Note: Within nine months of the publication of the mention of the grant of the European patent in the European Patent Bulletin, any person may give notice to the European Patent Office of opposition to that patent, in accordance with the
2 1
69 879
B1
&
(11)
EP 2 169 879 B1
(12)
EUROPEAN PATENT SPECIFICATION
(45) Date of publication and mentionof the grant of the patent:
21.09.2011 Bulletin 2011/38
(21) Application number: 09171477.4 (22) Date of filing: 28.09.2009
(51) Int Cl.:
H04L 12/26(2006.01)
(54) Real-time traffic monitoring in a mobile data network
Echtzeit-Verkehrsüberwachung in einem mobilen Datennetzwerk Surveillance de trafic en temps réel dans un réseau de données mobile (84) Designated Contracting States:
AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO SE SI SK SM TR
(30) Priority: 30.09.2008 FI 20085923 (43) Date of publication of application:
31.03.2010 Bulletin 2010/13
(73) Proprietor: Iptune Oy
00380 Helsinki (FI)
(72) Inventor: Haimi, Vesa
00380, Helsinki (FI)
(74) Representative: Tanskanen, Jarmo Tapio et al
PAPULA OY Mechelininkatu 1 a 00180 Helsinki (FI) (56) References cited: WO-A-03/005244 US-A1- 2003 115 364 US-B1- 7 047 423
5 10 15 20 25 30 35 40 45 50 55 Description
BACKGROUND OF THE INVENTION
Field of the Invention
[0001] The invention relates generally to management
of mobile telecommunications traffic. In particular, the invention relates to methods, computer programs and apparatuses for managing mobile telecommunications packet data service traffic.
Description of the Related Art
[0002] Today, various kinds of traffic measurements
are routinely performed on packet switched telecommu-nication networks as well as on circuit switched telecom-munication networks. In the case of packet switched net-works, these traffic measurements may contain e.g. packet headers, signaling messages, and authorization log-files. These traffic measurements may be utilized in examining the status and performance of a network, and in order to ensure the correct operation of the network. In addition, traffic analysis based on these measure-ments provides valuable data about user behavior and trends in application and network usage.
[0003] A prior art network management system
typi-cally comprises fault management and performance management. Fault management refers to monitoring notifications and alarms indicating status changes and detected faults, as well as evaluating their importance and effects, and initiating actions such as repairs. These notifications and alarms are generated by various net-work elements, operation and maintenance units, and the network management system itself. Performance management refers to collecting performance measure-ments from various network elemeasure-ments, operation and maintenance units, etc. to the network management sys-tem, and subsequently analyzing the collected data. Thus, e.g. trends and problems in the network can be detected.
[0004] The collected performance measurements
typ-ically relate to parameters which can be used to indicate the performance of the network or a network element, or a service provided by the network. The performance measurements are typically transmitted to the network management system sequentially, e.g. every 15, 30 or 60 minutes or every 12 or 24 hours, depending on the network, e.g. the network size, the amount of different kind of measurements to be collected, and the capacity of the network management system. Having received the collected performance measurements, the network man-agement system analyzes them. Typically the analysis is performed by batch processing in which the received data is analyzed e.g. once every 24 hours.
[0005] As current networks continue to grow, faster
network management including monitoring of network re-sources, network services and services provided over
the network is needed. In particular, analysis of the col-lected performance measurements has proven problem-atic. Firstly, the current implementations typically perform the analysis as an off-line procedure, for example once every 24 hours. In other words, the analysis is not formed in real-time which may seriously degrade the per-formance of the network or the quality of service since performance problems may remain unattended to until the next batch processing of collected performance measurements. Furthermore, the present algorithm based analysis methods do not allow real-time decision making and monitoring either.
[0006] Prior art further includes US 2003/115364 A1
that discloses camouflage of network traffic to resist at-tack, wherein an apparatus for transmitting a file through a network includes a file-splitting processor that splits the file into a plurality of message segments and addresses the plurality of message segments to a plurality of ad-dresses assigned to a receiving host. The apparatus in-cludes a message segment transmitter for transmitting the plurality of message segments to the receiving host.
[0007] Prior art further includes US 7047423 B1 that
discloses an information security analysis system that is a collection, configuration and integration of software pro-grams that reside on multiple interconnected computer platforms. This collection and integration of software and the migration to a single computer platform results in an approach to LAM/WAM monitoring in either a passive and/or active mode. The architecture permits digital data input from external sensors for analysis, display and cor-relation with data and displays derived from four major software concept groups.
[0008] Therefore, an object of the present invention is
to alleviate the problems described above and to intro-duce a solution that allows analysis and monitoring for a communications network, network resources, network services and services provided over the network in real-time.
SUMMARY OF THE INVENTION
[0009] A first aspect of the present invention is a
meth-od of managing mobile telecommunications packet data service traffic. Packet data traffic related to one or more services of a mobile telecommunications network is re-ceived from one or more data collectors. At least a portion of the received packet data traffic is stored in a traffic file. The stored traffic file is split into capture files, wherein each of the capture files is specific to one service of the one or more services of the mobile telecommunications network. The service specific capture files are stored, wherein each capture file is assigned an index. Prede-termined key information is extracted from the stored service specific capture files for entry points of the one or more services of the mobile telecommunications net-work by utilizing one or more filters configured for search-ing one or more strsearch-ings related to the predetermined key information, wherein the key information includes at least
5 10 15 20 25 30 35 40 45 50 55
the index assigned to the associated service specific cap-ture file, at least one user identification, and time data. The extracted key information is stored in entry point spe-cific tables.
[0010] A second aspect of the present invention is an
apparatus for managing mobile telecommunications packet data service traffic. The apparatus comprises a receiver configured to receive packet data traffic related to one or more services of a mobile telecommunications network from one or more data collectors. The apparatus further comprises a first storage configured to store at least a portion of the received packet data traffic in a traffic file. The apparatus further comprises a a splitter configured to split the stored traffic file into capture files, wherein each of the capture files is specific to one service of said one or more services. The apparatus further com-prises a second storage configured to store the service specific capture files, wherein each capture file is as-signed an index. The apparatus further comprises an ex-tractor configured to extract predetermined key informa-tion from the stored service specific capture files for entry points of the one or more services of the mobile telecom-munications network by utilizing one or more filters con-figured for searching one or more strings related to the predetermined key information, wherein the key informa-tion includes at least the index assigned to the associated service specific capture file, at least one user identifica-tion, and time data. The apparatus further comprises a third storage configured to store the extracted key infor-mation in entry point specific tables.
[0011] A third aspect of the present invention is a
com-puter program embodied on a comcom-puter readable medi-um. The computer program controls a data-processing device to perform the steps of:
receiving, from one or more data collectors, packet data traffic related to one or more services of a mobile telecommunications network;
storing at least a portion of the received packet data traffic in a traffic file;
splitting the stored traffic file into capture files, each of the capture files specific to one service of said one or more services;
storing the service specific capture files, with each capture file assigned an index;
extracting predetermined key information from the stored service specific capture files for entry points of the one or more services by utilizing one or more filters configured for searching one or more strings related to the predetermined key information, said key information including at least the index assigned to the associated service specific capture file, at least one user identification, and time data; and
storing the extracted key information in entry point specific tables.
[0012] In an embodiment of the invention, a traffic
anal-ysis is performed utilizing at least a portion of at least one
of the stored key information and the stored service spe-cific capture files.
[0013] In an embodiment of the invention, the
perform-ing the traffic analysis comprises executperform-ing an end-to-end search on a given user identification, wherein the stored key information is searched for the given user identification and given time data, and the search results are used to select one or more entry point transactions to pass on to further analysis.
[0014] In an embodiment of the invention, the
perform-ing the traffic analysis further comprises collectperform-ing traffic statistics, wherein the number of transactions in a given service specific capture file matching a statistics filter is counted and stored for further processing.
