CN117354418B - A method, device and storage medium for monitoring call behavior - Google Patents
A method, device and storage medium for monitoring call behavior Download PDFInfo
- Publication number
- CN117354418B CN117354418B CN202311283319.5A CN202311283319A CN117354418B CN 117354418 B CN117354418 B CN 117354418B CN 202311283319 A CN202311283319 A CN 202311283319A CN 117354418 B CN117354418 B CN 117354418B
- Authority
- CN
- China
- Prior art keywords
- call
- dimension
- monitoring
- indicator
- target
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 101
- 238000000034 method Methods 0.000 title claims abstract description 43
- 230000011664 signaling Effects 0.000 claims abstract description 59
- 238000004458 analytical method Methods 0.000 claims abstract description 48
- 230000004044 response Effects 0.000 claims abstract description 21
- 230000000977 initiatory effect Effects 0.000 claims abstract description 15
- 238000010219 correlation analysis Methods 0.000 claims abstract description 4
- 230000006399 behavior Effects 0.000 claims description 40
- 238000012806 monitoring device Methods 0.000 claims description 8
- 230000001186 cumulative effect Effects 0.000 claims description 4
- 238000007619 statistical method Methods 0.000 abstract description 10
- 238000004891 communication Methods 0.000 abstract description 5
- 238000005516 engineering process Methods 0.000 abstract description 2
- 239000010410 layer Substances 0.000 description 20
- 238000004422 calculation algorithm Methods 0.000 description 15
- 230000006870 function Effects 0.000 description 9
- 238000012545 processing Methods 0.000 description 9
- 239000000284 extract Substances 0.000 description 6
- 238000012098 association analyses Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 5
- 230000003287 optical effect Effects 0.000 description 5
- 230000008569 process Effects 0.000 description 4
- 238000003491 array Methods 0.000 description 3
- 239000012792 core layer Substances 0.000 description 3
- 238000012163 sequencing technique Methods 0.000 description 3
- 230000002776 aggregation Effects 0.000 description 2
- 238000004220 aggregation Methods 0.000 description 2
- 239000000463 material Substances 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 238000010223 real-time analysis Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000004590 computer program Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M3/00—Automatic or semi-automatic exchanges
- H04M3/22—Arrangements for supervision, monitoring or testing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M3/00—Automatic or semi-automatic exchanges
- H04M3/22—Arrangements for supervision, monitoring or testing
- H04M3/2281—Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
Landscapes
- Engineering & Computer Science (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Technology Law (AREA)
- Telephonic Communication Services (AREA)
Abstract
本发明提出一种呼叫行为监测方法、装置及存储介质，涉及通讯技术领域。其中，方法包括：对监测到的会话初始协议SIP信令提取各次呼叫的呼叫信息，以生成相应呼叫的话单，其中，话单中的呼叫信息包括多个维度；根据各次呼叫的话单，分别在多个维度统计涉及的话单集合；基于各维度的话单集合，采用各维度配置的监控指标进行指标分析，以得到各维度对应监控指标的指标值；根据各维度对应监控指标的指标值，进行告警。通过在不同维度对话单进行分类统计分析，可以根据分析结果按需拉取，解决多维关联分析难的问题；同时通过分析拉取指标数量，均衡分配接口返回响应结果，降低单接口压力，缩短响应时延，提高实时性。
The present invention proposes a call behavior monitoring method, device and storage medium, which relate to the field of communication technology. The method includes: extracting the call information of each call from the monitored Session Initiation Protocol SIP signaling to generate a call list of the corresponding call, wherein the call information in the call list includes multiple dimensions; according to the call list of each call, respectively counting the involved call list sets in multiple dimensions; based on the call list sets of each dimension, using the monitoring indicators configured in each dimension to perform indicator analysis to obtain the indicator value of the corresponding monitoring indicator of each dimension; according to the indicator value of the corresponding monitoring indicator of each dimension, an alarm is issued. By performing classified statistical analysis on the call list in different dimensions, it is possible to pull on demand according to the analysis results, solving the problem of difficult multi-dimensional correlation analysis; at the same time, by analyzing the number of pulled indicators, the response results returned by the interface are evenly distributed, the pressure on the single interface is reduced, the response delay is shortened, and the real-time performance is improved.
Description
Technical Field
The present invention relates to the field of communications technologies, and in particular, to a method and apparatus for monitoring call behavior, and a storage medium.
Background
Along with the mass scale of mobile communication service, the complexity of user behavior and the diversification of application scenes, the method has great significance for monitoring a large amount of complex data and for the stability, reliability and safety of a communication system.
Two general monitoring systems are commonly used in the prior art, one is based on a relational database for statistical analysis, and the real-time performance of the statistical analysis is poor; the other is based on the time sequence type database for statistical analysis, the time sequence type database is not in charge of structure and association, only single index monitoring inquiry and displaying of some time sequence trend can be completed, and call behavior aggregation analysis of different industries in different areas under a complex scene multi-dimensional association analysis, such as tens of millions of number scene, cannot be well processed.
Accordingly, currently mainstream monitoring systems each have disadvantages in terms of monitoring of large amounts of complex data.
