WO2022057501A1 - 异常终端的识别方法、分析装置及设备、存储介质 - Google Patents

异常终端的识别方法、分析装置及设备、存储介质 Download PDF

Info

Publication number
WO2022057501A1
WO2022057501A1 PCT/CN2021/110953 CN2021110953W WO2022057501A1 WO 2022057501 A1 WO2022057501 A1 WO 2022057501A1 CN 2021110953 W CN2021110953 W CN 2021110953W WO 2022057501 A1 WO2022057501 A1 WO 2022057501A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
distribution
granularity
terminal
characteristic value
Prior art date
Application number
PCT/CN2021/110953
Other languages
English (en)
French (fr)
Inventor
冯媛
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2022057501A1 publication Critical patent/WO2022057501A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0677—Localisation of faults
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
    • H04L43/0817—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W64/00—Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Definitions

  • the embodiments of the present application relate to, but are not limited to, the field of communications technologies, and in particular, relate to a method for identifying an abnormal terminal, an analysis device and equipment, and a storage medium.
  • IoT smart terminals With the emergence and development of the Internet of Things, various IoT smart terminals are increasingly appearing in people's daily lives, such as smart watches/bands, smart meters, smart door locks, and sweeping robots.
  • the abnormal terminal identification technology of the Internet of Things is almost limited to the internal system of the Internet of Things industry.
  • the upgrading of the functional modules of the Internet of Things terminal the adjustment of the management system structure and the optimization of the signaling message, the abnormal terminal and the server signaling link can be identified and the abnormal terminal can be identified. positioning.
  • This kind of abnormal terminal identification needs to adjust the system architecture and change the signaling process, and the overall resource overhead is high; if it is not planned in the initial stage of the Internet of Things construction, the later realization cost is high; there are differences in industry business processes for this kind of upgrade and transformation within the industry, so this kind of The method is not universal; as the provider of the IoT pipeline, the mobile operator cannot conduct a unified monitoring and analysis of the network terminal situation. Quickly make fault demarcation and location, the abnormal terminal detection method is single, the abnormal detection effect is not good, and the detection is inaccurate.
  • An embodiment of the present application provides a method for identifying an abnormal terminal, including: collecting signaling information of a terminal within a period of time; performing distribution statistics on the signaling information to obtain a first distribution characteristic value; when the first distribution characteristic value is related to a historical distribution When the difference value of the characteristic values is greater than the preset threshold, it is determined that the terminal is an abnormal terminal.
  • the embodiment of the present application further provides an analysis device, the analysis device includes: a collection module, which is used for collecting signaling information of a terminal within a period of time; a feature building module, where the feature building module is used to perform distribution statistics on the signaling information, The first distribution characteristic value is obtained; the abnormality detection module, the abnormality detection module is used to determine that the terminal is an abnormal terminal when the difference value between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold
  • the embodiment of the present application also provides an analysis device, the analysis device includes a processor, a memory, and a communication bus; the communication bus is used to implement connection and communication between the processor and the memory; the processor is used to execute one or more stored in the memory.
  • Embodiments of the present application further provide a computer storage medium, where the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above method for identifying abnormal terminals A step of.
  • FIG. 1 is a schematic diagram of a basic flow of a method for identifying an abnormal terminal according to Embodiment 1 of the present application;
  • FIG. 2 is a basic schematic diagram of the IoT networking signaling collection in Embodiment 1 of the present application;
  • FIG. 3 is a basic schematic diagram of a time series distribution of valid information showing fluctuations in an interval according to Embodiment 1 of the present application;
  • FIG. 4 is a basic schematic diagram showing intra-range fluctuations in time-series distribution of another valid information according to Embodiment 1 of the present invention.
  • FIG. 5 is a basic schematic diagram of fluctuations in the mean value of the valid information in Embodiment 1 of the present application.
  • FIG. 6 is a basic schematic diagram of distribution statistics data in Embodiment 1 of the present application.
  • FIG. 7 is a sequence diagram of valid information of a silent terminal according to Embodiment 2 of the present application.
  • FIG. 8 is a schematic diagram of a basic flow of a method for identifying an abnormal terminal according to Embodiment 2 of the present application.
  • FIG. 9 is a schematic diagram of the basic structure of an analysis device provided in Embodiment 4 of the present application.
  • FIG. 10 is a schematic diagram of the basic structure of the analysis device provided in Embodiment 4 of the present application.
  • the embodiments of the present application provide an abnormal terminal identification method, an analysis device and equipment, and a storage medium, and the main technical problem to be solved is that when an abnormal terminal exists in the Internet of Things, the abnormal terminal cannot be accurately detected, and the detection effect is poor.
  • FIG. 1 shows a basic flowchart of a method for identifying abnormal terminals, including but not limited to:
  • S101 Collect signaling messages of a terminal within a period of time.
  • the signaling messages of the terminal within the period of time are collected by the outer probe.
  • control plane signaling information collection point 1 in the networking of the physical network, there are control plane signaling information collection point 1 and user plane signaling information collection point.
  • Point 2 for example, by deploying external probes on the MME side of the S1MME interface between the base station (Evolved Node B, eNodeB for short) and the key control node (Mobility Management Entity, short for: MME), the control plane signaling messages are processed.
  • the cycle duration can be set freely, for example, the cycle duration is seven days, the cycle duration is five days, and so on.
  • the method before performing distribution statistics on signaling messages, the method further includes: performing data cleaning on signaling messages to obtain a plurality of valid information; performing small-granularity aggregation statistics on each valid information to obtain data of N granularities; It is understood that the collected signaling messages contain a large amount of information.
  • the information in the signaling information needs to be cleaned, stripped, and regularized to obtain perfect and effective information as key indicators; for example, the time information in the information , user information, terminal information, user behavior information (for example, Access Point Name (APN)), user location information, key KPI indicators (for example, coverage indicators, call establishment indicators, call hold indicators) indicators, mobility management indicators, etc.) and other fields, and then obtain valid information as key indicators; then make small-grained aggregate statistics on the valid information (ie, key indicators), for example, the signaling type of the control plane of the terminal , the number of signaling is aggregated at hourly granularity; for example, the effective information such as uplink traffic, downstream traffic, and transmission duration of the terminal is aggregated at hourly granularity to obtain N granularity data corresponding to N valid information.
  • key indicators for example, the signaling type of the control plane of the terminal , the number of signaling is aggregated at hourly granularity; for example, the effective information such as uplink traffic, downstream traffic, and transmission
  • performing distribution statistics on the signaling information to obtain the first distribution characteristic value includes: performing distribution statistics on the data of each granularity to obtain the first distribution characteristic value corresponding to the data of each granularity; it should be understood that , IoT terminals are affected by external factors such as network, environment, and human behavior.
  • each valid information in the signaling information identifies the abnormal terminal, and the high-dimensional expansion analysis method of a single index (single valid information) is used to identify the abnormal terminal.