[0015] In an embodiment of the invention, the
perform-ing the traffic analysis further comprises monitorperform-ing a giv-en service, wherein the number of transactions in a givgiv-en service specific capture file matching a first monitoring filter is counted, the number of transactions in the given service specific capture file matching a second monitor-ing filter is counted, and a predetermined ratio of the both numbers is compared to a predetermined threshold value to determine if sufficient network operability has been reached.
[0016] In an embodiment of the invention, the
perform-ing the traffic analysis further comprises trackperform-ing users fulfilling a given criteria, wherein the user identifications in the transactions in a given service specific capture file matching a tracking criteria filter are extracted, and a list of the extracted user identifications is generated for fur-ther processing.
[0017] In an embodiment of the invention, the services
include at least one of a multimedia messaging service, a wireless application protocol related service, a short message service, an email service, a remote authenti-cation dial in user service, and a session initiation proto-col related service.
[0018] In an embodiment of the invention, the entry
points include at least one of a remote authentication dial in user service entry point, a multimedia messaging serv-ice interface between the first multimedia messaging service relay/server and an external messaging system, a short message service entry point, a multimedia mes-saging service interface between the first multimedia messaging service relay/server and a second multimedia messaging service relay/server, a multimedia messaging service interface between the first multimedia messaging service relay/server and a value added service applica-tion of the multimedia messaging service, a Gn interface of a gateway GPRS support node, and a Gi interface of the gateway GPRS support node.
[0019] In an embodiment of the invention, the packet
data service traffic is received via one or more bonded interfaces.
[0020] It is to be understood that the aspects and
em-bodiments of the invention described above may be used in any combination with each other. Several of the as-pects and embodiments may be combined together to
5 10 15 20 25 30 35 40 45 50 55
form a further embodiment of the invention. A method, an apparatus, or a computer program which is an aspect of the invention may comprise at least one of the embod-iments of the invention described above.
[0021] The invention allows analysis and monitoring
for a communications network, network resources, net-work services and services provided over the netnet-work in real-time.
BRIEF DESCRIPTION OF THE DRAWINGS
[0022] The accompanying drawings, which are
includ-ed to provide a further understanding of the invention and constitute a part of this specification, illustrate embodi-ments of the invention and together with the description help to explain the principles of the invention. In the draw-ings:
Fig. 1a is a block diagram illustrating an apparatus
according to an embodiment of the invention as de-ployed in a mobile telecommunications network;
Fig. 1b is a block diagram illustrating an apparatus
according to an embodiment of the invention in more detail;
Fig. 2 is a flow diagram illustrating a method
accord-ing to an embodiment of the invention;
Fig. 3a is a flow diagram illustrating a method
ac-cording to another embodiment of the invention;
Fig. 3b is a flow diagram illustrating a method
ac-cording to yet another embodiment of the invention;
Fig. 3c is a flow diagram illustrating a method
ac-cording to a further embodiment of the invention; and
Fig. 3d is a flow diagram illustrating a method
ac-cording to another further embodiment of the inven-tion.
DETAILED DESCRIPTION OF THE PREFERRED EM-BODIMENTS
[0023] Reference will now be made in detail to the
em-bodiments of the invention, examples of which are illus-trated in the accompanying drawings.
[0024] Figure 1a is a block diagram illustrating an
ap-paratus 1400 according to an embodiment of the inven-tion as deployed in a mobile telecommunicainven-tions network 1000. Figure 1b is a block diagram illustrating the appa-ratus 1400 of Figure 1a in more detail.
[0025] The mobile telecommunications network 1000
provides various services which may include both circuit switched services and packet switched services. The cir-cuit switched services may include e.g. conventional wireless telephony services. The packet switched serv-ices or packet data servserv-ices may be implemented using e.g. General Packet Radio Service (GPRS) techniques, packet data techniques of Third Generation Partnership Project (3GPP) mobile telecommunications networks, or packet data service (CPDS) techniques of code division multiple access 2000 (CDMA2000; also known as
IS-2000) mobile telecommunications networks, and the packet data services may include e.g. a multimedia mes-saging service (MMS) 1101, a wireless application pro-tocol (WAP) related service 1102, a short message serv-ice (SMS) 1103 (when implemented with packet data techniques), an email service 1105, a remote authenti-cation dial in user service (RADIUS) 1104, and/or a ses-sion initiation protocol (SIP) related service 1106 (e.g. a push-to-talk over cellular (PoC) service, a voice-over-in-ternet protocol (VoIP) service, a video-on-demand serv-ice). Obviously, the packet data services are not limited to the above examples.
[0026] The mobile telecommunications network 1000
includes entry points. Herein, the term "entry point" is used to refer to locations in the mobile telecommunica-tions network 1000 in which a subscriber (not illustrated in Figure 1a) may first enter the mobile telecommunica-tions network 1000 to use its packet data services with his/her terminal device (not illustrated in Figure 1a). The entry points may include e.g. a remote authentication dial in user service entry point 1201 (e.g. a RADIUS request from a gateway GPRS support node (GGSN, not illus-trated in Figure 1a), from a packet data serving node (PDSN, not illustrated in Figure 1a), from a Network Ac-cess Server (NAS) towards service network, or from an external RADIUS proxy server), a multimedia messaging service interface 1202 (also known as MM3 interface in the art of multimedia messaging service) between the first multimedia messaging service relay/server and an external messaging system (not illustrated in Figure 1a), a short message service entry point 1203, a multimedia messaging service interface 1204 (also known as MM4 interface in the art of multimedia messaging service) be-tween the first multimedia messaging service relay/serv-er and a second multimedia messaging srelay/serv-ervice relay/ server (not illustrated in Figure 1a), a multimedia mes-saging service interface 1205 (also known as MM7 inter-face in the art of multimedia messaging service) between the first multimedia messaging service relay/server and a value added service (VAS) application (not illustrated in Figure 1a) of the multimedia messaging service, a Gn interface 1206 of a gateway GPRS support node, and/or a Gi interface 1207 of the gateway GPRS support node. Obviously, the entry points are not limited to the above examples. For example, in place of the MM7 interface, an external application interface (EAIF) may used.
[0027] The RADIUS entry point 1201 may be used for
e.g. MMS MM1 traffic and WAP browsing traffic. The Gn interface 1206 of the GGSN may be used for e.g. mobile internet browsing. For SIP services, e.g. the Gn interface 1206 of the GGSN or the Gi interface 1207 of the GGSN may be used. The MM3 interface 1202 may be used e.g. by the MMS Relay/Server to send multimedia messages to and retrieve multimedia messages from servers of ex-ternal messaging systems that are connected to the serv-ice provider’s MMS Relay/Server. The MM4 interface 1204 between MMS Relay/Servers belonging to different multimedia messaging service environments (MMSE)
5 10 15 20 25 30 35 40 45 50 55
may be used e.g. to transfer messages between them. The MM7 interface 1205 may be used e.g. to transfer multimedia messages from MMS Relay/Server to MMS VAS applications and to transfer multimedia messages from MMS VAS applications to MMS Relay/Server.
[0028] The mobile telecommunications network 1000
further includes a data collector 1300. In an embodiment of the invention, the data collector 1300 may comprise a network node 1300 that is capable of port monitoring. In the embodiment of Figure 1a, the network node 1300 is a network switch capable of port monitoring. However, the network node 1300 may also be e.g. a router, a load balancer, a network tap, or a service node capable of port monitoring. The port monitoring capability may be implemented e.g. as a port mirroring capability. Since both port mirroring and port monitoring are concepts known in the art, they are not described in more detail herein. Furthermore, even though only one network node 1300 capable of port monitoring is illustrated in Figure 1a for the sake of clarity, it is to be understood that mul-tiple network nodes capable of port monitoring may be used for the purposes of the present invention.