Disclosure of Invention
The present invention aims to solve at least one of the technical problems in the related art to some extent.
Therefore, a first object of the present invention is to provide a call behavior monitoring method to realize efficient real-time analysis of a large data volume ticket.
A second object of the present invention is to provide a call behavior monitoring device.
A third object of the present invention is to propose another call behavior monitoring device.
A fourth object of the present invention is to propose a non-transitory computer readable storage medium.
To achieve the above object, an embodiment of a first aspect of the present invention provides a call behavior monitoring method, including:
Extracting call information of each call from the monitored Session Initiation Protocol (SIP) signaling to generate a ticket of the corresponding call, wherein the call information in the ticket comprises a plurality of dimensions;
counting the related ticket sets in the plurality of dimensions according to the ticket of each call;
performing index analysis by adopting monitoring indexes configured in each dimension based on the ticket set in each dimension to obtain index values of the monitoring indexes corresponding to each dimension;
And alarming according to the index value of the corresponding monitoring index of each dimension.
To achieve the above object, an embodiment of a second aspect of the present invention provides a call behavior monitoring device, including:
the generation module is used for extracting call information of each call for the monitored Session Initiation Protocol (SIP) signaling to generate a call ticket of the corresponding call, wherein the call information in the call ticket comprises a plurality of dimensions;
the statistics module is used for counting the related ticket sets in the plurality of dimensions respectively according to the ticket of each call;
The analysis module is used for carrying out index analysis by adopting the monitoring indexes configured in each dimension based on the ticket set in each dimension so as to obtain index values of the monitoring indexes corresponding to each dimension;
and the alarm module is used for alarming according to the index value of the corresponding monitoring index of each dimension.
In order to achieve the above object, an embodiment of a third aspect of the present invention provides an electronic device, including: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to execute the instructions to implement a call behavior monitoring method as proposed by the embodiment of the first aspect of the present invention.
In order to achieve the above object, an embodiment of a fourth aspect of the present invention proposes a computer readable storage medium, which when executed by a processor of an electronic device, enables the electronic device to perform a call behavior monitoring method as proposed by the embodiment of the first aspect of the present invention.
The invention at least has the following beneficial effects:
The invention provides a call behavior monitoring method, which extracts call information of each call for a monitored Session Initiation Protocol (SIP) signaling to generate a call ticket of the corresponding call, wherein the call information in the call ticket comprises a plurality of dimensions; according to the call ticket of each call, counting the related call ticket sets in a plurality of dimensions respectively; performing index analysis by adopting monitoring indexes configured in each dimension based on the ticket set in each dimension to obtain index values of the monitoring indexes corresponding to each dimension; and alarming according to the index value of the corresponding monitoring index of each dimension. The dialogue sheets with different dimensions are classified and counted, so that the dialogue sheets can be pulled according to analysis results as required, and the problem that multidimensional association analysis is difficult is solved; meanwhile, by analyzing the number of the pull indexes, the response results are returned by the balanced distribution interfaces, the pressure of a single interface is reduced, the response time delay is shortened, and the instantaneity is improved.
Additional aspects and advantages of the invention will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the invention.
Drawings
The foregoing and/or additional aspects and advantages of the invention will become apparent and readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings, in which:
fig. 1 is a flow chart of a call behavior monitoring method according to an embodiment of the present invention;
fig. 2 is a flowchart of another call behavior monitoring method according to an embodiment of the present invention;
FIG. 3 is a diagram of an analysis index classification provided by an embodiment of the present invention;
fig. 4 is a schematic structural diagram of a call behavior monitoring device according to an embodiment of the present invention;
fig. 5 is a block diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to like or similar elements or elements having like or similar functions throughout. The embodiments described below by referring to the drawings are illustrative and intended to explain the present invention and should not be construed as limiting the invention.
A call behavior monitoring method and apparatus according to embodiments of the present invention are described below with reference to the accompanying drawings.
Fig. 1 is a flow chart of a call behavior monitoring method according to an embodiment of the present invention.
The monitoring system for statistical analysis based on the relational database can carry out statistical analysis through structured query language (Structured Query Language, abbreviated as SQL) after putting the communication ticket in storage, and two problems can occur here: firstly, the statistical analysis real-time performance is poor, secondly, the relational database faces to a scene of concurrent call with tens of millions of numbers, the disk input/output is difficult to bear tens of thousands of SQL writing requests, and the problems of deadlock and the like easily occur to the query of high concurrent associated data, so that the reading and writing performance is reduced. The real-time processing of the big data by the relational database is realized by creating an index, and the convenience is not enough.
The monitoring system based on the time sequence type database for statistical analysis stores time sequence data, can well solve the problem of real-time processing of big data, but has no responsible structure and association, can only complete single index monitoring inquiry and display some time sequence trends, and can not well process call behavior aggregation analysis of different areas and different industries in complex scenes, such as tens of millions of number scenes. Therefore, the time-series database does not perform well for multidimensional correlation analysis of large data.
