Carrier billing settlement auditing system and method, electronic device and storage medium

Abstract

This invention provides a billing and settlement audit system, method, electronic device, and storage medium for telecom operators, belonging to the field of communication technology. It includes: a signaling acquisition module receiving raw signaling data packets sent by a signaling transfer point and sending them to a signaling parsing module; the signaling parsing module decoding the raw signaling data packets based on the SS7 protocol to obtain a target message; extending service attributes based on the target message to obtain standardized signaling records; and sending these records to an audit processing module; the audit processing module comparing the standardized signaling records with the billing records to be verified provided by the operator to generate a settlement audit result. This invention, by parsing the underlying raw signaling of the signaling transfer point to generate standardized signaling records and comparing these records with the operator's call detail records (CDRs), establishes a third-party verification mechanism. This effectively identifies and resolves inconsistencies in cross-border billing data, improving the accuracy of settlements between international telecom operators.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to an operator billing and settlement auditing system, method, electronic device and storage medium. Background Technology

[0002] Billing and settlement auditing of international telecommunications operators is an important part of the verification and auditing of communication costs between multinational telecommunications operators.

[0003] Currently, call detail records (CDRs) generated by the network elements of the operator's core network are typically used as the basis for accounting reconciliation and billing settlement. However, this method relies heavily on call detail records provided by the operator. When inconsistencies occur across borders, it is often difficult to detect anomalies in a timely manner and accurately determine responsibility, thus affecting the accuracy of settlements between international telecommunications operators. Summary of the Invention

[0004] This invention provides a billing and settlement audit system, method, electronic device, and storage medium for operators, which addresses the shortcomings of existing technologies that heavily rely on call details provided by operators. When inconsistencies occur in cross-border data, it is often difficult to detect anomalies in a timely manner and accurately determine responsibility, thus affecting the accuracy of settlements between international telecommunications operators. This invention enables independent verification and accurate auditing of cross-border telecommunications service billing data, ensuring the accuracy and fairness of settlements between operators.

[0005] This invention provides a billing and settlement audit system for telecom operators, including a signaling acquisition module, a signaling parsing module, and an audit processing module; The signaling acquisition module receives the raw signaling data packets sent by the signaling transfer point and sends the raw signaling data packets to the signaling parsing module; The signaling parsing module decodes the original signaling data packet based on the SS7 protocol to obtain the target message; it then extends the service attributes based on the target message to obtain a standardized signaling record; and finally sends the standardized signaling record to the audit processing module. The audit processing module compares the standardized signaling records with the billing records to be verified provided by the operator to generate settlement audit results.

[0006] According to the operator billing and settlement auditing system provided by the present invention, the step of decoding the original signaling data packet based on the SS7 protocol to obtain the target message includes: The original signaling data packets are decoded using network layer protocols to obtain network layer decoded data; The network layer decoded data is then decoded using a transport layer protocol to obtain the target message.

[0007] According to the operator billing and settlement auditing system provided by the present invention, the step of expanding the service attributes based on the target message to obtain standardized signaling records includes: Extract the target fields from the target message, and expand the business attributes based on the target fields to obtain the standardized signaling record; The standardized signaling record includes the calling and called numbers, International Mobile Subscriber Identity (IMSI), signaling point code, timestamp, and calling and called party attribution information.

[0008] According to the operator billing and settlement auditing system provided by the present invention, the signaling acquisition module receives the original signaling data packets sent by the signaling transfer point through a primary and backup dual-probe architecture.

[0009] According to the present invention, a billing and settlement auditing system for operators includes a primary and backup dual-probe architecture comprising a first probe and a second probe; the signaling acquisition module receives raw signaling data packets sent by the signaling transfer point through the primary and backup dual-probe architecture, including: If both the first probe and the second probe are normally connected to the signaling transfer point, then the first probe receives the original signaling data packet; If the connection between the first probe and the signaling transfer point is interrupted, the original signaling data packet will be received by the second probe. If the first probe and the second probe each receive only a portion of the link data, then the first probe and the second probe are simultaneously enabled to receive data in parallel to obtain dual-path signaling data. The dual-path signaling data is then deduplicated and merged to obtain the original signaling data packet.

[0010] According to the operator billing and settlement auditing system provided by the present invention, the signaling acquisition module establishes a communication connection with the signaling transfer point through the TCP protocol, so as to receive the original signaling data packets sent by the signaling transfer point through the communication connection.

[0011] According to the present invention, a billing and settlement auditing system for operators is provided, the billing and settlement auditing system for operators further includes an association query module; The association query module establishes an association index between the standardized signaling records and the original signaling data packets; If the settlement audit result meets the preset conditions, the original signaling data packet corresponding to the settlement audit result is queried through the associated index.