[0029] The apparatus 1400 is connected to the
net-work node 1300. In the embodiment of Figure 1a, the apparatus 1400 is connected to the network node 1300 via bonded interfaces 1410, 1420. In the art, bonded in-terfaces are also known as IP-multipathing and interface aggregates. Again, since the bonded interface is a con-cept known in the art, it is not described in more detail herein. In an embodiment, no internet protocol (IP) ad-dresses are configured for the bonded interfaces 1410, 1420. Furthermore, even though only two bonded inter-faces 1410, 1420 are illustrated in Figure 1a for the sake of clarity, it is to be understood that any number of bonded interfaces may be used per each apparatus 1400 for the purposes of the present invention. Similarly, any number of network nodes capable of port monitoring may be con-nected to each apparatus 1400 for the purposes of the present invention. Finally, any number of apparatuses 1400 may be used for the purposes of the present inven-tion.
[0030] Using bonded interfaces has several
advantag-es. For example, monitored traffic data can be received from multiple locations at the same time and be captured by a single capturing process. Furthermore, time stamps of the traffic don’t need synchronization because only one capturing process is running to capture traffic data from multiple locations, and local system time is used as a time value for captured traffic. Therefore, all the cap-tured packets are stored in chronological order by default. Furthermore, when network nodes are redundant (dou-bled), it is possible to receive traffic from a primary and a secondary node at the same time with interface bond-ing. On the other hand, if all the monitored service data is received from a single non-redundant node, interface bonding is not needed.
[0031] Alternatively, instead of implementing the data
collector 1300 in a network node remote from the packet
data services 1101-1106 as illustrated in Figure 1a, the data collector 1300 may also be arranged locally, i.e. in connection with (not illustrated in Figure 1a) one or more of the packet data services 1101-1106. Again, there may be multiple data collectors 1300, each of which may be arranged e.g. in connection with one of the packet data services 1101-1106. In this embodiment, the data collec-tor(s) 1300 may be e.g. software module(s), each of which may be installed in connection with one of the pack-et data services 1101-1106 and each of which may collect packet data traffic related to its respective packet data service 1101-1106.
[0032] The apparatus 1400 comprises a receiver 1430
that is configured to receive (typically via the bonded in-terfaces 1410, 1420, as described above) packet data traffic related to one or more of the services 1101-1106 of the mobile telecommunications network 1000 from the data collector 1300. In the above embodiment in which the data collector 1300 is arranged locally in connection with one of the packet data services 1101-1106, the re-ceiver 1430 may be configured to receive the packet data traffic related to one or more of the services 1101-1106 e.g. via file transfer protocol (FTP) or via volume mount-ing, both of which are techniques well known to a person skilled in the art and therefore do not need to be described in further detail herein.
[0033] The apparatus 1400 further comprises a first
storage 1440 that is configured to store at least a portion of the received packet data traffic in a traffic file 1441. In an embodiment, the traffic files 1441 may be created us-ing a rus-ing buffer (not illustrated in Figure 1b). Further-more, the traffic files 1441 may be created based on e.g. duration, file size, and/or the number of files.
[0034] The apparatus 1400 further comprises a splitter
1450 that is configured to split the stored traffic file into capture files 1461, wherein each of the capture files 1461 is specific to one service of the one or more services 1101-1106.
[0035] The apparatus 1400 further comprises a
sec-ond storage 1460 that is configured to store the service specific capture files 1461. Each capture file may be as-signed an index. The index may be e.g. an incremental file index number. As a result, the traffic file 1441 is split into small logical pieces (i.e. the capture files 1461) spe-cific to the packet data services 1101-1106.
[0036] The apparatus 1400 further comprises an
ex-tractor 1470 that is configured to extract predetermined key information from the stored service specific capture files 1461 for entry points 1201-1207 by utilizing one or more filters configured for searching one or more strings (e.g. character strings) related to the predetermined key information. The key information may include the index assigned to the associated service specific capture file, user identifications, and/or time data. The apparatus 1400 further comprises a third storage 1480 (e.g. a da-tabase) that is configured to store the extracted key in-formation in tables 1481 each of which may be specific to one of the entry points 1201-1205.
5 10 15 20 25 30 35 40 45 50 55
[0037] It is to be understood that in the context of the
present invention, the term "user" is used to refer to an entity using a packet data service(s). That is, the term "user" refers to at least one of a subscriber and a terminal device using the packet data service(s). Accordingly, the "user identification" may comprise at least one of a sub-scriber identification and a terminal device identification, such as at least one of a mobile subscriber integrated services digital network number (MSISDN), a mobile identification number (MIN), an international mobile sub-scriber identity (IMSI), an electronic serial number (ESN) of the terminal device, and an internet protocol (IP) ad-dress.
[0038] It is to be understood that the first storage 1440,
the second storage 1460 and the third storage 1480 may be implemented separately from each other (as illustrat-ed in Figure 1b) or in any combination with each other.
[0039] The apparatus 1400 further comprises an
ana-lyzer 1490 that is configured to perform a traffic analysis utilizing information stored in the entry point specific ta-bles 1481 and/or the capture files 1461. Various exam-ples of this traffic analysis will be described in more detail in connection with Figures 3a-3d.
[0040] Figure 2 is a flow diagram illustrating a method
according to an embodiment of the invention. At step 2100, packet data traffic related to one or more services of a mobile telecommunications network is received from one or more data collectors. The received packet data traffic is stored in a traffic file, step 2200. At step 2300, the stored traffic file is split into capture files, wherein each of the capture files is specific to one service of the one or more services of the mobile telecommunications network. At step 2400, the service specific capture files are stored, wherein each capture file is assigned an in-dex. At step 2500, predetermined key information is ex-tracted from the stored service specific capture files for entry points of the one or more services of the mobile telecommunications network by utilizing one or more fil-ters configured for searching one or more strings related to the predetermined key information, wherein the key information includes at least the index assigned to the associated service specific capture file, at least one user identification, and time data. The extracted key informa-tion is stored in entry point specific tables, step 2600. At optional step 2700, a traffic analysis is performed utilizing at least a portion of at least one of the stored key infor-mation and the stored service specific capture files.
[0041] Figures 3a-3d are flow diagrams illustrating
em-bodiments of the analysis step 2700 of the method of Figure 2. Figure 3a illustrates a case in which the at least one user identification may comprise e.g. a mobile sub-scriber integrated services digital network number (MSISDN), and the performing the traffic analysis com-prises executing an end-to-end search on a given MSIS-DN (i.e. executing a trace). Key information stored in the table 1481 specific to a desired one of the entry points 1201-1205 is searched for the given MSISDN and given time data, step 2711. Search results are returned, step
2712. At step 2713, the returned search results are used to select one or more entry point transactions for detailed further analysis. At step 2714, the selected entry point transactions are passed on to the detailed further anal-ysis. The detailed further analysis may be performed us-ing known traffic analysis techniques. Furthermore, the embodiment of Figure 3a may also be used to enable lawful authorities to effectively run various tasks required for data monitoring and surveillance. It is to be under-stood that the embodiment of Figure 3a is not limited to mobile subscriber integrated services digital network numbers (MSISDNs). For example, the at least one user identification may comprise one of mobile identification numbers (MINs), international mobile subscriber identi-ties (IMSIs), electronic serial numbers (ESNs), and IP-addresses instead of mobile subscriber integrated serv-ices digital network numbers.
[0042] Figure 3b illustrates a case in which the
per-forming the traffic analysis further comprises collecting traffic statistics. A respective capture file is read with a statistics filter, step 2721. At step 2722, the number of transactions in the respective capture file matching the used statistics filter is counted. The counted number is then stored for further processing, step 2723. The traffic statistics collected in this manner may include e.g. serv-ice related statistics (e.g. number of requests, number of responses, and/or number of successful transactions), terminal type statistics, content size statistics, and/or net-work related statistics (e.g. round trip time, packet count, and/or number of broadcasts).