  • performing distribution statistics on the data of each granularity, and obtaining the first distribution characteristic value corresponding to the data of each granularity includes: calculating the ith granularity of the data of the N granularities by calculating the exponential sliding change rate formula.
  • the exponential sliding change rate of the data, the exponential sliding change rate is used as the first distribution characteristic value of the data of the ith granularity.
  • a ⁇ (0,1) is the coefficient of variation.
  • the scene of small glitches in the valid information is identified by the exponential sliding change rate, as shown in Fig. 5, so as to obtain the first distribution characteristic value of the valid information.
  • performing distribution statistics on the data of each granularity to obtain the first distribution characteristic value corresponding to the data of each granularity includes: The data of n are fitted with least squares, and the least square coefficient of variation of the data of the ith granularity among the data of N granularities is calculated, and the least squares of variation coefficient is used as the first distribution characteristic value of the data of the ith granularity.
  • the coefficient of variation removes the dimension and makes the algorithm general. Improved accuracy when performing anomaly analysis on valid information from IoT endpoints.
  • the coefficient of variation of the window window is defined as:
  • performing distribution statistics on the data of each granularity to obtain the first distribution characteristic value corresponding to the data of each granularity includes: calculating the data of the ith granularity among the data of N granularities by calculating the total variation formula The total variation coefficient of variation is taken as the first distribution eigenvalue of the data of the i-th granularity.
  • the instantaneous abnormal fluctuation of valid terminal information in the Internet of Things can be monitored and identified through the coefficient of variation of the total variation.
  • the first distribution characteristic value of each valid information collected in the current cycle is compared with the distribution characteristic value of each valid information collected in the previous cycle, and when the difference between the first distribution characteristic value and the historical distribution characteristic value is When the value is greater than the preset threshold, it is determined that the terminal is an abnormal terminal.
  • the preset threshold may be determined according to the first distribution characteristic value of each effective parameter.
  • the method further includes: performing statistics on the first distribution characteristic value and the distribution characteristic values of similar terminals to obtain distribution statistical data; judging whether the terminal is an abnormal terminal according to the distribution statistical data; it should be understood that the first distribution A distribution characteristic value and distribution characteristic values of similar terminals are counted, and before obtaining the distribution statistical data, the method further includes: identifying the terminal type through signaling information, and determining the terminal type.
  • the terminal type is identified by the characteristic service in the signaling information, and the terminal type is determined.
  • the Internet-connected enterprise identifies and classifies the IoT terminal to determine the terminal category.
  • the behavior of terminals in the same IoT industry has consistent characteristics, that is, the distribution of effective information has consistent characteristics, including control plane behavior and user plane behavior; when an individual terminal is abnormal, the effective Information (key indicators) and other terminals in the industry will show significant differences; in some embodiments, the distribution statistics are obtained by calculating the first distribution characteristic value and the distribution characteristic value of similar terminals, as shown in FIG. 6 . ; Then judge whether the terminal is an abnormal terminal according to the distribution statistics; for example, when identifying abnormal high-frequency terminals, perform feature extraction according to the distribution statistics, and use the discrete Fourier transform to extract the main frequency as the key in the feature extraction process.
  • the characteristic index is set as a discrete sequence, and the discrete Fourier transform formula is:
  • the main frequency reported by the signaling is used as the frequency feature for the transformed sequence, and the number of control plane signaling and service reporting traffic are added as auxiliary features for discrete point solution, so as to identify abnormal high-frequency terminals in the same industry, and control the
  • the high-frequency terminals with abnormal plane signaling and the high-frequency users with abnormal signaling on the user plane are identified; that is, for terminals with abnormal key indicators, the distribution characteristics of the matrix after the two-dimensional expansion are obtained through the two-dimensional expansion results of the second-degree expansion module. , and mark the terminal with abnormal key indicators by identifying the discrete points of the overall distribution.
  • the method for identifying an abnormal terminal collects the signaling information of the terminal within a period of time; performs distribution statistics on the signaling information to obtain a first distribution characteristic value; when the difference between the first distribution characteristic value and the historical distribution characteristic value is When the difference value is greater than the preset threshold, it is determined that the terminal is an abnormal terminal; the method for identifying abnormal terminals proposed in this embodiment performs abnormality detection based on terminal historical data, and realizes automatic self-abnormal detection by expanding signaling messages, avoiding related technologies.
  • the first distribution eigenvalue and the distribution eigenvalues of similar terminals are counted, and the problem of inaccurate anomaly detection improves the accuracy of abnormal terminal detection.
  • the abnormal terminal identification method proposed in this embodiment has no function upgrade requirements for the terminal, does not need to change the architecture of the original Internet of Things, and supports the detection of abnormal terminals in different Internet of Things industries. identification, thereby reducing the cost of identifying abnormal terminals.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • this embodiment provides a more specific example to describe the above-mentioned method for identifying abnormal terminals.
  • a silent terminal abnormal terminal
  • the silent terminal control plane signaling The information exchange is normal, and the user plane signaling information only exists in the flow of the basic heartbeat message, which does not trigger the service reporting of the industry.
  • Figure 7 is the sequence diagram of the effective information of the silent terminal. It can be understood that , the effective information indicators of the terminals in the Internet of Things all have a baseline value, that is, the indicators of the effective information are not zero in the "non-glitch" place. It should be understood that the baseline value of different terminals is different, so it is impossible to The silent terminal is simply judged by the index threshold of valid information.
  • the identification method of the abnormal terminal includes but is not limited to:
  • the signaling information of the user plane terminal within the period is obtained.
  • effective information obtained by cleaning user information from the collected signaling information is used as a key indicator, for example, including key indicator information such as traffic and duration; for example, terminal information, including key information such as terminal signal and brand; APN accessed by the terminal; information such as the location of the terminal.
  • key indicator information such as traffic and duration
  • terminal information including key information such as terminal signal and brand
  • APN accessed by the terminal information such as the location of the terminal.
  • the user's IoT industry and IoT enterprise are identified through key business features such as the user's number segment and the accessed APN, so as to determine the industry of the terminal. It should be understood that the execution order of this step is not limited, and it may be after step S702 and before step S707.
  • the key indicators obtained after cleaning the signaling information are used for hourly granularity indicator statistics; for example, hourly granularity aggregation is performed on key indicators such as uplink traffic, downlink traffic, and transmission duration in the terminal dimension.
  • the indicators are one-dimensionally expanded, and the one-dimensional feature extraction is performed to obtain the first distribution characteristic value; for example, the key indicators of the terminal are expanded in a time series dimension with an hourly granularity window period of 7 days, and data of each granularity is obtained.
