System and method for mass call onset detection in a communications network

• US 6,614,894 B1
• Filed: 06/05/1998
• Issued: 09/02/2003
• Est. Priority Date: 06/05/1998
• Status: Expired due to Term

• Current Assignee: NetScout Systems Texas, LLC (NetScout Systems Incorporated)
• Original Assignee: Inet Technologies, Inc. (Fortive Corp.)
• Inventors: Lin, Lisan, Ramirez, Emil Alfred Baenz, Brockman, Pierce Edward
• Primary Examiner(s): NGUYEN, DUC MINH
• Application Number:
  US09/092,428
• Time in Patent Office: 1,915 Days
• Field of Search: 379/111, 379/112.01, 379/112-3-1, 379/114.08, 379/114.09, 379/32-1-, 379/229, 379/230
• US Class Current: 379/112.06
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 2215/32 Involving wireless systems
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks
• CPC Class Codes: H04M 7/06 using auxiliary connections for control or supervision , e.g. where the auxiliary connection is a signalling system number 7 link
• CPC Class Codes: H04Q 3/0025 Provisions for signalling
• CPC Class Codes: H04Q 3/0087 Network testing or monitoring arrangements
• CPC Class Codes: H04Q 3/0091 Congestion or overload control

Abstract

A system and method is disclosed for correlating transaction messages in a communications network into transaction records. A plurality of monitoring units capture the messages from the links in the communication network. A processor or state machine processes the correlated transaction records and detects calls to particular destination telephone numbers. Transactions affecting particular destination point codes can also be detected or monitored. When a short-term threshold number of calls to a particular telephone number are detected, the detecting monitor instructs other monitors to track calls to that telephone number. If a long-term threshold number of calls are detected for the destination telephone number, then a mass call alarm is generated. Information comprising the highly called destination telephone number, dialed number, destination point code, and top originating point codes is provided to the service provider following the mass call alarm. The system may direct an originating point code to drop a percentage of the calls that are directed to a highly called destination telephone number.

Claims

1. A method for monitoring message traffic levels in a communications network having a plurality of nodes, said network nodes coupled by communications links, wherein messages pass between said nodes over said communications links, and wherein

wherein a plurality of interlinked monitoring units are coupled to said communications links, said monitoring units capturing said messages on said communications links and correlating associated ones of said captured messages;

said method comprising the steps of;

filtering said messages using preselected profiles, wherein said profiles comprise message destination data to be used when filtering said messages;

tracking, at a first monitoring unit, a number of messages sent to a plurality of destinations during a particular period of time;

detecting, at said first monitoring unit, when said number of messages sent to a particular one of said plurality of destinations exceeds a first threshold level;

designating said first monitoring unit as a master monitoring unit for said particular destination, wherein other of the plurality of monitoring units forward information the master regarding all future detections of messages sent to said particular destination;

detecting, at said first monitoring unit, when said number of messages sent to said particular destination exceeds a second threshold level; and

when said number of messages exceeds said second threshold level, directing one or more originating network nodes to reduce a number of future calls to said destination, wherein said originating nodes originate or forward said messages sent to said particular destination.

2. The method of claim 1 wherein said message destination data comprises telephone number digits, and wherein a high message traffic level corresponds to a mass call condition to one or more telephones assigned said telephone number digits.

3. The method of claim 1 wherein said message destination data corresponds to one or more of said network nodes, and wherein a high message traffic level corresponds to mass transaction onset condition for said nodes.

4. The method of claim 1 wherein said destination data is configurable by a user.

5. The method of claim 1 wherein said period of time is configurable by a user.

6. The method of claim 1 wherein said network nodes are selected from the group consisting of:

a Signal Transfer Point (STP);

a Signal Control Point (SCP);

a Service Switching Point (SSP);

an Intelligent Peripheral (IP);

a Service Node (SN); and

an end office.

7. The method of claim 1 wherein said filtering step, said tracking step and said detecting step are performed by a processor on one of said monitoring units.

8. The method of claim 1 further comprising the step of:

tracking numbers of messages sent to multiple destinations during said particular period of time.

16. The system of claim 8 further comprising:

means for tracking numbers of messages sent to multiple destinations during said particular period of time.

9. A system for monitoring message traffic levels in a communications network having a plurality of nodes, said network nodes coupled by communications links, wherein messages pass between said nodes over said communications links, and

wherein a plurality of interlinked monitoring units are coupled to said communications links, said monitoring units capturing said messages on said communications links and correlating associated ones of said captured messages;

said system comprising;

means for filtering said messages using preselected profiles, wherein said profiles comprise message destination data to be used when filtering said messages;

means for tracking, at a first monitoring unit, a number of messages sent to a plurality of destinations during a particular period of time;

means for detecting, at said first monitoring unit, when said number of messages sent to a particular one of said plurality of destinations exceeds a first threshold level;

means for designating said first monitoring unit as a master monitoring unit for said particular destination, wherein other of the plurality of monitoring units forward information the master regarding all future detections of messages sent to said particular destination;

means for detecting, at said first monitoring unit, when said number of messages sent to said particular destination exceeds a second threshold level; and

means for directing one or more originating network nodes to reduce a number of future calls to said particular destination when said number of messages exceeds said second threshold level, wherein said originating nodes originate or forward said messages sent to said particular destination.

10. The system of claim 9 wherein said message destination data comprises telephone number digits, and wherein a high message traffic level corresponds to a mass call condition to one or more telephones assigned said telephone number digits.

11. The system of claim 9 wherein said message destination data corresponds to one or more of said network nodes, and wherein a high message traffic level corresponds to mass transaction onset condition for said nodes.

12. The system of claim 9 further comprising:

means for allowing users to configure said destination data.

13. The system of claim 9 further comprising:

means for allowing users to configure said period of time.

14. The system of claim 9 wherein said network nodes are selected from the group consisting of:

a Signal Transfer Point (STP);

a Signal Control Point (SCP);

a Service Switching Point (SSP);

an Intelligent Peripheral (IP);

a Service Node (SN); and

an end office.

15. The system of claim 12 wherein said monitoring units comprise a processor;

and wherein said processors comprises said means for filtering, said means for tracking and said means for detecting.

17. A computer readable medium having a computer program thereon for use in a system for monitoring a communications network having a plurality of network nodes, each of said nodes coupled by communications links, and wherein one or more monitoring units are coupled to said communications links and are operable to capture messages passing across said communications links, the computer program comprising:

means for filtering said messages using preselected profiles, wherein said profiles comprise message destination data to be used when filtering said messages;

means for tracking, at a first monitoring unit, a number of messages sent to a plurality of destinations during a particular period of time;

means for detecting, at said first monitoring unit, when said number of messages sent to a particular one of said plurality of destinations exceeds a first threshold level;

means for designating said first monitoring unit as a master monitoring unit for said particular destination, wherein other of the plurality of monitoring units forward information the master regarding all future detections of messages sent to said particular destination;

means for detecting, at said first monitoring unit, when said number of messages sent to said particular destination exceeds a second threshold level; and

means for directing one or more originating network nodes to reduce a number of future calls to said particular destination when said number of messages exceeds said second threshold level, wherein said originating nodes originate or forward said messages sent to said particular destination.

18. The computer readable medium of claim 17 further comprising:

means for allowing users to configure said profiles.

19. The computer readable medium of claim 18 wherein said configuring means further comprises:

means for configuring said destination data; and

means for configuring said period of time.