment of the condition; while in others, they may be performed some time after the occurrence of the event or the fulfillment of the condition.

[0014] For clarity, before describing the specific technical solutions of the embodiments of this application, the technical terms involved in the embodiments of this application will be explained first.

[0015] 5G Core Network (5GC): refers to the core network part of the fifth-generation mobile communication system. It adopts a service-based architecture and is responsible for core functions such as session management, mobility management, and policy control.

[0016] International Mobile Subscriber Identity (IMSI): A number used to uniquely identify a mobile subscriber worldwide.

[0017] Large Language Model (LLM): refers to a large-scale artificial intelligence model that is trained on massive amounts of text data and is able to understand and generate natural language text.

[0018] Retrieval-augmented Generation (RAG) is a technological paradigm that combines information retrieval with the generation capabilities of large language models, aiming to improve the accuracy and relevance of generated content.

[0019] Deep Packet Inspection (DPI): A technique for in-depth analysis of network packet content, used to identify, classify, or intercept application layer information in packet payloads.

[0020] The 3rd Generation Partnership Project (3GPP) is a standardization organization that leads the development of technical specifications for global mobile communication systems.

[0021] Anomaly Main Process Signaling Feature Base: A predefined knowledge base containing specific signaling message features (such as signaling name, key information elements, etc.) used to identify anomalies or failures in key signaling processes of the fifth-generation core network.

[0022] Structured Signaling Recognition Case Rule Documentation Library: A knowledge base stored in a structured form based on historical operation and maintenance experience. Each case rule includes information such as main event message characteristics, involved signaling, rule thinking chain (i.e., the sequence of executable judgment logic steps), abnormal scenario description, and handling suggestions.

[0023] Plan-Do-Summary Paradigm: A working mode of intelligent agents, which refers to the method by which an intelligent agent first formulates a step-by-step execution plan when performing a task, then executes the steps in the plan step by step, and finally summarizes and outputs the execution process and results.

[0024] As described in the background section, the methods in related technologies suffer from significant drawbacks when dealing with massive, heterogeneous 5GC signaling data, including low analysis efficiency, insufficient intelligence, and high reliance on personnel's professional experience. Manual analysis can take several hours, making it difficult to quickly respond to user complaints; furthermore, traditional tools cannot automatically identify and delimit abnormal signaling, limiting the accuracy and scalability of operational responses. Specifically: The relevant technical solutions mainly have the following technical problems when handling the fifth-generation core network signaling analysis for complaint scenarios: Limited analysis efficiency: It heavily relies on technical personnel to manually process massive amounts of signaling data, the process is time-consuming and lengthy, it is difficult to quickly locate problems, and it cannot meet the real-time response requirements in high-concurrency complaint scenarios.

[0025] Insufficient level of intelligence: It mainly relies on traditional signaling analysis tools and human experience for judgment, lacks the ability to automatically identify anomalies and intelligently analyze root causes, and the analysis results are greatly affected by the professional level of personnel, resulting in poor reproducibility and consistency.

[0026] Insufficient flexibility: Traditional analysis tools have rigid functions, making it difficult to adapt to complex and ever-changing signaling scenarios and complaint types. They also typically rely on specific software environments and server resources, making their deployment and use inflexible and inconvenient.

[0027] The professional threshold is too high: the analysis process relies heavily on technical personnel's in-depth understanding of core network protocols and signaling processes, which leads to high personnel training costs, difficulties in knowledge transfer, and hinders the scaling and popularization of operation and maintenance capabilities.

[0028] In view of this, this application provides a signaling analysis method, system, device, medium, and product that can solve or partially solve the above-mentioned problems to a certain extent. Specifically, this application introduces Large Language Model (LLM) and intelligent agent technology to construct an automated process covering "complaint-driven - anomaly localization - rule matching - semantic filtering - intelligent analysis". While ensuring the accuracy and interpretability of the analysis results, it significantly improves the analysis efficiency and reduces the dependence on professional experience and specific analysis environments, thereby realizing the intelligent, efficient, and widespread application of 5GC signaling analysis.

[0029] The signaling analysis method in this disclosure can be executed by a signaling analysis system. This system can be deployed in the operator's network operation and maintenance center to intelligently handle user complaints regarding the service quality of the fifth-generation core network. When the system receives a new user complaint on the operation and maintenance platform or in the work order system, it can automatically trigger the complete signaling analysis process described in this disclosure, thereby replacing the traditional analysis mode that relies on experts manually tracing back the signaling.