[0012] This invention also provides a method for operator billing and settlement auditing, comprising the following steps: Receive raw signaling data packets sent by the signaling transfer point; The original signaling data packet is decoded based on the SS7 protocol to obtain the target message; then, service attributes are extended based on the target message to obtain a standardized signaling record. The standardized signaling records and the billing records to be verified provided by the operator are compared to generate settlement audit results.

[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the operator billing and settlement auditing methods described above.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the operator billing and settlement auditing method as described above.

[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the operator billing and settlement auditing methods described above.

[0016] The operator billing and settlement audit system, method, electronic device, and storage medium provided by this invention generate standardized signaling records by parsing the underlying raw signaling of the signaling transfer point, and compare the standardized signaling records with the operator's call detail records, thereby establishing a third-party verification mechanism. This can effectively discover and solve the problem of inconsistent cross-border billing data and improve the accuracy of settlement between international telecommunications operators. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is one of the architectural diagrams of the operator billing and settlement audit system provided by the present invention.

[0019] Figure 2 This is a flowchart illustrating the operator billing and settlement auditing method provided by the present invention.

[0020] Figure 3 This is a schematic diagram of the signaling acquisition process provided by the present invention.

[0021] Figure 4 This is the second schematic diagram of the process for decoding raw signaling data packets provided by the present invention.

[0022] Figure 5 This is the second schematic diagram of the architecture of the operator billing and settlement auditing system provided by the present invention.

[0023] Figure 6 This is a technical architecture diagram of the operator billing and settlement audit system provided by the present invention.

[0024] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0026] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0027] The terms "first," "second," etc., used in this invention are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more.

[0028] To facilitate a full understanding of the technical solution of this application, the following content is hereby introduced: In international telecommunications scenarios, operators in different countries typically communicate via international signaling transfer points for services such as voice and SMS. Traditional billing and settlement methods mainly rely on call details generated by the operator's core network elements, using these records for account reconciliation and billing. However, due to inconsistent data formats, transmission delays, data loss, or human error among operators in different countries, discrepancies arise in the call details used as the basis for settlement, leading to billing errors and even fraudulent activities.

[0029] The specific existing technical problems are mainly reflected in the following aspects: First, the data source is relatively singular, relying solely on call details provided by operators, lacking an effective third-party verification mechanism; second, existing systems mostly perform post-event comparisons, unable to conduct real-time monitoring, making it difficult to detect anomalies in a timely manner; third, the system is susceptible to fraudulent attacks such as callback fraud and fake traffic injection, which are difficult to identify; finally, cross-border data consistency is poor, as the data formats and timestamp standards of operators in different countries are often inconsistent, leading to difficulties in comparison.

[0030] Therefore, there is an urgent need for a billing and settlement auditing system for operators that can effectively audit the authenticity and billing accuracy of international communication services by analyzing underlying signaling without relying on data provided by operators.

[0031] The following is combined Figures 1-7 This invention describes the operator billing and settlement auditing system, method, electronic device, and storage medium provided by the present invention.

[0032] Figure 1 This is one of the architectural diagrams of the operator billing and settlement audit system provided by the present invention, such as... Figure 1 As shown, as an optional embodiment, the operator's billing and settlement audit system mainly includes, but is not limited to, a signaling acquisition module 110, a signaling parsing module 120, and an audit processing module 130.

[0033] The signaling acquisition module 110 receives the raw signaling data packets sent by the signaling transfer point and sends the raw signaling data packets to the signaling parsing module 120.

[0034] A signaling transfer point refers to a core node in a Signaling System No. 7 (SS7) network used for signaling message transfer and routing. For example, a signaling transfer point can be a signaling transfer point (STP) device in an operator's network, which is usually deployed in a primary / backup manner.

[0035] Raw signaling data packets refer to unfiltered or unmodified underlying communication protocol data units that pass through the signaling transfer point in real time. For example, raw signaling data packets can be binary signaling code streams based on protocol stacks such as Message Transfer Part (MTP), Signaling Connection Control Part (SCCP), Integrated Services Digital Network User Part (ISDN User Part (ISUP), and Transaction Capabilities Application Part (TCAP).

[0036] Sending the original signaling data packets to the signaling parsing module 120 can be achieved through wired or wireless data transmission links. For example, after capturing the data packets, the signaling acquisition module 110 forwards the data to the downstream parsing and processing unit in real time through an internal high-speed local area network or a specific message queue.

[0037] The signaling parsing module 120 decodes the original signaling data packets based on the SS7 protocol to obtain the target message; it then extends the service attributes based on the target message to obtain a standardized signaling record; and finally sends the standardized signaling record to the audit processing module 130.

[0038] Signaling System No. 7 (SS7) is a set of layered communication protocols used to implement functions such as call setup, billing, and routing in telecommunications networks. For example, SS7 includes the Message Transfer Part (MTP), the Signaling Connection Control Part (SCCP), the ISDN User Part (ISUP), and the Transaction Capabilities Application Part (TCAP).