[0043] Figure 3c illustrates a case in which the
per-forming the traffic analysis further comprises monitoring a given service 1101, 1102, 1103, 1104, 1105 or 1106 (for example, to find out if the given service is operating sufficiently). A respective capture file (that is, a capture file related to the given service 1101, 1102, 1103, 1104, 1105 or 1106) is read with a first monitoring filter, step 2731. The number of transactions in the respective cap-ture file matching the first monitoring filter is counted, step 2732. The respective capture file is read with a sec-ond monitoring filter, step 2733. In another embodiment, another capture file may be read with the second moni-toring filter. The number of transactions in the respective capture file matching the second monitoring filter is counted, step 2734. At step 2735, a predetermined ratio of the both numbers counted at steps 2732 and 2734 is compared to a predetermined threshold value to deter-mine if sufficient network operability has been reached. If it is determined at step 2735 that the threshold value is not reached, it may be determined that sufficient net-work operability has not been reached, and e.g. an alarm may be given, step 2736. If it is determined at step 2735 that the threshold value is reached, it may be determined that sufficient network operability has been reached, and the numbers may e.g. be stored for further processing, step 2737.
[0044] In an example of the embodiment of Figure 3c,
5 10 15 20 25 30 35 40 45 50 55
of profile requests, and the second monitoring filter may be used to count the number of successfully executed profile responses. In other words, the invention allows performing service monitoring on the seventh layer (i.e. application layer) of the Open Systems Interconnection (OSI) reference model thereby allowing viewing applica-tion layer informaapplica-tion rather than merely the number of transactions. The threshold value may be e.g. 90%. The predetermined ratio of the counted numbers may be e.g. the ratio of the number of profile requests to the number of profile responses. Therefore, it may be determined e.g. that if the number of profile requests / the number of profile responses equals or exceeds 90%, then sufficient network operability has been reached. Otherwise, suffi-cient network operability has not been reached.
[0045] Figure 3d illustrates a case in which the
per-forming the traffic analysis further comprises tracking us-ers fulfilling a given criteria. A respective capture file is read with a tracking criteria filter, step 2741. The user identifications (e.g. MSISDNs, MINs, IMSIs, ESNs, or IP-addresses) in the transactions in the respective capture file matching the tracking criteria filter are extracted, step 2742. At optional step 2743 it may be checked whether the user identifications include subscriber identifications, such as e.g. MSISDNs or MINs. If the user identifications do not include subscriber identifications, they may in-clude e.g. IP addresses which will allow retrieving the subscriber identifications matching the IP addresses from the entry point specific tables, step 2744. At step 2745, a list of the extracted (or retrieved) user identifica-tions is generated for further processing of step 2746. Examples of tracking criteria include subscribers who do not have credit on their prepaid account, subscribers who tried to use a given service and succeeded/failed, sub-scribers who have used a given service, subsub-scribers who have a given virus in their mobile terminal device, sub-scribers who are using a mobile terminal device provided by a specific vendor and/or with a specific software ver-sion, subscribers who are using the telecommunications network at a given time, and/or subscribers who are send-ing messages to a recipient or recipients under a given network operator.
[0046] Furthermore, the embodiment of Figure 3d may
be utilized for personalized advertising targeting in real-time that is based on actual subscriber activities and therefore significantly more accurate than prior art ad-vertising targeting. Information used in such adad-vertising targeting may include e.g. time (used to trigger delivery), subscriber status (currently active or passive), keywords (content containing one or more specified keywords), ac-tivity (browsing destination and multimedia message characteristics), profile (available profile information, such as terminal type, terminal capability, subscriber pro-file), and location of the subscribers.
[0047] The apparatus 1400 as well as the methods of
Figures 2 and 3a-3d may be implemented as software, firmware, hardware, or any combination thereof. Further-more, they may be implemented as one or more separate
entities, or they may be integrated with other entities of the mobile telecommunications network 1000.
[0048] The exemplary embodiments can include, for
example, any suitable servers, workstations, PCs, laptop computers, personal digital assistants (PDAs), Internet appliances, handheld devices, cellular telephones, smart phones, wireless devices, other devices, and the like, capable of performing the processes of the exemplary embodiments. The devices and subsystems of the ex-emplary embodiments can communicate with each other using any suitable protocol and can be implemented us-ing one or more programmed computer systems or de-vices.
[0049] One or more interface mechanisms can be used
with the exemplary embodiments, including, for example, Internet access, telecommunications in any suitable form (e.g., voice, modem, and the like), wireless communica-tions media, and the like. For example, employed com-munications networks or links can include one or more wireless communications networks, cellular communica-tions networks, 3G communicacommunica-tions networks, Public Switched Telephone Network (PSTNs), Packet Data Networks (PDNs), the Internet, intranets, a combination thereof, and the like.
[0050] It is to be understood that the exemplary
em-bodiments are for exemplary purposes, as many varia-tions of the specific hardware used to implement the ex-emplary embodiments are possible, as will be appreci-ated by those skilled in the hardware and/or software art (s). For example, the functionality of one or more of the components of the exemplary embodiments can be im-plemented via one or more hardware and/or software devices.
[0051] The exemplary embodiments can store
infor-mation relating to various processes described herein. This information can be stored in one or more memories, such as a hard disk, optical disk, magnetooptical disk, RAM, and the like. One or more databases can store the information used to implement the exemplary embodi-ments of the present inventions. The databases can be organized using data structures (e.g., records, tables, arrays, fields, graphs, trees, lists, and the like) included in one or more memories or storage devices listed herein. The processes described with respect to the exemplary embodiments can include appropriate data structures for storing data collected and/or generated by the processes of the devices and subsystems of the exemplary embod-iments in one or more databases.
[0052] All or a portion of the exemplary embodiments
can be conveniently implemented using one or more gen-eral purpose processors, microprocessors, digital signal processors, micro-controllers, and the like, programmed according to the teachings of the exemplary embodi-ments of the present inventions, as will be appreciated by those skilled in the computer and/or software art(s). Appropriate software can be readily prepared by pro-grammers of ordinary skill based on the teachings of the exemplary embodiments, as will be appreciated by those
5 10 15 20 25 30 35 40 45 50 55
skilled in the software art. In addition, the exemplary em-bodiments can be implemented by the preparation of ap-plication-specific integrated circuits or by interconnecting an appropriate network of conventional component cir-cuits, as will be appreciated by those skilled in the elec-trical art(s). Thus, the exemplary embodiments are not limited to any specific combination of hardware and/or software.
[0053] Stored on any one or on a combination of
com-puter readable media, the exemplary embodiments of the present inventions can include software for control-ling the components of the exemplary embodiments, for driving the components of the exemplary embodiments, for enabling the components of the exemplary embodi-ments to interact with a human user, and the like. Such software can include, but is not limited to, device drivers, firmware, operating systems, development tools, appli-cations software, and the like. Such computer readable media further can include the computer program product of an embodiment of the present inventions for perform-ing all or a portion (if processperform-ing is distributed) of the processing performed in implementing the inventions. Computer code devices of the exemplary embodiments of the present inventions can include any suitable inter-pretable or executable code mechanism, including but not limited to scripts, interpretable programs, dynamic link libraries (DLLs), Java classes and applets, complete executable programs, Common Object Request Broker Architecture (CORBA) objects, and the like. Moreover, parts of the processing of the exemplary embodiments of the present inventions can be distributed for better performance, reliability, cost, and the like.
