Cross-Protocol Signaling Anomaly Detection With Two-Stage Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current signaling analysis methods are limited to specific protocols and cannot be multiplexed between different protocols, leading to resource waste and maintenance difficulties in communication networks.
Innovation Solution
A signaling analysis method and apparatus that can be multiplexed between different protocols by performing feature construction on message types and information elements, using a first and second signaling anomaly detection model for coarse- and fine-level anomaly detection, respectively, to detect anomalies in signaling flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If customized signaling analysis apparatuses are created for different protocols, then protocol-specific analysis accuracy is improved, but resource waste and maintenance difficulty increase
Solution Approach 1:
The patent applies universality by designing a single signaling analysis apparatus that can handle multiple protocols (SIP, H.323, MGCP, SIGTRAN) through a unified feature construction approach. The apparatus extracts common features from different protocol formats and feeds them into a single anomaly detection model, eliminating the need for separate customized apparatuses for each protocol while maintaining protocol-specific analysis accuracy.
2Measurement precision
If customized signaling analysis apparatuses are created for different protocols, then protocol-specific analysis accuracy is improved, but resource consumption increases
Solution Approach 1:
The patent consolidates multiple protocol-specific analysis resources into a single universal apparatus. By extracting common features across different protocols and using a unified anomaly detection model, the system reduces resource consumption while maintaining the ability to accurately analyze multiple protocol types simultaneously.
3Productivity
If a single multiplexed signaling analysis method is used for different protocols, then resource efficiency is improved, but anomaly detection accuracy may deteriorate
Solution Approach 1:
The patent applies segmentation by dividing the anomaly detection process into two stages: coarse-level detection using message type information and fine-level detection using information element details. This segmented approach allows the system to first filter out obvious anomalies at the message type level, then perform detailed analysis only when necessary, maintaining high accuracy while improving resource efficiency.
Solution Approach 2:
The patent applies local quality by differentiating the depth of analysis based on the specific signaling content. The system uses coarse-level feature construction for initial screening and reserves fine-level feature construction for cases requiring detailed examination. This localized application of analysis depth ensures high accuracy where needed while optimizing resource consumption overall.
4Measurement precision
If fine-grained feature construction is performed on all signaling elements, then anomaly detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent applies partial action by performing fine-grained feature construction only on information elements when necessary, rather than universally applying it to all signaling elements. The system first performs coarse-level analysis and only dives into detailed fine-grained analysis when the coarse level indicates potential anomalies or when the signaling content requires such detailed examination, thus reducing unnecessary processing time while maintaining accuracy.
Data Source
AI summary
Signaling analysis methods and apparatus are provided to obtain a to-be-detected signaling flow that includes N pieces of signaling. First feature construction is performed on a message type and an information element that are included in each of the N pieces of signaling to obtain a first feature sequence. The first feature sequence includes N first feature vectors which are in a one-to-one correspondence with the N pieces of signaling. The first feature sequence is input to a first signaling anomaly detection model to perform anomaly detection processing. A first anomaly detection result is produced indicating that the to-be-detected signaling flow is normal or abnormal. In this way, an anomaly caused due to an information element error can be covered. The method and the apparatus can be multiplexed between different protocols.