[0039] The layer order of the SS7 protocol refers to the logical order in which data is encapsulated and decapsulated during network transmission. For example, the layer order can be from the bottom physical layer, data link layer MTP2, network layer MTP3, upward transport layer SCCP, and application layer ISUP, TCAP, or Mobile Application Part (MAP).

[0040] Data decoding refers to the process of parsing and extracting binary raw data streams layer by layer according to predefined communication protocol specifications. For example, data decoding can be performed according to the hierarchical order of the No. 7 signaling system protocol, parsing the network layer, transport layer and application layer in sequence to extract key business information.

[0041] A target message refers to a signaling message unit with a clear business meaning obtained after complete decoding. For example, a target message can be a complete Initial Address Message (IAM) or a MAP update location request message.

[0042] Business attribute expansion refers to the process of using extracted basic fields to query a pre-built static database or rule engine to derive richer business dimensions. For example, based on the extracted IMSI number segment or GT code, the user's country code and mobile network code can be analyzed to determine the source / destination country and source / destination operator name.

[0043] Standardized signaling records refer to service details generated in a unified format after parsing, cleaning, and formatting. For example, a standardized signaling record can be an extended detail record (xDR), which contains key service fields such as the calling and called numbers, call start and end times, and routing information, and the data format is different from that of the operator.

[0044] The audit processing module 130 compares the standardized signaling records with the billing records to be verified provided by the operator to generate settlement audit results.

[0045] The billing records to be verified provided by the operator usually refer to the original billing data generated by the operator's core network elements themselves and used as the basis for billing and settlement. For example, the billing records to be verified may be call details generated by the operator's core network elements themselves.

[0046] Comparison refers to the process of matching or aggregating statistical analysis of the standardized signaling records generated by the system with the records provided by the operator. For example, comparison can identify differences between the two in terms of call volume, call duration or cost calculation by matching unique identifiers or time windows.

[0047] Settlement audit results refer to the difference analysis report or verification conclusion output after comparison. For example, settlement audit results may include specific items with inconsistent data, billing error amount statistics, potential fraud warnings, and cross-border settlement fee verification reports.

[0048] The operator billing and settlement auditing system provided by this invention generates standardized signaling records by parsing the underlying raw signaling of the signaling transfer point, and compares the standardized signaling records with the operator's call detail records, thereby establishing a third-party verification mechanism. This system can effectively discover and solve the problem of inconsistent billing data across borders, and improve the accuracy of settlements between international telecommunications operators.

[0049] In another embodiment of the present invention, data decoding of the original signaling data packet to obtain the target message includes: decoding the original signaling data packet using a network layer protocol to obtain network layer decoded data; and decoding the network layer decoded data using a transport layer protocol to obtain the target message.

[0050] Protocol decoding refers to the process of stripping and translating binary signaling data streams layer by layer according to protocol specifications. For example, protocol decoding can first parse the MTP layer to obtain the routing label, then parse the SCCP layer to obtain the subsystem number, and finally parse the application layer to obtain the specific business operation instructions.

[0051] Network layer protocol decoding refers to the parsing operation performed on the routing labels of the Message Transfer Part 3 (MTP3) or Signalling Connection Control Part (SCCP) in the Signalling No. 7 system. For example, it identifies and extracts information such as source signaling point codes, destination signaling point codes, and service indicators in the signaling unit to determine the routing path of the message.

[0052] Network layer decoded data refers to the payload stripped off after the network layer header is parsed. For example, network layer decoded data can be the portion of the data packet remaining after the MTP routing label has been removed.

[0053] Transport layer protocol decoding refers to the parsing performed on the signaling connection control part or the transaction processing capability application part (TCAP), such as identifying the message type, global code, and specific transaction ID.

[0054] Considering that long messages are often fragmented and transmitted by the network layer or transport layer during actual signaling transmission, direct full parsing may lead to data corruption. Therefore, this invention adopts a layer-by-layer decoding strategy, first completing the parsing and fragment reassembly judgment at the network layer, and then performing the parsing and transaction association at the transport layer. This ensures the accurate restoration of long signaling messages or fragmented signaling packets and avoids signaling loss or parsing failure due to incorrect decoding order.

[0055] The operator billing and settlement auditing system provided by this invention adopts a layered and progressive decoding strategy to sequentially decode the network layer and transport layer protocols of the original signaling data packets. This enables the accurate stripping of protocol headers at each layer and the extraction of payloads, thereby ensuring the accuracy and completeness of the parsing of complex signaling structures and laying a reliable data foundation for subsequent business information extraction.