  • the corresponding first distribution characteristic value it should be understood that obtaining the first distribution characteristic value corresponding to the data of each granularity is consistent with the method in the above-mentioned embodiment, and details are not repeated here.
  • the terminal is determined to be an abnormal terminal when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold.
  • the eigenvalues of the first distribution are determined.
  • the method further includes:
  • the indicators of the terminal and the two-dimensional indicators of the same type of terminals are expanded to obtain distribution statistics, and then discrete fast Fourier transform is performed on the indicators to convert the time series features of the terminals into frequency domain features, and calculate discrete The mean squared error of the sequence after the Fast Fourier Transform.
  • the clustered terminal grouping categories are sorted according to the mean value, and the threshold of the grouping with the smallest mean value is obtained. Filter the terminal and mark it as a silent user. If the terminal belongs to the current terminal, mark the current terminal as a silent terminal (abnormal terminal).
  • this embodiment provides a more specific example to describe the above-mentioned abnormal terminal identification method.
  • the Internet of Things has the characteristics of terminal behavior consistency in the industry, the signaling behavior of the control plane is There is also distributional feature consistency.
  • the signaling process will have a handover process compared with the base station (NodeB, referred to as: NB), but in the same Internet of Things network or in the same industry, its behavior is within the range of signaling fluctuations There is still consistency. Due to the consistent behavior of IoT terminals, and the number of terminals is much higher than that of the human network, abnormally high frequency of signaling can easily lead to network signaling storms and network congestion. Therefore, the identification of high-frequency terminals with abnormal control plane signaling is of high value.
  • the identification method of this abnormal terminal includes but is not limited to:
  • Step 1 Terminal signaling collection.
  • the collection of control plane signaling messages is performed by deploying external probes on the MME side of the S1MME interface between the eNodeB and the MME.
  • Step 2 Indicator cleaning.
  • effective information obtained by cleaning user information from the collected signaling information is used as a key indicator, for example, including key indicator information such as traffic and duration; for example, terminal information, including key information such as terminal signal and brand; Key indicators, including the number of attach requests, the number of attach failures, the number of detachment requests, the number of detachment failures, the number of tracking area update requests, the number of tracking area update failures, the number of service requests, the number of service request failures, the number of S1 handover requests, and the number of S1 handovers Request Failure Times, X2 Handover Request Times, X2 Request Failure Times, Paging Request Times, Paging Failure Times, Dedicated Bearer Activation Request Times, Dedicated Bearer Activation Failure Times, Bearer Modification Request Times, Bearer Modification Failure Times, Bearer Deactivation Request Times key signaling indicators such as the number of times and the number of bearer deactivation failures.
  • key indicator information such as traffic and duration
  • terminal information including key information such as terminal signal and brand
  • Key indicators
  • Step 3 Identify the IoT industry.
  • the user's IoT industry and IoT enterprise are identified through key business features such as the user's number segment and the accessed APN, so as to determine the industry of the terminal. It should be understood that the execution order of this step is not limited, and it may be after step 2 and before step 7.
  • Step 4 Indicator statistics.
  • the key indicators obtained after cleaning the signaling information are counted at hourly granularity; for example, hourly granularity aggregation is performed on the indicators of the number of requests and the number of failures of each signaling in the terminal dimension.
  • Step 5 One-dimensional expansion of the index, and one-dimensional feature extraction.
  • the indicators are one-dimensionally expanded, and the one-dimensional feature extraction is performed to obtain the first distribution characteristic value; for example, the key indicators of the terminal are expanded in a time series dimension with an hourly granularity window period of 7 days to obtain data of each granularity The corresponding first distribution characteristic value; it should be understood that obtaining the first distribution characteristic value corresponding to the data of each granularity is consistent with the method in the above-mentioned embodiment, and details are not repeated here.
  • Step 6 Identify abnormal terminals.
  • the terminal is determined to be an abnormal terminal when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold.
  • the eigenvalues of the first distribution are determined.
  • the method further includes:
  • Step 7 Expand the indicator two-dimensionally.
  • the indicators of the terminal and the two-dimensional indicators of the same type of terminals are expanded to obtain distribution statistics.
  • Step 8 Two-dimensional feature extraction and abnormal terminal identification.
  • the distribution threshold is obtained according to the mean value within the group.
  • the terminal whose median and mean are both higher than the threshold is finally identified as a high-frequency terminal with abnormal control plane signaling. If the current terminal's median and mean are both higher than the threshold, then Identify the current terminal as a high-frequency terminal with abnormal control plane signaling.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • This embodiment provides an analysis device, as shown in FIG. 9 , the analysis device includes:
  • Collection module the collection module is used to collect the signaling information of the terminal within the period of time.
  • a feature building module where the feature building module is used to perform distribution statistics on the signaling information to obtain a first distribution feature value.
  • An abnormality detection module configured to determine that the terminal is an abnormal terminal when the difference between the first distribution characteristic value and the historical distribution characteristic value is greater than a preset threshold.
  • This embodiment also provides an analysis device, as shown in FIG. 10, which includes a processor 901, a memory 902, and a communication bus 903, wherein:
  • the communication bus 903 is used to realize the connection communication between the processor 901 and the memory 902 .
  • the processor 901 is configured to execute one or more computer programs stored in the memory 902 to implement at least one step in the methods for identifying abnormal terminals in the first embodiment, the second embodiment and the third embodiment.
  • the present embodiments also provide a computer-readable storage medium embodied in any method or technology for storing information, such as computer-readable instructions, data structures, computer program modules, or other data volatile or nonvolatile, removable or non-removable media.
  • Computer-readable storage media include but are not limited to RAM (Random Access Memory, random access memory), ROM (Read-Only Memory, read-only memory), EEPROM (Electrically Erasable Programmable read only memory, electrically erasable programmable read only memory) ), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, Or any other medium that can be used to store the desired information and that can be accessed by a computer.
  • RAM Random Access Memory
  • ROM Read-Only Memory
  • EEPROM Electrically Erasable Programmable read only memory
  • flash memory or other memory technology
  • CD-ROM Compact Disc Read-
  • the computer-readable storage medium in this embodiment may be used to store one or more computer programs, and the one or more computer programs stored in the storage medium may be executed by a processor to implement the first, second, and third embodiments described above. at least one step in the method for identifying abnormal terminals.
  • the functional modules/units in the system, and the device can be implemented as software (which can be implemented by computer program codes executable by a computing device). ), firmware, hardware, and their appropriate combination.
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components Components execute cooperatively.
  • Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .
  • communication media typically embodies computer readable instructions, data structures, computer program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery, as is well known to those of ordinary skill in the art medium. Therefore, the present application is not limited to any particular combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供了一种异常终端的识别方法、分析装置及设备、存储介质，通过采集周期时长内终端的信令信息；对所述信令信息进行分布统计，得到第一分布特征值；当所述第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定所述终端为异常终端。