Aiming at the problem that the existing monitoring system is poor in monitoring a large amount of complex data, the embodiment of the invention provides a call behavior monitoring method for realizing high-efficiency real-time analysis of a large amount of data ticket, as shown in fig. 1, the method comprises the following steps:
step 101, extracting call information of each call from the monitored session initiation protocol SIP signaling to generate a ticket of the corresponding call, wherein the call information in the ticket includes multiple dimensions.
It should be noted that the session initiation protocol (Session Initiation Protocol, SIP for short) is an application-layer signaling control protocol for creating, modifying, and releasing sessions of one or more participants. These sessions may be web multimedia conferences, web telephony or multimedia distribution.
Alternatively, a monitoring system that performs statistical analysis based on a time-series database may be used to monitor SIP signaling for each call.
Optionally, the call information includes at least one dimension of calling number, intermediate number, called number, intermediate number attribution province, intermediate number attribution city, intermediate number attribution business, and call duration.
In the embodiment of the invention, the call information of each call is extracted through the SIP signaling, the call ticket corresponding to the call is generated based on the call information of each call, and the call behavior characteristics are reflected through the multi-dimensional call information, so that the call behavior can be accurately analyzed.
Step 102, according to the call ticket of each call, counting the related call ticket sets in a plurality of dimensions respectively.
Optionally, the call information of any ticket includes multiple dimensions, and accordingly, any dimension refers to multiple tickets of each call, so that the multiple tickets related to each dimension are counted and form a ticket set to analyze the ticket from each dimension.
And 103, performing index analysis by adopting the monitoring indexes configured in each dimension based on the ticket set in each dimension to obtain index values of the monitoring indexes corresponding to each dimension.
Optionally, the monitoring indexes are configured corresponding to each dimension, are related to the dimension, and perform index analysis by using an index (Metrics) algorithm according to the index definition of each monitoring index to obtain a corresponding index value.
As a possible implementation, in the case where the dimension is the calling number, the corresponding monitoring indicator may be that the "calling number" field is read in the corresponding ticket set. And carrying out index analysis on the monitoring index through a Metrics algorithm to obtain a corresponding index value.
And 104, alarming according to index values of the corresponding monitoring indexes of the dimensions.
In the embodiment of the invention, the calling behavior of the ticket set corresponding to each dimension is reflected by the index value and is used as the analysis basis of the calling behavior.
As a possible implementation manner, the distribution condition is calculated for each index value, and a corresponding threshold value is configured to alarm.
As another possible implementation manner, a corresponding threshold value is set for the index value, and an alarm is given.
In this embodiment, call information of each call is extracted from the monitored session initiation protocol SIP signaling to generate a ticket of the corresponding call, where the call information in the ticket includes multiple dimensions; according to the call ticket of each call, counting the related call ticket sets in a plurality of dimensions respectively; performing index analysis by adopting monitoring indexes configured in each dimension based on the ticket set in each dimension to obtain index values of the monitoring indexes corresponding to each dimension; and alarming according to the index value of the corresponding monitoring index of each dimension. The dialogue sheets with different dimensions are classified and counted, so that the dialogue sheets can be pulled according to analysis results as required, and the problem that multidimensional association analysis is difficult is solved; meanwhile, by analyzing the number of the pull indexes, the response results are returned by the balanced distribution interfaces, the pressure of a single interface is reduced, the response time delay is shortened, and the instantaneity is improved.
In order to clearly illustrate the above embodiment, another call behavior monitoring method is provided in this embodiment, and fig. 2 is a schematic flow chart of another call behavior monitoring method provided in the embodiment of the present invention.
As shown in fig. 2, the method may include the steps of:
step 201, extracting call information of each call for the monitored session initiation protocol SIP signaling to generate a ticket of the corresponding call, wherein the call information in the ticket includes multiple dimensions.
In the embodiment of the invention, a monitoring system which performs statistical analysis based on a time sequence database is utilized to monitor a core network so as to obtain the SIP signaling adopted by each call.
The SIP signaling comprises a first signaling used for initiating a call by the calling terminal and a temporary response used for responding to the first signaling.
In the embodiment of the invention, the calling terminal initiates a first signaling to the called terminal, the first signaling reaches the called terminal through the core network, the called terminal responds to the first signaling and sends a temporary response to the calling terminal, the temporary response is received by the called terminal, and the calling terminal receives the temporary response, wherein the first signaling and the temporary signaling form an SIP signaling.
Further, the called terminal extracts a source domain of the first signaling to obtain a calling number, and extracts a destination domain of the first signaling to obtain an intermediate number; extracting a destination header field of the temporary response to obtain a called number; a ticket for the corresponding call is generated.
The call ticket is used for recording the calling information of the corresponding calling in the dimensions of the calling number, the intermediate number and the called number.
In the embodiment of the invention, the called terminal disassembles the first signaling, extracts the source domain of the first signaling as the calling number, extracts the destination header domain of the first signaling as the intermediate number, disassembles the temporary response, extracts the destination header domain of the temporary response as the called number, records the calling information of the call in the dimensions of the calling number, the intermediate number and the called number, and generates the call ticket of the call.
Further, the SIP signaling may further include a second signaling sent when the called terminal answers the call and a third signaling for ending the call.