[0056] In another embodiment of the present invention, a standardized signaling record is obtained by extending the service attributes based on the target message, including: extracting the target field from the target message and extending the service attributes based on the target field to obtain the standardized signaling record; wherein, the standardized signaling record includes the calling and called numbers, International Mobile Subscriber Identity, signaling point code, timestamp, and calling and called party attribution information.

[0057] The target field refers to the key information elements necessary for the billing and settlement audit process. For example, the target field may be the Mobile Station International ISDNNumber (MSISDN), International Mobile Subscriber Identity (IMSI), Originating Point Code / Destination Point Code (OPC / DPC), Global Title (GT), etc.

[0058] Extracting target fields from target messages can be achieved through regular expression matching, fixed offset reading, or automatic parsing by a decoder based on Abstract Syntax Notation One (ASN.1) syntax.

[0059] The calling and receiving numbers refer to the user numbers that initiate and receive the call; the International Mobile Subscriber Identity (IMSI) is a number that uniquely identifies a mobile user in a mobile communication network; the signaling point code is the address information that uniquely identifies a node in the SS7 network; the timestamp is the precise point in time when the signaling message is generated or collected; and the calling and receiving party attribution information refers to the operator and geographical area information to which the user belongs, identified based on the number characteristics.

[0060] The operator billing and settlement auditing system provided by this invention performs deep decoding by strictly following the SS7 protocol layer, and on this basis extracts key fields to enrich and expand business attributes. It can transform complex underlying binary signaling into highly readable standardized signaling records containing calling and called party attribution, user information and routing details, thereby realizing a fine-grained restoration of the entire communication service process and providing a rich and standardized data foundation for subsequent high-precision billing and auditing.

[0061] In another embodiment provided by the present invention, the signaling acquisition module receives the original signaling data packets sent by the signaling transfer point through a primary and backup dual-probe architecture.

[0062] The primary and backup dual-probe architecture refers to deploying two or more signaling acquisition devices with redundant backup functions on the network side. For example, the primary and backup dual-probe architecture can be deployed as the first signaling parsing device and the second signaling parsing device, which serve as backups for each other to meet the high availability and disaster recovery requirements of telecom-grade systems.

[0063] The operator billing and settlement auditing system provided by this invention receives raw signaling data packets by deploying a primary and backup dual-probe architecture. It can build a redundant backup mechanism at the signaling acquisition level to avoid data loss due to the failure of a single acquisition device, thereby effectively improving the integrity of signaling data acquisition and the overall reliability of the system, and meeting the high availability requirements of telecom-grade services.

[0064] In another embodiment of the present invention, the primary and backup dual-probe architecture includes a first probe and a second probe; the signaling acquisition module receives the original signaling data packet sent by the signaling transfer point through the primary and backup dual-probe architecture, including: if both the first probe and the second probe are normally connected to the signaling transfer point, the first probe receives the original signaling data packet; if the connection between the first probe and the signaling transfer point is interrupted, the second probe receives the original signaling data packet.

[0065] The first probe and the second probe refer to independent hardware servers or virtualized network elements that perform signaling data collection and preliminary analysis functions in the system. For example, the first probe and the second probe can be two signaling analysis devices, which are usually deployed in different physical racks or different data centers to achieve physical disaster recovery.

[0066] Specifically, the first probe and the second probe establish connections with different ports of the signaling transfer point or the primary and backup devices, and dynamically undertake data reception tasks according to the network status. For example, under normal circumstances, the primary first probe is responsible for receiving and processing all data, while the second probe is in standby status to monitor the operation of the first probe in real time, or both work at the same time to share the traffic load and ensure that signaling data is not lost when a single point of failure occurs.

[0067] Specifically, the system monitors the connection status between the first and second probes and the signaling transfer point in real time. In the default normal operation mode, the first probe is set as the primary device, responsible for completing the data acquisition, synthesis, processing, and sending statistical records to the database. At this time, the second probe is in standby mode. When the system detects that the first probe has failed or the network connection is interrupted, the system automatically triggers the failover mechanism. The second probe immediately takes over the work of the first probe and begins to receive data from the signaling transfer point, thereby ensuring business continuity.

[0068] If the first probe and the second probe each receive only a portion of the link data, then the first probe and the second probe are activated simultaneously to receive data in parallel, resulting in dual-path signaling data. The dual-path signaling data is then deduplicated and merged to obtain the original signaling data packet.

[0069] Dual-path signaling data refers to incomplete subsets of data captured by two probe devices from different ports or links of a signaling transfer point under specific network failure scenarios. For example, the first probe may only receive data from the first signaling transfer point STP1, while the second probe may only receive data from the second signaling transfer point STP2.

[0070] Deduplication and merging refers to the logical operation of synchronously comparing two data streams, removing duplicate data packets based on the unique identifier of the signaling message, and integrating the unique data packets in the two data streams. For example, it can reassemble the entire data based on the timestamp and message sequence number.