Description

异常终端的识别方法、分析装置及设备、存储介质
交叉引用
本申请基于申请号为“202010972425.4”、申请日为2020年09月16日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请实施例涉及但不限于通信技术领域，尤其涉及一种异常终端的识别方法、分析装置及设备、存储介质。
背景技术
随着物联网的产生和发展，各种物联网智能终端也越来越多地出现在人们的日常生活当中，如智能手表/手环、智能电表、智能门锁、扫地机器人等。
然而在物联网终备大规模普及的同时，物联网终端接入数量呈现指数级增长；而物联网中异常终端会降低运营商网络有效负荷，造成网络资源浪，因此，异常终端检查可以提高网络优化效率，降低网络运营成本。
当前物联网异常终端识别技术几乎都限定在物联网行业内部***中，通过物联网终端功能模块升级、管理***架构调整及信令消息优化，识别终端与服务器信令链路异常进而实现对异常终端的定位。这种异常终端识别需要调整***架构并更改信令流程，总体的资源开销较高；若非物联网建设初期统一规划，后期实现成本高；行业内部这种升级改造存在行业业务流程差异，因此这种方式不具备通用性；移动运营商作为物联网管道的提供者，无法对网络终端的情况做统一监控分析，由于特定物联网业务存在“同时同步”的特性，当出现终端故障时，运营商无法快速做出故障定界及定位，异常终端检测方法单一，异常检测效果欠佳，检测不准确。
发明内容
本申请实施例提供了一种异常终端的识别方法，包括：采集周期时长内终端的信令信息；对信令信息进行分布统计，得到第一分布特征值；当第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定终端为异常终端。
本申请实施例还提供了一种分析装置，分析装置包括：采集模块，采集模块用于采集周期时长内终端的信令信息；特征构建模块，特征构建模块用于对信令信息进行分布统计，得到第一分布特征值；异常检测模块，异常检测模块用于当第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定终端为异常终端
本申请实施例还提供了一种分析设备，分析设备包括处理器、存储器及通信总线；通信总线用于实现处理器和存储器之间的连接通信；处理器用于执行存储器中存储的一个或者多个计算机程序，以实现如上所述的异常终端的识别方法的步骤。
本申请实施例还提供了一种计算机存储介质，计算机可读存储介质存储有一个或者多个程序，一个或者多个程序可被一个或者多个处理器执行，以实现如上的异常终端的识别方法的步骤。
附图说明
图1为本申请实施例一的异常终端的识别方法的基本流程示意图；
图2为本申请实施例一的物联网组网信令采集基本示意图；
图3为本申请实施例一的一种有效信息的时序分布呈现区间内波动基本示意图；
图4为本申请发明实施例一的另一种有效信息的时序分布呈现区间内波动基本示意图；
图5为本申请实施例一的有效信息的均值呈现区间内波动基本示意图；
图6为本申请实施例一的分布统计数据基本示意图；
图7为本申请实施例二的沉默终端的有效信息的时序图；
图8为本申请实施例二的异常终端的识别方法的基本流程示意图；
图9为本申请实施例四提供的分析装置基本结构示意图；
图10为本申请实施例四提供的分析设备基本结构示意图。
具体实施方式
本申请实施例提供了一种异常终端的识别方法、分析装置及设备、存储介质，主要解决的技术问题是物联网内存在异常终端时，无法准确检测出异常终端，检测效果欠佳的问题。
为了使本申请的目的、技术方案及优点更加清楚明白，下面通过具体实施方式结合附图对本申请实施例作进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
实施例一：
请参见图1，图1所示为异常终端的识别方法的基本流程示意图，其包括但不限于：
S101，采集周期时长内终端的信令消息。
在一些实施例中，通过外探针采集周期时长内终端的信令消息，如图2所示，在物理网的组网中，存在控制面信令信息采集点1和用户面信令信息采集点2，例如，通过在基站(Evolved Node B，简称：eNodeB)和关键控制节点(Mobility Management Entity，简称：MME)之间的S1MME接口的MME侧部署外部探针，进行控制面信令消息的采集；通过在eNodeB和服务网关(Serving GateWay，简称：SGW)之间的S1-U接口的SGW侧，进行用户面信令消息的采集；进而完整的获得周期时长内终端的信令消息。需要理解的是，周期时长可以自由设置，例如，周期时长为七天、周期时长为五天等。
S102、对信令消息进行分布统计，得到第一分布特征值。
在一些实施例中，对信令消息进行分布统计之前还包括：对信令消息进行数据清洗，得到多个有效信息；将每个有效信息做小粒度聚集统计，得到N个粒度的数据；需要理解的是，采集得到的信令消息中包含大量的信息，因此，需要对信令信息中的信息进行清洗、剥离、规整，得到完善的有效信息作为关键指标；例如，对信息中的时间信息、用户信息、终端信息、用户行为信息(例如，接入点名称(Access Point Name，简称：APN))、用户位置信息、关键KPI指标(例如，覆盖类指标、呼叫建立类指标、呼叫保持类指标、移动性管理类指标等)等字段的清洗和规整，进而得到有效信息作为关键指标；然后将有效信息(即关键指标)分别做小粒度聚集统计，例如，对终端的控制面信令类型、信令数做小时粒度的聚集统计；例如，对终端的上行流量、下行流量、传输时长等有效信息做小时粒度的聚集统计，得到N 个有效信息对应的N个粒度的数据。
在一些实施例中，对信令信息进行分布统计，得到第一分布特征值包括：对每个粒度的数据进行分布统计，得到每个粒度的数据对应的第一分布特征值；需要理解的是，物联网终端受网络、环境、人的行为等外在因素的影响，各物联网终端在没有故障的情况下，各有效信息的时序分布呈现区间内波动的特性，如图3所示，若使用各有效信息的均值来作为有效信息的唯一衡量标准会丢失很多有效信息的细节特征，如图4所示，进而导致无法准确检测出异常终端，检测效果欠佳；因此为了能够更加准确的通过信令信息中的有效信息对异常终端进行识别，采用单指标(单个有效信息)高维展开的分析方法来对异常终端进行识别。
在一些实施例中，对每个粒度的数据进行分布统计，得到每个粒度的数据对应的第一分布特征值包括：通过指数滑动变化率公式计算得到N个粒度的数据中第i个粒度的数据的指数滑动变化率，将指数滑动变化率作为第i个粒度的数据的第一分布特征值。
指数滑动变化率公式如下：
Figure PCTCN2021110953-appb-000001
其中，a∈(0,1)为变异系数。例如，通过指数滑动变化率来识别有效信息中小毛刺的场景，如图5所示，从而获得有效信息的第一分布特征值。