In the embodiment of the invention, when the called terminal is connected with a call, a second signaling is sent to a call processing module of the called terminal, the call processing module receives the second signaling, and the call of the calling terminal is executed; and when the called terminal ends the call, sending a third signaling to a call processing module, and executing the call ending after the call processing module receives the third signaling.
Further, determining a start time based on the time at which the second signaling is monitored; determining an end time based on the time at which the third signaling is monitored; and determining the call duration of the corresponding call according to the starting time and the ending time.
In the embodiment of the invention, the call duration can be calculated by the following formula:
t＝tend-tstart
Where t represents a call duration, t start represents a start time, and t end represents an end time.
Note that, in response to not monitoring the second signaling, the call duration t=0.
Further, inquiring enterprise information of the intermediate number registration binding; and adding the attribution province information and the local city information corresponding to the first H codes in the intermediate number as call information of corresponding dimensions into a call ticket of the corresponding call.
As a possible implementation manner, the called terminal invokes the database to inquire enterprise information of the registration binding of the intermediate number, intercepts the first 7H codes in the intermediate number to inquire the attribution province information and the local city information, and adds the corresponding attribution province information and local city information as call information of corresponding dimensionality into a call ticket of a corresponding call.
Step 202, reading the message queue to obtain the target ticket to be processed currently, and attributing the target ticket to the ticket set of the affiliated dimension according to the call information of each dimension in the target ticket every time the target ticket is obtained from the message queue.
Wherein the message queue is used for storing the generated ticket.
As a possible implementation manner, the called terminal encapsulates the calling information, the call duration, the attribution province and the city information of the call in the dimensions of the calling number, the intermediate number and the called number into a ticket in the TXT format, establishes a ticket message sending channel with the message queue, and sends the ticket to the message queue for storage.
In the embodiment of the invention, a ticket analysis module of the called terminal reads the message queue to obtain the target ticket to be processed currently, wherein the ticket analysis module comprises an interface layer, a calculation core layer and a data cache layer. The interface layer input unit sends the target ticket obtained from the message queue to the computational core layer.
Further, each time a target ticket is obtained from the message queue, the computing core layer attributes the target ticket to a ticket set of the affiliated dimension according to call information of each dimension in the target ticket.
As a possible implementation manner, the "province" field is read for each ticket as a dimension, and the target ticket in the same dimension is attributed to the same ticket set.
As a possible implementation manner, the "city" field is read for each ticket as a dimension, and the target ticket in the same dimension is assigned to the same ticket set.
As a possible implementation manner, the "enterprise" field is read for each ticket as a dimension, and the target ticket in the same dimension is assigned to the same ticket set.
As one possible implementation, two fields of "city" and "enterprise" are read for each ticket at the same time as one dimension, and the target ticket in the same dimension is attributed to the same ticket set.
As a possible implementation manner, the "calling number" field is read for each ticket as a dimension, and the target ticket in the same dimension is assigned to the same ticket set.
As a possible implementation manner, the fields of "enterprise" and "called number" are read for each ticket as one dimension, and the target ticket in the same dimension is attributed to the same ticket set.
And 203, performing index analysis by adopting the monitoring indexes configured in each dimension based on the ticket set in each dimension to obtain index values of the monitoring indexes corresponding to each dimension.
In the embodiment of the present invention, the dimensions are divided into dimensions related to calling behavior and dimensions related to number characteristics, and the corresponding index values are divided into calling behavior analysis indexes and number characteristic analysis indexes, as shown in fig. 3. Wherein, the relevant dimension related to the calling behavior comprises province, city and business.
Optionally, a plurality of statistics are periodically obtained for a ticket set of any dimension.
Wherein each statistic includes: the time length accumulated value T of the call time length of each call ticket in the call ticket set, the total number C of the call ticket, the first call ticket number C 0 of the call time length in the short-time call interval and the second call ticket number C 0 of which the call time length is not zero.
In the embodiment of the invention, the short-time conversation interval can be a conversation time length in a [0,6] second interval.
Further, according to the target dimension to which the target ticket belongs, reading an index value with the latest timestamp for the monitoring index in the target dimension, or generating an initial value of the monitoring index in the target dimension; updating the index value according to the target ticket; and storing the updated index value and the current timestamp for the monitoring index in the target dimension.
As a possible implementation manner, reading a "province" field for each ticket, calling a data caching layer of a ticket analysis module to inquire C, C 0、C1 and T four statistical values of a latest timestamp "lab1=corresponding province", and accumulating according to the algorithm on the basis of the cached values; and if the corresponding index value does not exist in the cache layer, calling a defined C, C 0、C1 and T algorithm to calculate four statistical values.
Further, the four latest statistics and the time stamp are stored in the data cache layer according to the data structure of < C+ province name, value >, < C 0 + province name, value >, < C 1 + province name, value >, < T+ province name, value >.
Label is generally used for displaying text or as a "button to use", and the name of the Label object is Label1, which represents the name of the Label class object.
