A large model-based automated signaling analysis method and system

Abstract

This invention relates to the field of communication technology and discloses an automated signaling analysis method and system based on a large-scale model. The method includes: first, acquiring the bitstream file of the communication network; dynamically generating decoding rules and extracting key signaling fields using a dynamic protocol adapter; organizing these fields into protocol-independent intermediate representation data; then, calling a pre-built signaling knowledge base; determining standard information elements matching the query vector through precise matching of the structured knowledge layer and / or generalized retrieval of the embedded knowledge layer; and generating a comprehensive retrieval result; finally, constructing prompt words from the comprehensive retrieval result and the target analysis task, inputting them into a pre-trained large-scale signaling model for inference analysis, and outputting analysis results containing the root causes of signaling anomalies and semantic explanations. This invention achieves highly automated and high-precision signaling anomaly detection and deep analysis through a tiered collaboration of intelligent decoding, hybrid retrieval, and domain-scale model inference, significantly improving the operational efficiency of communication networks.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to an automated signaling analysis method and system based on a large model. Background Technology

[0002] In communication networks, signaling refers to the instructions and messages that control information transmission, call establishment, and connection release between communication devices. With the rapid development of communication technologies such as 5G / 6G and edge computing, network scale is constantly expanding, signaling data volume is exponentially increasing, and the complexity of communication network signaling is also increasing exponentially. On the one hand, protocols are becoming more diversified. 5G core networks have introduced new signaling protocols such as HTTP / 2 and JSON (e.g., the SBI interface), which coexist with traditional binary protocols (e.g., GTP, Diameter). At the same time, the increase in operator-specific protocol extensions has led to insufficient coverage of standardized tools, significantly increasing the difficulty of parsing. On the other hand, service scenarios such as network slicing and VoNR have created an urgent need for automation in real-time signaling analysis. Traditional manual rule configuration is no longer efficient enough to meet the response requirements of minutes or even seconds.

[0003] Currently, signaling analysis techniques in the communications field mainly fall into three mainstream categories. The first is rule-based parsing methods, which use predefined syntax rules (such as ASN.1 description files and regular expressions) to perform structured parsing of signaling. The second is structured knowledge base matching methods, which transform communication protocol standards into structured databases or knowledge graphs (such as Neo4j) for query matching. The third is analysis methods based on traditional machine learning, which utilize supervised learning models to classify signaling features or detect anomalies. Furthermore, the industry has begun exploring the application of Large Language Models (LLM) in signaling semantic understanding, aiming to leverage AI technology to drive the intelligent transformation of signaling analysis.

[0004] However, the aforementioned existing technologies have key drawbacks in practical applications. First, rule engine methods suffer from rigid matching, making it difficult to handle differences in protocol versions or vendor-defined fields, and their maintenance costs are extremely high, requiring significant manpower to rewrite the rule base for each new protocol version. Second, knowledge base matching methods lack semantic understanding capabilities, supporting only precise matching at the syntactic level and failing to consider context. Furthermore, the knowledge base update cycle typically lags behind the release of 3GPP standards, making it unable to adapt to dynamic network changes. Third, traditional machine learning methods heavily rely on manual feature engineering, making it difficult to capture deep semantics in signaling, and exhibiting poor cross-domain generalization performance and a significant drop in accuracy in multi-vendor equipment hybrid networking environments. Finally, existing solutions generally suffer from insufficient multimodal data processing, failing to effectively integrate multi-dimensional information such as signaling text, binary streams, and network topology, and possessing weak dynamic reasoning capabilities, making it impossible to achieve adaptive analysis based on real-time network conditions.

[0005] Therefore, how to achieve highly automated and accurate detection and analysis of communication signaling anomalies has become a core technical challenge that urgently needs to be solved in the field of communication network operation and maintenance. Summary of the Invention

[0006] This invention provides an automated signaling analysis method and system based on a large model. By utilizing a high-precision structured signaling knowledge base and advanced retrieval and matching algorithms, it ensures the accuracy and generalization of the analysis results. It can quickly uncover abnormal events in signaling, accurately interpret signaling messages and information cells, and provide strong support for the optimization, troubleshooting, and business expansion of communication networks, thereby reducing the operating costs of communication networks and improving the quality of network services.

[0007] This invention provides an automated signaling analysis method based on a large model, comprising:

[0008] S1. Obtain the bitstream file of the communication network, dynamically load the protocol description file corresponding to the bitstream file to generate decoding rules, extract the signaling key fields in the bitstream file based on the decoding rules, and combine the signaling key fields according to the protocol-independent data structure to generate intermediate representation data;

[0009] S2. Extract the signaling key fields from the intermediate representation data as target signaling fields, and use the target signaling fields to perform retrieval and matching in a preset signaling knowledge base. Through precise matching of the structured knowledge layer and / or generalized retrieval of the embedded knowledge layer in the signaling knowledge base, extract the standard information elements corresponding to the target signaling fields and generate comprehensive retrieval results.

[0010] S3. Construct the comprehensive search results and target analysis task into prompt words, and input the prompt words into a pre-trained signaling big data model for reasoning analysis to obtain signaling analysis results; wherein, the analysis results include the root causes of signaling anomalies and the semantic interpretation of signaling derived from the comprehensive search results.

[0011] Furthermore, S1 specifically includes:

[0012] S101. Obtain the raw data of the communication network and perform data normalization preprocessing to obtain a normalized bitstream file; wherein, the raw data includes PCAP data, XDR data, and TRACE data;

[0013] S102. Based on the preset protocol fingerprint library, identify the protocol type contained in the normalized bitstream file, and use the dynamic protocol adapter to load the corresponding protocol description file to dynamically generate decoding rules.

[0014] S103. The multi-layer decoding engine is used to parse the bitstream file based on the decoding rules, and key signaling fields are extracted through a combination of rules and models.

[0015] S104. The extracted signaling key fields are combined according to a protocol-independent intermediate representation data structure and uniformly encapsulated into the intermediate representation data.

[0016] Furthermore, data normalization preprocessing specifically includes:

[0017] For PCAP data, extract the raw binary stream and restore the protocol payload;

[0018] For XDR data, parse the logs in JSON or XML format and extract the signaling-related fields;

[0019] For TRACE data, perform cross-service link aggregation to reconstruct the signaling flow.

[0020] Furthermore, the multi-layer decoding engine includes a syntax layer, a semantic layer, and a business layer;

[0021] At the syntax layer, the original field values ​​of the bitstream file are restored using a pre-built decoder or parser;

[0022] At the semantic layer, the original field values ​​are mapped to semantic tags according to the protocol specification mapping table;

[0023] At the business layer, the context information corresponding to the signaling key fields is obtained through network topology association.

[0024] Furthermore, key signaling fields are extracted through a combination of rules and models, specifically including:

[0025] For standard fields, a rule-driven extraction method is used, employing predefined regular expressions or path expressions to locate the standard fields;

[0026] For non-standard fields, a model-driven extraction method is used to construct prompt word templates and input them into a fine-tuned large model. The fine-tuned large model then infers and outputs the semantic attributes of the non-standard fields.

[0027] After extraction, the extracted signaling key fields are compared with a pre-set structured knowledge base to perform illegal value verification. When an unknown protocol field is detected, an online embedding model is triggered to calculate the cosine similarity between the unknown protocol field and the standard information element, so as to update the signaling knowledge base based on the cosine similarity.