[0071] Specifically, when there is a problem with the dual-link routing between the signaling transfer point and the probe, causing a single probe to be unable to obtain the full amount of data, for example, STP1 can only connect to the first probe, while STP2 can only connect to the second probe, both probes enter the working state at the same time, process the data they can receive respectively, and merge and deduplicate the data before or during the backend database entry, so as to restore the complete original signaling flow.

[0072] Considering that complex routing faults or unilateral link interruptions may occur in real network environments, relying solely on a single primary / backup switching logic may result in the loss of half of the signaling data when some links are interrupted. Therefore, this invention designs a dual-probe parallel reception and deduplication merging mechanism, which forces both probes to work simultaneously when a dual-link routing anomaly is detected. This ensures the integrity and zero loss of signaling data under extreme network conditions, avoiding billing and auditing errors caused by data loss.

[0073] The operator billing and settlement auditing system provided by this invention, through the setting of flexible primary and backup switching and dual-path parallel acquisition strategy, especially for special fault scenarios where probes only receive partial link data, enables dual probes to receive data in parallel and perform deduplication and merging processing, which can effectively cope with complex network routing faults, prevent data loss caused by single-sided link interruption, ensure the integrity and consistency of original signaling data in various extreme network environments, and thus guarantee the accuracy of billing and auditing.

[0074] In another embodiment of the present invention, the signaling acquisition module establishes a communication connection with the signaling transfer point through the Transmission Control Protocol (TCP) to receive the original signaling data packets sent by the signaling transfer point through the communication connection.

[0075] TCP is a connection-oriented, reliable, byte-stream-based transport layer communication protocol, and a standard data transmission protocol widely used in Internet Protocol (IP) networks.

[0076] It should be noted that traditional signaling capture methods are usually based on Time Division Multiplexing (TDM) signaling access acquisition. This method usually requires dedicated physical links (such as E1 / T1 links) and dedicated hardware interface cards. Each link provides a fixed number of time slots for signaling transmission. Even when there is no data transmission, the time slots allocated to specific channels will be reserved, resulting in bandwidth waste. In addition, each connection requires physical link support, making implementation relatively complex and costly.

[0077] Considering the need to reduce deployment costs and improve operational efficiency, this invention adopts an IP-based path to transmit signaling data that originally ran on the TDM link. Specifically, it utilizes the message replication function of the signaling transfer point to directly transmit the replicated signaling message packets to the signaling acquisition module through an established TCP connection. This eliminates the need for expensive dedicated hardware boards and physical lines, significantly reducing hardware investment and construction costs. It also supports remote logical access, improving the deployment flexibility of the system.

[0078] The operator billing and settlement auditing system provided by this invention establishes a communication connection with the signaling transfer point using the transmission control protocol, and transmits signaling data that originally ran on the TDM link via an IP-based path. This can effectively replace the traditional signaling access method based on physical links, without relying on dedicated physical lines and hardware interface cards, thereby significantly reducing the hardware deployment cost and construction complexity of the system, while avoiding the waste of bandwidth resources and improving the flexibility and operational efficiency of signaling collection.

[0079] In another embodiment of the present invention, the operator billing and settlement audit system further includes an association query module; the association query module establishes an association index between standardized signaling records and original signaling data packets; if the settlement audit result meets the preset conditions, the original signaling data packets corresponding to the settlement audit result are queried through the association index.

[0080] The association index between standardized signaling records and raw signaling data packets refers to the logical pointers or key-value pairs stored in the system database that map the parsed service records back to the underlying raw data stream. For example, a unique signaling message sequence number, transaction identifier, or a combination of "filename + byte offset" can be used as the index key.

[0081] Preset conditions refer to anomalies or specific query needs discovered during the billing audit process. For example, a significant difference is found between the billing amount of a certain call detail record and the bill provided by the operator, or the call is detected to have high-risk characteristics such as callback fraud.

[0082] Specifically, when generating standardized signaling records, the system will simultaneously record the location information of the original binary data packet corresponding to the record in the storage system; when auditors investigate a controversial audit result on the interface, the system will directly retrieve and display the underlying hexadecimal signaling code stream based on the index.

[0083] Considering that statistical data alone is often insufficient as strong evidence when dealing with cross-border settlement disputes, and that it is difficult to trace whether the data has been distorted during the parsing process, this invention designs a reverse correlation query mechanism from upper-level business records to the lower-level raw code stream. This provides tamper-proof, bottom-level raw signaling data as audit evidence, greatly improving the credibility and traceability of billing audit results and meeting the compliance requirements of international settlement.

[0084] The operator billing and settlement audit system provided by this invention establishes an association index between standardized signaling records and original signaling data packets, and supports reverse querying of original signaling data based on audit results. It can achieve full-link traceability from upper-layer business call detail records to lower-layer original code streams, thereby providing tamper-proof underlying data evidence when billing differences or disputes are discovered, significantly improving the credibility of audit results and the compliance of audits.