Wherein, the defined C, C 0、C1, T algorithm calculates the statistic value by the following formula:
C＝∑c
C0＝∑c0
C1＝∑t1
T＝∑t
Wherein c represents the statistics of any ticket; c 0 represents the statistics of the call duration of any ticket in the [0,6] second interval; c 1 represents statistics that the call time length of any ticket is greater than 0; t represents the call duration of any ticket.
As a possible implementation manner, reading a field of "city" for each ticket, calling a data caching layer of the ticket analysis module to query C, C 0、C1 and T four statistical values of the latest timestamp "lab1=corresponding city", and accumulating according to the algorithm on the basis of the cached values; and if the corresponding index value does not exist in the cache layer, calling a defined C, C 0、C1 and T algorithm to calculate four statistical values.
Further, the four latest statistics and the time stamp are stored in the data cache layer according to the data structure of < C+ ground city name, value >, < C 0 + ground city name, value >, < C 1 + ground city name, value >, < T+ ground city name, value >.
As a possible implementation manner, reading an enterprise field for each ticket, calling a data caching layer of a ticket analysis module to inquire C, C 0、C1 and T index values of a latest timestamp of lab1=corresponding enterprise, and accumulating according to the algorithm on the basis of the cache values; and if the corresponding index value does not exist in the cache layer, invoking C, C 0、C1 defined by the index definition unit and calculating four basic Metrics by a T algorithm.
Further, the four latest Metrics and the timestamp are stored in the data cache layer according to the data structures of < C+ business name, value >, < C 0 + business name, value >, < C 1 + business name, value >, < T+ business name.
As a possible implementation manner, two fields of "city" and "enterprise" are read for each ticket at the same time, and the data buffer layer of the ticket analysis module is called to query the up-to-date timestamp "lab1=corresponding city and lab2=corresponding enterprise' C, C 0、C1, T four index values, and the index values are accumulated according to the algorithm on the basis of the buffer values; and if the corresponding index value does not exist in the cache layer, invoking C, C 0、C1 defined by the index definition unit and calculating four basic Metrics by a T algorithm.
Further, the data structures of < C+Deshi name+Business name, value >, < C 0 +Deshi name+Business name, value >, < C 1 +Deshi name+Business name, value >, < T+Deshi name+Business name, value > store four latest Metrics and time stamps in the data cache layer.
Further, according to the difference value of each statistic value between the latest period and the preset period, the index values of invalid call rate, call completing rate and average call duration in the monitoring index are determined.
In an embodiment of the present invention, the period may be 1 second.
Wherein, the invalid call rate is the ratio between the difference value of the first call ticket number and the difference value of the total call ticket number; the call completing rate is the ratio between the difference value of the second call ticket number and the difference value of the total number of call tickets; average call duration is the ratio between the difference between the cumulative value of duration and the total number of calls.
Optionally, the ticket analysis module interface layer pulls a uniform resource locator system (uniform resource locator, abbreviated as URL), each controller binds one URL, writes the returned results of the statistics into the URL in TXT format, and exposes the URL to the monitoring system.
Optionally, the monitoring system performs index pulling once every 1 second, the interface layer configuration unit of the ticket analysis module analyzes the URL, connects with the call behavior analysis controller, executes the call behavior analysis index inquiry function, invokes the ticket analysis module data caching layer, returns the index value within 1 minute before the request timestamp pushes, and directly writes the index value into the response body and returns the index value to the monitoring system.
In the embodiment of the invention, the dimension related to the number characteristics comprises enterprise information of calling number, called number and intermediate number registration binding.
Optionally, periodically acquiring the call volume of each calling number based on the call ticket set of each calling number; and periodically acquiring call volume of each combination based on the call ticket set associated with each combination of the called number and the enterprise information.
As a possible implementation manner, the field of the calling number is read for each ticket, an external data caching module is called to inquire the C statistical value of the latest timestamp of lab1=calling number, and the C statistical values are accumulated according to the algorithm on the basis of the cached values; and if the buffer memory module does not have the corresponding calling number index, calling a defined C algorithm to calculate a statistic value.
Further, the latest statistics and time stamps are stored in an external data buffer module according to the < calling number > data structure.
As a possible implementation manner, reading the fields of 'enterprise' and 'called number' for each ticket, calling an external data caching module to query the C statistical value of the latest timestamp 'lab1=enterprise and lab2=called number', and accumulating according to the algorithm on the basis of the cached value; and if the cache module does not have the index of the called number of the corresponding enterprise, calling a defined C algorithm to calculate a statistic value.
Further, according to the < enterprise+called number, the Score > data structure stores the latest statistics and the time stamp in the external data buffer module.
In the embodiment of the invention, each calling number is sequenced according to the call quantity of each calling number; sequencing each combination according to the call volume of each combination; the call volume of calling numbers of the digits before the ordering is used as an index value of the corresponding call volume dimension.
Optionally, the monitoring system performs index pulling once every 1 second, the ticket analysis module interface layer analyzes the URL, connects the number feature analysis controller, executes the number feature analysis index query function, invokes the external data buffer module, and the external data buffer module sorts the current day index < calling number, < Score > and < enterprise+called number, <score >, and returns the previous N call volumes as index values of corresponding call volume dimensions.
