Methods and systems for observing, analyzing and correlating multi-protocol signaling message traffic in a mobile telecommunications network

[0002] This application claims the benefit of United States Provisional Patent Application No. 60/171,009, filed Dec. 15, 1999, the disclosure of which is incorporated herein by reference in its entirety.

[0003] The present invention relates to the monitoring of call signaling in a telecommunications network, and more particularly to methods and systems for observing, analyzing and correlating a sequence of call signaling messages associated with a particular mobile call whereby information contained in one monitored signaling message is used to locate another signaling message in the call trace sequence.

[0004] A typical wireless or cellular telecommunications network, generally indicated by the numeral 100, is illustrated in FIG. 1. More particularly, the wireless communication network 100 presented in FIG. 1 is an example of simplified global system for mobile communication (GSM)-type network. Sample GSM network 100 includes a telecommunication terminal or telephone handset 102, a base station system (BSS) 104, a mobile switching center (MSC) 106, a home location register (HLR) 108, and an authentication center (AuC) 110.

[0005] Mobile switching center (MSC) 106 is the functional entity that represents an automatic packet switching system within a wireless communication network. When such a packet switching system is implemented so as to serve as the interface for user traffic between the cellular network and other public switched networks, the corresponding node is often referred to as a Gateway MSC or GMSC. In general, MSC 106 provides basic switching functionality and coordinates the establishment of calls between wireless end users. An MSC is directly responsible for transmission facilities management, mobility management, and call processing functions. An MSC node is typically in communication with the air-interface components of a wireless network (i.e., base station systems) as well as with other voice and signaling related nodes in the wireless network. As such, an MSC incorporates switching functions, mobile application functions, and other service logic functions in a wireless communications network.

[0006] Home location register (HLR) 108 is the functional entity that represents the primary database repository of subscriber information used to provide control and intelligence in wireless communication networks. The term register denotes control and processing center functions as well as the database functions. An HLR is managed by the wireless service provider and represents the “home” database for subscribers who have subscribed to service in a particular geographic area. An HLR contains a record for each “home” subscriber that includes location information, subscriber status, subscribed features, and directory numbers. Supplementary services or features that are provided to a subscriber are ultimately controlled by an HLR. HLR nodes typically incorporate database functions, mobile application functions, as well as other service logic functions, and may service one or more MSCs.

[0007] Authentication center (AuC) 110 is the functional entity that represents the authentication functions used to verify and validate a mobile subscriber's identity. An AuC node manages and processes authentication information related to a particular mobile subscriber. Typically, this information consists of encryption and authentication keys as well as complex mathematical algorithms used to prevent fraudulent or unauthorized use of the wireless network. An AuC incorporates database functions used for the authentication keys and authentication algorithm functions.

[0008] Those skilled in the art of GSM communication networking will appreciate that the network elements described above represent only a few of the network entities that are commonly deployed in a GSM network. It will also be appreciated that such GSM-type network elements are communicatively coupled via a variety of communication link types, which in turn may employ a variety of signaling application and transport protocol suites. As illustrated in FIG. 1, BSS 104 is communicatively coupled to GMSC node 106, while GMSC node 106 is further coupled to both HLR node 108 and AuC node 110.

[0009] The establishment and maintenance of a call to or from mobile handset 102 typically involves the use of a number of signaling messages that are communicated between various network entities that comprise the GSM network 100. For instance, BSS 104 communicates with GMSC node 106 using both direct transfer application protocol (DTAP) and base station system management application protocol (BSSMAP) signaling protocol messages which may be transmitted over inter-connecting communication links using a transport protocol suite such as the signaling system 7 (SS7) message transfer part (MTP) protocol. GMSC 106, in turn, communicates with HLR node 108 and AuC node 110 using mobile application part (MAP) signaling protocol messages which may also be transmitted over signaling links using an SS7 MTP transport protocol suite.