[0054] As stated above, the components of the
exem-plary embodiments can include computer readable me-dium or memories for holding instructions programmed according to the teachings of the present inventions and for holding data structures, tables, records, and/or other data described herein. Computer readable medium can include any suitable medium that participates in providing instructions to a processor for execution. Such a medium can take many forms, including but not limited to, non-volatile media, non-volatile media, transmission media, and the like. Non-volatile media can include, for example, op-tical or magnetic disks, magneto-opop-tical disks, and the like. Volatile media can include dynamic memories, and the like. Transmission media can include coaxial cables, copper wire, fiber optics, and the like. Transmission me-dia also can take the form of acoustic, optical, electro-magnetic waves, and the like, such as those generated during radio frequency (RF) communications, infrared (IR) data communications, and the like. Common forms of computer-readable media can include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, any other suitable magnetic medium, a ROM, CDR, CD-RW, DVD, DVD-ROM, DVDCD-RW, DVDR, any other suitable optical medium, punch cards, paper tape, optical mark sheets, any other suitable physical medium with patterns of holes or other optically recognizable indicia,
a RAM, a PROM, an EPROM, a FLASH-EPROM, any other suitable memory chip or cartridge, a carrier wave or any other suitable medium from which a computer can read.
[0055] While the present inventions have been
de-scribed in connection with a number of exemplary em-bodiments, and implementations, the present inventions are not so limited, but rather cover various modifications, and equivalent arrangements, which fall within the pur-view of prospective claims.
Claims
1. A method of managing mobile telecommunications
packet data service traffic, comprising:
receiving (2100), from one or more data collec-tors, packet data traffic related to one or more services of a mobile telecommunications net-work;
storing (2200) at least a portion of the received packet data traffic in a traffic file;
splitting (2300) the stored traffic file into capture files, each of the capture files specific to one service of said one or more services;
characterized in that the method further
com-prises:
storing (2400) the service specific capture files, with each capture file assigned an in-dex;
extracting (2500) predetermined key infor-mation from the stored service specific cap-ture files for entry points of said one or more services by utilizing one or more filters con-figured for searching one or more strings related to said predetermined key informa-tion, said key information including at least the index assigned to the associated serv-ice specific capture file, at least one user identification, and time data; and
storing (2600) the extracted key information in entry point specific tables.
2. The method according to claim 1, characterized in that the method further comprises performing (2700)
a traffic analysis utilizing at least a portion of at least one of the stored key information and the stored serv-ice specific capture files.
3. The method according to claim 2, characterized in that the performing the traffic analysis (2700) further
comprises executing an end-to-end search on a giv-en user idgiv-entification, wherein the stored key infor-mation is searched (2711) for the given user identi-fication and given time data, and the search results are used to select (2713) one or more entry point
5 10 15 20 25 30 35 40 45 50 55
transactions to pass on to further analysis (2714).
4. The method according to claim 2 or 3, characterized in that the performing the traffic analysis (2700)
fur-ther comprises collecting traffic statistics, wherein the number of transactions in a given service specific capture file matching a statistics filter is counted (2722) and stored (2723) for further processing.
5. The method according to any of the claims 2 - 4, characterized in that the performing the traffic
anal-ysis (2700) further comprises monitoring a given service, wherein the number of transactions in a giv-en service specific capture file matching a first mon-itoring filter is counted (2732), the number of trans-actions in the given service specific capture file matching a second monitoring filter is counted (2734), and a predetermined ratio of the both num-bers is compared (2735) to a predetermined thresh-old value to determine if sufficient network operability has been reached.
6. The method according to any of the claims 2 - 5, characterized in that the performing the traffic
anal-ysis (2700) further comprises tracking users fulfilling a given criteria, wherein user identifications in the transactions in a given service specific capture file matching a tracking criteria filter are extracted (2742), and a list of the extracted user identifications is generated (2745) for further processing (2746).
7. The method according to any of the claims 1 - 6, characterized in that the services include at least
one of a multimedia messaging service (1101), a wireless application protocol related service (1102), a short message service (1103), a remote authenti-cation dial in user service (1104), an email service (1105), and a session initiation protocol related serv-ice 1106.
8. The method according to any of the claims 1 - 7, characterized in that the entry points include at
least one of a remote authentication dial in user ice entry point (1201), a multimedia messaging serv-ice interface (1202) between the first multimedia messaging service relay/server and an external messaging system, a short message service entry point (1203), a multimedia messaging service inter-face (1204) between the first multimedia messaging service relay/server and a second multimedia mes-saging service relay/server, a multimedia mesmes-saging service interface (1205) between the first multimedia messaging service relay/server and a value added service application of the multimedia messaging service, a Gn interface (1206) of a gateway GPRS support node, and a Gi interface (1207) of the gate-way GPRS support node.
9. An apparatus (1400) for managing mobile
telecom-munications packet data service traffic, comprising: a receiver (1430) configured to receive, from one or more data collectors (1300), packet data traf-fic related to one or more services (1101-1106) of a mobile telecommunications network (1000); a first storage (1440) configured to store at least a portion of the received packet data traffic in a traffic file (1441);
a splitter (1450) configured to split the stored traffic file into capture files (1461), each of the capture files (1461) specific to one service of said one or more services (1101-1106);
characterized in that the apparatus (1400)
fur-ther comprises:
a second storage (1460) configured to store the service specific capture files (1461), with each capture file (1461) assigned an index;
an extractor (1470) configured to extract predetermined key information from the stored service specific capture files (1461) for entry points (1201-1207) of said one or more services (1101-1106) by utilizing one or more filters configured for searching one or more strings related to said predeter-mined key information, said key information including at least the index assigned to the associated service specific capture file (1461), at least one user identification, and time data; and
a third storage (1480) configured to store the extracted key information in entry point (1201-1207) specific tables (1481).
10. The apparatus according to claim 9, characterized in that the apparatus (1400) further comprises an
analyzer (1490) configured to perform a traffic anal-ysis utilizing at least a portion of at least one of the stored key information and the stored service spe-cific capture files.
11. The apparatus according to claim 10, characterized in that the analyzer (1490) is further configured to
perform the traffic analysis by executing an end-to-end search on a given user identification, wherein the stored key information is searched for the given user identification and given time data, and the search results are used to select one or more entry point (1201-1207) transactions to pass on to further analysis.
12. The apparatus according to claim 10 or 11, charac-terized in that the analyzer (1490) is further
config-ured to perform the traffic analysis by collecting traffic statistics, wherein the number of transactions in a
5 10 15 20 25 30 35 40 45 50 55
given service specific capture file matching a statis-tics filter is counted and stored for further processing.
13. The apparatus according to any of the claims 10
-12, characterized in that the analyzer (1490) is fur-ther configured to perform the traffic analysis by monitoring a given service (1101-1106), wherein the number of transactions in a given service specific capture file matching a first monitoring filter is count-ed, the number of transactions in the given service specific capture file matching a second monitoring filter is counted, and a predetermined ratio of the both numbers is compared to a predetermined threshold value to determine if sufficient network op-erability has been reached.
14. The apparatus according to any of the claims 10
-13, characterized in that the analyzer (1490) is fur-ther configured to perform the traffic analysis by tracking users fulfilling a given criteria, wherein the user identifications in the transactions in a given service specific capture file matching a tracking cri-teria filter are extracted, and a list of the extracted user identifications is generated for further process-ing.
15. The apparatus according to any of the claims 9 - 14, characterized in that the apparatus (1400) further
comprises one or more bonded interfaces (1410, 1420) via which the packet data service (1101-1106) traffic is received.
16. A computer program embodied on a computer
read-able medium, the computer program controlling a data-processing device to perform the step of:
receiving (2100), from one or more data collec-tors, packet data traffic related to one or more services of a mobile telecommunications net-work;
storing (2200) at least a portion of the received packet data traffic in a traffic file;
splitting (2300) the stored traffic file into capture files, each of the capture files specific to one service of said one or more services;
characterized in that the computer program
further controls the data-processing device to perform the steps of:
storing (2400) the service specific capture files, with each capture file assigned an in-dex;
extracting (2500) predetermined key infor-mation from the stored service specific cap-ture files for entry points of said one or more services by utilizing one or more filters con-figured for searching one or more strings related to said predetermined key
informa-tion, said key information including at least the index assigned to the associated serv-ice specific capture file, at least one user identification, and time data; and
storing (2600) the extracted key information in entry point specific tables.