[0030] Figure 1 A schematic flowchart of a signaling analysis method provided in an embodiment of this application is shown; Figure 2 A schematic flowchart of a signaling analysis process provided in an embodiment of this application is shown.

[0031] like Figure 1 and 2 As shown, the method may include the following steps: S102: In response to receiving complaint information from the target user, a first signaling dataset is generated based on the network signaling data corresponding to the complaint information.

[0032] When the system receives a user complaint ticket, its primary task is to obtain signaling data related to the complaint that can be directly processed by the machine. Therefore, the system can determine the target user's identification information (such as mobile phone number or IMSI) and the time period of the complaint based on the complaint information. This is the data anchor point for initiating analysis, because without user identification and time, it is impossible to locate relevant data in the vast ocean of network signaling.

[0033] In some optional embodiments, the aforementioned target user identification information may be a unique identifier such as an International Mobile Subscriber Identity (IMSI), telephone number, or subscription identifier. The complaint time period may refer to the time range within which the user perceives the problem occurring.

[0034] Subsequently, the system can automatically query the signaling monitoring system (such as a deep packet inspection probe deployed on the core network side) based on the identification information and the complaint time period to obtain all the original signaling code streams of the user within that time period. The signaling monitoring system is responsible for collecting and storing network signaling, and it can accurately locate the relevant raw data through the user identifier and time period.

[0035] Since the raw bitstream is unprocessed binary data, it cannot be directly used for analysis. Therefore, the system can decode and structure the raw signaling bitstream to generate a first signaling dataset.

[0036] In some optional embodiments, the aforementioned decoding process can convert binary data into human-computer readable text based on the 3GPP standard protocol stack; structuring can be achieved by extracting key fields such as signaling time, signaling name (e.g., Registration request), and signaling path (source / destination network element) to form a structured dataset that is easy for the program to process and analyze.

[0037] In some optional embodiments, the process of generating the first signaling dataset may also include data cleaning and formatting, such as standardizing timestamp formats and network element names, to improve data quality.

[0038] In this disclosure, by automatically decoding the raw bitstream and structuring it into a standard dataset, a unified and clear data input is provided for subsequent steps, eliminating the tediousness and errors of manual parsing. This is the first and crucial step in starting the entire automated analysis process.

[0039] S104: Identify abnormal signaling from the first signaling dataset based on a preset abnormal signaling feature library, and extract signaling data within a preset time range from the first signaling dataset based on the timestamp of the abnormal signaling to form a second signaling dataset.

[0040] After obtaining the initial signaling dataset, the core challenge for the system is how to quickly focus on the anomalies most likely to trigger complaints from potentially thousands of signaling messages. Performing a full, in-depth analysis of the entire dataset would be extremely inefficient.

[0041] Therefore, this disclosure innovatively introduces a pre-defined abnormal signaling signature library. This signature library can be pre-extracted by operations and maintenance experts and contains key signaling names or content (e.g., "Registration reject") that indicate the failure of various services (such as registration, handover, session establishment).

[0042] In some optional embodiments, the system can traverse the first dataset and quickly compare each signaling message with an abnormal signaling feature library (such as string matching). Once a match is found, it can be identified as "abnormal signaling." This is equivalent to automatically tagging a "suspicious fault" in the data stream, finding a starting point for in-depth analysis.

[0043] In some optional embodiments, the aforementioned preset abnormal signaling feature library may also include keywords or key information element features used to characterize the failure of different signaling events. For example, for the "initial registration" event, the feature library may include message text such as "Registration reject".

[0044] In some optional embodiments, the aforementioned process of identifying abnormal signaling can be further specified as follows: the system traverses each signaling message in the first signaling dataset and matches its signaling name or key content with features in the abnormal signaling feature library. If a match is successful, the signaling message is identified as abnormal. This step enables the rapid and automatic identification of potential fault points from massive amounts of data.

[0045] The inventors of this disclosure also discovered in their research that simply locating abnormal signaling is insufficient, as a single service failure often involves a series of preceding and following signaling interactions. Therefore, in order to obtain the complete fault context, the system in this disclosure can also use the timestamp of the identified abnormal signaling as a reference and extend it forward and backward by a preset time window (e.g., 20 seconds forward, 10 seconds backward, etc.) to form a time range.