[0010] Also shown in FIG. 1 is a network monitoring system that includes a central monitoring platform 112 which is connected to communication link probes 114, 116 and 118. More particularly, link probe 114 is adapted to monitor both DTAP and BSSMAP signaling messages communicated between BSS 104 and GMSC 106, sending copies of the DTAP and BSSMAP messages to monitoring platform 112 for analysis and display. Link probe 116 is adapted to monitor the MAP signaling message traffic flowing between GMSC node 106 and HLR node 108, and again sends copies of the monitored messages to platform 112 for analysis and display. In a similar manner, link probe 116 is adapted to monitor the MAP signaling message traffic flowing between GMSC node 106 and AuC node 110, sending copies of the MAP messages to monitoring platform 112 for analysis and display.

[0011] As indicated in FIG. 1, the above described wireless network elements function together in concert to provide the intelligent network services typically associated with modern wireless telecommunication networks. As such, inter-communication between these network elements is a very important issue, and is facilitated at least in part by signaling communication links. Currently, the trend within the United States wireless telecommunications industry is towards a signaling infrastructure based on the SS7 and IS-41 protocols. In many countries outside of the United States, a signaling protocol known as global system for mobile communications (GSM) is often employed in wireless communication networks. These two signaling protocols are similar in many respects, and consequently discussions of signaling type communications in this disclosure will be limited to those based on the GSM protocol. It will be appreciated that the present invention, described herein, can be successfully deployed in GSM, Personal Communication Services (PCS) and IS-41-based signaling networks.

[0012] Signaling in a wireless or cellular network is employed to implement a number of call processing operations. The term call processing encompasses a wide variety of functions that establish, maintain, and tear down calls to and from mobile subscribers (where a call is defined as a temporary communication between end users for the purpose of exchanging information). Mobile calls include a sequence of events that allocate and assign the resources and signaling channels required to establish build a communication connection. In general terms, the act of call establishment or call setup in a wireless communications network comprises a set of discrete signaling operations that arrange for the allocation and engagement of network resources required for the connection of a mobile call.

[0013] In addition to providing the infrastructure for basic call setup and teardown operations as mentioned above, wireless signaling is also responsible for providing general mobility management services. Such services enable a communications network to maintain location and mobile subscriber status information so that end users can make and receive mobile-originated and mobile-terminated calls while moving or roaming from geographic location to another.

[0014] The establishment of a mobile call may involve both GSM and Signaling System 7 (SS7) ISDN User Part (ISUP) call control signaling to properly connect the called and calling parties. GSM call signaling is used to obtain the location, status, routing, and any special call treatment information about a mobile subscriber to properly complete mobile-terminated calls. It is also used to obtain call treatment and routing information for mobile-originated calls. This signaling is provided by the GSM intersystem operations. With regard to intersystem handoff, GSM signaling is also used to control the allocation and engagement of inter-MSC voice trunks. A more detailed discussion of GSM and IS-41 mobile signaling can be found in Mobile Telecommunications Networking With IS-41 by Michael D. Gallagher and Randall A. Snyder, McGraw-Hill Publishing 1997 and Signaling System #7 by Travis Russell, McGraw-Hill Publishing 1998.

[0015] The brief discussion presented above illustrates the important role of mobile call signaling operations in a wireless communications network and highlights the need for network operators to have the capability of viewing a comprehensive listing of all signaling message traffic associated with a particular mobile call. Such information is particularly useful for troubleshooting, network planning, and billing operations. Previous network monitoring systems, such as monitoring system 112 shown in FIG. 1, have been capable of simultaneously monitoring multiple communication links, where the mobile signaling messages carried on these links are formatted in a variety of signaling protocols. However, automatic correlation of signaling messages generated and communicated between a BSS air-interface and an MSC (e.g., DTAP and BSSMAP) with those signaling messages typically associated with the SS7 protocol (e.g., ISUP, TCAP and MAP) has not previously been available. Those skilled in the art of wireless telecommunication systems will appreciate that the internal structures and parameter contents of BSSMAP, DTAP, ISUP, TCAP and MAP mobile signaling messages differ considerably.

[0016] As generally indicated in FIG. 2, the internal structure and parameter content differences primarily exist at a level in the overall protocol stack that is above the MTP transport protocol layer(s). More particularly, shown in FIG. 2 is a typical mobile application part (MAP) message structure 120, a typical ISDN user part (ISUP) message structure 140, a typical DTAP message structure 150, and a typical BSSMAP message structure 160. In these sample structures, it is assumed that each message utilizes an MTP transport protocol which is comprised of an MTP 1 level 122, an MTP 2 level 124, and an MTP 3 level 126. These three MTP levels generally correspond to the physical, data link and network levels, respectively, in the open systems integration (OSI) model developed by the International Standards Organization (ISO). The MTP levels are charged with providing the upper levels of each protocol stack with node-to-node transmission capability, basic error detection/correction capabilities, message sequencing, message routing, message discrimination, and message distribution functionality.

[0017] In addition to the MTP layers described above, MAP structure 120 further includes a signaling connection control part (SCCP) level 128, a transaction capabilities application part (TCAP) level 130, and a mobile application part (MAP) level 132. In a similar manner, ISUP structure 140 further includes an ISDN user part (ISUP) level 142. DTAP structure 150 further includes an SCCP level 128, as well as a DTAP level 152. Likewise, BSSMAP structure 162 includes an SCCP level 128, and a BSSMAP level 162. It will be appreciated by those skilled in the art of wireless telecommunication networking that a single mobile call attempt can, and often does, result in the generation of a plurality of messages that are representative of all of the above described mobile signaling message types.

[0018] With particular regard to the TCAP level 130, MAP level 132, ISUP level 142, DTAP level 152, and BSSMAP level 162, it will be appreciated that the structure and parameter contents within these levels differ significantly. Consequently, a specific parameter contained in one message type may not necessarily be contained in the structure of another message type. For example, a BSSMAP message associated with a particular mobile call includes a TMSI parameter, while a MAP message associated with the same mobile call does not include a TMSI parameter. This lack of parameter uniformity among mobile signaling message types, combined with the fact that there is not a unique mobile call ID value assigned to each mobile call and subsequently contained in every signaling message associated with that mobile call, makes a complete and comprehensive correlation of all mobile call signaling messages difficult.

[0019] Therefore, what is needed is a network monitoring system that is capable of simultaneously monitoring a plurality of communication links in a wireless communications network, including air-interface to MSC links, and automatically correlating and displaying all signaling messages associated with a mobile call.

[0020] According to one aspect, the present invention includes a network monitoring system that is capable of simultaneously monitoring a plurality of signaling communication links in a wireless communication network, including air-interface to mobile switching center (MSC) signaling links. The monitoring system is further adapted to automatically correlate all messages associated with a specific call, including related signaling messages observed on an air-interface to MSC communication link. Consequently, a complete and comprehensive record of all relevant signaling messages associated with a specific call is automatically presented to the monitoring system user.

[0021] In one embodiment, a network monitoring system of the present invention is adapted to simultaneously monitor a plurality of signaling communication links in a global system for mobile communication (GSM) wireless telecommunications network. As such, the network monitoring system observes and automatically correlates signaling messages associated with a particular user specified call, where the signaling messages are formatted in a variety of different signaling protocols. Such GSM signaling protocols include, but are not limited to base station system management application part (BSSMAP), direct transfer application part (DTAP), mobile application part (MAP), ISDN user part (ISUP), and transaction capabilities application part (TCAP). In a closely related embodiment of the present invention, a network monitoring system is adapted to perform a similar function within an ANSI IS-41 or Personal Communication Services (PCS) type wireless networks.

[0022] A network monitoring system of the present invention includes a plurality of communication probes that are adapted to provide non-intrusive monitoring of the signaling communication links to which they are connected. Each communication link probe is communicatively coupled to a central monitoring platform, where collection and correlation processing is performed. The monitoring platform may also implement a user interface for managing any required input/output (I/O) operations. As such, via the user interface a user may specify one or more parameters identifying a particular call or set of calls to be examined. With the necessary call parameters specified, the network monitoring system is adapted to automatically collect, correlate and display all signaling messages indicated by the specified call parameters. Such functionality allows a complete and comprehensive call trace to be automatically performed and displayed, where the results of the trace include relevant signaling messages collected from all monitored communication links.

[0023] It is of particular significance that the automatically generated call trace output produced by the network monitoring system of the present invention includes call signaling messages that are communicated between an air-interface or base station system (BSS) and an associated mobile switching center (MSC).

[0024] It is also significant that the network monitoring system of the present invention does not require that all signaling message traffic on a signaling link during a given time interval be reported to a central processing platform in order to perform a call trace operation. Instead a network monitoring system of the present invention employs a pre-determined sequence of signaling message filter criteria which are selectively downloaded to a plurality of link monitoring modules, so as to effectively use information contained in a first located signaling message associated with a call trace to search for a second signaling message associated with the same call trace.

[0025] Accordingly, it is an object of the present invention to provide a network monitoring system that is capable of simultaneously monitoring a plurality of GSM signaling communication links, including a BSS to MSC signaling communication link, and automatically correlating all signaling messages associated with a user specified call or calls.

[0026] It is another object of the present invention to provide a monitoring system for automatically generating and displaying correlated call trace information associated with a specific call or set of calls in a GSM wireless telecommunication network.

[0027] It is another object of the present invention to provide a monitoring system for automatically generating and displaying correlated call trace information associated with a specific call or set of calls in an ANSI IS-41 wireless telecommunication network.

[0028] It is another object of the present invention to provide a monitoring system for automatically generating and displaying correlated call trace information associated with a specific call or set of calls in a PCS wireless telecommunication network.

[0029] It is another object of the present invention to provide a monitoring system that facilitates independent dynamic filtering of signaling message traffic at each signaling link monitoring module or probe.

[0030] It is another object of the present invention to provide a monitoring system that does not require that all signaling message traffic on a signaling link during a given time interval be reported to a central correlating platform in order to perform a call trace operation.

[0031] It is another object of the present invention to provide a monitoring system that employs a pre-determined sequence of signaling message filter criteria, so as to effectively use information contained in a first located signaling message associated with a call trace to search for a second signaling message associated with the same call trace.

[0032] Some of the objects of the invention having been stated hereinabove, other objects will become evident as the description proceeds, when taken in connection with the accompanying drawings as best described hereinbelow.

[0033] Preferred embodiments of the invention will now be explained with reference to the accompanying drawings, of which:

[0034] FIG. 1 is a diagram illustrating a prior art mobile telecommunications network architecture and associated network elements.

[0035] FIG. 2 is a block diagram of mobile signaling message protocol structures.

[0036] FIG. 3 is a network diagram illustrating an implementation of a network monitoring system of the present invention in a global system for mobile communication (GSM) network.

[0037] FIG. 4 is a diagram of a message correlating and processing platform according to an embodiment of the present invention.

[0038] FIG. 5 is a table illustrating a sample set of inter-message parameter matching rules.

[0039] FIG. 6 is a diagram of a link monitoring module (LMM) according to an embodiment of the present invention;

[0040] FIG. 7 is a network diagram illustrating another implementation of a network monitoring system according to an alternative embodiment of the present invention in a global system for mobile communication (GSM) network;

[0041] FIGS. 8A-8D illustrate a call flow diagram associated with a mobile call in a GSM wireless communication network;

[0042] FIG. 9 is a diagram illustrating several call signaling messages employed in a typical GSM wireless communication network;

[0043] FIG. 10 is a block diagram illustrating a billing process of a network monitoring system according to an embodiment of the present invention;

[0044] FIG. 11 illustrates an exemplary billing rate database used by the billing process illustrated in FIG. 10; and

[0045] FIG. 12 is a block diagram illustrating a billing-subsystem-equipped network monitoring system according to an embodiment of the present-invention.

[0046] Shown in FIG. 3 is a simplified global system for mobile communication (GSM) network, generally indicated by the numeral 200. GSM network 200 includes a first base station transceiver system (BSS) 202, a first mobile switching center 204, a home location register (HLR) 206, a second MSC 208, and a second BSS 210. Also included in FIG. 3 is a network monitoring system of the present invention, generally indicated by the numeral 212. Network monitoring system 212 is comprised of a central message correlating or processing platform 214, and a plurality of associated communication link probes. More specifically, in the example shown in FIG. 3, network monitoring system 212 includes a first link monitoring module (LMM) 216, a second LMM 218, a third LMM 220, and a fourth LMM 222. Each LMM is communicatively coupled to the central message correlating platform 214 via an Internet protocol (IP) communication network 224. The central message correlating platform 214 is adapted to provide a user 226 with an interface (UI) such that the user may enter monitoring and correlating instructions and observe the subsequent results.

[0047] As further indicated in FIG. 3, simplified GSM network 200 includes a plurality of signaling links, with each link effectively communicatively coupling a pair of network nodes. More particularly, signaling link 228 is adapted to carry signaling messages between BSS 202 and MSC 204. It will be appreciated from FIG. 3 that the signaling protocols supported on link 228 include base station system management application part (BSSMAP) and direct transfer application part (DTAP). Those skilled in the art of wireless network communication will appreciate that BSSMAP and DTAP protocol signaling messages are transmitted and received only between BSS and MSC type network elements. Signaling link 230 is adapted to carry signaling messages between MSC 204 and HLR 206. Again, it will be appreciated from FIG. 3 that the signaling protocols supported on link 230 include mobile application part (MAP). Signaling link 232 is adapted to support the transmission of ISUP type signaling messages between MSC 204 and MSC 208. Signaling link 234 is adapted to carry signaling messages between MSC 208 and BSS 210. As with link 228, the signaling protocols supported on link 234 include BSSMAP and DTAP.

[0048] It will be appreciated by those skilled in the art of wireless telecommunication networks that the GSM network 200 is a highly simplified example of typical GSM network architectures, and is intended to merely illustrate the basic functionality of a monitoring system of the present invention. Significantly more complex architectures would typically be employed in a fully deployed and operating GSM network. However, it should also be appreciated that a network monitoring system of the present invention could be deployed and would function similarly in such complex architectures.

[0049] Shown in FIG. 4 is a message correlating platform (MCP), generally indicated by the numeral 300, that includes a communication interface 302, a user interface process 304, a filter manager process 306 that is included within a message correlator process 308, and a LMM routing process 310. User interface process 304 further includes an input process 312 and an output process 314. In general, user interface 304 is adapted to provide a human operator or user with a means to input monitoring instructions and to subsequently view the correlated monitoring results. In one embodiment, a user is permitted to specify, via input process 312, a set of filter criteria that correspond to particular values or ranges of values of various parameters contained with the types of signaling messages that are to be observed or monitored. Input process 312 may assume the form of a graphical user interface (GUI) or a text-based command line type interface. In a similar manner, output process 314 provides a user with a means to view and interpret the results of a monitoring session, and may assume the form of a graphical user interface (GUI) or a text-based interface.

[0050] The above-mentioned filter criteria specified by a user are conveyed to the correlator process 308, as indicated in FIG. 4. Correlator process 308 is adapted to receive the initial user specified call trace criteria information and subsequently generate the appropriate filter criteria information to each provisioned LMM unit. In general, once constructed, filter criteria information is provided to the filter manger 306 which makes a copy of the filter set for each appropriately configured LMM, and these copies are subsequently provided to LMM routing process 310 which determines the appropriate destination LMM unit for the filter criteria information. Once a call trace has been initiated, correlator process 308 is adapted to receive a signaling message from an associated LMM unit and subsequently generate the next filter criteria set required to continue or complete the specified call trace. Once this determination or correlation is complete, the signaling message is passed to the user interface output process 314 for display. With regard to the process of correlation, it will again be appreciated from FIG. 2 that different signaling message types carry different information that is organized in different formats. Consequently, there is no guarantee that a particular parameter found in a first type signaling message (e.g., BSSMAP) is also included in a second type signaling message (e.g., ISUP). It is the responsibility of the correlator process 308 to maintain and apply a sequenced mapping of parameters in different signaling message types that contain similar or equivalent information, such that information gleaned from a first signaling message can be used to search for the next signaling message in the call trace sequence. It is through the application of this parameter mapping and sequencing function that the automatic correlation of many signaling messages of differing types, all of which are associated with the same mobile call, is achieved by the monitoring system of the present invention.