Patentansprüche
1. Verfahren für das Management von
Mobiltelekom-munikations-Paketdatendienst-Verkehr, das um-fasst:
Empfangen (2100) von Paketdatenverkehr, der mit einem oder mehreren Diensten eines Mobil-telekommunikationsnetzes in Beziehung steht, von einem oder mehreren Datensammeleinrich-tungen;
Speichern (2200) wenigstens eines Teils des empfangenen Paketdatenverkehrs in einer Ver-kehrsdatei;
Aufteilen (2300) der gespeicherten Verkehrsda-tei in EinfangdaVerkehrsda-teien, wobei jede der Einfang-dateien für einen Dienst des einen oder der meh-reren Dienste spezifisch ist;
dadurch gekennzeichnet, dass das
Verfah-ren ferner umfasst:
Speichern (2400) der dienstspezifischen Einfangdateien, wobei jeder Einfangdatei ein Index zugewiesen ist;
Extrahieren (2500) vorgegebener Schlüs-selinformationen aus den gespeicherten dienstspezifischen Einfangdateien für Ein-trittspunkte des einen oder der mehreren Dienste unter Verwendung eines oder meh-rerer Filter, die konfiguriert sind, um einen oder mehrere Strings zu suchen, die mit den vorgegebenen Schlüsselinformationen in Beziehung stehen, wobei die Schlüsselin-formationen zumindest den der zugeordne-ten dienstspezifischen Einfangdatei zuge-wiesenen Index, wenigstens eine Anwen-derkennung und Zeitdaten enthalten; und Speichern (2600) der extrahierten Schlüs-selinformationen in eintrittspunktspezifi-schen Tabellen.
2. Verfahren nach Anspruch 1, dadurch gekenn-zeichnet, dass das Verfahren ferner das Ausführen
(2700) einer Verkehrsanalyse unter Verwendung wenigstens eines Teils der gespeicherten Schlüs-selinformationen und/oder der gespeicherten dienstspezifischen Einfangdateien umfasst.
3. Verfahren nach Anspruch 2, dadurch gekenn-zeichnet, dass das Ausführen der Verkehrsanalyse
5 10 15 20 25 30 35 40 45 50 55
(2700) ferner das Ausführen einer Suche von Ende zu Ende in einer gegebenen Anwenderkennung um-fasst, wobei die gespeicherten Schlüsselinformatio-nen auf die gegebene Anwenderkennung und gege-bene Zeitdaten durchsucht werden (2711) und wo-bei die Suchergebnisse verwendet werden, um eine oder mehrere Eintrittspunkttransaktionen auszu-wählen (2713), um eine weitere Analyse fortzuset-zen (2714).
4. Verfahren nach Anspruch 2 oder 3, dadurch ge-kennzeichnet, dass das Ausführen der
analyse (2700) ferner das Sammeln von Verkehrs-statistiken umfasst, wobei die Anzahl von Transak-tionen in einer gegebenen dienstspezifischen Ein-fangdatei, die mit einem Statistikfilter übereinstimmt, gezählt (2722) und für eine weitere Verarbeitung ge-speichert (2723) wird.
5. Verfahren nach einem der Ansprüche 2-4, dadurch gekennzeichnet, dass das Ausführen der
Verkehr-sanalyse (2700) ferner das Überwachen eines ge-gebenen Diensts umfasst, wobei die Anzahl von Transaktionen in einer gegebenen dienstspezifi-schen Einfangdatei, die mit einem ersten Überwa-chungsfilter übereinstimmt, gezählt (2732) wird, die Anzahl von Transaktionen in der gegebenen dienst-spezifischen Einfangdatei, die mit einem zweiten Überwachungsfilter übereinstimmt, gezählt (2734) wird und ein vorgegebenes Verhältnis der beiden Zahlen mit einem vorgegebenen Schwellenwert ver-glichen (2735) wird, um zu bestimmen, ob eine aus-reichende Netzbetriebsfähigkeit erreicht worden ist.
6. Verfahren nach einem der Ansprüche 2-5, dadurch gekennzeichnet, dass das Ausführen der
Verkehr-sanalyse (2700) ferner das Verfolgen von Anwen-dern, die gegebene Kriterien erfüllen, umfasst, wo-bei Anwenderkennungen in den Transaktionen in ei-ner gegebenen dienstspezifischen Einfangdatei, die mit einem Verfolgungskriteriumfilter übereinstimmt, extrahiert (2742) werden und wobei eine Liste der extrahierten Anwenderkennungen für eine weitere Verarbeitung (2746) erzeugt (2745) wird.
7. Verfahren nach einem der Ansprüche 1-6, dadurch gekennzeichnet, dass die Dienste einen
Multime-diaNachrichtendienst (1101), einen drahtlosen, an-wendungsprotokollbezogenen Dienst (1102), einen Kurznachrichtendienst (1103), eine Fernauthentifi-zierungseinwahl in einen Anwenderdienst (1104), ei-nen Email-Dienst (1105) und eiei-nen auf ein Sitzungsi-nitiierungsprotokoll bezogenen Dienst (1106) ent-halten.
8. Verfahren nach einem der Ansprüche 1-7, dadurch gekennzeichnet, dass die Eintrittspunkte eine
Fernauthentifizierungseinwahl in einen
Anwender-dienst-Eintrittspunkt (1201) und/oder eine Multime-dianachrichtendienst-Schnittstelle (1202) zwischen dem ersten Multimedianachrichtendienst-Verstär-ker/Server und einem externen Nachrichtensystem, einen Kurznachrichtendienst-Eintrittspunkt (1203), eine Multimedianachrichtendienst-Schnittstelle (1204) zwischen dem ersten Multimedianachrich-tendienst-Verstärker/Server und einem zweiten Mul-timedianachrichtendienst-Verstärker/Server, eine Multimedianachrichtendienst-Schnittstelle (1205) zwischen dem ersten Multimedianachrichtendienst-Verstärker/Server und einer Dienstanwendung des Multimedianachrichtendiensts, zu der ein Wert hin-zugefügt ist, eine Gn-Schnittstelle (1206) eines Ga-teway-GPRS-Unterstützungsknotens und eine Gi-Schnittstelle (1207) des Gateway-GPRS-Unterstüt-zungsknotens enthalten.
9. Vorrichtung (1400) für das Management von
Mobil-telekommunikations- Paketdatendienst- Verkehr, mit:
einem Empfänger (1430), der konfiguriert ist, um von einer oder mehreren Datensammelein-richtungen (1300) Paketdatenverkehr, der mit einem oder mehreren Diensten (1101-1106) ei-nes Mobiltelekommunikationsnetzes (1000) in Beziehung steht, zu empfangen;
einem ersten Speicher (1440), der konfiguriert ist, um wenigstens einen Anteil des empfange-nen Paketdatenverkehrs in einer Verkehrsdatei (1441) zu speichern;
einem Teiler (1450), der konfiguriert ist, um die gespeicherte Verkehrsdatei in Einfangdateien (1461) zu teilen, wobei jede der Einfangdateien (1461) für einen Dienst des einen oder der meh-reren Dienste (1101-1106) spezifisch ist;
dadurch gekennzeichnet, dass die
Vorrich-tung (1400) ferner enthält:
einen zweiten Speicher (1460), der konfi-guriert ist, um die dienstspezifischen Ein-fangdateien (1461) zu speichern, wobei je-der Einfangdatei (1461) ein Index zugewie-sen ist;
eine Extraktionseinrichtung (1470), die kon-figuriert ist, um vorgegebene Schlüsselin-formationen aus den gespeicherten dienst-spezifischen Einfangdateien (1461) für Ein-trittspunkte (1201-1207) des einen oder der mehreren Dienste (1101-1106) unter Ver-wendung eines oder mehrerer Filter zu ex-trahieren, die konfiguriert sind, um nach ei-nem oder mehreren Strings zu suchen, die mit den vorgegebenen Schlüsselinforma-tionen in Beziehung stehen, wobei die Schlüsselinformationen wenigstens den der zugeordneten dienstspezifischen
Ein-5 10 15 20 25 30 35 40 45 50 55
fangdatei (1461) zugewiesenen Index, we-nigstens eine Anwenderkennung und Zeit-daten enthalten; und
einen dritten Speicher (1480), der konfigu-riert ist, um die extrahierten Schlüsselinfor-mationen in eintrittspunktspezifischen Ta-bellen (1481) zu speichern.
10. Vorrichtung nach Anspruch 9, dadurch gekenn-zeichnet, dass die Vorrichtung (1400) ferner einen
Analysator (1490) enthält, der konfiguriert ist, um ei-ne Verkehrsanalyse unter Verwendung wenigstens eines Teils der gespeicherten Schlüsselinformatio-nen und/oder der gespeicherten dienstspezifischen Einfangdateien auszuführen.
11. Vorrichtung nach Anspruch 10, dadurch gekenn-zeichnet, dass der Analysator (1490) ferner
konfi-guriert ist, um die Verkehrsanalyse durch Ausführen einer Suche von Ende zu Ende in einer gegebenen Anwenderkennung auszuführen, wobei die gespei-cherten Schlüsselinformationen auf die gegebene Anwenderkennung und auf gegebene Zeitdaten durchsucht werden und die Suchergebnisse ver-wendet werden, um eine oder mehrere Eintritts-punkttransaktionen (1201-1207) zu wählen, um eine weitere Analyse fortzusetzen.
12. Vorrichtung nach Anspruch 10 oder 11, dadurch ge-kennzeichnet, dass der Analysator (1490) ferner
konfiguriert ist, um die Verkehrsanalyse durch Sam-meln von Verkehrsstatistiken auszuführen, wobei die Anzahl von Transaktionen in einer gegebenen dienstspezifischen Einfangdatei, die mit einem Sta-tistikfilter übereinstimmt, gezählt und für eine weitere Verarbeitung gespeichert wird.
13. Vorrichtung nach einem der Ansprüche 10-12, da-durch gekennzeichnet, dass der Analysator
(1490) ferner konfiguriert ist, um die Verkehrsanaly-se durch Überwachen eines gegebenen Diensts (1101-1106) auszuführen, wobei die Anzahl von Transaktionen in einer gegebenen dienstspezifi-schen Einfangdatei, die mit einem ersten Überwa-chungsfilter übereinstimmt, gezählt wird, die Anzahl von Transaktionen in der gegebenen dienstspezifi-schen Einfangdatei, die mit einem zweiten Überwa-chungsfilter übereinstimmt, gezählt wird und ein vor-gegebenes Verhältnis der beiden Zahlen mit einem vorgegebenen Schwellenwert verglichen wird, um zu bestimmen, ob eine ausreichende Netzbetriebs-fähigkeit erreicht worden ist.
14. Vorrichtung nach einem der Ansprüche 10-13, da-durch gekennzeichnet, dass der Analysator
(1490) ferner konfiguriert ist, um die Verkehrsanaly-se durch Verfolgen von Anwendern, die ein gegebe-nes Kriterium erfüllen, auszuführen, wobei die
An-wenderkennungen in den Transaktionen in einer ge-gebenen dienstspezifischen Einfangdatei, die mit ei-nem Verfolgungskriteriumfilter übereinstimmt, extra-hiert werden und eine Liste der extraextra-hierten Anwen-derkennungen für eine weitere Verarbeitung erzeugt wird.
15. Vorrichtung nach einem der Ansprüche 9-14, da-durch gekennzeichnet, dass die Vorrichtung
(1400) ferner eine oder mehrere gebundene Schnitt-stellen (1410, 1420) enthält, über die der Paketda-tendienst-Verkehr (1101-1106) empfangen wird.
16. Computerprogramm, das in einem
computerlesba-ren Medium verkörpert ist, wobei das Computerpro-gramm eine Datenverarbeitungsvorrichtung steuert, um den folgenden Schritt auszuführen:
Empfangen (2100) von Paketdatenverkehr, der mit einem oder mehreren Diensten eines Mobil-telekommunikationsnetzes in Beziehung steht, von einer oder mehreren Datensammeleinrich-tungen;
Speichern (2200) wenigstens eines Anteils des empfangenen Paketdatenverkehrs in einer Ver-kehrsdatei;
Teilen (2300) der gespeicherten Verkehrsdatei in Einfangdateien, wobei jede der Einfangdatei-en für einEinfangdatei-en DiEinfangdatei-enst des einEinfangdatei-en oder der mehrerEinfangdatei-en Dienste spezifisch ist;
dadurch gekennzeichnet, dass das
Compu-terprogramm ferner die Datenverarbeitungsvor-richtung steuert, um die folgenden Schritte aus-zuführen:
Speichern (2400) der dienstspezifischen Einfangdateien, wobei jeder Einfangdatei ein Index zugewiesen ist;
Extrahieren (2500) vorgegebener Schlüs-selinformationen aus den gespeicherten dienstspezifischen Einfangdateien für Ein-trittspunkte des einen oder der mehreren Dienste unter Verwendung eines oder meh-rerer Filter, die konfiguriert sind, um nach einem oder mehreren Strings zu suchen, die mit den vorgegebenen Schlüsselinfor-mationen in Beziehung stehen, wobei die Schlüsselinformationen wenigstens den In-dex, der der zugeordneten dienstspezifi-schen Einfangdatei zugewiesen ist, wenig-stens eine Anwenderkennung und Zeitda-ten enthalZeitda-ten; und
Speichern (2600) der extrahierten Schlüs-selinformationen in eintrittspunktspezifi-schen Tabellen.
5 10 15 20 25 30 35 40 45 50 55 Revendications
1. Procédé de gestion du trafic de services de données
par paquets de télécommunication mobiles, compre-nant le fait :
de recevoir (2100), d’un ou de plusieurs collec-teurs de données, un trafic de données par pa-quets associé à un ou à plusieurs services d’un réseau de télécommunication mobile;
de stocker (2200) au moins une partie du trafic de données par paquets reçu dans un fichier de trafic ;
de diviser (2300) le fichier de trafic stocké dans des fichiers de capture, chacun des fichiers de capture étant spécifique à un service desdits un ou plusieurs services ;
caractérisé en ce que le procédé comprend en
outre le fait :
de stocker (2400) les fichiers de capture spécifiques aux services, à chaque fichier de capture étant attribué un indice ; d’extraire (2500) des informations impor-tantes prédéterminées des fichiers de cap-ture spécifiques aux services stockés pour des points d’entrée desdits un ou plusieurs services en utilisant un ou plusieurs filtres configurés pour rechercher une ou plu-sieurs chaînes associées auxdites informa-tions importantes prédéterminées, lesdites informations importantes comprenant au moins l’indice attribué au fichier de capture spécifique à un service associé, au moins une identification d’utilisateur, et des don-nées temporelles ; et
de stocker (2600) les informations impor-tantes extraites dans des tableaux spécifi-ques aux points d’entrée.
2. Procédé selon la revendication 1, caractérisé en ce que le procédé comprend en outre le fait de
réa-liser (2700) une analyse du trafic en utilisant au moins une partie d’au moins l’une des informations importantes stockées et des fichiers de capture spé-cifiques aux services stockés.