By outputting different dimensionalities and analysis results for the monitoring system, real-time association analysis of the large-data-volume telephone bill can be realized.
And 204, alarming according to index values of the corresponding monitoring indexes of the dimensions.
In the embodiment of the invention, the index values of the invalid call rate, the call completing rate and the average call duration in each dimension and the calling number, the enterprise+called number corresponding to the call volume TOP N directly pulled by the call ticket analysis module are displayed, and an alarm threshold is configured for monitoring and alarming.
In this embodiment, call information of each call is extracted from the monitored session initiation protocol SIP signaling to generate a ticket of the corresponding call, where the call information in the ticket includes multiple dimensions; according to the call ticket of each call, counting the related call ticket sets in a plurality of dimensions respectively; performing index analysis by adopting monitoring indexes configured in each dimension based on the ticket set in each dimension to obtain index values of the monitoring indexes corresponding to each dimension; and alarming according to the index value of the corresponding monitoring index of each dimension. The dialogue sheets with different dimensions are classified and counted, so that the dialogue sheets can be pulled according to analysis results as required, and the problem that multidimensional association analysis is difficult is solved; meanwhile, by analyzing the number of the pull indexes, the response results are returned by the balanced distribution interfaces, the pressure of a single interface is reduced, the response time delay is shortened, and the instantaneity is improved.
In order to realize the embodiment, the invention also provides a call behavior monitoring device.
Fig. 4 is a schematic structural diagram of a call behavior monitoring device according to an embodiment of the present invention.
As shown in fig. 4, the call behavior monitoring apparatus 400 includes: a generation module 401, a statistics module 402, an analysis module 403, and an alarm module 404.
A generating module 401, configured to extract call information of each call for the monitored session initiation protocol SIP signaling, so as to generate a ticket of the corresponding call, where the call information in the ticket includes multiple dimensions;
A statistics module 402, configured to respectively count related ticket sets in multiple dimensions according to the ticket of each call;
the analysis module 403 is configured to perform index analysis by using the monitoring indexes configured in each dimension based on the ticket set in each dimension, so as to obtain index values of the monitoring indexes corresponding to each dimension;
And the alarm module 404 is used for alarming according to the index value of the corresponding monitoring index of each dimension.
Further, in a possible implementation manner of the embodiment of the present invention, the generating module 401 is further configured to:
Monitoring a core network to obtain SIP signaling adopted by each call, wherein the SIP signaling comprises a first signaling used by a calling terminal for initiating the call and a temporary response used for responding to the first signaling;
Extracting a source domain of the first signaling to obtain a calling number, and extracting a destination domain of the first signaling to obtain an intermediate number;
extracting a destination header field of the temporary response to obtain a called number;
And generating a ticket of the corresponding call, wherein the ticket is used for recording call information of the corresponding call in the dimensions of the calling number, the intermediate number and the called number.
Inquiring enterprise information of intermediate number registration binding;
and adding the attribution province information and the local city information corresponding to the first H codes in the intermediate number as call information of corresponding dimensions into a call ticket of the corresponding call.
Further, in a possible implementation of the embodiment of the present invention, the analysis module 403 is further configured to:
periodically acquiring a plurality of statistical values for a ticket set of any dimension;
According to the difference value of each statistic value between the latest period and the preset period, determining index values of invalid call rate, call completing rate and average call duration in the monitoring index;
The statistical value comprises a time length accumulated value of the call time length of each call ticket in the call ticket set, the total number of call tickets, a first call ticket number of which the call time length is in a short call interval and a second call ticket number of which the call time length is not zero;
the invalid call rate is the ratio between the difference value of the first call ticket number and the difference value of the total call ticket number;
the call completing rate is the ratio between the difference value of the second call ticket number and the difference value of the total number of call tickets;
average call duration is the ratio between the difference between the cumulative value of duration and the total number of calls.
Determining a start time based on the time at which the second signaling is monitored;
determining an end time based on the time at which the third signaling is monitored;
And determining the call duration of the corresponding call according to the starting time and the ending time.
The dimension comprises enterprise information of calling number, called number and middle number registration binding;
periodically acquiring the call volume of each calling number based on the call ticket set of each calling number;
Periodically acquiring call volume of each combination based on a ticket set associated with each combination of the called number and the enterprise information;
Sequencing each calling number according to the call quantity of each calling number;
sequencing each combination according to the call volume of each combination;
The call volume of calling numbers of the digits before the ordering is used as an index value of the corresponding call volume dimension.
Further, in one possible implementation of the embodiment of the present invention, the statistics module 402 is further configured to:
Reading a message queue to obtain a target ticket to be processed currently, wherein the message queue is used for storing the generated ticket;
And each time the target ticket is acquired from the message queue, attributing the target ticket to the ticket set of the affiliated dimension according to the call information of each dimension in the target ticket.
According to the target dimension of the target ticket, reading an index value with the latest timestamp for the monitoring index in the target dimension, or generating an initial value of the monitoring index in the target dimension;
Updating the index value according to the target ticket;
And storing the updated index value and the current timestamp for the monitoring index in the target dimension.