在一些实施例中，对每个粒度的数据进行分布统计，得到每个粒度的数据对应的第一分布特征值包括：通过对第i-3，i-2，i-1和第i个粒度的数据用最小二乘拟合，计算得到N个粒度的数据中第i个粒度的数据的最小二乘变异系数，将最小二乘变异系数作为第i个粒度的数据的第一分布特征值。需要理解的是，由于实际数据中往往掺杂噪声数据，因此算法同时加入变异系数对噪声进行屏蔽。变异系数消除了量纲，使算法具有通用性。在对物联网终端的有效信息进行异常分析时提升了准确度。
窗口window的变异系数定义为：
Figure PCTCN2021110953-appb-000002
在一些实施例中，对每个粒度的数据进行分布统计，得到每个粒度的数据对应的第一分布特征值包括：通过总变差公式计算得到N个粒度的数据中第i个粒度的数据的总变差变异系数，将总变差变异系数作为第i个粒度的数据的第一分布特征值。
总变差变公式如下：
Figure PCTCN2021110953-appb-000003
其中，
Figure PCTCN2021110953-appb-000004
例如，通过该总变差变异系数来监测识别物联网中终端有效信息的瞬间异常波动。
S103、当第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定终端为异常终端。
在一些实施例当中，将当前周期采集的各有效信息的第一分布特征值分别与上一周期采集的各有效信息的分布特征值作为比较，当第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定终端为异常终端，需要理解的是，其中预设阈值可以根据各有效参数的第 一分布特征值去确定。
需要理解的是，上述对每个粒度的数据进行分布统计，得到每个粒度的数据对应的第一分布特征值的各种方法可以组合使用，从而提升物联网内异常终端的识别率。
在一些实施例中，该方法还包括：将第一分布特征值与同类终端的分布特征值进行统计，得到分布统计数据；根据分布统计数据判断终端是否为异常终端；需要理解的是，将第一分布特征值与同类终端的分布特征值进行统计，得到分布统计数据之前还包括：通过信令信息，对终端类别进行识别，确定终端类别。
在一些实施例中，通过信令信息中的特征业务，对终端类别进行识别，确定终端类别，例如，通过终端的号段、访问的APN等关键业务特征，对该终端的物联网行业及物联网企业进行识别，以此对该物联网终端进行分类，确定终端类别。
需要理解的是，同一物联网行业终端的行为具有一致性特征，也即，其有效信息的分布具有一致性特征，包括控制面行为及用户面行为；当个别终端出现异常时，该终端的有效信息(关键指标)与行业内其他终端会呈现出显著性差异；在一些实施例中，通过将第一分布特征值与同类终端的分布特征值进行统计，得到分布统计数据，如图6所示；然后根据分布统计数据判断终端是否为异常终端；例如，在进行异常高频终端识别时，根据分布统计数据进行特征提取，在特征提取过程中，使用离散傅里叶变换提取主频率做为关键特征指标，设为离散序列，则离散傅里叶变换公式为：
Figure PCTCN2021110953-appb-000005
对变换后的序列求解信令上报的主频率作为频率特征，此外增加控制面信令数和业务上报流量作为辅助特征进行离散点求解，从而对相同行业内的异常高频终端进行识别，对控制面信令异常高频终端及用户面信令异常高频用户均做了识别；也即，对于关键指标异常终端，通过二度展开模块的二维展开结果，求解二维展开后矩阵的分布特征，通过对整体分布的离散点进行识别对关键指标异常的终端进行标记。
本申请实施例提供的异常终端的识别方法，通过采集周期时长内终端的信令信息；对信令信息进行分布统计，得到第一分布特征值；当第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定终端为异常终端；本实施例提出的异常终端的识别方法基于终端历史数据进行异常检测，通过将信令消息进行展开，实现自动自异常检测，避免了相关技术中，使用指标均值进行异常检测，异常检测不准确的问题，提高了异常终端检测的准确度；在一些可选实施例中，通过将第一分布特征值与同类终端的分布特征值进行统计，得到分布统计数据；根据分布统计数据判断终端是否为异常终端；将第一分布特征值在此进行统计，也即对信令信息进行高纬展开，从而对异常终端进行识别，进而提高了异常终端的检测速度，同时提高了异常终端检测的准确度；同时，本实施例提出的异常终端的识别方法对终端没有功能升级要求，不需要改变原物联网的架构，支持不同物联网行业异常终端的识别，进而降低了异常终端识别成本。
实施例二：
为了更好的理解本申请，本实施例提供一种更为具体的示例，对上述的异常终端的识别方法进行说明，当物联网中存在沉默终端(异常终端)，该沉默终端控制面信令信息交互正常，用户面信令信息仅存在保持基本心跳消息的流量，确没有触发该行业的业务上报，如图7所 示，图7为该沉默终端的有效信息的时序图，可以理解的是，物联网内终端的有效信息指标都有一个基线值，即“非毛刺”的地方该有效信息的指标并不是零，需要理解的是，不同的终端，该基线值是由差异的，因此无法简单通过有效信息的指标门限对沉默终端进行判定。如图8所示，该异常终端的识别方法包括但不限于：
S701、终端信令采集。
在一些实施例中，通过在eNodeB和SGW之间的S1-U接口SGW侧，进行用户面信令消息的采集，获得周期时长内用户面终端的信令信息。
S702、指标清洗。
在一些实施例中，将采集到的信令信息中清洗用户信息得到有效信息作为关键指标，例如，包括：流量、时长等关键指标信息；例如，终端信息，包括终端信号、品牌等关键信息；终端访问的APN；终端的位置等信息。
S703、物联网行业识别。
在一些实施例中，通过用户的号段、访问的APN等关键业务特征，对该用户的物联网行业及物联网企业进行识别，从而确定该终端的行业。需要理解的是，该步骤的执行顺序不受限制，在步骤S702之后，步骤S707之前即可。
S704、指标统计。
在一些实施例中，清洗信令信息后得到的关键指标做小时粒度的指标统计；例如，对终端维度的上行流量、下行流量、传输时长等关键指标做小时粒度聚集。
S705、指标一维展开，一维特征提取。
在一些实施例中，指标一维展开，一维特征提取，得到第一分布特征值；例如：对终端的关键指标进行小时粒度的窗口周期为7天的时序维度展开，得到每个粒度的数据对应的第一分布特征值；需要理解的是，得到每个粒度的数据对应的第一分布特征值与上述实施例中的方法一致，在此不再赘述。
S706、异常终端识别。
在一些实施例当中，将终端，当第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定终端为异常终端，需要理解的是，其中预设阈值可以根据各有效参数的第一分布特征值去确定。
需要理解的是，在一些实施例中，该方法还包括了：
S707、指标二维展开，二维特征提取。