[0028] Furthermore, S2 specifically includes:

[0029] S201. Obtain the signaling key fields in the intermediate representation data as the target signaling fields to be processed;

[0030] S202. In the preset signaling knowledge base, the target signaling field is first used to perform precise matching in the structured knowledge layer, and the value of the target signaling field is then validated.

[0031] S203. When the exact match is not found, the corresponding embedding level is selected according to the field type of the target signaling field, and the target signaling field is converted into a query vector using the embedding model corresponding to the embedding level; wherein, the embedding level includes the process layer, message layer, information cell layer and reason value layer.

[0032] S204. Perform vector similarity calculation based on hybrid distance algorithm in the embedded knowledge layer, and filter and extract standard information elements that match based on similarity threshold;

[0033] S205. Summarize the standard information elements obtained from the precise matching and / or generalized retrieval to generate comprehensive retrieval results.

[0034] Furthermore, in S204, the calculation formula for the hybrid distance algorithm is as follows:

[0035] Overall similarity = α·cosine similarity + β·(1 / Mahanobis distance)

[0036] The weights are configured such that α and β are both weights, and α + β = 1.

[0037] Furthermore, S3 specifically includes:

[0038] S301, A task routing mechanism based on a multi-task reasoning framework, which automatically allocates processing engines to determine the type of target analysis task based on input keywords;

[0039] S302. Obtain the comprehensive search results output by S2, and perform input data integration and formatting processing to achieve real-time search enhancement;

[0040] S303. Using a dynamic template engine, select and generate target prompt words based on the target analysis task;

[0041] S304. Configure inference control for the pre-trained signaling big model, and input the target prompt word to perform inference analysis; wherein, the signaling big model is: a fine-tuning dataset is constructed based on 3GPP protocol text, vendor fault case library, signaling QA pairs and protocol and topology association rules, and a two-stage fine-tuning strategy is adopted, that is, firstly, domain pre-training of the masked language model is performed, and then instruction-supervised fine-tuning is performed for specific tasks using LORA parameter efficient fine-tuning technology to obtain the signaling big model;

[0042] S305. Obtain the preliminary output of the signaling big model, generate highly interpretable signaling analysis results through the knowledge tracing mechanism, extract the protocol terms in the preliminary results using regular expressions, and generate hyperlinks pointing to the original text of the corresponding structured knowledge base to achieve knowledge tracing.

[0043] S306. Perform confidence verification and feedback loop on the signaling analysis results.

[0044] Furthermore, S303 specifically includes:

[0045] A pre-set structured knowledge prompt template library is provided, and templates are automatically matched according to the type of the target analysis task.

[0046] For anomaly analysis tasks, information element interpretation tasks, or knowledge question answering tasks, corresponding template keywords and output structure requirements are matched respectively; wherein, the output structure requirements include at least one of the following: Markdown list, table, and natural language supplemented with reference links;

[0047] The formatted comprehensive search results are filled into the matching template to generate the target prompt words.

[0048] This invention also provides an automated signaling analysis system based on a large model. Based on the automated signaling analysis method based on a large model described above, the system includes:

[0049] The intelligent decoding module is used to acquire the bitstream file of the communication network, dynamically load the protocol description file corresponding to the bitstream file to generate decoding rules, extract the signaling key fields in the bitstream file based on the decoding rules, and combine the signaling key fields according to the protocol-independent data structure to generate intermediate representation data.

[0050] The hybrid retrieval module is used to extract the signaling key fields from the intermediate representation data as target signaling fields, and to perform retrieval and matching in a preset signaling knowledge base using the target signaling fields. Through precise matching of the structured knowledge layer and / or generalized retrieval of the embedded knowledge layer in the signaling knowledge base, the module extracts the standard information elements corresponding to the target signaling fields and generates comprehensive retrieval results.

[0051] The analysis and summary module is used to construct prompt words from the comprehensive search results and the target analysis task, and input the prompt words into a pre-trained signaling big data model for inference analysis to obtain signaling analysis results; wherein, the analysis results include the root causes of signaling anomalies and the signaling semantic explanation derived from the comprehensive search results.

[0052] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method.

[0053] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method.

[0054] The beneficial effects of this invention are as follows:

[0055] 1. Breakthrough in traditional technical performance bottlenecks. On the one hand, the parsing accuracy of this invention is significantly improved, with the accuracy rate of standardized field matching reaching 99.5% or higher, and the success rate of semantic mapping of non-standard fields reaching 88% or higher, effectively solving the problem of cross-vendor protocol compatibility. On the other hand, the efficiency of anomaly location is greatly improved, reducing the time spent on signaling root cause analysis from hours of manual intervention to seconds (less than 10 seconds per request), fully meeting the real-time requirements of 5G uRLLC scenarios.

[0056] 2. Building full-stack automation capabilities. First, this invention achieves zero-human-intervention parsing by automatically loading ASN.1 or Swagger description files using a dynamic protocol adapter, drastically reducing protocol update response time from 3 to 7 days of manual maintenance to less than 10 minutes. Second, this invention constructs a self-evolving knowledge system, achieving adaptive adaptation to protocol evolution through online embedded model incremental training and real-time knowledge graph expansion. For example, it reduces the support cycle for new features added in 3GPP Release 18 from 6 months to 2 weeks.

[0057] 3. Enhanced adaptability to complex scenarios. At the data processing level, this invention achieves multimodal data fusion, enabling simultaneous processing of PCAP binary streams, XDR logs, and TRACE link tracing data, supporting joint signaling analysis in cloud-network-edge collaborative scenarios (such as MEC edge node anomaly tracing). At the network deployment level, this invention improves cross-domain generalization capabilities. In hybrid networking environments, the accuracy of non-standard field parsing can still be maintained at 85% or higher, which is 47% higher than traditional solutions in cross-vendor scenarios.

[0058] 4. Reduce operating costs and risks. In terms of cost optimization, this invention reduces the manpower required for rule base maintenance by 90% (from 200 person-days / version to 20 person-days / version) and supports development-free parsing of private protocols. In terms of risk reduction, the reliability of the system's decision-making is significantly enhanced. The output results not only include references to protocol clauses but also provide confidence scores, which greatly reduces the proportion of manual review to below 20%.

[0059] 5. Driving Industry Technological Evolution. This invention sets a new benchmark for intelligent signaling analysis, achieving for the first time deep coupling between large models and communication protocols, providing signaling autonomy technology reserves for 6G AI-Native networks. Simultaneously, this invention has a standard compatibility driving effect; its dynamic knowledge base collaboration mechanism can directly interface with the 3GPP NWDAF framework, accelerating the industrialization of network data analysis. Attached Figure Description

[0060] Figure 1 This is a schematic diagram of the input and output of the automated signaling analysis method based on a large model according to the present invention.

[0061] Figure 2 This is a flowchart illustrating the automated signaling analysis method based on a large model according to the present invention.

[0062] Figure 3 This is a schematic diagram of the structure of the automated signaling analysis system based on a large model according to the present invention.

[0063] Figure 4 This is a schematic diagram of the internal structure of a computer device according to an embodiment of the present invention.