It should be noted that the foregoing explanation of the embodiment of the call behavior monitoring method is also applicable to the call behavior monitoring device of this embodiment, and will not be repeated herein.
Fig. 5 is a block diagram of an electronic device 500, according to an example embodiment.
As shown in fig. 5, the electronic device 500 includes:
memory 501 and processor 502, bus 503 connecting the different components (including memory 501 and processor 502), memory 501 stores a computer program, and processor 502 implements the call behavior monitoring method of the embodiments of the present invention when executing the program.
Bus 503 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, micro channel architecture (MAC) bus, enhanced ISA bus, video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.
Electronic device 500 typically includes many types of electronic device readable media. Such media can be any available media that is accessible by electronic device 500 and includes both volatile and nonvolatile media, removable and non-removable media.
Memory 501 may also include computer system readable media in the form of volatile memory, such as Random Access Memory (RAM) 504 and/or cache memory 505. Electronic device 500 may further include other removable/non-removable, volatile/nonvolatile computer system storage media. By way of example only, storage system 506 may be used to read from or write to non-removable, nonvolatile magnetic media (not shown in FIG. 5, commonly referred to as a "hard disk drive"). Although not shown in fig. 5, a magnetic disk drive for reading from and writing to a removable non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive for reading from or writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In such cases, each drive may be coupled to bus 503 through one or more data medium interfaces. Memory 501 may include at least one program product having a set (e.g., at least one) of program modules configured to carry out the functions of embodiments of the invention.
A program/utility 508 having a set (at least one) of program modules 507 may be stored in, for example, memory 501, such program modules 507 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each or some combination of which may include an implementation of a network environment. Program modules 507 typically perform the functions and/or methods of the described embodiments of the invention.
The electronic device 500 may also communicate with one or more external devices 509 (e.g., keyboard, pointing device, display 511, etc.), one or more devices that enable a user to interact with the electronic device 500, and/or any devices (e.g., network card, modem, etc.) that enable the electronic device 500 to communicate with one or more other computing devices. Such communication may occur through an input/output (I/O) interface 512. Also, the electronic device 500 may communicate with one or more networks such as a Local Area Network (LAN), a Wide Area Network (WAN) and/or a public network, such as the Internet, through a network adapter 513. As shown in fig. 5, the network adapter 513 communicates with other modules of the electronic device 500 via the bus 503. It should be appreciated that although not shown, other hardware and/or software modules may be used in connection with electronic device 500, including, but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, data backup storage systems, and the like.
The processor 502 executes various functional applications and data processing by running programs stored in the memory 501.
It should be noted that, the implementation process and the technical principle of the electronic device in this embodiment refer to the foregoing explanation of the call behavior monitoring in the embodiment of the present invention, and are not repeated herein.
In order to implement the above embodiment, the present invention also proposes a computer-readable storage medium, which when executed by a processor of an electronic device, enables the electronic device to perform a call behavior monitoring method as described above.
In the description of the present specification, a description referring to terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, the different embodiments or examples described in this specification and the features of the different embodiments or examples may be combined and combined by those skilled in the art without contradiction.
Furthermore, the terms "first," "second," and the like, are used for descriptive purposes only and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first" or "a second" may explicitly or implicitly include at least one such feature. In the description of the present invention, the meaning of "plurality" means at least two, for example, two, three, etc., unless specifically defined otherwise.
Any process or method descriptions in flow charts or otherwise described herein may be understood as representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or steps of the process, and additional implementations are included within the scope of the preferred embodiment of the present invention in which functions may be executed out of order from that shown or discussed, including substantially concurrently or in reverse order from that shown or discussed, depending on the functionality involved, as would be understood by those reasonably skilled in the art of the embodiments of the present invention.
Logic and/or steps represented in the flowcharts or otherwise described herein, e.g., a ordered listing of executable instructions for implementing logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the computer readable medium may even be paper or other suitable medium on which the program is printed, as the program may be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.
It is to be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above-described embodiments, the various steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. As with the other embodiments, if implemented in hardware, may be implemented using any one or combination of the following techniques, as is well known in the art: discrete logic circuits having logic gates for implementing logic functions on data signals, application specific integrated circuits having suitable combinational logic gates, programmable Gate Arrays (PGAs), field Programmable Gate Arrays (FPGAs), and the like.
Those of ordinary skill in the art will appreciate that all or a portion of the steps carried out in the method of the above-described embodiments may be implemented by a program to instruct related hardware, where the program may be stored in a computer readable storage medium, and where the program, when executed, includes one or a combination of the steps of the method embodiments.
In addition, each functional unit in the embodiments of the present invention may be integrated in one processing module, or each unit may exist alone physically, or two or more units may be integrated in one module. The integrated modules may be implemented in hardware or in software functional modules. The integrated modules may also be stored in a computer readable storage medium if implemented in the form of software functional modules and sold or used as a stand-alone product.
The above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, or the like. While embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and not to be construed as limiting the invention, and that variations, modifications, alternatives and variations may be made to the above embodiments by one of ordinary skill in the art within the scope of the invention.