[0046] Furthermore, the system can extract all signaling data with timestamps falling within this time range from the aforementioned first signaling dataset, thus forming a second signaling dataset. This dataset is no longer the full dataset, but rather an "event slice" tightly focused on the anomaly point, containing the complete signaling flow before and after the failure. The purpose of this is to significantly reduce the amount of data that requires in-depth processing later, while ensuring that no key context is lost, laying the foundation for accurate analysis.

[0047] In some optional embodiments, the process of forming the aforementioned time range may also be specifically as follows: the system uses the timestamp t0 of the identified abnormal signaling as a reference to determine the start and end time points of the signaling data extraction, for example, the start point is t0-m and the end point is t0+n, where m and n are preset positive integers (e.g., m=20 seconds, n=10 seconds).

[0048] It is understandable that the aforementioned time range can be dynamically adjusted according to different signaling event types, rather than being a fixed value, in order to adapt to the duration characteristics of different business processes.

[0049] This disclosure achieves intelligent simplification of core analytical data through anomaly feature matching and dynamic time slicing. The inventors' practical experience shows that this can reduce the amount of data to be analyzed by more than 30%, significantly reducing subsequent computational overhead, while ensuring that the complete signaling context surrounding the anomaly event is preserved, laying the foundation for accurate analysis.

[0050] S106: Match the second signaling dataset with the pre-built case rule base to determine the target case rule.

[0051] In some optional embodiments, after obtaining a second signaling dataset containing anomalous events, the core task of the system is to match the dataset with a suitable analysis method. To this end, this disclosure also constructs and maintains a case rule base. This case rule base systematically stores fault analysis logic (also known as a "thinking chain") summarized and solidified based on historical operational experience. Each rule in the base precisely corresponds to a specific network anomaly scenario and its complete analysis and diagnostic method. By matching the current anomalous event with the rule base, the system can automatically invoke validated analysis paths, thereby achieving intelligent and standardized fault identification.

[0052] In some optional embodiments, in order to accurately retrieve analysis rules that match the current anomalous event from the case rule base, the system employs an efficient matching strategy. Specifically, the system first extracts the "signaling names" of all signaling in the second signaling dataset and aggregates them into a "feature set" that represents the current event.

[0053] Subsequently, the system performs string matching between this feature set and the main event message features defined by each rule in the case rule base (i.e., the text identifier used to identify the core abnormal signaling targeted by the rule). For example, if there is a signaling named "Registration reject" in the second dataset, and the main event feature of a rule in the rule base is also "Registration reject", then that rule is initially selected as a relevant rule.

[0054] It is understandable that the aforementioned matching algorithm can be either an exact matching algorithm such as string matching, or a fuzzy matching algorithm containing specific keywords.

[0055] Furthermore, the system identifies all matched rules as target case rules, collectively forming a list of candidate rules for further in-depth analysis. In this disclosure, this step essentially completes the transformation from detecting abnormal signaling to intelligently selecting analytical solutions, replacing the traditional operational process of relying on manual experience to choose diagnostic approaches through automated rule matching.

[0056] In some optional embodiments, the aforementioned case rule base may be a structured document library (e.g., JSON format) built based on historical operation and maintenance experience, which can support online hot-swappable updates, thereby enabling continuous knowledge accumulation and version management.

[0057] In this disclosure, the key feature of signaling name is used to quickly filter out analysis templates (i.e. target case rules) that are potentially related to the current abnormal dataset from a large rule knowledge base. This transforms the manual, experience-based screening process into an efficient rule retrieval process, pointing the way for subsequent targeted and in-depth analysis.

[0058] S108: Extract the signaling subset associated with the target case rule from the second signaling dataset through semantic filtering.

[0059] After determining the list of target case rules, the system needs to filter and provide highly relevant input data for each rule. This is because the analytical logic (i.e., the "thinking chain") embedded in each rule typically focuses only on a few key signaling nodes in the signaling process. For example, for the rule "registration is rejected due to authentication failure," its analytical logic may only need to examine the two specific signaling messages, "authentication request" and "authentication failure response," without paying attention to other unrelated signaling interactions that occur within the same time period.

[0060] Therefore, to achieve accurate data filtering, the system needs to perform semantic filtering operations for each target case rule. Specifically: In some optional embodiments, the system first obtains predefined signaling features from the target case rules. These features are typically recorded in the signaling fields related to the rules and are textual descriptions of the specific signaling on which the rule analysis depends, with a more granular level than the main event message features used for rule matching.

[0061] In some optional embodiments, the system uses an embedding model to convert the “signaling name” of each signaling in the second signaling dataset and the “signaling feature” obtained from the rules into high-dimensional vector representations, that is, to obtain the signaling name vector and the signaling feature vector.

