Search

EP-4539413-B1 - METHOD FOR RESOLVING ERRORS IN A COMMUNICATION SYSTEM

EP4539413B1EP 4539413 B1EP4539413 B1EP 4539413B1EP-4539413-B1

Inventors

  • RIEMER, JOACHIM
  • SIENEL, JUERGEN
  • GARG, SEEMA
  • KHAN, Manzoor

Dates

Publication Date
20260513
Application Date
20241008

Claims (15)

  1. An apparatus (500) comprising: means for providing (500) a reference set (504) of multi-protocol message flows carried out in a first communication system, wherein said reference set comprises a plurality of reference multi-protocol message flows having various high-level message flow scenarios, wherein said high-level message flow scenarios correspond to communication services; means for obtaining (500) a first message flow carried out in the first or a second communication system; means for extracting (512) protocol-specific messages from said first message flow; means for identifying (512) the protocol-specific messages of the first message flow based on protocol-specific features in said messages; means for correlating (518c) the protocol-specific messages of the first message flow into a first message flow sequence; means for matching (534) the first message flow sequence to at least one reference multi-protocol message flow of said reference set; and means for determining, in response to detecting a deviation between the first message flow sequence and said at least one reference multi-protocol message flow, the first message flow sequence as being potentially faulty.
  2. The apparatus according to claim 1, wherein said means for extracting protocol-specific messages from said first message flow comprises means for decoding (512a) protocol-specific messages by a corresponding protocol-specific decoder; means for determining (512b) fields of the protocol-specific messages usable for identifying message flow sequences, and means for providing (512c) said fields with associated tags.
  3. The apparatus according to claim 2, wherein a part of the identified fields are usable as cross-protocol tags.
  4. The apparatus according to claim 2 or 3, wherein said means for correlating the protocol-specific messages of the first message flow into the first message flow sequence comprises means for matching the protocol-specific messages of different protocols based on the tags; and means for arranging (518a) the protocol-specific messages of different protocols into the first message flow sequence based on a time stamp and/or a sequence number of each protocol-specific message.
  5. The apparatus according to any preceding claim, comprising means for determining (532) a high-level message flow scenario for the first message flow sequence; and means for matching (534) the first message flow sequence to at least one reference multi-protocol message flow of said reference set having corresponding high-level message flow scenario.
  6. The apparatus according to claim 5, wherein said means for determining the high-level message flow scenario for the first message flow sequence comprises means for arranging the first message flow sequence into a structured data frame; and means for supplementing the structured data frame with fields associating different messages to the same message flow.
  7. The apparatus according to any preceding claim, wherein said means for matching the first message flow sequence to at least one reference multi-protocol message flow of said reference set comprises means for searching a reference multi-protocol message flow in said reference set, providing a minimum measure of similarity to the first message flow sequence, by comparing string distances between the first message flow sequence with one or more reference multi-protocol message flows of said reference set, the reference multi-protocol message flow providing the minimum string distance being matched to the first message flow sequence.
  8. The apparatus according to any preceding claim, comprising means for collecting a set of files from one or more network interfaces between a plurality of network elements of the communication system, wherein said set of files comprise packets of multi-protocol message flows; and means for obtaining said first message flow from said set of files.
  9. The apparatus according to claim 8, comprising means for obtaining a plurality of message flows from said set of files; means for correlating protocol-specific messages of the plurality of message flows into a plurality of message flow sequences; and means for identifying a plurality of network elements of the communication system involved in said plurality of message flow sequences.
  10. The apparatus according to claim 9, comprising means for identifying roles of plurality of network elements of the communication system involved in said plurality of message flow sequences.
  11. The apparatus according to any preceding claim, comprising means for adding the first message flow sequence into the reference set of multi-protocol message flows.
  12. A method comprising: providing (400) a reference set of multi-protocol message flows carried out in a first communication system, wherein said reference set comprises a plurality of reference multi-protocol message flows for various high-level message flow scenarios, wherein said high-level message flow scenarios correspond to communication services; obtaining (402) a first message flow carried out in the first or a second communication system; extracting (404) protocol-specific messages from said first message flow; identifying (406) the protocol-specific messages of the first message flow based on protocol-specific features in said messages; correlating (408) the protocol-specific messages of the first message flow into a first message flow sequence; matching (410) the first message flow sequence to at least one reference multi-protocol message flow of said reference set; and determining (412), in response to detecting a deviation between the first message flow sequence and said at least one reference message flow, the first message flow sequence as being potentially faulty.
  13. The method according to claim 12, wherein said extracting protocol-specific messages from said first message flow comprises decoding protocol-specific messages by a corresponding protocol-specific decoder; determining fields of the protocol-specific messages usable for identifying message flow sequences, and providing said fields with associated tags.
  14. The method according to claim 13, wherein a part of the identified fields are usable as cross-protocol tags.
  15. The method according to claim 13 or 14, wherein said correlating (408) the protocol-specific messages of the first message flow into the first message flow sequence comprises matching the protocol-specific messages of different protocols based on the tags; and arranging the protocol-specific messages of different protocols into the first message flow sequence based on a time stamp and/or a sequence number of each protocol-specific message.