Claims (8)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311283319.5A CN117354418B (en) | 2023-09-28 | 2023-09-28 | A method, device and storage medium for monitoring call behavior |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311283319.5A CN117354418B (en) | 2023-09-28 | 2023-09-28 | A method, device and storage medium for monitoring call behavior |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117354418A CN117354418A (en) | 2024-01-05 |
| CN117354418B true CN117354418B (en) | 2024-10-15 |
Family
ID=89368417
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311283319.5A Active CN117354418B (en) | 2023-09-28 | 2023-09-28 | A method, device and storage medium for monitoring call behavior |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117354418B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105791215A (en) * | 2014-12-22 | 2016-07-20 | 上海粱江通信系统股份有限公司 | Communication network attack detection method based on SIP protocol |
| CN106791220A (en) * | 2016-11-04 | 2017-05-31 | 国家计算机网络与信息安全管理中心 | Prevent the method and system of telephone fraud |
Family Cites Families (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7818195B2 (en) * | 2006-07-06 | 2010-10-19 | International Business Machines Corporation | Method, system and program product for reporting a call level view of a customer interaction with a contact center |
| US8599837B2 (en) * | 2011-11-18 | 2013-12-03 | Verizon Patent And Licensing Inc. | Local identity based on called number |
| CN104573724A (en) * | 2015-01-09 | 2015-04-29 | 安徽清新互联信息科技有限公司 | Method for monitoring call making and receiving behaviors of driver |
| CN106255113A (en) * | 2015-06-10 | 2016-12-21 | 中兴通讯股份有限公司 | The recognition methods of harassing call and device |
| CN108737622A (en) * | 2017-04-14 | 2018-11-02 | 中兴通讯股份有限公司 | Monitoring method of conversing and device |
| CN109818817B (en) * | 2017-11-21 | 2020-12-04 | 中国移动通信集团海南有限公司 | Data transmission time delay analysis method, device, electronic device and storage medium |
| US10554814B1 (en) * | 2018-11-29 | 2020-02-04 | International Business Machines Corporation | Presenting context and relevance of incoming calls |
| CN111918226B (en) * | 2020-07-23 | 2022-01-07 | 广州市申迪计算机系统有限公司 | Real-time signaling-based method and device for analyzing international high-settlement embezzlement behavior |
| CN114067834B (en) * | 2020-07-30 | 2024-08-09 | 中国移动通信集团有限公司 | Bad preamble identification method and device, storage medium and computer equipment |
| CN112437197B (en) * | 2020-10-30 | 2021-06-18 | 中国人民解放军战略支援部队信息工程大学 | A kind of abnormal call detection method and device based on communication behavior information entropy |
-
2023
- 2023-09-28 CN CN202311283319.5A patent/CN117354418B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105791215A (en) * | 2014-12-22 | 2016-07-20 | 上海粱江通信系统股份有限公司 | Communication network attack detection method based on SIP protocol |
| CN106791220A (en) * | 2016-11-04 | 2017-05-31 | 国家计算机网络与信息安全管理中心 | Prevent the method and system of telephone fraud |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117354418A (en) | 2024-01-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105657003B (en) | Information processing method and server | |
| CN114461691B (en) | Control method and device of state machine, electronic equipment and storage medium | |
| CN110764936A (en) | A data collection method and device | |
| US20080005801A1 (en) | Remote session media playback | |
| CN106095923A (en) | A kind of method and system adding data of being on the list in orderly list | |
| CN110531912A (en) | Method for page jump and device | |
| CN112685672A (en) | Method and device for backtracking page session behavior track and electronic equipment | |
| CN117354418B (en) | A method, device and storage medium for monitoring call behavior | |
| CN117093627A (en) | Information mining method, device, electronic equipment and storage medium | |
| WO2023147716A1 (en) | Flow control and billing methods, apparatuses and system, electronic device, medium and product | |
| CN110515750A (en) | Application topology generation method, system and cluster | |
| CN106446289A (en) | Information inquiry method and device based on Pinpoint | |
| CN119202100A (en) | Real-time processing method and device for equipment operation data of Internet of Things | |
| JP5482243B2 (en) | Sequence generation program, sequence generation method, and sequence generation apparatus | |
| CN103282880B (en) | A kind of method for stream processing and device | |
| CN116016288A (en) | Flow monitoring method, device, equipment and storage medium of industrial equipment | |
| CN115408214A (en) | Distributed, time-sequence and high-concurrency performance test tool collection sample calculation method and system | |
| CN114416414A (en) | Fault information positioning method, device, equipment and storage medium | |
| CN114390015A (en) | Data pushing system, method and equipment based on object model and storage medium | |
| US20200257687A1 (en) | Determining session count of unique sessions for requested time periods | |
| CN113873268B (en) | Virtual gift list pushing method, server, live broadcast system and storage medium | |
| CN118484525B (en) | Question-answer interaction method and related device, electronic equipment and storage medium | |
| US20240340478A1 (en) | System and method for detecting and reporting concurrent viewership of online audio-video content | |
| CN118152441B (en) | Real-time matching aggregation report generation algorithm and device under stream processing framework | |
| CN111949876B (en) | Information processing method and device, electronic device and computer readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |