TWI802413B - Electronic device and method of detecting abnormal equipment in telecommunication network - Google Patents

Abstract

An electronic device and a method of detecting an abnormal equipment in a telecommunication network are provided. The method includes: obtaining a signaling set, wherein each signaling of the signaling set corresponds to the same response code and equipment type; determining at least one feature according to the response code and the equipment type and obtaining at least one feature vector corresponding to the at least one feature according to the signaling set; dividing the signaling set into a plurality of clusters according to the at least one feature vector, wherein the plurality of clusters includes a first cluster; and obtaining a first abnormal equipment corresponding to the first cluster, adding the first equipment to a abnormal equipment list, and outputting the abnormal equipment list in response to determining that the response code corresponds to a abnormal response code.

Description

Electronic device and method for detecting abnormal communication equipment in telecommunication network

The invention relates to an electronic device and method for detecting abnormal communication equipment in a telecommunication network.

With the development and evolution of telecommunication networks and the increase of various value-added services, the network architecture has become increasingly complex, and network equipment and components have also increased. Various network protocols are intricate and complex, making it difficult for humans to identify and track network obstacles. In response to this, artificial intelligence technology is gradually being introduced to solve network obstacles. Current research mainly collects telecommunications network information in the whole area, and uses artificial intelligence to analyze the network status, so as to improve the speed of obstacle detection and identification accuracy.

Currently common network obstacle detection methods can be divided into device status detection methods and signaling packet detection methods. The device status detection method can detect network anomalies by analyzing the resource usage status or device performance of the device, but this method can only detect abnormalities after the functional abnormality of the device has lasted for a period of time. Device status detection The detection method can analyze network anomaly data according to important characteristic values of device status, but this method requires experts to select important characteristic values for different network environments, and needs to manually label abnormal data to train more accurate error detection test model. Therefore, this method not only needs a lot of time and manpower, but also cannot detect unknown abnormal obstacles.

The signaling packet detection method can analyze the packets sent by the device to detect faults, but this method still has to rely on manual labor to identify the root cause of abnormal faults in signaling tags, and requires complete communication records as analysis data. Therefore, the efficiency of the signaling packet detection method for anomaly detection is not ideal.

It can be seen that the above-mentioned customary method still has many deficiencies, which is not a good design and needs to be improved urgently.

The invention provides an electronic device and method for detecting abnormal communication equipment in a telecommunication network, which can detect suddenly abnormal communication equipment and degraded communication equipment.

An electronic device for detecting abnormal communication equipment in a telecommunication network of the present invention includes a transceiver, a storage medium and a processor. The storage medium stores multiple modules. The processor is coupled to the storage medium and the transceiver, and accesses and executes multiple modules, wherein the multiple modules include a signaling extraction module, a feature extraction module, a grouping module, and a grouping aggregation module. The signaling extraction module receives the data stream from the telecommunication network through the transceiver, and obtains a signaling set from the data stream, wherein each of the signaling sets corresponds to Same response code and device type. The feature extraction module determines at least one feature according to the response code and the device type, and obtains at least one feature vector corresponding to the at least one feature according to the signaling set. The grouping module divides the signaling set into multiple groups according to at least one feature vector, wherein the multiple groups include the first group. In response to judging that the response code corresponds to the abnormal response code, the grouping and converging module obtains the first abnormal device corresponding to the first group, and adds the first abnormal device to the abnormal device list, wherein the grouping and converging module outputs the abnormality through the transceiver Device List.

In an embodiment of the present invention, the above-mentioned grouping and aggregation module obtains the second abnormal devices corresponding to the outliers of a plurality of groups in response to judging that the response code corresponds to the normal response code, and adds the second abnormal device to the abnormal device list.

In an embodiment of the present invention, the above-mentioned first abnormal device corresponds to the first abnormal signaling in the first group, and the first abnormal signaling is the closest to the first abnormal signaling among the plurality of abnormal signaling in the first group. Abnormal signaling of a group of hearts.

In an embodiment of the present invention, the above grouping and gathering module determines that the second abnormal device corresponds to an outlier according to the interquartile range of one of the plurality of groups and the feature value corresponding to the second abnormal device.