[0051] A sample set of signaling message parameter mapping and sequencing rules that may be maintained and applied by correlator 308 is illustrated in table 350 of FIG. 5. In FIG. 5, each row of table 350 indicates a sequence of messages of the same or different types and the parameters used to correlate the messages. During call setup, multiple message types can be sent between entities involved in the call setup. In addition, the same parameter may not be available in all of the messages for correlating the messages Accordingly, correlator 308 preferably generates filter criteria that correlate multiple message types using a variety of parameters. For example, in table 350 at trace sequence 2, the filter criteria correlate a BSSMAP message having a particular called number value with a DTAP message having a particular DLRN value. Similarly, in trace sequence 3, the filter criteria correlate a DTAP message having a particular called number value with a MAP message having a particular transaction ID value. Because correlator 308 is capable of generating filter criteria for detecting and correlating multiple message types using different parameters, a mobile network monitoring system according to the present embodiment is especially well suited for network environments in which multiple protocols are utilized.

[0052] Of particular significance in table 350 are the two entries (trace sequences 5 and 6) relating equivalent DTAP/MAP parameters and equivalent MAP/BSSMAP parameters. As discussed previously, automatic correlation of signaling messages generated and communicated between a BSS air-interface and an MSC (e.g., DTAP and BSSMAP) with those signaling messages typically associated with the SS7 protocol (e.g., ISUP, TCAP and MAP) has not previously been possible. Yet, correlation of such BSS-MSC signaling messages is essential in order to obtain a complete or comprehensive trace of a mobile call.

[0053] Referring back to FIG. 4, communication interface 302 is adapted to facilitate the transmission and reception of data between the MCP 300 and a LMM unit. More particularly, communication interface 302 is responsible for packaging filter criteria information within an appropriately formatted and addressed TCP/IP data packet for transmission to a destination LMM unit. The discussion presented herein assumes that the protocol used to facilitate communication between an MCP and a LMM unit is transmission control protocol/Internet protocol (TCP/IP). However, it will be appreciated by those skilled in the art of network communications that a variety of communication protocols such as UDP/IP, frame relay, asynchronous transfer mode (ATM), SONET, etc., could be used to establish an MCP to LMM communication link. Communication interface 302 is also responsible for receiving and unpackaging TCP/IP datagrams that contain copies of signaling messages sent to the MCP 300 by LMM units.

[0054] Shown in FIG. 6 is a Link Monitoring Module (LMM), generally indicated by the numeral 400. LMM 400 includes a communication interface process 402, a filter assertion process 404, a message buffer 406, and a message collection process 408. Communication interface process 402 is adapted to facilitate the transmission and reception of data between the LMM 400 and an MCP unit. More particularly, communication interface process 402 is responsible for unpacking filter criteria information from an incoming TCP/IP filter criteria data packet received from an associated MCP unit. Once again, the discussion presented herein assumes that the protocol used to facilitate communication between a LMM and an MCP unit is TCP/IP. However, other functionally similar communication protocols could be alternatively employed, as discussed above. Once unpacked, filter criteria information is passed from communication interface process 402 to filter assertion process 404. Filter assertion process 404 is adapted to receive and decode the incoming filter criteria information. Process 404 then assert the filter criteria against the contents of message buffer 406. Message buffer 406 is adapted to receive and temporarily store or buffer signaling messages. These signaling messages (e.g., BSSMAP, DTAP, ISUP, MAP) are first received by the message collector process 408, which is adapted to effectively copy signaling message traffic that is being transmitted over a monitored signaling communication link. The specific configuration of a message collector process on a LMM depends upon the type of signaling communication link that the LMM is intended to monitor. For example, a LMM that is placed on a SS7/MTP signaling link may include a message collector process that is adapted to interpret the MTP transport protocol suite; whereas, a LMM that is placed on a SS7/TCP/IP signaling link may include a message collector process that is adapted to interpret the TCP/IP transport protocol suite. As used herein, the phrase transport protocol suite refers to physical, data link, and network layer functionality, as defined in the ISO open systems interconnect model.

[0055] Communication interface 302 is also responsible for receiving signaling messages that have been selected, based on a filter criteria set, from the message buffer 406 and subsequently packaging these select signaling messages in TCP/IP packets for delivery to an MCP.