在一些实施例中，将终端的指标与同类终端的二维指标进行展开，得到分布统计数据，然后，对指标进行离散快速傅里叶变换，将终端的时序特征转换为频域特征，计算离散快速傅里叶变换后序列的均方差。
S708、异常终端识别。
在一些实施例中，通过对单个终端的指标傅里叶变换后的均方差进行聚类，聚类后的终端分组类别根据均值进行排序，获取均值最小分组的门限。对于的终端进行过滤，并标记为沉默用户，若当前终端属于的终端，则将当前终端标记为沉默终端(异常终端)。
实施例三：
为了更好的理解本申请，本实施例提供一种更为具体的示例，对上述的异常终端的识别方法进行说明，物联网由于行业内具有终端行为一致性特征，因此控制面的信令行为也存分 布特征一致性。在物联网中，由于存在多小区覆盖问题，信令流程与基站(NodeB，简称：NB)相比会存在切换流程，但相同物联网组网或相同行业内，其行为在信令波动范围内仍存在一致性。由于物联网终端的行为一致性，加上终端数远高于人网，因此信令异常高频就极易引发网络信令风暴及网络拥塞。因此控制面信令异常高频终端识别有很高的价值。该异常终端的识别方法包括但不限于:
步骤一、终端信令采集。
在一些实施例中，通过在eNodeB和MME之间的S1MME接口的MME侧部署外部探针，进行控制面信令消息的采集。
步骤二、指标清洗。
在一些实施例中，将采集到的信令信息中清洗用户信息得到有效信息作为关键指标，例如，包括：流量、时长等关键指标信息；例如，终端信息，包括终端信号、品牌等关键信息；关键指标，包括附着请求次数、附着失败次数、去附着请求次数、去附着失败次数、跟踪区更新请求次数、跟踪区更新失败次数、业务请求次数、业务请求失败次数、S1切换请求次数、S1切换请求失败次数、X2切换请求次数、X2请求失败次数、寻呼请求次数、寻呼失败次数、专用承载激活请求次数、专用承载激活失败次数、承载修改请求次数、承载修改失败次数、承载去激活请求次数、承载去激活失败次数等关键信令指标。
步骤三、物联网行业识别。
在一些实施例中，通过用户的号段、访问的APN等关键业务特征，对该用户的物联网行业及物联网企业进行识别，从而确定该终端的行业。需要理解的是，该步骤的执行顺序不受限制，在步骤二之后，步骤七之前即可。
步骤四、指标统计。
在一些实施例中，清洗信令信息后得到的关键指标做小时粒度的指标统计；例如，对终端维度各信令的请求次数和失败次数指标做小时粒度聚集。
步骤五、指标一维展开，一维特征提取。
在一些实施例中，指标一维展开，一维特征提取，得到第一分布特征值；例如，对终端的关键指标进行小时粒度的窗口周期为7天的时序维度展开，得到每个粒度的数据对应的第一分布特征值；需要理解的是，得到每个粒度的数据对应的第一分布特征值与上述实施例中的方法一致，在此不再赘述。
步骤六、异常终端识别。
在一些实施例当中，将终端，当第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定终端为异常终端，需要理解的是，其中预设阈值可以根据各有效参数的第一分布特征值去确定。
需要理解的是，在一些实施例中，该方法还包括了：
步骤七、指标二维展开。
在一些实施例中，将终端的指标与同类终端的二维指标进行展开，得到分布统计数据。
步骤八、二维特征提取、异常终端识别。
对二次展开后的矩阵进行分布特征提取，最终选择二次分布的四分之三分位数及中值两个指标进行聚类。聚类后根据组内均值进获取分布门限，对于中值和均值均高于该门限的终端最终标识为控制面信令异常高频终端，若当前终端的中值和均值均高于该门限则将当前终 端标识为控制面信令异常高频终端。
实施例四：
本实施例提供了一种分析装置，如图9所示，该分析装置包括：
采集模块，采集模块用于采集周期时长内终端的信令信息。
特征构建模块，特征构建模块用于对信令信息进行分布统计，得到第一分布特征值。
异常检测模块，异常检测模块用于当第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定终端为异常终端。
需要理解的是，本申请通过在物联网组网外增加分析装置进行物联网异常终端识别，无需改造物联网组网内终端和总体架构，对物联网组网没有变动需求，功能泛化可同时覆盖物联网所有行业，因此极大程度的降低了监测成本、缩短了功能上线周期，在实现了物联网内全行业异常终端监测的同时，大幅提升物联网网络运维的效率。
本实施例还提供了一种分析设备，参见图10所示，其包括处理器901、存储器902及通信总线903，其中：
通信总线903用于实现处理器901和存储器902之间的连接通信。
处理器901用于执行存储器902中存储的一个或者多个计算机程序，以实现上述实施例一、实施例二和实施例三中的异常终端的识别方法中的至少一个步骤。
本实施例还提供了一种计算机可读存储介质，该计算机可读存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、计算机程序模块或其他数据)的任何方法或技术中实施的易失性或非易失性、可移除或不可移除的介质。计算机可读存储介质包括但不限于RAM(Random Access Memory，随机存取存储器),ROM(Read-Only Memory，只读存储器),EEPROM(Electrically Erasable Programmable read only memory，带电可擦可编程只读存储器)、闪存或其他存储器技术、CD-ROM(Compact Disc Read-Only Memory，光盘只读存储器)，数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。
本实施例中的计算机可读存储介质可用于存储一个或者多个计算机程序，其存储的一个或者多个计算机程序可被处理器执行，以实现上述实施例一、实施例二和实施例三中的异常终端的识别方法中的至少一个步骤。
可见，本领域的技术人员应该明白，上文中所公开方法中的全部或某些步骤、***、装置中的功能模块/单元可以被实施为软件(可以用计算装置可执行的计算机程序代码来实现)、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。
此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、计算机程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。所以，本申请不限制于任何特定的硬件和软件结合。
以上内容是结合具体的实施方式对本申请实施例所作的进一步详细说明，不能认定本申请的具体实施只局限于这些说明。对于本申请所属技术领域的普通技术人员来说，在不脱离 本申请构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本申请的保护范围。