[0064] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0065] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0066] This invention provides an automated signaling analysis method based on a large model. From the overall execution logic, this method performs end-to-end automated processing and analysis of the bitstream file of a communication network. In the initial stage of the method execution, the bitstream file of the communication network is first acquired as input data. The bitstream file includes at least one of PCAP, XDR, and TRACE data. PCAP is a network packet capture file format used to store network traffic data; XDR is a standardized data representation and encoding format commonly used for data transmission and storage between different systems in the communication field; TRACE is log data that records key events and information during system operation. In the core processing flow, the data flow of the method is logically divided into three progressively advancing processing stages:

[0067] Intelligent decoding stage (corresponding to the specific step S1): responsible for parsing and extracting information from the input raw bitstream file;

[0068] Hybrid retrieval stage (corresponding to the subsequent specific step S2): Combining a high-precision structured signaling knowledge base and advanced retrieval matching algorithms, the decoded information is matched to ensure the accuracy and generalization of the analysis results;

[0069] Analysis and summary phase (corresponding to the subsequent specific step S3): In-depth reasoning analysis and processing based on the signaling big model.

[0070] After the network stream data undergoes the three-stage concatenation process described above, the final analysis results are directly output. These results may specifically include signaling anomaly analysis, signaling message interpretation, information element interpretation, and signaling knowledge Q&A content. Through this automated analysis process, this method can quickly uncover abnormal events in signaling, accurately interpret signaling messages and information elements, and provide strong support for communication network optimization, fault diagnosis, and service expansion, thereby reducing communication network operating costs and improving network service quality.

[0071] like Figure 1 , Figure 2 As shown, this invention provides an automated signaling analysis method based on a large model, including:

[0072] S1. Obtain the bitstream file of the communication network, dynamically load the protocol description file corresponding to the bitstream file to generate decoding rules, extract the signaling key fields in the bitstream file based on the decoding rules, and combine the signaling key fields according to the protocol-independent data structure to generate intermediate representation data.

[0073] Step S1 aims to build an automated processing architecture with multi-protocol compatibility, dynamic adaptation, and semantic enhancement capabilities. This step fully supports 5G / 4G / 3G standardized protocols and vendor-specific extensions, and can respond in real-time to protocol version iterations (such as new signaling added in 3GPP Release 17), ensuring dynamic synchronization of decoding rules. By accurately extracting key fields such as message headers, message bodies, cause values, cause values, timestamps, network element information (such as gNB ID), and user information (such as SUPI) from complex raw bitstream data, and combining this with a large model to enhance the semantic understanding of unstructured fields (such as Vendor-Specific AVPs), the original heterogeneous data is transformed into a standardized intermediate representation that is protocol-independent and possesses deep semantic information.

[0074] In a specific embodiment of the present invention, step S1, based on a multi-layer coding architecture and dynamic protocol adaptation technology, achieves fully automated parsing from raw PCAP / XDR / TRACE data to structured signaling information, including the following sub-steps:

[0075] S101. Obtain the raw data from the communication network and perform data normalization preprocessing to obtain the normalized bitstream file. Specifically,

[0076] Due to the existence of 5G / 4G / 3G standardized protocols and vendor-specific extensions in communication networks, the input data sources are complex and diverse. The raw data acquired in this embodiment includes PCAP (Network Packet Capture File), XDR (Standardized Data Representation and Encoding Format Log), and TRACE (Distributed Tracing Link Log).

[0077] Normalization is performed for data sources of different formats. Specifically, for PCAP data, the raw binary stream is extracted, Ethernet, IP, TCP or UDP headers are parsed, and the protocol payload (e.g., NGAP, HTTP / 2 signaling) is restored. For XDR data, security event logs in JSON or XML format are parsed, and signaling-related fields (e.g., session ID, endpoint device hash) are extracted. For TRACE data, distributed tracing data (e.g., OpenTelemetry Span) is aggregated across service links to reconstruct the complete signaling flow.

[0078] S102. Based on a preset protocol fingerprint database, identify the protocol type contained in the normalized bitstream file, and use a dynamic protocol adapter to load the corresponding protocol description file to dynamically generate decoding rules. Specifically,

[0079] First, a protocol fingerprint database is used to quickly identify the protocol type based on protocol characteristics, such as the "PRI*" magic word or Diameter header flags in HTTP / 2. After identifying the protocol type, the Dynamic Protocol Adapter (DPA) is triggered to automatically load the corresponding protocol description file (e.g., ASN.1 syntax file or Swagger API definition file), and dynamically generate decoding rules according to the specific protocol version, thereby achieving dynamic adaptation to protocol version updates (e.g., automatically adapting to the "IAB Node" information element added in 5G Release 16), as shown in the following example:

[0080] Python

[0081] class DynamicASN1Decoder:

[0082] def load_schema(self, asn1_file):

[0083] # Parse ASN.1 files to generate a decoding tree

[0084] def decode(self, binary_data):

[0085] # Decode binary stream according to the current protocol tree

[0086] S103. The multi-layer decoding engine is used to parse the bitstream file based on the decoding rules, and key signaling fields are extracted through a combination of rules and models.

[0087] Specifically, the multi-layer decoding engine performs the following multi-dimensional parsing:

[0088] hierarchy Technical Implementation Output Example Syntax layer ASN.1 PER / UPER decoder, JSON parser Original field value (e.g., Cause Value=3) semantic layer Protocol specification mapping table (such as fields defined in 3GPP TS 38.413) Semantic tags (such as "Handover Failure") Business layer Network topology associations (e.g., gNB ID mapping to AMF instance) Contextual information (e.g., "source gNB=10.1.1.1:36412")

[0089] During the information extraction stage, a rule-based and model-based collaborative extraction strategy is adopted. Specifically, for standard fields, rule-driven extraction is used, employing predefined regular expressions or XPath to locate standard fields (e.g., timestamp format 2026-04-20T14:35:21.123Z); for non-standard fields (e.g., vendor-specific AVP), model-driven extraction is adopted, utilizing a finely tuned large model (e.g., CodeBERT) to identify the semantics of unknown fields (e.g., input binary stream output "Vendor:Huawei,Field:UE_Location_Accuracy").

[0090] Furthermore, this step also includes dynamic outlier verification, which compares the extracted fields with a structured knowledge base (e.g., the range of Cause values ​​defined in 3GPP TS 29.273) and marks illegal values ​​(e.g., Cause 256). In addition, if an unknown protocol field is detected during the information extraction stage, a real-time knowledge base update mechanism is implemented. This mechanism triggers an online embedding model to align the data, calculate the cosine similarity between the new field and standard information elements, and if the similarity is greater than a preset threshold (e.g., 0.8), the new field is mapped to the nearest neighbor standard information element and updated in the subsequent required knowledge base to dynamically adapt to protocol version evolution.

[0091] Furthermore, in the model-driven extraction process of S103 above, in order to achieve semantic parsing enhancement of the large model, when encountering raw fields that cannot be directly mapped (such as the vendor-specific AVP value 0x2A3B), a specific prompt word template is constructed and input into the fine-tuned large model. For example, the constructed template is: parsing the meaning of the following hexadecimal values ​​in the corresponding protocol: {protocol context}, and the large model infers and outputs the specific field attributes (e.g., output: Vendor:Huawei, Field:UE_Radio_Capability_Hash, Type:OCTET_STRING), thereby effectively solving the problem of semantic understanding of unstructured fields.

[0092] S104. The extracted signaling key fields are combined according to a protocol-independent intermediate representation (PIIR) data structure and uniformly encapsulated into the intermediate representation data. Specifically,

[0093] To unify the parsing results of different protocols (such as binary ASN.1 and text HTTP / 2) for subsequent model processing, the extracted key information is assembled into a Protocol-Independent Intermediate Representation (PIIR). This intermediate representation uses a standardized data structure (e.g., JSON format), which internally combines: header information (containing protocol name and message type, such as NGAP and InitialUEMessage), message body (containing reason value and its preliminary semantics), user information (such as SUPI and GUTI identifiers), and context information (such as timestamp and source network element IP information), as shown in the following example:

[0094] json

[0095] {

[0096] "header": {"protocol": "NGAP", "message_type": "InitialUEMessage"},

[0097] "body": {"cause": {"value": 3, "semantic": "Radio Network LayerFailure"},

[0098] "ue_info": {"supi": "imsi-001010000000001", "guti": "00101.0a0001"},

[0099] "context": {"timestamp": "2023-08-20T14:35:21.123Z", "src_gnb": "10.1.1.1:36412"}

[0100] }

[0101] The intermediate representation data generated by this unified organization effectively masks the differences in the underlying protocols and is passed as structured input to step S2.

[0102] To more clearly illustrate the intelligent decoding process from S101 to S104 above, let's take 5G Xn interface signaling parsing as an example: First, the XnAP signaling (ASN.1 PER encoding) captured in the PCAP file is obtained; in the multi-layer decoding engine, the syntax layer restores the ASN.1 field structure, the semantic layer associates the cause value = 3 with the specific semantic "Handover Failure," and the service layer locates the topology information of the source and target base stations through the base station identifier (such as gNB ID); finally, the parsed content is combined according to a protocol-independent intermediate representation structure, outputting JSON-formatted intermediate representation data containing the event type (XnAP_Handover_Failure), root cause, affected user identifier, and network context. Example output:

[0103] json

[0104] {

[0105] "event_type": "XnAP_Handover_Failure",

[0106] "root_cause": "Target Cell Radio Resource Insufficient",

[0107] "affected_ue": "imsi-001010000000001",

[0108] "network_context": {"src_gnb": "10.1.1.1", "dst_gnb": "10.1.1.2"}

[0109] }

[0110] S2. Extract the signaling key fields from the intermediate representation data as target signaling fields, and use the target signaling fields to perform retrieval and matching in a preset signaling knowledge base. Through precise matching of the structured knowledge layer and / or generalized retrieval of the embedded knowledge layer in the signaling knowledge base, extract the standard information elements corresponding to the target signaling fields and generate comprehensive retrieval results.

[0111] Step S2 aims to achieve accurate matching and generalized retrieval of signaling information through a two-layer architecture of a high-precision structured knowledge base and a multi-layer embedded knowledge base. Specifically, it achieves accurate matching with an accuracy rate of no less than a preset threshold (e.g., 99%) for standardized signaling, while achieving compatibility parsing for non-standard signaling (e.g., vendor-specific fields) through semantic similarity matching (e.g., cosine similarity > 0.85). Furthermore, it supports dynamic expansion of the knowledge base to adapt to protocol evolution and network topology changes.

[0112] In one specific embodiment of the present invention, step S2 includes the following sub-steps:

[0113] S201. Obtain the signaling key fields from the intermediate representation data and use them as the target signaling fields to be processed. Specifically,

[0114] Extract the preliminarily parsed field information from the Protocol Independent Intermediate Representation (PIIR) data structure generated in step S1, including but not limited to message type, cause value / reason, information element (IE) name and value, and vendor-specific AVPs / IEs, as target input for subsequent retrieval and matching.

[0115] S202. In the pre-set signaling knowledge base, the target signaling field is first used to perform a precise matching operation at the structured knowledge layer. Specifically,

[0116] The structured knowledge layer pre-stores structured data based on 3GPP standards, RFC documents, and vendor product manuals. The 3GPP standards include TS 29.273 (5G core network signaling) and TS 38.413 (NGAP protocol), etc.; the RFC documents include RFC 6733 (Diameter protocol) and RFC 7540 (HTTP / 2); and the vendor product manuals include Huawei / ZTE equipment proprietary protocol extensions (such as NGAP custom IEs). Data structure example:

[0117] json

[0118] {

[0119] "field_name": "Cause Value",

[0120] "protocol": "NGAP",

[0121] "value_range": {"min": 0, "max": 255},

[0122] "semantic_mapping": {

[0123] "3": "Radio Network Layer Failure",

[0124] "22": "Congestion Management"

[0125] },

[0126] "reference": "3GPP TS 38.413 V16.4.0 Section 9.2.3"

[0127] }

[0128] The retrieval and matching logic locates a subset of the structured knowledge layer based on the protocol type (such as NGAP, Diameter, etc.) and performs precise mapping on the value of the target signaling field. For example, when the target signaling field "Cause Value=3" is detected, it is directly mapped to the standard information element "Radio Network Layer Failure" and its corresponding semantics and specification references (such as 3GPP TS 38.413 V16.4.0 Section 9.2.3). If an exact match is found, the result is directly stored as a standard information element in the comprehensive retrieval results.

[0129] During the precise matching process in step S202, a validity check function is also provided. Specifically, the value of the target signaling field is compared with the value range defined in the structured knowledge base. If an illegal value is detected (for example, if the 3GPP standard defines the Cause value range as 0-255, but the extracted value is 256), the field is marked as an abnormal illegal value and transferred to the exception handling process or the generalized retrieval process.

[0130] S203. When the exact match fails, select the corresponding embedding level based on the field type of the target signaling field (triggering a multi-level embedding retrieval process), and use the embedding model corresponding to the level to convert the target signaling field into a query vector. Specifically,

[0131] When encountering non-standard fields, vendor-specific fields, or unknown fields due to protocol version differences (e.g., the vendor-specific field Vendor_IE=0xA1B2), the generalized retrieval logic of the embedded knowledge layer is triggered. The embedded knowledge layer is pre-divided into multiple data layers based on signaling characteristics, including:

[0132] hierarchy Embedded Model Typical data Process layer BERT-Process Signaling procedures (such as Attach, Handover) Message layer RoBERTa-Message Message types (such as InitialUEMessage, PDUSession) cell layer CodeBERT-IE Signaling fields (such as SUPI, QoS Flow ID) Cause Value Layer FastText-Cause Cause / Reason value semantics (e.g., "Failure" "Reject")

[0133] Each layer uses a dedicated model (the embedding model is fine-tuned online based on newly added protocol description files, such as monthly incremental training) to generate vector representations (e.g., the signaling cell layer uses CodeBERT to parse binary field description text). Based on the attributes of the target signaling field, the system automatically switches to the corresponding layer model and calls the dedicated model matching the layer (e.g., the CodeBERT-IE model) to process the binary stream or description text of the target signaling field to generate query vectors. For example, for the Huawei proprietary field "Vendor_IE=0xA1B2", this model generates a high-dimensional vector representation (e.g., embedding vectors 0.23, −0.45, …, 0.78) to perform semantic similarity measurement in the vector space (e.g., mapping "UE_Radio_Failure" to the standard signaling cell "Radio LinkFailure").