[0085] Figure 2 This is a flowchart illustrating the operator billing and settlement auditing method provided by the present invention, as shown below. Figure 2 As shown, as another optional embodiment provided by the present invention, the operator billing and settlement auditing method includes, but is not limited to, the following steps: Step 210: Receive the original signaling data packets sent by the signaling transfer point through the primary and backup dual-probe architecture.

[0086] Step 220: Decode the original signaling data packet to obtain a standardized signaling record.

[0087] Step 230: Compare the standardized signaling records with the billing records to be verified provided by the operator to generate settlement audit results.

[0088] It should be noted that the operator billing and settlement auditing method provided by the present invention can execute the operator billing and settlement auditing system described in any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0089] The operator billing and settlement auditing method provided by this invention generates standardized signaling records by parsing the underlying original signaling of the signaling transfer point, and compares the standardized signaling records with the operator's call detail records, thereby establishing a third-party verification mechanism. This method can effectively discover and solve the problem of inconsistent billing data across borders and improve the accuracy of settlements between international telecommunications operators.

[0090] Figure 3 This is a schematic diagram of the signaling acquisition process provided by the present invention, as shown below. Figure 3 The diagram illustrates the complete path of signaling data flow from the operator's core network elements to the audit system provided in this application. Specifically, on the operator's network side, signaling interaction occurs between core network elements such as the Mobile Switching Center (MSC) and the Home Location Register (HLR) through Signaling Transfer Points (STPs). Figure 3 The diagram illustrates both STP (primary) and STP (backup) to demonstrate high availability deployment on the network side. The data units transmitted between these network elements are called message packets.

[0091] To achieve non-intrusive data acquisition, the STP (primary) and STP (backup) are connected to the intermediate switch via a Transmission Control Protocol (TCP) link. Utilizing the STP's message replication function, message packets originally transmitted in the network are mirrored and transmitted to the switch via TCP. On the data acquisition side, this system deploys a dual-probe architecture consisting of a primary and a backup signaling parser. These two devices also connect to the switch via a TCP link to receive signaling data from the STP. After acquiring the raw data, the primary and backup signaling parsers perform preliminary processing before converging to the upper-layer signaling analysis system. The signaling analysis system then performs subsequent decoding, storage, and auditing operations. This architecture achieves a closed-loop process from message generation at the MSC / HLR, transmission via the STP and switch, to processing by the signaling analysis system.

[0092] It should be noted that for dual-link routing between the Signaling Transfer Point (STP) and the probe, the system can handle various complex connection states to ensure no data loss. Specifically, this includes: Under normal circumstances: the primary signaling parsing device (STP1) and the backup signaling parsing device (STP2) are interconnected with the first probe and the second probe respectively, and the networks are interconnected.

[0093] Single probe failure: When the first probe fails, the second probe takes over to receive data from STP1 and STP2.

[0094] Cross-route failure: When STP1 is only connected to the first probe and STP2 is only connected to the second probe (or vice versa), the first probe and the second probe simultaneously start processing the data they receive that is connected to the STP, and then store it in the database in subsequent processing. This parallel processing mechanism ensures that no data is lost.

[0095] Fault recovery: When the fault is recovered, if it is found that both probes are connected to the network, the system will automatically return to the state where the primary probe (such as the first probe) handles the fault.

[0096] Figure 4 This is the second schematic diagram of the data decoding process for the original signaling data packets provided by the present invention, as shown below. Figure 4 The diagram illustrates the detailed layer-by-layer processing logic from the initial raw data to the generation of service call detail records (CDRs). Specifically, the system first acquires raw data by receiving raw data packets from the network interface card (NIC) or data acquisition interface. Next, it performs MAC layer decoding to obtain the upper-layer protocol, specifically decoding the Media Access Control (MAC) layer to extract the data link layer protocol identifier. Subsequently, it performs link layer decoding to obtain network layer information, parsing the data link layer protocol to extract network layer protocol information.

[0097] Based on this, network layer decoding is performed to extract network layer data, and logical judgment is made: Is the network layer data a fragmented packet? If it is a network layer fragmented packet, a packet reassembly operation is performed to combine the fragmented data before submission. If not, or after packet reassembly, the process continues downwards to decode the transport layer protocol and extract transport layer data. At this point, another judgment is made: Is the transport layer data a fragmented packet? If transport layer fragmentation exists, packet reassembly is performed before submission. Once the packet reassembly at the above levels is completed and distributed to the designated processing core according to rules, the system utilizes the advantages of multi-core processing for parallel processing. The processing core identifies application layer data through port identification and other methods and hands it over to the designated module for processing. The designated processing module is responsible for decoding the upper-layer protocol and synthesizing and filling the CDR record, that is, performing deep parsing of the application layer protocol, extracting business fields, and filling them into the intermediate state record.