Claims (10)

  1. 一种异常终端的识别方法，包括：
    采集周期时长内终端的信令信息；
    对所述信令信息进行分布统计，得到第一分布特征值；
    当所述第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定所述终端为异常终端。
  2. 如权利要求1所述的异常终端的识别方法，其中，所述对所述信令信息进行分布统计之前还包括：
    对所述信令信息进行数据清洗，得到多个有效信息；
    将每个所述有效信息做小粒度聚集统计，得到N个粒度的数据；
    将清洗后的所述信令信息做小粒度计数统计，得到N个粒度的数据，将所述N个粒度的数据作为用于进行分布统计的信令信息；
    所述对所述信令信息进行分布统计，得到第一分布特征值，包括：
    对每个粒度的数据进行分布统计，得到每个粒度的数据对应的第一分布特征值。
  3. 如权利要求2所述的异常终端的识别方法，其中，所述对每个粒度的数据进行分布统计，得到每个粒度的数据对应的第一分布特征值包括：
    通过指数滑动变化率公式计算得到所述N个粒度的数据中第i个粒度的数据的指数滑动变化率，将所述指数滑动变化率作为第i个粒度的数据的第一分布特征值；
    所述指数滑动变化率公式如下：
    Figure PCTCN2021110953-appb-100001
    其中，a∈(0,1)为变异系数。
  4. 如权利要求2所述的物联网中异常终端的识别方法，其中，所述对每个粒度的数据进行分布统计，得到每个粒度的数据对应的第一分布特征值，包括：
    通过对第i-3，i-2，i-1和第i个粒度的数据用最小二乘拟合，计算得到所述N个粒度的数据中第i个粒度的数据的最小二乘变异系数，将所述最小二乘变异系数作为第i个粒度的数据的第一分布特征值。
  5. 如权利要求2所述的异常终端的识别方法，其中，所述对每个粒度的数据进行分布统计，得到每个粒度的数据对应的第一分布特征值，包括：
    通过总变差公式计算得到所述N个粒度的数据中第i个粒度的数据的总变差变异系数，将所述总变差变异系数作为第i个粒度的数据的第一分布特征值；
    所述总变差变公式如下：
    Figure PCTCN2021110953-appb-100002
    其中，
    Figure PCTCN2021110953-appb-100003
  6. 如权利要求1-5任一项所述的异常终端的识别方法，其中，所述方法还包括：
    将所述第一分布特征值与同类终端的分布特征值进行统计，得到分布统计数据；
    根据所述分布统计数据判断所述终端是否为异常终端。
  7. 如权利要求6所述的异常终端的识别方法，其中，在所述将所述第一分布特征值与同类终端的分布特征值进行统计，得到分布统计数据之前，还包括：
    通过所述信令信息，对所述终端类别进行识别，确定所述终端类别。
  8. 一种分析装置，所述分析装置包括：
    采集模块，所述采集模块用于采集周期时长内终端的信令信息；
    特征构建模块，所述特征构建模块用于对所述信令信息进行分布统计，得到第一分布特征值；
    异常检测模块，所述异常检测模块用于当所述第一分布特征值与历史分布特征值的差异值大于预设阈值时，判定所述终端为异常终端。
  9. 一种分析设备，所述分析设备包括处理器、存储器及通信总线；
    所述通信总线用于实现处理器和存储器之间的连接通信；
    所述处理器用于执行存储器中存储的一个或者多个计算机程序，以实现如权利要求1至7中任一项所述的异常终端的识别方法的步骤。
  10. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有一个或者多个计算机程序，所述一个或者多个计算机程序可被一个或者多个处理器执行，以实现如权利要求1至7中任一项所述的异常终端的识别方法的步骤。
PCT/CN2021/110953 2020-09-16 2021-08-05 异常终端的识别方法、分析装置及设备、存储介质 WO2022057501A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010972425.4 2020-09-16
CN202010972425.4A CN114268567A (zh) 2020-09-16 2020-09-16 异常终端的识别方法、分析装置及设备、存储介质