3. Procédé selon la revendication 2, caractérisé en ce que la réalisation de l’analyse du trafic (2700)
comprend en outre le fait d’exécuter une recherche de bout en bout sur une identification d’utilisateur donnée, dans lequel on recherche (2711) dans l’in-formation importante stockée l’identification d’utili-sateur donnée et les données temporelles données, et les résultats de la recherche sont utilisés pour sé-lectionner (2713) une ou plusieurs transactions de points d’entrée pour passer à une autre analyse (2714).
4. Procédé selon la revendication 2 ou 3, caractérisé en ce que la réalisation de l’analyse du trafic (2700)
comprend en outre le fait de collecter des statistiques concernant le trafic, dans lequel le nombre de tran-sactions dans un fichier de capture spécifique à un service donné correspondant à un filtre statistique est compté (2722) et stocké (2723) pour un traite-ment ultérieur.
5. Procédé selon l’une des revendications 2-4, carac-térisé en ce que la réalisation de l’analyse du trafic
(2700) comprend en outre le fait de surveiller un ser-vice donné, dans lequel le nombre de transactions dans un fichier de capture spécifique au service don-né correspondant à un premier filtre de surveillance est compté (2732), le nombre de transactions dans le fichier de capture spécifique à un service donné correspondant à un deuxième filtre de surveillance est compté (2734), et un rapport prédéterminé entre les deux nombres est comparé (2735) à une valeur seuil prédéterminée pour déterminer si l’opérabilité suffisante du réseau a été atteinte.
6. Procédé selon l’une des revendications 2-5, carac-térisé en ce que la réalisation de l’analyse du trafic
(2700) comprend en outre le fait de suivre des utili-sateurs remplissant un critère donné, dans lequel les identifications des utilisateurs dans les transac-tions dans un fichier de capture spécifique à un ser-vice donné correspondant à un filtre de critères de suivi sont extraites (2742), et une liste des identifi-cations des utilisateurs extraite est générée (2745) pour un traitement ultérieur (2746).
7. Procédé selon l’une des revendications 1-6, carac-térisé en ce que les services comprennent au moins
l’un d’un service de messagerie multimédia (1101), d’un service associé à un protocole d’application sans fil (1102), d’un service de messages courts (1103), d’un service (1104) d’entrée en communica-tion d’un utilisateur distant avec authentificacommunica-tion, d’un service de messageries (1105), et d’un service associé à un protocole d’initiation de session (1106).
8. Procédé selon l’une des revendications 1-7, carac-térisé en ce que les points d’entrée comprennent
au moins l’un d’un point d’entrée (1201) de service d’entrée en communication d’un utilisateur distant avec authentification, d’une interface de service de messageries multimédia (1202) entre le premier re-lais/serveur de service de messageries multimédia et un système de messageries externe, d’un point d’entrée de service de messages courts (1203), d’une interface de service de messageries multimé-dia (1204) entre le premier relais/serveur de services de messageries multimédia et un deuxième relais/ serveur de services de messageries multimédia, d’une interface de service de messageries
multimé-5 10 15 20 25 30 35 40 45 50 55
dia (1205) entre le premier relais/serveur de services de messageries multimédia et une application de services à valeur ajoutée du service de messageries multimédia, d’une interface Gn (1206) d’un noeud de support de passerelle GPRS, et d’une interface Gi (1207) du noeud de support de passerelle GPRS .
9. Appareil (1400) de gestion du trafic de services de
données par paquets de télécommunications mobi-les, comprenant :
un récepteur (1430) configuré pour recevoir, à partir d’un ou de plusieurs collecteurs de don-nées (1300), un trafic de dondon-nées par paquets associé à un ou à plusieurs services (1101-1106) d’un réseau de télécommunica-tions mobiles (1000) ;
un premier stockage (1440) configuré pour stoc-ker au moins une partie du trafic de données par paquets reçu dans un fichier de trafic (1441) ; un diviseur (1450) configuré pour diviser le fi-chier de trafic stocké dans des fifi-chiers de cap-ture (1461), chacun des fichiers de capcap-ture (1461) étant spécifique à un service desdits un ou plusieurs services (1101-1106) ;
caractérisé en ce que l’appareil (1400)
com-prend en outre :
un deuxième stockage (1460) configuré pour stocker les fichiers de capture (1461) spécifiques aux services, à chaque fichier de capture (1461) étant attribué un indice ; un extracteur (1470) configuré pour extraire des informations importantes prédétermi-nées des fichiers de capture spécifiques aux services stockés (1461) pour des points d’entrée (1201-1207) desdits un ou plu-sieurs services (1101-1106) en utilisant un ou plusieurs filtres configurés pour recher-cher une ou plusieurs chaînes associées auxdites informations importantes prédé-terminées, lesdites informations importan-tes comprenant au moins l’indice attribué au fichier de capture (1461) spécifique au service associé, au moins une identification d’utilisateur, et des données temporelles ; et
un troisième stockage (1480) configuré pour stocker les informations importantes extraites dans des tableaux spécifiques (1481) aux points d’entrée (1201-1207).
10. Appareil selon la revendication 9, caractérisé en ce que l’appareil (1400) comprend en outre un
analy-seur (1490) configuré pour réaliser une analyse du trafic en utilisant au moins une partie d’au moins l’une des informations importantes stockées et des fi-chiers de capture spécifiques aux services stockés.
11. Appareil selon la revendication 10, caractérisé en ce que l’analyseur (1490) est en outre configuré pour
réaliser l’analyse du trafic en exécutant une recher-che de bout en bout sur une identification d’utilisateur donnée, dans lequel on recherche dans l’information importante stockée l’identification d’utilisateur don-née et les dondon-nées temporelles dondon-nées, et les ré-sultats de la recherche sont utilisés pour sélectionner une ou plusieurs transactions de points d’entrée (1201-1207) pour passer à une autre analyse.
12. Appareil selon la revendication 10 ou 11, caracté-risé en ce que l’analyseur (1490) est en outre
con-figuré pour réaliser l’analyse du trafic en collectant des statistiques concernant le trafic, dans lequel le nombre de transactions dans un fichier de capture spécifique à un service donné correspondant à un filtre statistique est compté et stocké pour un traite-ment ultérieur.
13. Appareil selon l’une des revendications 10-12, ca-ractérisé en ce que l’analyseur (1490) est en outre
configuré pour réaliser l’analyse du trafic en sur-veillant un service donné (1101-1106), dans lequel le nombre de transactions dans un fichier de capture spécifique au service donné correspondant à un pre-mier filtre de surveillance est compté, le nombre de transactions dans le fichier de capture spécifique au service donné correspondant à un deuxième filtre de surveillance est compté, et un rapport prédéter-miné entre les deux nombres est comparé à une valeur seuil prédéterminée pour déterminer si l’opé-rabilité suffisante du réseau a été atteinte.
14. Appareil selon l’une des revendications 10-13, ca-ractérisé en ce que l’analyseur (1490) est en outre
configuré pour réaliser l’analyse du trafic en suivant des utilisateurs satisfaisant un critère donné, dans lequel les identifications des utilisateurs dans les transactions dans un fichier de capture spécifique à un service donné correspondant à un filtre de critères de suivi sont extraites, et une liste des identifications des utilisateurs extraite est générée pour un traite-ment ultérieur.
15. Appareil selon l’une des revendications 9-14, carac-térisé en ce que l’appareil (1400) comprend en
outre une ou plusieurs interfaces liées (1410, 1420) par lesquelles le trafic de service de données par paquets (1101-1106) est reçu.
16. Programme informatique incorporé sur un support
lisible par ordinateur, le programme informatique commandant un dispositif de traitement de données pour réaliser les étapes qui consistent :
à recevoir (2100), à partir d’un ou de plusieurs collecteurs de données, un trafic de données