[0062] In some optional embodiments, the system calculates the semantic similarity between each signaling name vector and the signaling feature vector. Commonly used metrics include cosine similarity. This calculation aims to evaluate the strength of the association between signaling data and rule features at the semantic level, rather than just the literal matching level.

[0063] In some optional embodiments, the aforementioned similarity calculation process can be specifically represented as follows: .

[0064]

[0065] In some optional embodiments, the system filters the second signaling dataset based on a preset similarity threshold (e.g., 0.8). Only when the semantic similarity between a signaling string and a feature of a rule is greater than or equal to this threshold is the signaling string considered highly relevant to that rule. It is understood that this threshold can be flexibly configured according to different requirements for accuracy and recall in actual scenarios.

[0066] In some optional embodiments, the system generates a subset of signaling data specific to the current target case rule based on all the filtered target signaling data. This subset is a refined subset of the second signaling dataset, effectively eliminating a large amount of "noise" data that is irrelevant to the analysis context.

[0067] In this disclosure, the semantic filtering step is a second, in-depth refinement of the signaling data. It not only overcomes the limitations of simple string matching but also captures the deep-seated relationships between signaling text and rule features through vectorization and semantic similarity calculation. As a result, the system can provide highly relevant and extremely concise data to the subsequent intelligent analysis module. This significantly improves the processing efficiency of the analysis engine and effectively alleviates the context length pressure faced by large language models, making it a key technical step in ensuring the accuracy and real-time nature of the analysis results.

[0068] S110: Perform case analysis on the signaling subset based on a preset analysis paradigm to obtain analysis results.

[0069] Once the system has matched each potential fault scenario to be diagnosed (i.e., target case rule) with dedicated analysis logic and refined data (i.e., signaling subset), the analysis process in this disclosure enters the final intelligent analysis and conclusion generation stage.

[0070] Specifically, the system can dynamically create multiple parallel analysis tasks based on the target case rule list, with each task independently handling one rule and its corresponding signaling subset. This parallel task scheduling architecture can fully explore and utilize computing resources to achieve simultaneous diagnosis of multiple possible root causes of failures, thereby greatly improving the overall processing throughput and response speed of the system.

[0071] Within each independent analysis task, the system strictly adheres to a pre-defined analysis paradigm (i.e., "plan-execute-summary") for the analysis process. Specifically: In some optional embodiments, the system creates and executes multiple analysis tasks based on the target case rules. Since the previous steps may match multiple target case rules, the system creates multiple parallel analysis tasks accordingly, each task focusing on in-depth analysis of one rule.

[0072] In some optional embodiments, for each analysis task, the system can generate an "analysis execution plan" containing multiple ordered decision steps based on its corresponding target case rules. This plan is directly derived from the "rule thinking chain" defined in the rules, and its function is to decompose the abstract analysis logic into a series of specific, sequentially executable task instructions.

[0073] In some optional embodiments, the system can sequentially perform the analysis operations defined in each decision step on the signaling subset based on the analysis execution plan. For example, one step might require "checking whether signaling A exists in the signaling subset," and a subsequent step might be "if it exists, verify whether its parameter X is equal to a specific value Y." These operations can be executed by calling a large language model (such as the Jiutian Network Operation and Maintenance Large Model) or a dedicated rule engine in the backend.

[0074] In some optional embodiments, the system summarizes the execution results of each of the determination steps. For example, the retrieval results of all steps are integrated with the logical judgment conclusion.

[0075] In some optional embodiments, the system generates a final judgment analysis result for the signaling subset under the target case rule. This result clearly clarifies whether the current signaling data conforms to the abnormal scenario defined by the rule, and outputs detailed root cause analysis, business impact assessment, and actionable processing suggestions.

[0076] In some optional embodiments, the preset analysis paradigm is specifically instantiated as a "plan-execute-summary" agent working paradigm. The planning phase corresponds to generating an analysis execution plan, the execution phase corresponds to executing each step sequentially, and the summary phase corresponds to summarizing intermediate results and generating a final decision. This paradigm ensures that the entire analysis process has good interpretability, auditability, and reproducibility.