In an embodiment of the present invention, the above-mentioned feature extraction module performs normalization on the eigenvalues of the signaling in the signaling set, and uses principal component analysis on the signaling set to generate at least one feature vector.

In an embodiment of the present invention, the above grouping module determines the number of groups according to one of the following: contour method and elbow method.

In one embodiment of the present invention, the above grouping module is based on the following One of them divides the signaling set into multiple groups: K-means method, K-medoid method, hierarchical grouping method, and density grouping method.

In an embodiment of the present invention, the aforementioned modules further include an impact analysis module. The impact analysis module responds to the match between the first device corresponding to the first time point in the abnormal device list and the second device corresponding to the second time point, and generates an abnormal device topology diagram according to the first time point and the second time point, The abnormal device topology graph indicates the time axis when the first device is abnormal.

In an embodiment of the present invention, the aforementioned modules further include an impact analysis module. The impact analysis module receives a device connection configuration through the transceiver, wherein the impact analysis module generates an exception based on the first device and the second device in response to the abnormal device list including the first device and the device connection configuration indicating that the first device is coupled to the second device A device topology diagram, wherein the abnormal device topology diagram indicates that the second device is coupled to the first device.

A method for detecting abnormal communication equipment in a telecommunication network of the present invention includes: receiving a data flow from the telecommunication network, and obtaining a signaling set from the data flow, wherein each of the signaling sets corresponds to the same response code and device type; determine at least one feature according to the response code and device type, and obtain at least one feature vector corresponding to at least one feature according to the signaling set; divide the signaling set into multiple groups according to the at least one feature vector, wherein The plurality of groups includes a first group; and in response to judging that the response code corresponds to an abnormal response code, obtaining a first abnormal device corresponding to the first group, adding the first abnormal device to the abnormal device list, and outputting the abnormal device list.

Based on the above, the present invention can detect sporadic differences of communication equipment in a telecommunication network. Often with sudden disorder. The present invention can regularly collect signaling data of communication equipment, and perform filtering and classification through data preprocessing to generate vectorized signaling feature structures. The present invention can extract signaling features by principal component analysis, and calculate the group centers and outliers of multiple communication equipment groups through the clustering method, so as to quickly detect abnormal network equipment and analyze the impact of the equipment The scope and time of abnormal occurrence, so as to provide a list of abnormal equipment for reference of network management personnel, accelerate the interpretation of obstacles and provide follow-up event statistics and analysis applications.

100: Electronic device

110: Processor

120: storage media

121:Signaling acquisition module

122: Feature extraction module

123: Grouping module

124: Grouping collection module

125: Impact Analysis Module

130: Transceiver

601, 602, 603, 604, 605: Equipment

S201, S202, S301, S302, S401, S402, S501, S502, S503, S504, S505, S506, S701, S702, S703, S704: steps

FIG. 1 shows a schematic diagram of an electronic device for detecting abnormal communication equipment in a telecommunication network according to an embodiment of the present invention.

FIG. 2 shows a flow chart of collecting signaling data in a telecommunication network by a signaling retrieval module according to an embodiment of the present invention.

FIG. 3 shows a flow chart of obtaining feature vectors by the feature extraction module according to an embodiment of the present invention.

FIG. 4 shows a flow chart of generating multiple groups by the grouping module according to an embodiment of the present invention.

FIG. 5 shows a flow chart of generating an abnormal device list by the clustering module according to an embodiment of the present invention.

FIG. 6 shows a schematic diagram of abnormal device topology according to an embodiment of the present invention.

FIG. 7 illustrates a method for detecting anomalies in a telecommunication network according to an embodiment of the present invention A flowchart of a method for a communication device.

In order to make the content of the present invention more comprehensible, the following specific embodiments are taken as examples in which the present invention can actually be implemented. In addition, wherever possible, elements/components/steps using the same reference numerals in the drawings and embodiments represent the same or similar parts.

FIG. 1 shows a schematic diagram of an electronic device 100 for detecting abnormal communication equipment in a telecommunication network according to an embodiment of the present invention. The electronic device 100 may include a processor 110 , a storage medium 120 and a transceiver 130 .