[0134] S204. In the embedded knowledge layer, vector similarity calculation based on a hybrid distance algorithm is performed, and standard information elements that match are filtered and extracted based on a similarity threshold. Specifically,

[0135] The query vector is compared with the pre-stored standard vector in the embedded knowledge base. This embodiment uses a hybrid distance calculation algorithm, with the formula: Comprehensive Similarity = α·Cosine Similarity + β·(1 / Mahanobis Distance). The preferred weight configuration is α=0.7, β=0.3. This weighted calculation method effectively optimizes generalization performance in cross-vendor scenarios, returning Top-K similarity entries (e.g., K=3) with an added confidence score. Example output:

[0136] json

[0137] {

[0138] "query": "Vendor_IE=0xA1B2",

[0139] "matched_entries": [

[0140] {"standard_field": "UE_Capability", "similarity": 0.91, "source": "3GPP TS 38.331"},

[0141] {"standard_field": "Radio_Config", "similarity": 0.87, "source": "Huawei NGAP Manual"} ]

[0143] }

[0144] If the highest similarity score is greater than or equal to the preset threshold (default 0.85), the generalization match is considered successful, and the entry is adopted as the standard information element for trusted mapping. For example, the vendor-specific cause value "Vendor_Cause=0xE1" is mapped to the standard information element "Authentication_Reject". If the similarity score is lower than the threshold, it is marked as an "unknown field" and the knowledge base expansion process is triggered.

[0145] S205. Summarize the standard information elements obtained from the precise matching and / or generalized retrieval to generate comprehensive retrieval results. Specifically,

[0146] All successfully matched standard information elements and their associated semantic labels, confidence scores, and reference sources (such as 3GPP clauses) are formatted and integrated. The comprehensive search results include the target signaling field, the matched standard information element semantics (such as "SQN Synchronization Failure"), and the corresponding recommended operation suggestions (such as "Update UE / AuC synchronization parameters"), which serve as contextual input for subsequent large-scale model inference analysis.

[0147] As a crucial support for this embodiment, the signaling knowledge base possesses dynamic update and offline training mechanisms, specifically including:

[0148] 1) Layered Embedded Model Training: Dedicated models are trained in advance using 3GPP protocol text and vendor field description documents for different layers (process layer, message layer, cell layer, cause value layer). For example, in the cell layer, the input format is " <protocol> NGAP< / protocol> <hexvalue> 0xA1B2< / hexvalue> <description> UE RadioCapability Hash< / description> The data was used to train the CodeBERT-IE model, generating a 256-dimensional vector representation.

[0149] 2) Dynamic updates: When an unknown protocol field is detected or a new standardized document is submitted by a vendor, the description of the new field will be added to the embedding training set, triggering incremental training of the model; at the same time, the structured knowledge base will be updated to ensure the real-time nature of the knowledge base.

[0150] To illustrate the effectiveness of hybrid retrieval, let's take 5G authentication failure analysis as an example: The private field "Vendor_Cause=0xE1" was captured in the XDR log. In stage S202, since this private field is not defined in the structured knowledge base, an exact match was not found. Subsequently, in stages S203-S204, the information element layer model was selected for vectorization, and the standard information element "Authentication_Reject" with a similarity of 0.89 was retrieved from the embedded knowledge layer. This identified the root cause as "SQN synchronization failure," and corresponding recommended actions were provided. Example of analysis summary output:

[0151] json

[0152] {

[0153] "event_type": "Authentication_Failure",

[0154] "root_cause": "SQN Synchronization Failure",

[0155] "recommended_action": "UpdateUE / AuC synchronization parameters"

[0156] }

[0157] As an alternative or preferred implementation of the hybrid retrieval architecture in step S2 above, this embodiment can also use a combination of knowledge graph multi-hop reasoning and contrastive learning embedding to replace the original structured and semantic hierarchical retrieval architecture. The specific implementation process includes:

[0158] 1) Knowledge Graph Construction: Heterogeneous data such as 3GPP protocol specifications and vendor product manuals are pre-modeled into graph nodes and edge relationships. Nodes include protocol fields, exception types, and device vendors; edge relationships include belonging to a protocol, causing an exception, and vendor-defined relationships. For example, the associated path is constructed as follows: [Cause Value=3]→[Triggered]→[Switchover Failure]→[Associated Vendor]→[Huawei].

[0159] 2) Contrastive Learning Embedded Model Training: Contrastive learning models such as SimCSE are used to train the descriptive text of signaling fields to generate unified semantic vectors. During training, for the mapping between vendor-specific fields and standard fields, the model's cross-vendor generalization ability is improved by maximizing the vector distance between similar positive sample pairs.

[0160] 3) Multi-hop retrieval and fusion strategy: When the target signaling field to be parsed (e.g., Vendor_IE=0xA1B2) is input, dual-path retrieval is performed simultaneously. Specifically,

[0161] Path reasoning retrieval: Search for K-hop neighbor nodes associated with the field in the knowledge graph (e.g., reasoning along the path "manufacturer → protocol → anomaly type").

[0162] Semantic similarity retrieval: The semantic similarity between the target field and the standard fields in the graph is calculated using the contrastive learning model, and Top-K candidate results are extracted.

[0163] Finally, the two search results are merged according to preset weights to generate a final matching list as the comprehensive search result.

[0164] The advantages of this alternative implementation are that, on the one hand, the implicit associations between signaling fields and network topology and equipment manufacturers can be captured through graph multi-hop inference (for example, mining "common private fields of a certain manufacturer's equipment in edge scenarios"); on the other hand, the contrastive learning mechanism significantly reduces the dependence on large-scale labeled data and improves cross-vendor generalization; in addition, when adding a new protocol, only the nodes and relationships in the graph need to be expanded, without reconstructing the entire embedding model, which greatly reduces maintenance costs.

[0165] S3. Construct the comprehensive search results and target analysis task into prompt words, and input the prompt words into a pre-trained signaling big data model for reasoning analysis to obtain signaling analysis results; wherein, the analysis results include the root causes of signaling anomalies and the semantic interpretation of signaling derived from the comprehensive search results.

[0166] In a specific embodiment of the present invention, step S3, based on the domain-enhanced signaling large model and combined with the structured and generalized matching results output by the hybrid retrieval module, realizes automated signaling deep analysis and knowledge reasoning, including the following sub-steps:

[0167] S301. A task routing mechanism based on a multi-task reasoning framework determines the target analysis task. Specifically,

[0168] The system receives input analysis request queries and automatically assigns a processing engine based on the input keywords to determine the type of target analysis task. For example, if the query contains "why", it is routed to the "signaling anomaly analysis" task; if it contains "meaning of", it is routed to the "cell interpretation" task; otherwise, it is routed to the "signaling knowledge Q&A" or "signaling message interpretation" task.

[0169] Signaling anomaly analysis is used to locate root causes (such as handover failures and authentication anomalies); signaling message interpretation is used to parse message semantics (such as in the business scenario of InitialUEMessage); information element interpretation is used to map the meaning of standard / non-standard fields (such as Vendor-Specific AVP); signaling knowledge Q&A is used to answer questions about protocol specifications, fault handling strategies, etc. The output results include confidence scores and references (such as 3GPP clauses), and support protocol version iterations and network topology changes (such as network slicing scenarios).