[0077] In this disclosure, this step is the core manifestation of the overall intelligence level of the method. By transforming the static case rule base into a dynamic and executable intelligent agent task cluster, and strictly following the "plan-execute-summary" paradigm, the system can simulate the reasoning process of domain experts, achieving automated, in-depth, and logically transparent analysis of complex fifth-generation core network signaling processes. This not only significantly reduces the signaling analysis time for a single complaint from hours in traditional manual methods to minutes, but also greatly improves the system throughput efficiency through parallel processing capabilities. Ultimately, it can efficiently and accurately produce complaint analysis reports with precise positioning and clear recommendations, and automatically populate them back into the operation and maintenance work order system, forming a closed-loop processing mechanism.

[0078] Based on the same inventive concept, and corresponding to the methods of any of the above embodiments, this application also provides a signaling analysis system.

[0079] Figure 3 This is a schematic diagram of the structure of a signaling analysis system provided in an embodiment of this application.

[0080] refer to Figure 3 As shown, the signaling analysis system includes: The complaint information parsing module 202 is configured to: in response to receiving complaint information from a target user, generate a first signaling dataset based on network signaling data corresponding to the complaint information.

[0081] In some optional embodiments, the complaint information parsing module 202 further performs the following steps: Based on the complaint information, the target user's identification information and the time period of the complaint are determined; Based on the identification information and the complaint time period, the original signaling code stream is obtained from the signaling monitoring system; The original signaling bitstream is decoded and structured to generate the first signaling dataset.

[0082] The abnormal signaling determination module 204 is configured to: identify abnormal signaling from the first signaling dataset based on a preset abnormal signaling feature library, and extract signaling data within a preset time range from the first signaling dataset based on the timestamp of the abnormal signaling to form a second signaling dataset.

[0083] In some optional embodiments, the abnormal signaling determination module 204 further performs the following steps: Based on the timestamp of the abnormal signaling, determine the start and end times for signaling data extraction; From the first signaling dataset, extract all signaling data whose timestamps are between the start time and the end time, and form a second signaling dataset; wherein, the second signaling dataset is a signaling dataset associated with the abnormal signaling.

[0084] The case rule determination module 206 is configured to match the second signaling dataset with a pre-built case rule library to determine the target case rule.

[0085] In some optional embodiments, the case rule determination module 206 further performs the following steps: Extract the signaling name of each signaling from the second signaling dataset; The signaling name is matched with the main event message features of each case rule in the case rule base to obtain the matching result; The matching case rule is determined as the target case rule.

[0086] The signaling subset generation module 208 is configured to extract a signaling subset associated with the target case rule from the second signaling dataset through semantic filtering.

[0087] In some optional embodiments, the signaling subset generation module 208 further performs the following steps: Obtain the predefined signaling features from the target case rules; The signaling name is vectorized to obtain a signaling name vector, and the signaling feature is vectorized to obtain a signaling feature vector; Calculate the semantic similarity between the signaling name vector and the signaling feature vector; In the second signaling dataset, identify target signaling data whose semantic similarity is greater than a preset threshold; A signaling subset is generated based on the target signaling data.

[0088] The signaling analysis module 210 is configured to perform case analysis on the signaling subset based on a preset analysis paradigm to obtain analysis results.

[0089] In some optional embodiments, the signaling analysis module 210 further performs the following steps: Multiple analysis tasks are created and executed based on the target case rules; Specifically, for each of the aforementioned analysis tasks: Based on the target case rules, an analysis execution plan containing multiple decision steps is generated; Based on the analysis execution plan, the analysis operations defined in each of the decision steps are executed sequentially on the signaling subset; The analysis results of each determination step are summarized to generate the determination analysis results of the signaling subset under the target case rule.

[0090] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0091] The apparatus described above can be used to implement the corresponding signaling analysis method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0092] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the signaling analysis method described in any of the above embodiments.

[0093] Figure 4 This embodiment illustrates a more specific hardware structure of a computer device, which may include a processor 810, a memory 820, an input / output interface 830, a communication interface 840, and a bus 850. The processor 810, memory 820, input / output interface 830, and communication interface 840 are interconnected internally via the bus 850. The processor 810 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the signaling analysis method provided in any of the foregoing embodiments of this specification.

[0094] The memory 820 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 820 can store operating devices and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 820 and is called and executed by the processor 810.

[0095] The input / output interface 830 is used to connect input / output modules to enable information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0096] The communication interface 840 is used to connect the communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 850 includes a pathway for transmitting information between various components of the device, such as processor 810, memory 820, input / output interface 830, and communication interface 840.

[0097] It should be noted that although the above-described device only shows the processor 810, memory 820, input / output interface 830, communication interface 840, and bus 850, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures. The electronic devices described above are used to implement the corresponding signaling analysis methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here. Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to execute the signaling analysis method as described in any of the above embodiments.