The processor 110 is, for example, a central processing unit (central processing unit, CPU), or other programmable general purpose or special purpose micro control unit (micro control unit, MCU), microprocessor (microprocessor), digital signal processing Digital Signal Processor (DSP), Programmable Controller, Application Specific Integrated Circuit (ASIC), Graphics Processing Unit (GPU), Image Signal Processor (ISP) ), image processing unit (image processing unit, IPU), arithmetic logic unit (arithmetic logic unit, ALU), complex programmable logic device (complex programmable logic device, CPLD), field programmable logic gate array (field programmable gate array , FPGA) or other similar components or a combination of the above components. The processor 110 can be coupled to the storage medium 120 and the transceiver 130, and access and execute the data stored in the storage medium 120 Multiple mods and various apps.

The storage medium 120 is, for example, any type of fixed or removable random access memory (random access memory, RAM), read-only memory (read-only memory, ROM), flash memory (flash memory) , hard disk drive (hard disk drive, HDD), solid state drive (solid state drive, SSD) or similar components or a combination of the above components, and are used to store multiple modules or various application programs that can be executed by the processor 110 . In this embodiment, the storage medium 120 can store a plurality of modules including a signaling extraction module 121, a feature extraction module 122, a grouping module 123, a grouping collection module 124, and an impact analysis module 125. Will be explained later.

The transceiver 130 transmits and receives signals in a wireless or wired manner. The transceiver 130 may also perform operations such as low noise amplification, impedance matching, frequency mixing, up or down frequency conversion, filtering, amplification, and the like.

FIG. 2 shows a flow chart of collecting signaling data in the telecommunication network by the signaling retrieval module 121 according to an embodiment of the present invention. In step S201 , the signaling capture module 121 can access the telecommunication network through the transceiver 130 and receive data streams from the telecommunication network. The data flow may include signaling transmitted between communication devices in a telecommunication network, such as a next generation network (NGN) voice device, but the invention is not limited thereto. In one embodiment, the signaling may include an Internet protocol corresponding to the session initiation protocol (SIP), Diameter protocol, Megaco protocol, or the Telephone Number Mapping (ENUM) domain name system (DNS) protocol. Internet protocol (Internet protocol) packets. exist In one embodiment, the signaling may include protocols corresponding to ISDN user part (ISDN user part), intelligent network application protocol (intelligent network application protocol, INAP), mobile application part (mobile application part, MAP) protocol or open SS7 (signaling system NO.7) signaling of the multimedia application platform (open multimedia application platform, OMAP) protocol.

In one embodiment, the electronic device 100 may include multiple signaling capture modules 121 and transceivers 130 . A plurality of signaling capture modules 121 can be deployed in different areas of the telecommunication network, so as to collect signaling covering various areas of the entire telecommunication network. For example, if the telecommunication network is a new generation network (NGN) or an IP multimedia subsystem (IP multimedia subsystem, IMS) network, the signaling retrieval module 121 can retrieve the signal of the IP packet from the telecommunication network order information. If the telecommunication network is a public land mobile network (PLMN) or a public switched telephone network (PSTN), the signaling retrieval module 121 can retrieve the SS7 signal from the telecommunication network. make.

In one embodiment, the signaling capture module 121 can receive data streams according to a preset period. The preset period is, for example, a time interval of 10 seconds, 15 seconds or 1 hour. The signaling extraction module 121 can sort the signalings according to the timestamps of the signalings in the data stream, and store the sorted signalings in the storage medium 120 .

In step S202, the signaling retrieval module 121 can obtain a signaling set from the data stream. Each signaling in the signaling set may come from different communication devices. Each signaling in the signaling set may correspond to the same response code type and device type. Signaling can include frame number, frame size, time stamp, IP address of source device, destination Feature information such as the IP address of the device, response time, UA number 1, UA number 2, request method (eg OPTIONS, REGISTER or INVITE) or response code.

In one embodiment, the storage medium 120 may pre-store a lookup table including the mapping relationship between the IP address of the source device and the device type. The signaling retrieval module 121 can determine the device type corresponding to the signaling according to the lookup table and the IP address of the source device in the signaling. For example, suppose the lookup table records that the IP address "192.168.100.1" corresponds to the device type "NGN voice device". If the signaling captured by the signaling capture module 121 includes the IP address "192.168.100.1" of the source device, the signaling capture module 121 can judge that the captured signaling corresponds to the device type according to the lookup table "NGN voice equipment".