Publications (1)

Publication Number Publication Date
WO2022057501A1 true WO2022057501A1 (zh) 2022-03-24

Family

ID=80777514

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/110953 WO2022057501A1 (zh) 2020-09-16 2021-08-05 异常终端的识别方法、分析装置及设备、存储介质

Country Status (2)

Country Link
CN (1) CN114268567A (zh)
WO (1) WO2022057501A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115545241A (zh) * 2022-11-25 2022-12-30 北京志翔科技股份有限公司 充电桩状态识别方法、装置、电子设备及存储介质
CN115801561A (zh) * 2022-12-27 2023-03-14 中国联合网络通信集团有限公司 物联网故障处理方法、装置、设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012083716A1 (zh) * 2010-12-21 2012-06-28 中兴通讯股份有限公司 一种移动通讯设备故障的检测方法及***
CN110198288A (zh) * 2018-02-27 2019-09-03 中兴通讯股份有限公司 一种异常节点的处理方法及设备
CN110505196A (zh) * 2019-07-02 2019-11-26 中国联合网络通信集团有限公司 物联网卡异常检测方法及装置
CN110719302A (zh) * 2019-12-12 2020-01-21 武汉绿色网络信息服务有限责任公司 一种物联网信令风暴攻击检测的方法及装置
CN110856188A (zh) * 2018-08-20 2020-02-28 中国电信股份有限公司 通信方法、装置、***和计算机可读存储介质
CN111030876A (zh) * 2019-12-25 2020-04-17 武汉绿色网络信息服务有限责任公司 一种基于DPI的NB-IoT终端故障定位方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012083716A1 (zh) * 2010-12-21 2012-06-28 中兴通讯股份有限公司 一种移动通讯设备故障的检测方法及***
CN110198288A (zh) * 2018-02-27 2019-09-03 中兴通讯股份有限公司 一种异常节点的处理方法及设备
CN110856188A (zh) * 2018-08-20 2020-02-28 中国电信股份有限公司 通信方法、装置、***和计算机可读存储介质
CN110505196A (zh) * 2019-07-02 2019-11-26 中国联合网络通信集团有限公司 物联网卡异常检测方法及装置
CN110719302A (zh) * 2019-12-12 2020-01-21 武汉绿色网络信息服务有限责任公司 一种物联网信令风暴攻击检测的方法及装置
CN111030876A (zh) * 2019-12-25 2020-04-17 武汉绿色网络信息服务有限责任公司 一种基于DPI的NB-IoT终端故障定位方法和装置

Also Published As

Publication number Publication date
CN114268567A (zh) 2022-04-01

Similar Documents

Publication Publication Date Title
US9544800B2 (en) Adaptive monitoring for cellular networks
WO2022057501A1 (zh) 异常终端的识别方法、分析装置及设备、存储介质
US9015312B2 (en) Network management system and method for identifying and accessing quality of service issues within a communications network
US20180285320A1 (en) User-level kqi anomaly detection using markov chain model
WO2022028120A1 (zh) 指标检测模型获取及故障定位方法、装置、设备及存储介质
CN109120463B (zh) 流量预测方法及装置
WO2019057363A1 (en) APPARATUS AND METHOD FOR PREDICTING RARE FAILURES
US20230281071A1 (en) Using User Equipment Data Clusters and Spatial Temporal Graphs of Abnormalities for Root Cause Analysis
US20170153936A1 (en) Root-cause identification system and method for identifying root-cause of issues of software applications
WO2022019728A1 (en) Method and system for dynamic threshold detection for key performance indicators in communication networks
CN115038088B (zh) 一种智能网络安全检测预警***和方法
CN113518057A (zh) 分布式拒绝服务攻击的检测方法、装置及其计算机设备
CN112702219B (zh) 物联网网络监测方法、装置、设备及存储介质
CN109963292B (zh) 投诉预测的方法、装置、电子设备和存储介质
KR20180130295A (ko) 통신망의 장애를 예측하는 장치 및 방법
CN112751722B (zh) 数据传输质量监控方法和***
US20160360433A1 (en) Technique for Counting Objects in a Telecommunications Network
CN112867051A (zh) 用于基于对等统计的故障检测的***和方法
CN110120883B (zh) 一种评估网络性能的方法、装置和计算机可读存储介质
WO2021008393A1 (zh) 一种无线小区的覆盖黑洞识别方法及***
CN115333917A (zh) 一种cdn异常检测方法及装置
CN112148508A (zh) 一种信息处理的方法及相关装置
WO2022121513A1 (zh) 性能指标至差值的生成方法、装置、电子设备及存储介质
CN111385814A (zh) 小区网络负荷的评估方法、装置、设备及介质
WO2023084282A1 (en) Network analytics system with data loss detection

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 02/08/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21868330

Country of ref document: EP

Kind code of ref document: A1