[0098] Subsequently, the system outputs specified Call Detail Records (CDRs) according to the actual business scenario based on business logic, generating standardized call detail records that meet billing and auditing requirements. Finally, to ensure data traceability, the system will execute the step of sending raw data to the storage server, saving the raw data before processing to the storage server for subsequent correlation queries and auditing.

[0099] Figure 5 This is the second schematic diagram of the architecture of the operator billing and settlement audit system provided by the present invention, as shown below. Figure 5 As shown, the system adopts a layered architecture design, which includes a data acquisition layer, a parsing layer, a processing layer and an application layer from bottom to top. It is also equipped with third-party system integration capabilities and system self-monitoring functions.

[0100] Specifically, the acquisition layer is responsible for data access, which is manifested in the use of STP (Signaling Transfer Point) to transmit SS7 signaling messages using the TCP protocol. That is, by establishing a TCP channel, SS7 signaling is received, thereby achieving non-intrusive acquisition of underlying data.

[0101] The parsing layer is the core of data processing, encompassing modules such as data decoding, protocol decoding, CDR synthesis, and raw bitstream storage. This layer supports parsing the entire protocol stack, including MTP1 / 2 / 3 (message passing layers 1 / 2 / 3), SCCP (signaling connection control layer), CAP / TCAP, ISUP / TUP (Integrated Services Digital Network User Base / Telephone User Base), and MAP / INAP (Mobile Application Base / Intelligent Network Application Base). Through these modules, the system transforms the acquired binary bitstream into structured data.

[0102] The processing layer is primarily responsible for data enrichment and statistics. The field expansion module transforms the parsed basic technical parameters into business information, including identifying the source country, source operator, destination country, destination operator, and network element type. The multi-dimensional statistics module aggregates data based on OPC / DPC (Source / Destination Signalling Point Code), NAI (Network Access Identifier), NPI (Numbering Plan Identifier), SSN (Subsystem Number), and dimensions such as source / destination country and source / destination operator. Furthermore, this processing layer includes a data storage module for persistently storing the processed data and interacting with external systems through external interfaces (such as the FTPS secure file transfer protocol).

[0103] At the application layer, end users are provided with visual human-computer interaction functions, mainly including xDR call detail record (CDR) query, statistical CDR query, and billing statistics query, helping users view detailed records and macro-level statistical reports. As an optional implementation, when extracting data or generating reports at the application layer, the system needs to aggregate and accumulate the underlying statistical data. Specific accumulation methods can be based on time dimensions (such as minutes, hours, days) and network element dimensions (such as specific switches, gateways, or signaling points) to meet the settlement and auditing needs of different granularities.

[0104] The third-party system module demonstrates the interaction between this system and the external environment, such as data exchange through the Billing interface or a general 3rd-party system interface. The system self-monitoring module ensures the stable operation of the platform, covering call detail record (CDR) monitoring, application monitoring, server monitoring, and supporting alarm notification and management functions, ensuring that abnormal situations within the system can be detected and handled in real time.

[0105] As an optional embodiment, the operator billing and settlement auditing system provided by this invention also supports multi-dimensional statistics and queries on the application function side. Specifically, the system supports xDR call detail record queries, provides a human-computer interaction interface, and allows users to flexibly set query conditions, such as International Mobile Subscriber Identity (IMSI), Mobile Station International Integrated Services Digital Network Number (MSISDN), country, operator, etc., and supports reverse lookup of the original code stream to query the original signaling messages. In addition, the system also supports statistical call detail record queries, that is, aggregated statistics of call volume based on dimensions such as source / destination signaling point codes (OPC / DPC), incoming LS / outgoing LS, network indicator, and service indicator. Furthermore, the system supports billing call detail record queries, that is, based on the statistical call detail records, preset billing and settlement rules are applied to generate billing call detail records, which are used for audit comparison with the billing call detail records generated by the operator.

[0106] Figure 6 This is a technical architecture diagram of the operator billing and settlement audit system provided by the present invention, as shown below. Figure 6 As shown, the system's software architecture is divided into three layers from bottom to top: the signaling acquisition and parsing layer, the data processing and capability opening layer, and the application layer. The signaling acquisition and parsing layer is responsible for the underlying signaling capture and decoding. The data processing and capability opening layer is the core data flow hub, receiving the raw call detail records (CDRs) generated by the signaling acquisition and parsing layer and loading them into the database; the database mainly undertakes core business logic such as data aggregation, operator backfilling, and data querying.