[0098] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device. The aforementioned non-transitory computer-readable storage media can be any available medium or data storage device that a computer can access, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MOs), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)). The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the signaling analysis method as described in any of the embodiments in the exemplary method section above, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0099] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0100] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0101] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0102] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. A signaling analysis method, characterized in that, include: In response to receiving a complaint from a target user, a first signaling dataset is generated based on the network signaling data corresponding to the complaint information; Based on a preset abnormal signaling feature library, abnormal signaling is identified from the first signaling dataset, and based on the timestamps of the abnormal signaling, signaling data within a preset time range is extracted from the first signaling dataset to form a second signaling dataset; The second signaling dataset is matched with a pre-built case rule base to determine the target case rule; Semantic filtering is used to extract a subset of signaling associated with the target case rule from the second signaling dataset; The signaling subset is analyzed using a pre-defined analytical paradigm to obtain the analysis results.

2. The signaling analysis method according to claim 1, characterized in that, The generation of the first signaling dataset based on the network signaling data corresponding to the complaint information includes: Based on the complaint information, the target user's identification information and the time period of the complaint are determined; Based on the identification information and the complaint time period, the original signaling code stream is obtained from the signaling monitoring system; The original signaling bitstream is decoded and structured to generate the first signaling dataset.

3. The signaling analysis method according to claim 1, characterized in that, The step of extracting signaling data within a preset time range from the first signaling dataset based on the timestamp of the abnormal signaling to form a second signaling dataset includes: Based on the timestamp of the abnormal signaling, determine the start and end times for signaling data extraction; From the first signaling dataset, extract all signaling data whose timestamps are between the start time and the end time, and form a second signaling dataset; wherein, the second signaling dataset is a signaling dataset associated with the abnormal signaling.

4. The signaling analysis method according to claim 1, characterized in that, The step of matching the second signaling dataset with a pre-built case rule base to determine the target case rule includes: Extract the signaling name of each signaling from the second signaling dataset; The signaling name is matched with the main event message features of each case rule in the case rule base to obtain the matching result; The matching case rule is determined as the target case rule.

5. The signaling analysis method according to claim 1, characterized in that, The step of extracting a subset of signaling associated with the target case rule from the second signaling dataset through semantic filtering includes: Obtain the predefined signaling features from the target case rules; The signaling name is vectorized to obtain a signaling name vector, and the signaling feature is vectorized to obtain a signaling feature vector; Calculate the semantic similarity between the signaling name vector and the signaling feature vector; In the second signaling dataset, identify target signaling data whose semantic similarity is greater than or equal to a preset threshold; A signaling subset is generated based on the target signaling data.

6. The signaling analysis method according to claim 1, characterized in that, The analysis results obtained by performing case analysis on the signaling subset based on the preset analysis paradigm include: Multiple analysis tasks are created and executed based on the target case rules; Specifically, for each of the aforementioned analysis tasks: Based on the target case rules, an analysis execution plan containing multiple decision steps is generated; Based on the analysis execution plan, the analysis operations defined in each of the decision steps are executed sequentially on the signaling subset; The analysis results of each determination step are summarized to generate the determination analysis results of the signaling subset under the target case rule.

7. A signaling analysis system, characterized in that, include: The complaint information parsing module is configured to: in response to receiving complaint information from a target user, generate a first signaling dataset based on network signaling data corresponding to the complaint information; The abnormal signaling determination module is configured to: identify abnormal signaling from the first signaling dataset based on a preset abnormal signaling feature library, and extract signaling data within a preset time range from the first signaling dataset based on the timestamp of the abnormal signaling to form a second signaling dataset; The case rule determination module is configured to match the second signaling dataset with a pre-built case rule library to determine the target case rule; The signaling subset generation module is configured to extract a signaling subset associated with the target case rule from the second signaling dataset through semantic filtering; The signaling analysis module is configured to perform case analysis on the signaling subset based on a preset analysis paradigm to obtain analysis results.

8. A computer device, characterized in that, It includes one or more processors, memory; and one or more programs, wherein the one or more programs are stored in the memory and executed by the one or more processors, and the one or more programs include instructions for performing the method of any one of claims 1 to 6.

9. A non-volatile computer-readable storage medium containing a computer program, characterized in that, When the computer program is executed by one or more processors, the one or more processors perform the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes one or more computer programs that, when executed by one or more processors, implement the method as described in any one of claims 1 to 6.

Images