In an embodiment, the storage medium 120 may pre-store a lookup table including the mapping relationship between response codes and response code types. The signaling retrieval module 121 can determine the response code type corresponding to the signaling according to the lookup table and the response code in the signaling. Taking the signaling of the SIP protocol as an example, assume that the response code "1xx" recorded in the lookup table corresponds to the response code type "normal response code". If the signaling retrieved by the signaling retrieval module 121 includes the response code "1xx", the signaling retrieval module 121 can determine according to the lookup table that the retrieved signaling corresponds to the response code type "normal response code". .

In one embodiment, the signaling retrieval module 121 can filter the signaling according to the characteristic information of the signaling. For example, the signaling retrieval module 121 can determine whether to filter the signaling according to whether the signaling contains a response code. If a signaling includes a response code, the signaling retrieval module 121 can retain the signaling to generate a signaling set. If a signaling does not contain a response code, the signaling retrieval module 121 may discard the signaling. That is, each of the signaling sets Each signaling contains a response code.

Taking the SIP protocol as an example, the response codes 1xx, 2xx, 3xx, 401, 480, 486, 487, 488, 600 or 606 (x is any one of integers 1-9) can be classified by the signaling capture module 121 is the normal response code. Other response codes except the above response codes, such as response codes 400, 502 or 603, can be classified as abnormal response codes by the signaling retrieval module 121 .

FIG. 3 shows a flow chart of obtaining feature vectors by the feature extraction module 122 according to an embodiment of the present invention. The feature extraction module 122 can determine at least one feature according to the response code and the device type, and obtain at least one feature vector corresponding to the at least one feature according to the signaling set. Specifically, in step S301, the feature extraction module 122 can standardize the feature values of the signaling in the signaling set to generate a standardized signaling set, wherein the feature values can be associated with frame number, signal N types of characteristics such as frame size, timestamp, IP address of source device, IP address of destination device, response time, UA number 1, UA number 2, request method or response code, among which N is a positive integer.

In one embodiment, the feature extraction module 122 can standardize the signaling set according to methods such as Z-score standardization or Min-Max normalization.

In step S302, the feature extraction module 122 can perform principal component analysis on the standardized signaling set to generate at least one feature vector, wherein at least one feature can include a feature vector corresponding to the first principal component and a feature vector corresponding to the second principal component. The eigenvectors of the components, ..., the first p principal components such as the eigenvector corresponding to the p-th principal component, where p is a positive integer less than or equal to N, and p can be user-defined. feature extraction The module 122 can reduce the amount of data of the characteristics of the signaling set by retaining only part of the principal components of the signaling set, so as to reduce the computational complexity.

FIG. 4 shows a flow chart of generating multiple groups by the grouping module 123 according to an embodiment of the present invention. The grouping module 123 can divide the multiple signalings in the signaling set into K groups according to at least one eigenvector, where K is a positive integer. Specifically, in step S401, the grouping module 123 determines the K value representing the number of groups. The grouping module 123 can determine the most suitable K value for the signaling set according to the silhouette method or the elbow method.

In step S402, the grouping module 123 may divide the signaling set into K groups according to at least one feature vector based on a grouping algorithm. The clustering algorithm may include K-means, K-medoids, hierarchical clustering or DBSCANS.

For example, assuming that the signaling set includes M signalings (M is a positive integer), each of the at least one eigenvector may include M eigenvalues respectively corresponding to the M signalings. The grouping module 123 can divide the M signaling into K groups according to the M eigenvalues of each eigenvector in the at least one eigenvector. Each of the K groups may include at least one signaling.

FIG. 5 shows a flow chart of generating an abnormal device list by the grouping and gathering module 124 according to an embodiment of the present invention. In step S501 , the grouping and gathering module 124 can obtain K groups from the grouping module 123 .