[0107] After database processing, the data is encapsulated into billing detail records (CDRs). These CDRs are then further interacted with external billing systems for settlement purposes. The application layer is responsible for providing the system's external services and management capabilities. It uses Nginx as a high-performance reverse proxy server and is built on the Spring Cloud microservice architecture. Specifically, it integrates Nacos as a service registry and configuration center, Gateway as a gateway component, and Open Feign as a client component for inter-service calls, thus constructing a stable and scalable distributed system architecture.

[0108] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 7As shown, the electronic device may include a processor 710, a communications interface 720, a memory 730, and a communication bus 740. The processor 710, communications interface 720, and memory 730 communicate with each other via the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute the operator's billing and settlement audit system. This method includes: receiving raw signaling data packets sent by a signaling transfer point; decoding the raw signaling data packets based on the SS7 protocol to obtain a target message; extending service attributes based on the target message to obtain a standardized signaling record; and comparing the standardized signaling record with the billing record to be verified provided by the operator to generate a settlement audit result.

[0109] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0110] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the operator billing and settlement auditing system provided by the above methods. The method includes: receiving raw signaling data packets sent by a signaling transfer point; decoding the raw signaling data packets based on the SS7 protocol to obtain a target message; extending the service attributes based on the target message to obtain a standardized signaling record; and comparing the standardized signaling record with the billing record to be verified provided by the operator to generate a settlement auditing result.

[0111] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the operator billing and settlement auditing system provided by the methods described above. The method includes: receiving raw signaling data packets sent by a signaling transfer point; decoding the raw signaling data packets based on the SS7 protocol to obtain a target message; extending the service attributes based on the target message to obtain a standardized signaling record; and comparing the standardized signaling record with the billing record to be verified provided by the operator to generate a settlement auditing result.

[0112] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0113] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An operator billing settlement audit system, characterized in that, It includes a signaling acquisition module, a signaling parsing module, and an audit processing module; The signaling acquisition module receives the raw signaling data packets sent by the signaling transfer point and sends the raw signaling data packets to the signaling parsing module; The signaling parsing module decodes the original signaling data packet based on the SS7 protocol to obtain the target message; it extends the service attributes based on the target message to obtain a standardized signaling record; and it sends the standardized signaling record to the audit processing module. The audit processing module compares the standardized signaling records with the billing records to be verified provided by the operator to generate settlement audit results.

2. The operator billing and settlement auditing system according to claim 1, characterized in that, The process of decoding the original signaling data packets based on the SS7 protocol to obtain the target message includes: The original signaling data packets are decoded using network layer protocols to obtain network layer decoded data; The network layer decoded data is then decoded using a transport layer protocol to obtain the target message.

3. The operator billing and settlement auditing system according to claim 2, characterized in that, The process of extending service attributes based on the target message to obtain standardized signaling records includes: Extract the target fields from the target message, and expand the business attributes based on the target fields to obtain the standardized signaling record; The standardized signaling record includes the calling and called numbers, International Mobile Subscriber Identity (IMSI), signaling point code, timestamp, and calling and called party attribution information.

4. The operator billing and settlement auditing system according to claim 1, characterized in that, The signaling acquisition module receives raw signaling data packets sent by the signaling transfer point through a primary and backup dual-probe architecture.

5. The operator billing and settlement auditing system according to claim 4, characterized in that, The primary and backup dual-probe architecture includes a first probe and a second probe. The signaling acquisition module receives raw signaling data packets sent by the signaling transfer point through a primary / backup dual-probe architecture, including: If both the first probe and the second probe are normally connected to the signaling transfer point, then the first probe receives the original signaling data packet; If the connection between the first probe and the signaling transfer point is interrupted, the original signaling data packet will be received by the second probe. If the first probe and the second probe each receive only a portion of the link data, then the first probe and the second probe are simultaneously enabled to receive data in parallel to obtain dual-path signaling data. The dual-path signaling data is then deduplicated and merged to obtain the original signaling data packet.

6. The operator billing and settlement auditing system according to claim 1, characterized in that, The signaling acquisition module establishes a communication connection with the signaling transfer point via the TCP protocol to receive the original signaling data packets sent by the signaling transfer point through the communication connection.

7. The operator billing and settlement auditing system according to claim 1, characterized in that, The operator's billing and settlement auditing system also includes an associated query module; The association query module establishes an association index between the standardized signaling records and the original signaling data packets; If the settlement audit result meets the preset conditions, the original signaling data packet corresponding to the settlement audit result is queried through the associated index.

8. A method for operator billing and settlement auditing, characterized in that, include: Receive raw signaling data packets sent by the signaling transfer point; The original signaling data packets are decoded based on the SS7 protocol to obtain the target message; Standardized signaling records are obtained by extending the service attributes based on the target message; The standardized signaling records and the billing records to be verified provided by the operator are compared to generate settlement audit results.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the operator billing and settlement auditing method as described in claim 8.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the operator billing and settlement auditing method as described in claim 8.

Images