Description

TECHNICAL FIELD The present invention relates to resolving error situations in communication systems. BACKGROUND Communication flow, i.e. call/message flow, in a communication network, such as in 5G network, is always prone to errors. The communication networks are provided with network monitoring systems, which enable a user (a.k.a. operator) of the network monitoring system to detect various error situations in the network and carry out corrective measures. In modern communication networks, the call/message flow across the various parts and network elements of the network typically takes place using several protocols on the path of the call/message flow. However, the concurrent network monitoring systems are typically only able to trace packets inside a single protocol flow, or in some cases within a fixed hierarchy of protocols having the same key to match messages of the protocols. This becomes problematic especially in a situation, where a randomly occurring or a sporadic error happens in a message flow, especially if it happens in a message flow involving a plurality of protocols, i.e. in a so-called multi-protocol message flow. Sporadic errors are poorly detected by statistical methods, and the concurrent network monitoring systems are not able to trace errors across multiple protocols and correlate them to the same call flows. US patent US8209756 B1 relates to an intrusion detection and prevention device that monitors network traffic and integrates textual and non-textual pattern matching with protocol-specific anomaly detection to identify sophisticated attack behaviors. Document by Finsterbush et al, entitled 'A survey of Payload-based Traffic Classification Approaches", published in IEEE Communications Surveys & Tutorials, in April 2014, discloses a survey for evaluating known open-source Deep Packet Inspection (DPI) traffic classification solutions. SUMMARY Now, improved methods and technical equipment implementing the methods have been invented, by which the above problems are alleviated. Various aspects include a system, multiple apparatus and non-transitory computer readable media comprising a computer program, or a signal stored therein, which are characterized by what is stated in the independent claims. Various details of the embodiments are disclosed in the dependent claims and in the corresponding images and description. The scope of protection sought for various embodiments of the invention is set out by the independent claims. BRIEF DESCRIPTION OF THE DRAWINGS For a more complete understanding of the example embodiments, reference is now made to the following descriptions taken in connection with the accompanying drawings in which: Fig. 1 illustrates a high-level architecture of a 5G/6G network;Fig. 2 illustrates an exemplifying architecture of a 5G/6G generation network;Fig. 3 shows an IMS network in an illustrative embodiment;Fig. 4 shows a flow chart of a method according to an embodiment;Fig. 5 shows a logical architecture of an apparatus according to an embodiment;Figs. 6a - 6e show exemplifying UI presentations of a network monitoring system according to an embodiment;Fig. 7 illustrates different user/network element interfaces along a possible call/message flow; andFig. 8 shows a block chart of an apparatus according to an embodiment. DETAILED DESCRIPTON OF SOME EXAMPLE EMBODIMENTS The following describes in further detail suitable apparatus and possible mechanisms for resolving error situations in a communication network. Before discussing the present embodiments in more detailed manner, a short reference to related technology is given. Figure 1 illustrates a high-level architecture of a 5G/6G network 100 as described in the Third Generation Partnership Project (3GPP) TR 23.799 (v14.0.0). Next generation network 100 includes a next generation (Next-Gen) core network 102, and a next generation access network and/or radio access network ((R)AN) 104. (R)AN 104 may support Evolved-UMTS Terrestrial Radio Access Network (E-UTRAN) access, Wireless Local Area Network (WLAN) access, fixed access, satellite radio access, new Radio Access Technologies (RAT), etc. Core network 102 interconnects (R)AN 104 with a data network (DN) 106. Data network 106 may be an operator external public or private data network, or an intra-operator data network (e.g., for IMS services). Next generation User Equipment (UE) 108 is configured to attach to (R)AN 104 to access services from core network 102. Figure 2 illustrates a non-roaming architecture 200 of a 5G/6G generation network. The architecture in FIG. 2 is a reference point representation, as is further described in 3GPP TS 23.501 (v1.5.0). Architecture 200 is comprised of Network Functions (NF) for core network 102, which may be implemented either as a network element on dedicated hardware, as a software instance running on dedicated hardware, or as a virtualized function instantiated on an appropriate platform (e.g., a cloud infrastructure). The ne