In step S502, the group aggregation module 124 can determine whether the K groups correspond to abnormal response codes. If K groups correspond to abnormal response codes, enter the step S503. If the K groups do not correspond to abnormal response codes (that is, the K groups correspond to normal response codes), go to step S504. Since each signaling in the signaling set generated in step S202 corresponds to the same response code, the grouping and converging module 124 can determine whether the K groups correspond to Exception response code.

In step S503, the grouping and gathering module 124 can obtain K abnormal devices respectively corresponding to the K groups according to the signaling aggregation. Taking the first group among the K groups as an example, since the response code of each signaling in the first group is an abnormal response code, it means that an unexpected event may occur in the telecommunications network and cause the The source device in each signaling is abnormal. Accordingly, the grouping and gathering module 124 can obtain the abnormal equipment that can represent the emergency according to the first group for the user's reference. Specifically, the grouping and gathering module 124 can obtain the cluster center of the first group, and select the abnormal signaling closest to the cluster center from the first group. After obtaining the abnormal command closest to the group center, the clustering module 124 can obtain the abnormal device representing the first group according to the information of the source device in the abnormal command. Based on similar steps, the grouping and gathering module 124 can obtain abnormal devices representing other groups in the K groups except the first group. Finally, the grouping and gathering module 124 can obtain K abnormal devices respectively corresponding to the K groups.

In step S504 , the cluster collection module 124 can obtain abnormal devices corresponding to outliers in K groups according to the signaling set. Since the response codes of each signaling in the K groups are normal response codes, it means that most of the source devices of these signalings should be normal, and only a small number of devices may be damaged due to factors such as equipment degradation. Sporadic abnormalities occur, and the signaling transmitted by these sporadic abnormal devices may become outliers of K groups. Accordingly, the grouping and gathering module 124 obtains the outliers in the K groups as abnormal signaling, and obtains the corresponding abnormal device according to the information of the source device of the abnormal signaling.

In one embodiment, the grouping and gathering module 124 can obtain the outliers of the K groups based on the grouping algorithm. In one embodiment, the clustering module 124 can determine whether the signaling is an outlier according to the interquartile range (IQR) of one of the K groups and the characteristic value of the signaling, and then Determine whether the source device of the signaling is an abnormal device. Taking the second group among the K groups as an example, each signaling in the second group may include a characteristic value corresponding to the characteristic "response time". If the second group contains X signalings (X is a positive integer), the grouping and gathering module 124 can select the first quartile Q1 and the third quartile from the X eigenvalues respectively corresponding to the X signalings. Quantile Q3, and the threshold T of response time can be calculated according to equation (1). If the eigenvalue representing the "response time" of a signaling is greater than the threshold T, the cluster aggregation module 124 may determine that the signaling is an outlier of the second group. If the eigenvalue representing the "response time" of a signaling is less than or equal to the threshold T, the cluster aggregation module 124 may determine that the signaling is not an outlier of the second group.

In step S505, the clustering module 124 may add the abnormal device (ie: the abnormal device generated by step S503 or step S504) to the abnormal device list.

In step S506 , the grouping and gathering module 124 can output a list of abnormal devices through the transceiver 130 for user's reference.

The impact analysis module 125 can generate an abnormal device topology according to the abnormal device list, and output the abnormal device topology through the transceiver 130 for user's reference. FIG. 6 shows a schematic diagram of abnormal device topology according to an embodiment of the present invention. In one embodiment, the impact analysis module 125 may respond to the first device corresponding to the first time point in the device list matching the second device corresponding to the second time point, according to the first time point and the second time point A topological graph of the abnormal equipment is generated, wherein the topological graph of the abnormal equipment may indicate a time axis when the first equipment is abnormal.

Taking the device 601 and the device 602 in FIG. 6 as an example, it is assumed that the abnormal device list includes the device 601 and the device 602 . The impact analysis module 125 can obtain the signaling corresponding to the device 601 from the signaling set according to the abnormal device list, wherein the signaling can include the time stamp "t-2" and the IP address "192.168.100.1" of the source device. The impact analysis module 125 can also obtain the signaling corresponding to the device 602 from the signaling set according to the list of abnormal devices, wherein the signaling can include the time stamp "t-1" and the IP address "192.168.100.1" of the source device . Since the device 601 and the device 602 correspond to the same IP address "192.168.100.1" of the source device. Accordingly, the impact analysis module 125 can determine that the device 601 matches the device 602 . The impact analysis module 125 can generate the abnormal device topology map 600 according to the timestamp "t-1" and the timestamp "t-2" in response to the device 601 matching the device 602, wherein the abnormal device topology map 600 can indicate the device 601 (or device 602 ) the time axis of abnormal occurrence, as shown in FIG. 6 .

Taking the device 602 and the device 603 in FIG. 6 as an example, it is assumed that the abnormal device list includes the device 602 and the device 603 . The impact analysis module 125 can obtain the signaling corresponding to the device 602 from the signaling set according to the abnormal device list, wherein the signaling can include time Timestamp "t-1" and IP address "192.168.100.1" of the source device. The impact analysis module 125 can also obtain the signaling corresponding to the device 603 from the signaling set according to the abnormal device list, wherein the signaling can include a time stamp "t" and an IP address "192.168.100.1" of the source device. Since the device 602 and the device 603 correspond to the same IP address "192.168.100.1" of the source device. Accordingly, the impact analysis module 125 can determine that the device 602 matches the device 603 . The impact analysis module 125 can generate the abnormal device topology map 600 according to the timestamp "t" and the timestamp "t-1" in response to the device 602 matching with the device 603, wherein the abnormal device topology map 600 can indicate the device 602 (or Device 603) abnormal time axis, as shown in Figure 6.

In one embodiment, the impact analysis module 125 can receive the device connection configuration through the transceiver 130 . The impact analysis module 125 may generate an abnormal device topology map according to the first device and the second device in response to the abnormal device list including the first device and the device connection configuration indicating that the first device is coupled to the second device, wherein the abnormal device topology map The second device may be indicated to be mutually coupled to the first device.

Taking the device 602 and the device 604 in FIG. 6 as an example, the impact analysis module 125 can receive the device connection configuration through the transceiver 130 . Assume that the exception device list includes device 602 , and the device connection configuration indicates that device 602 is coupled to device 604 . The impact analysis module 125 can obtain the signaling corresponding to the device 602 from the signaling set, and obtain the IP address "192.168.100.1" of the source device from the signaling. The impact analysis module 125 can also obtain the signaling corresponding to the device 604 from the signaling set, and obtain the IP address "192.168.100.2" of the source device from the signaling. In response to device 602 matching the IP address of device 604, impact analysis module 125 may 604 generates an abnormal device topology 600 , wherein the abnormal device topology 600 may indicate that the device 602 and the device 604 are coupled to each other.

Taking the device 603 and device 605 in FIG. 6 as an example, the impact analysis module 125 can receive the device connection configuration through the transceiver 130 . Assume that the abnormal device list includes device 603 , and the device connection configuration indicates that device 603 is coupled to device 605 . The impact analysis module 125 can obtain the signaling corresponding to the device 603 from the signaling set, and obtain the IP address "192.168.100.1" of the source device from the signaling. The impact analysis module 125 can also obtain the signaling corresponding to the device 605 from the signaling set, and obtain the IP address "192.168.100.2" of the source device from the signaling. In response to the IP addresses of device 603 and device 605 matching, impact analysis module 125 may generate abnormal device topology map 600 according to device 603 and device 605, wherein abnormal device topology map 600 may indicate that device 603 and device 605 are coupled to each other .

FIG. 7 shows a flow chart of a method for detecting abnormal communication equipment in a telecommunication network according to an embodiment of the present invention, wherein the method can be implemented by the electronic device shown in FIG. 1 . In step S701, a data stream is received from a telecommunication network, and a signaling set is obtained from the data stream, wherein each of the signaling sets corresponds to the same response code and device type. In step S702, at least one feature is determined according to the response code and the device type, and at least one feature vector corresponding to the at least one feature is obtained according to the signaling set. In step S703, the signaling set is divided into multiple groups according to at least one feature vector, wherein the multiple groups include the first group. In step S704, in response to judging that the response code corresponds to the abnormal response code, obtain the first abnormal device corresponding to the first group, add the first abnormal device to the abnormal device list, and output the abnormal device list surface.

To sum up, the present invention can provide communication equipment (such as: voice equipment) abnormal obstacle detection and analysis of its impact range and time by capturing the packets or signaling of the telecommunication network, through data processing and group analysis, and assisting Network maintenance personnel find out the root cause of abnormal obstacles. Compared with other conventional technologies, it has the following benefits and advantages: the present invention can adopt the signaling feature extraction method of principal component analysis, and can be compatible with various voice communication protocols. Compared with traditional expert rules, it does not need to adapt to different networks Individually adjust the judgment conditions for each component, provide the versatility of the obstacle detection system, and reduce the burden on maintenance personnel. The present invention can provide abnormal obstacle event tracking after an abnormal state occurs, including the scope of influence caused by the obstacle and its time history, improve the accuracy of obstacle diagnosis by maintenance personnel, and shorten the time for troubleshooting.

S701, S702, S703, S704: steps

Claims (10)

An electronic device for detecting abnormal communication equipment in a telecommunication network, comprising: transceiver; a storage medium for storing multiple modules; and a processor, coupled to the storage medium and the transceiver, and accessing and executing the multiple modules, wherein the multiple modules include: a signaling retrieval module for receiving a data stream from the telecommunications network via the transceiver, and obtaining a signaling set from the data stream, wherein each of the signaling sets corresponds to the same Response code and device type; The feature extraction module determines at least one feature according to the response code and the device type, and obtains at least one feature vector corresponding to the at least one feature according to the signaling set; a grouping module, which divides the signaling set into multiple groups according to the at least one feature vector, wherein the multiple groups include a first group; and The grouping and gathering module, in response to judging that the response code corresponds to an abnormal response code, obtains a first abnormal device corresponding to the first group, and adds the first abnormal device to an abnormal device list, wherein the The grouping and gathering module outputs the list of abnormal devices through the transceiver. The electronic device as claimed in claim 1, wherein the cluster aggregation module obtains second abnormal devices corresponding to the outliers of the plurality of groups in response to determining that the response code corresponds to a normal response code, and adding the second abnormal device to the abnormal device list. The electronic device according to claim 1, wherein the first abnormal device corresponds to the first abnormal signaling in the first group, and the first abnormal signaling is multiple The abnormal signaling closest to the group center of the first group among the abnormal signaling. The electronic device according to claim 2, wherein the grouping and gathering module judges the second Anomalous devices correspond to the outliers. The electronic device according to claim 1, wherein the feature extraction module performs normalization on the feature values of the signaling in the signaling set, and uses principal component analysis on the signaling set to generate the at least one Feature vector. The electronic device as claimed in claim 1, wherein the grouping module determines the number of the plurality of groups according to one of the following: contour method and elbow method. The electronic device according to claim 1, wherein the grouping module divides the signaling set into the plurality of groups according to one of the following: K-means method, K-centroid method, hierarchical grouping method and density clustering. The electronic device as claimed in item 1, wherein the plurality of modules further include: The impact analysis module, in response to the first device corresponding to the first time point in the abnormal device list matching the second device corresponding to the second time point, according to the first time point and the second time point An abnormal equipment topology diagram is generated, wherein the abnormal equipment topology diagram indicates a time axis when the first equipment is abnormal. The electronic device as claimed in item 1, wherein the plurality of modules further include: an impact analysis module, receiving a device connection configuration through the transceiver, wherein The impact analysis module generates an abnormal device according to the first device and the second device in response to the abnormal device list including the first device and the device connection configuration indicating that the first device is coupled to the second device A topology diagram, wherein the abnormal device topology diagram indicates that the second device is coupled to the first device. A method for detecting abnormal communication equipment in a telecommunications network, comprising: receiving a data stream from the telecommunications network, and obtaining a signaling set from the data stream, wherein each of the signaling sets corresponds to the same response code and device type; determining at least one feature according to the response code and the device type, and obtaining at least one feature vector corresponding to the at least one feature according to the signaling set; dividing the signaling set into a plurality of groups according to the at least one eigenvector, wherein the plurality of groups includes a first group; and Responsive to judging that the response code corresponds to an abnormal response code, obtaining a first abnormal device corresponding to the first group, adding the first abnormal device to an abnormal device list, and outputting the abnormal device list.

Images