[0170] The target analysis task aims to achieve comprehensive analytical capabilities, including locating the root cause of anomalies (such as handover failures or authentication anomalies), parsing message semantics, mapping the meaning of standard / non-standard fields, and responding to protocol specifications or fault handling strategies. An example of automatically assigning a processing engine based on input keywords is provided.

[0171] Python

[0172] def route_task(query):

[0173] If "why" is in query.lower():

[0174] return "root_cause_analysis"

[0175] elif "meaning of" in query.lower():

[0176] return "field_interpretation"

[0177] else:

[0178] return "qa"

[0179] S302. Obtain the comprehensive search results output in step S2, and perform input data integration and formatting processing. Specifically,

[0180] Extract precise matching results from the hybrid search output (e.g., "Radio NetworkLayer Failure" corresponding to Cause Value 3) and generalized matching results from multi-layer embedding search (e.g., the standard field "UE_Capability" for similar matching of the vendor field Vendor_IE=0xA1B2). Integrate these results with network context information (e.g., timestamps, source network element IP information, etc.) in a formatted manner, for example, by encapsulating them into JSON format data containing "signals" and "context" fields, thus enabling external knowledge injection and real-time retrieval enhancement (RAG). Data formatting example:

[0181] json

[0182] {

[0183] "signals": [

[0184] {"field": "Cause Value", "value": 3, "semantic": "Radio Network LayerFailure"},

[0185] {"field": "Vendor_IE", "value": "0xA1B2", "similar_match": "UE_Capability (0.91)"}

[0186] ],

[0187] "context": {"timestamp": "2023-08-20T14:35:21.123Z", "src_gnb": "10.1.1.1"}

[0188] }

[0189] S303. Using a dynamic template engine, select and generate target prompt words based on the target analysis task. Specifically,

[0190] A pre-defined structured knowledge prompt template library is provided, and a prompt template is automatically matched based on the task type determined by S301.

[0191] Task type Template Keywords Output structure requirements Anomaly Analysis root_cause,confidence,reference Markdown list Xinyuan Interpretation field_meaning, protocol_clause sheet Knowledge Q&A direct_answer,supporting_evidence Natural language + citation links

[0192] As shown in the table above, when the task is "anomaly analysis," a template containing the keywords "root cause, confidence, reference" should be selected, and the large model should be output in a Markdown list structure. Finally, the JSON data integrated by S302 should be filled into the selected template to generate complete target prompts.

[0193] S304. Configure inference control for the pre-trained signaling model and input the target prompt word to perform inference analysis. Specifically,

[0194] The signaling model uses open-source LLMs (such as LLaMA-2-13B) or commercial APIs (such as GPT-4 Turbo), supporting the processing of long contexts (≥16k tokens) to analyze complete signaling sequences, and possessing the ability to understand code (such as parsing ASN.1 syntax). Before inference, the inference control parameters are dynamically adjusted according to the task type: for the "anomaly analysis" task, the temperature parameter is set to 0.2 to ensure deterministic output; for the "knowledge question answering" task, the temperature parameter is set to 0.7 to enhance creativity. Simultaneously, stop symbols are set to force the model to output in JSON format, avoiding redundant descriptions. Output example:

[0195] json

[0196] {

[0197] "analysis_type": "Root cause localization",

[0198] "results": [

[0199] {

[0200] "root_cause": "Insufficient Wi-Fi resources in the target cell (TS 38.413 Section 9.2.3)",

[0201] "confidence": 92%,

[0202] "evidence": [

[0203] "Cause Value=3 indicates wireless layer failure",

[0204] "Target gNB traffic load exceeds 85% (XDR data verification)" ]

[0206] },

[0207] {

[0208] "root_cause": "Transmission latency exceeds the standard (Huawei Edge Networking Manual, Section 5.3)",

[0209] "confidence": 78%,

[0210] "evidence": ["Source gNB to AMF latency = 63ms (threshold 50ms)"]

[0211] } ]

[0213] }

[0214] S305. Obtain the preliminary output of the large signaling model and generate highly interpretable signaling analysis results through a knowledge tracing mechanism. Specifically,

[0215] After the large model outputs preliminary results including the root causes of anomalies and signaling semantic interpretation, an automatic knowledge tracing mechanism is used to enhance the interpretability of the results. Regular expressions are used to extract protocol clauses (such as "TS 29.273 Section 8.1.2") from the model output and generate hyperlinks pointing to the corresponding structured knowledge base original text. The final signaling analysis results include specific root cause localization, confidence scores (such as 92%), and supporting evidence (such as XDR data verification evidence such as "target gNB traffic load exceeds 85%").

[0216] S306. Perform confidence verification and feedback loop on the signaling analysis results. Specifically,

[0217] The analysis results are evaluated using validation rules: if the highest confidence level of the analysis result is below 70%, a manual review process is triggered; if the terms referenced by the model conflict with the knowledge base version (e.g., a conflict between TS 38.413 V16 and V17), a version inconsistency warning is issued. Furthermore, domain-enhanced evaluation metrics are used for performance monitoring, including the accuracy of comparison with 3GPP standard answers, the feasibility of expert scoring suggestions (1-5 points), and end-to-end analysis response latency (required to be <10 seconds / request). Feedback results that have been manually corrected and confirmed are added to the fine-tuning dataset, triggering incremental training of the large model monthly.

[0218] As a necessary support for executing the above-mentioned online signaling analysis method, the embodiments of the present invention pre-construct a dedicated large-scale signaling model with deep communication domain knowledge. Specifically, a general-purpose base model supporting long context processing and code-level specification parsing capabilities is selected, and a multi-dimensional dedicated fine-tuning dataset is constructed based on 3GPP protocol text, vendor fault case library, signaling QA pairs, and protocol-topology association rules. The fine-tuning data is shown in the table below:

[0219] Data types Example use 3GPP Protocol Text TS 38.413 NGAP Message Definition Protocol semantic understanding Vendor Fault Case Library Huawei 5G handover failure root cause analysis report Exceptional pattern learning Signaling QA Q: What does "Cause Value=3" mean? A: "Wireless layer failure". Knowledge Question and Answer Skills Training Protocol and topology association rules If the gNB ID belongs to an edge node, then the transmission delay should be checked first. Contextual reasoning enhancement

[0220] A two-stage fine-tuning strategy is adopted in the model evolution process. First, the masked language model (MLM) is pre-trained in the domain on 3GPP documents, RFCs and equipment manual corpora. Then, the LORA parameter efficient fine-tuning technology is used to perform instruction-supervised fine-tuning for specific tasks such as fault analysis and knowledge question answering. Finally, a large signaling model that can adapt to complex communication networks is obtained.

[0221] To further verify the effectiveness of this invention in complex scenarios, VoNR call failure analysis in a multi-vendor network environment is taken as an example: After capturing the XDR signaling that triggered the alarm, the intermediate representation data containing the standard field "Cause Value=22" and the private field "Vendor_Reason=0xD1" is first extracted through dynamic decoding; then, in the signaling knowledge base, the structured knowledge layer accurately matches "Cause=22" as "congestion management", while the embedded knowledge layer finds through generalized retrieval that "0xD1" has a similarity of 0.89 with the standard information element "QoS Flow resource insufficiency" and successfully extracts the mapping; finally, the above comprehensive retrieval results are used to construct a target prompt word input signaling model. Under the premise of setting low temperature parameters to ensure rigor, the model directly outputs a highly interpretable JSON format analysis report containing high-priority suggestions (such as expanding CU-UP resources and citing 3GPP TS 23.501), thereby realizing an automated operation and maintenance closed loop for cross-vendor signaling anomalies. Output example:

[0222] json

[0223] {

[0224] "recommendations": [

[0225] {

[0226] "action": "Expand CU-UP resources in the target community",

[0227] "priority": "urgent",

[0228] "reference": "3GPP TS 23.501 Section 5.3.2"

[0229] },

[0230] {

[0231] "action": "Check QoS Flow and DRB mapping configuration",

[0232] "priority": "high",

[0233] "reference": "Huawei 5GC Maintenance Manual v3.2 Chapter 7"

[0234] } ]

[0236] It should be understood that the above-described automated signaling analysis method and system based on large models are not limited to the application scenarios in the foregoing embodiments. Based on the highly automated and generalizable foundation built by this invention, the invention can also be widely extended to the following known or potential technical fields:

[0237] 1) In the field of 5G / 6G communication network operation and maintenance and cross-vendor network testing: This invention can be used for real-time network optimization, identify high-load cells through signaling traffic analysis and guide base station expansion or QoS policy adjustment; at the same time, it can be used for cross-vendor interconnection verification, automatically map private information elements of multiple vendors (such as Huawei, ZTE, Ericsson, etc.) to 3GPP standard fields, generate compatibility reports and detect interaction anomalies such as version mismatch.

[0238] 2) In the field of large-scale Internet of Things (IoT) device management: The lightweight intelligent decoding mechanism of this invention can be applied to low-power wide area network (LPWAN) protocol analysis (such as parsing LoRaWAN or NB-IoT signaling to optimize terminal power consumption); at the same time, in scenarios with millions of IoT terminals in concurrency, the hybrid retrieval architecture can help quickly locate the source device of the signaling storm.

[0239] 3) In the fields of vehicle-to-everything (V2X) and autonomous driving: This invention can be deployed on MEC (Multi-access Edge Computing) nodes as a lightweight signaling processing engine to work with onboard terminals to perform real-time analysis, provide V2X reliability assurance for PC5 and Uu interface signaling, and ensure extremely low latency and high reliability of vehicle roadside unit (RSU) communication.

[0240] In the current era of continuous innovation in the communications field, signaling analysis technology faces numerous challenges, and the limitations of traditional technologies are becoming increasingly apparent, severely restricting the efficient operation and development of communication networks. This invention focuses on these key pain points and aims to overcome the following core technical challenges:

[0241] In breaking free from the rigid constraints of traditional parsing methods, this invention utilizes an intelligent decoding engine and multi-layer coding technology to transform binary or text-based signaling into a protocol-independent intermediate representation, significantly enhancing compatibility with non-standard signaling. Combined with a hybrid retrieval algorithm, through embedding models and distance calculations, it achieves fuzzy matching of similar semantic cells. Even when encountering proprietary fields, it can accurately map to the closest 3GPP standard cell, effectively solving the problem of rigid parsing.

[0242] In overcoming the challenges of semantic understanding, this invention introduces a domain cue word framework to guide large models in dynamic reasoning using communication expertise (such as 3GPP TS 29.273) to accurately understand signaling semantics. Through multimodal feature fusion technology, it jointly analyzes multi-dimensional information such as signaling text, binary streams, and network topology, significantly improving semantic relevance and making signaling analysis more intelligent and accurate.

[0243] In addressing the challenges of knowledge base updates and adaptation, this invention constructs a dynamic and scalable knowledge base collaboration mechanism. Leveraging the attention mechanism of a large model, it can align with the latest protocols in real time and automatically capture updated 3GPP document content, ensuring the knowledge base is always synchronized with the latest standards. Employing an online embedding model, it adaptively adjusts the retrieval strategy based on real-time network conditions (such as UE movement trajectories), effectively compensating for the deficiencies in knowledge base updates and dynamic adaptation.

[0244] Regarding improving generalization performance in multi-vendor environments, this invention designs a vendor-independent signaling representation layer, which uniformly handles signaling differences from different equipment vendors through multi-layer coding technology. Simultaneously, it utilizes multiple embedded models for parallel computation, such as employing BERT to process text signaling and CNN to process binary streams, comprehensively enhancing cross-vendor generalization capabilities and ensuring the accuracy and stability of signaling analysis in multi-vendor environments.

[0245] This invention targets network bitstream file (PCAP / XDR / TRACE) data, utilizing a high-precision structured signaling knowledge base and advanced retrieval and matching algorithms to ensure the accuracy and generalization of analysis results. It can quickly uncover abnormal events in signaling, accurately interpret signaling messages and information cells, providing strong support for communication network optimization, fault diagnosis, and service expansion, reducing communication network operating costs, and improving network service quality.

[0246] like Figure 3 As shown, the present invention also provides an automated signaling analysis system based on a large model. Based on the automated signaling analysis method based on a large model as described above, the system includes:

[0247] The intelligent decoding module 1 is used to acquire the bitstream file of the communication network, dynamically load the protocol description file corresponding to the bitstream file to generate decoding rules, extract the signaling key fields in the bitstream file based on the decoding rules, and combine the signaling key fields according to the protocol-independent data structure to generate intermediate representation data.

[0248] Hybrid retrieval module 2 is used to extract signaling key fields from the intermediate representation data as target signaling fields, and to perform retrieval and matching in a preset signaling knowledge base using the target signaling fields. Through precise matching of the structured knowledge layer and / or generalized retrieval of the embedded knowledge layer in the signaling knowledge base, the standard information elements corresponding to the target signaling fields are extracted, and comprehensive retrieval results are generated.

[0249] The analysis and summary module 3 is used to construct prompt words from the comprehensive search results and the target analysis task, and input the prompt words into a pre-trained signaling big data model for inference analysis to obtain signaling analysis results; wherein, the analysis results include the root causes of signaling anomalies and the signaling semantic explanation derived from the comprehensive search results.

[0250] Each of the above modules is used to perform the corresponding steps in the above-mentioned automated signaling analysis method based on a large model. The specific implementation method is as described in the above-mentioned method embodiment, and will not be repeated here.

[0251] like Figure 4 As shown, the present invention also provides a computer device, which may be a server, and its internal structure may be as follows: Figure 4 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores all the data required for the process of the large-model-based automated signaling analysis method. The network interface is used for communication with external terminals via a network connection. The computer program is executed by the processor to implement the large-model-based automated signaling analysis method.

[0252] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer equipment on which the present application is applied.

[0253] An embodiment of this application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements any of the above-described automated signaling analysis methods based on a large model.

[0254] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by hardware related to computer program instructions. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. Any references to memory, storage, databases, or other media provided in this application and used in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM), such as dynamic RAM (used as main storage) or static RAM (commonly used as cache memory). By way of illustration and not limitation, RAM has various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), and Rambus DRAM (RDRAM).

[0255] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, apparatus, article, or method. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0256] The above description is merely a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A large model-based automated signaling analysis method, characterized in that, include: S1. Obtain the bitstream file of the communication network, dynamically load the protocol description file corresponding to the bitstream file to generate decoding rules, extract the signaling key fields in the bitstream file based on the decoding rules, and combine the signaling key fields according to the protocol-independent data structure to generate intermediate representation data; S2. Extract the signaling key fields from the intermediate representation data as target signaling fields, and use the target signaling fields to perform retrieval and matching in a preset signaling knowledge base. Through precise matching of the structured knowledge layer and / or generalized retrieval of the embedded knowledge layer in the signaling knowledge base, extract the standard information elements corresponding to the target signaling fields and generate comprehensive retrieval results. S3. Construct the comprehensive search results and target analysis task into prompt words, and input the prompt words into a pre-trained signaling big data model for reasoning analysis to obtain signaling analysis results; wherein, the analysis results include the root causes of signaling anomalies and the semantic interpretation of signaling derived from the comprehensive search results.

2. The large model based automated signaling analysis method of claim 1, wherein, S1 specifically includes: S101. Obtain the raw data of the communication network and perform data normalization preprocessing to obtain a normalized bitstream file; wherein, the raw data includes PCAP data, XDR data, and TRACE data; S102. Based on the preset protocol fingerprint library, identify the protocol type contained in the normalized bitstream file, and use the dynamic protocol adapter to load the corresponding protocol description file to dynamically generate decoding rules. S103. The multi-layer decoding engine is used to parse the bitstream file based on the decoding rules, and key signaling fields are extracted through a combination of rules and models. S104. The extracted signaling key fields are combined according to a protocol-independent intermediate representation data structure and uniformly encapsulated into the intermediate representation data.

3. The automated signaling analysis method based on a large model according to claim 2, characterized in that, In step S101, the data normalization preprocessing specifically includes: For PCAP data, extract the raw binary stream and restore the protocol payload; For XDR data, parse the logs in JSON or XML format and extract the signaling-related fields; For TRACE data, perform cross-service link aggregation to reconstruct the signaling flow.

4. The automated signaling analysis method based on a large model according to claim 2, characterized in that, In S103, the multi-layer decoding engine includes a syntax layer, a semantic layer, and a business layer; At the syntax layer, the original field values ​​of the bitstream file are restored using a pre-built decoder or parser; At the semantic layer, the original field values ​​are mapped to semantic tags according to the protocol specification mapping table; At the business layer, the context information corresponding to the signaling key fields is obtained through network topology association.

5. The automated signaling analysis method based on a large model according to claim 2, characterized in that, Key signaling fields are extracted through a combination of rules and models, specifically including: For standard fields, a rule-driven extraction method is used, employing predefined regular expressions or path expressions to locate the standard fields; For non-standard fields, a model-driven extraction method is used to construct prompt word templates and input them into a fine-tuned large model. The fine-tuned large model then infers and outputs the semantic attributes of the non-standard fields. After extraction, the extracted signaling key fields are compared with a pre-set structured knowledge base to perform illegal value verification. When an unknown protocol field is detected, an online embedding model is triggered to calculate the cosine similarity between the unknown protocol field and the standard information element, so as to update the signaling knowledge base based on the cosine similarity.

6. The automated signaling analysis method based on a large model according to claim 1, characterized in that, S2 specifically includes: S201. Obtain the signaling key fields in the intermediate representation data as the target signaling fields to be processed; S202. In the preset signaling knowledge base, the target signaling field is first used to perform precise matching in the structured knowledge layer, and the value of the target signaling field is then validated. S203. When the exact match is not found, the corresponding embedding level is selected according to the field type of the target signaling field, and the target signaling field is converted into a query vector using the embedding model corresponding to the embedding level; wherein, the embedding level includes the process layer, message layer, information cell layer and reason value layer. S204. Perform vector similarity calculation based on hybrid distance algorithm in the embedded knowledge layer, and filter and extract standard information elements that match based on similarity threshold; S205. Summarize the standard information elements obtained from the precise matching and / or generalized retrieval to generate comprehensive retrieval results.

7. The automated signaling analysis method based on a large model according to claim 6, characterized in that, In S204, the calculation formula for the hybrid distance algorithm is as follows: Overall similarity = α·cosine similarity + β·(1 / Mahanobis distance) The weights are configured such that α and β are both weights, and α + β = 1.

8. The automated signaling analysis method based on a large model according to claim 1, characterized in that, S3 specifically includes: S301, A task routing mechanism based on a multi-task reasoning framework, which automatically allocates processing engines to determine the type of target analysis task based on input keywords; S302. Obtain the comprehensive search results output by S2, and perform input data integration and formatting processing to achieve real-time search enhancement; S303. Using a dynamic template engine, select and generate target prompt words based on the target analysis task; S304. Configure inference control for the pre-trained signaling big model, and input the target prompt word to perform inference analysis; wherein, the signaling big model is: a fine-tuning dataset is constructed based on 3GPP protocol text, vendor fault case library, signaling QA pairs and protocol and topology association rules, and a two-stage fine-tuning strategy is adopted, that is, firstly, domain pre-training of the masked language model is performed, and then instruction-supervised fine-tuning is performed for specific tasks using LORA parameter efficient fine-tuning technology to obtain the signaling big model; S305. Obtain the preliminary output of the signaling big model, generate highly interpretable signaling analysis results through the knowledge tracing mechanism, extract the protocol terms in the preliminary results using regular expressions, and generate hyperlinks pointing to the original text of the corresponding structured knowledge base to achieve knowledge tracing. S306. Perform confidence verification and feedback loop on the signaling analysis results.

9. The automated signaling analysis method based on a large model according to claim 8, characterized in that, Specifically, S303 includes: A pre-set structured knowledge prompt template library is provided, and templates are automatically matched according to the type of the target analysis task. For anomaly analysis tasks, information element interpretation tasks, or knowledge question answering tasks, corresponding template keywords and output structure requirements are matched respectively; wherein, the output structure requirements include at least one of the following: Markdown list, table, and natural language supplemented with reference links; The formatted comprehensive search results are filled into the matching template to generate the target prompt words.

10. An automated signaling analysis system based on a large model, comprising the automated signaling analysis method based on a large model according to any one of claims 1 to 9, characterized in that, The system includes: The intelligent decoding module is used to acquire the bitstream file of the communication network, dynamically load the protocol description file corresponding to the bitstream file to generate decoding rules, extract the signaling key fields in the bitstream file based on the decoding rules, and combine the signaling key fields according to the protocol-independent data structure to generate intermediate representation data. The hybrid retrieval module is used to extract the signaling key fields from the intermediate representation data as target signaling fields, and to perform retrieval and matching in a preset signaling knowledge base using the target signaling fields. Through precise matching of the structured knowledge layer and / or generalized retrieval of the embedded knowledge layer in the signaling knowledge base, the module extracts the standard information elements corresponding to the target signaling fields and generates comprehensive retrieval results. The analysis and summary module is used to construct prompt words from the comprehensive search results and the target analysis task, and input the prompt words into a pre-trained signaling big data model for inference analysis to obtain signaling analysis results; wherein, the analysis results include the root causes of signaling anomalies and the signaling semantic explanation derived from the comprehensive search results.

Images