[0056] At this point, It should be appreciated that one of the major functions of the network monitoring system of the present invention is the automatic correlation of a plurality of signaling messages associated with a particular mobile call, wherein the mobile call related signaling messages are formatted in different signaling protocols (e.g., BSSMAP, DTAP, MAP, ISUP, TCAP). As such, all signaling messages related to a call may be collected and displayed, regardless of the particular monitored signaling link over which they traverse. Those skilled in the art of telecommunication networking will appreciate that signaling messages related to a specific mobile call may be interspersed with hundreds or thousands of other signaling messages that are not relevant to the concerned call, and which consequently must be ignored by a monitoring system.

[0057] FIG. 7 illustrates a simplified GSM mobile communications network, generally indicated by the numeral 450. Network 450 is similar in architecture to the GSM network 200 previously discussed and illustrated in FIG. 3. As such, GSM network 450 includes a first base station transceiver system (BSS) 202, a first mobile switching center 204, a home location register (HLR) 206, and a second BSS 210. Also included in FIG. 7 is a network monitoring system of the present invention, generally indicated by the numeral 212. Network monitoring system 212 is comprised of a central message correlating or processing platform 214, and a plurality of associated communication link probes. More specifically, in the example shown in FIG. 7, network monitoring system 212 includes a first link monitoring module (LMM) 216, a second LMM 220, and a third LMM 222. Each LMM is communicatively coupled to central message correlating platform 214 via an Internet protocol (IP) communication network 224. Central message correlating platform 214 is adapted to provide a user 226 with a user interface (UI) such that the user may enter monitoring and correlating instructions and observe the subsequent results.

[0058] As further indicated in FIG. 7, simplified GSM network 450 includes a plurality of signaling links, with each link effectively communicatively coupling a pair of network nodes. More particularly, signaling link 228 is adapted to carry signaling messages between BSS 202 and MSC 204. It will be appreciated from FIG. 7 that the signaling protocols supported on link 228 include BSSMAP and DTAP. Signaling link 230 is adapted to carry signaling messages between MSC 204 and HLR 206. Again, it will be appreciated from FIG. 7 that the signaling protocols supported on link 230 include mobile application part (MAP). Signaling link 234 is adapted to carry signaling messages between MSC 204 and BSS 210. As with link 228, the signaling protocols supported on link 234 include BSSMAP and DTAP.

[0059] In the operational example provided below, it is assumed that user 226, shown in FIG. 7, wishes to trace the next mobile call that is placed to a certain telephone number. As such, user 226 enters the appropriate instructions via a user interface associated with central message correlating platform 214. Referring to FIG. 4, it will be appreciated that user interface input process 312 receives the user request for a trace on the next call to the specified number, and subsequently passes this trace request information to correlator process 308. Upon receipt of the initial trace request, correlator process 308 generates the appropriate network monitoring system filter set corresponding to at least one appropriately provisioned LMM unit with which MCP 300 is in communication. This filter set is then passed to filter manager process 306 where a copy of the filter set is made for each appropriately provisioned LMM in the monitoring system. Each filter set copy is then passed to LMM routing process 310 where each copy is packaged and addressed to an appropriate destination LMM unit. Each packaged filter set is then passed to communication interface 302 for further packaging or encapsulation within a TCP/IP datagram for transmission from the central processing platform 214 through TCP/IP network 224 to an appropriate destination LMM unit. Examples of filter sets that may be provided to LMMs 216, 220, and 222 will be described in detail below with regard to FIGS. 8A-8D.

[0060] As indicated in FIG. 7, LMM specific filter sets are transmitted from the central processing platform 214 to one or more provisioned LMMs via TCP/IP network 224. It will be appreciated from FIG. 6 and the previous discussion of LMM design presented above that each LMM receives a TCP/IP datagram which contains a filter criteria set packet. Communication interface 402, shown in FIG. 6, receives an incoming TCP/IP datagram and subsequently unpacks or decapsulates the datagram so as to generally extract the filter criteria set packet contained therein. The filter criteria information is then passed to the filter assertion process 404. Upon receipt of the filter criteria information, filter assertion process 404 initiates an examination of signaling messages stored in message buffer 406. Copies of any signaling messages residing in the message buffer 406 that satisfy the specified filter criteria are made and passed to the communication interface 402.

[0061] With particular regard to the case where the matching of telephone numbers is dictated by a filter criteria set, it will be appreciated that a LMM unit of the present invention is adapted to perform a flexible type of number matching between related signaling messages. The implementation of flexible number matching algorithms in a LMM provides a method of matching telephone numbers or other identification numbers that may have a prefix, (e.g. an area code or country code), or suffix, (e.g. a filler digit), in one message that is not present in another, related message although the numbers denote the same entity. This method requires that a certain minimum number of “core” digits match exactly. Any prefixes or suffixes are then examined. If both numbers have a prefix and the prefixes differ, or if both numbers have a suffix and the suffixes differ, then this is not considered a match. In this manner, LMM units contain the intelligence necessary to perform flexible or fuzzy number matching among related signaling messages. Furthermore, this flexible number matching intelligence may also be incorporated directly within the central processing platform so as to allow for off-line processing of signaling message traffic that is buffered via data storage media associated with and coupled to the central processing platform.

[0062] It will be appreciated that network monitoring is a dynamic process -signaling messages are constantly being received by message collector process 408, and consequently message buffer 406 is constantly being updated with new information. Therefore, while a signaling message meeting the specified filter criteria may not reside in message buffer 406 at the time that a new filter criteria is received at the LMM, filter assertion process 404 will continue to examine buffer 406 until a signaling message meeting the filter criteria is inserted into the buffer or a command is received from the central processing platform 214 instructing the LMM to discard the filter set.

[0063] Returning to communication interface 402, it will be appreciated that upon receipt of a signaling message meeting the filter criteria from message buffer 406, communication interface 402 encapsulates the signaling message within a TCP/IP datagram that is addressed to central processing platform 214, and transmits the datagram through TCP/IP network 224. The TCP/IP encapsulated signaling message is ultimately received by the corresponding communication interface process 302 associated with the MCP 300 that resides on central processing platform 214. Communication interface 302 decapsulates the TCP/IP datagram so as to generally extract the signaling message contained therein. The signaling message is then passed to correlator 308 where the message is examined, used to generate the next LMM specific filter set, and ultimately presented to the user interface 304 for handling and display by output process 314.

[0064] FIGS. 8A-8D illustrate a mobile call flow diagram associated with simple call trace through the example GSM network 450 presented in FIG. 7. In FIGS. 8A-8D, the curvilinear lines connecting the various messages indicate messages that can be correlated using the same or a related parameter. For example, in block (A), network monitoring system 112 according to an embodiment of the present invention may receive a request to trace a call to a particular number. As indicated by the curvilinear path associated with block (A), the DTAP called number value and the MAP MSISDN value may be used to locate DTAP and MAP messages associated with the call. Block (B) and its associated curvilinear line indicate a sequence of DTAP and BSSMAP messages that can be correlated based on SCCP source and destination local reference numbers. Block (C) and its associated curvilinear path indicate correlation of a DTAP message with a MAP message based on a match between the called number in the DTAP message and the MSISDN number in the DTAP message. Block (D) and its associated curvilinear path indicate correlation of TCAP messages based on transaction IDs. Block (E) and its associated curvilinear path indicates the correlation of a MAP message with a BSSMAP message when the MAP IMSI number matches the BSSMAP mobile identification parameter. Block (F) and its associated curvilinear path indicate correlation of a BSSMAP message and a DTAP message when the BSSMAP TMSI parameter matches the DTAP TMSI parameter. Finally, block (G) and its associated curvilinear path represent BSSMAP and DTAP messages that can be correlated when SCCP source and destination local reference numbers match. Because the network monitoring system according to the present invention is capable of correlating messages of different types using different parameters, a complete set of messages associated with a mobile call can be collected.

[0065] The following examples illustrate filter sets that may be delivered to LMMs 216, 220 and 222 for the mobile-to-mobile call trace illustrated in FIGS. 8A-8D. The steps described below must be performed sequentially, even though they are executed by different LMMs.

[0066] LMM 216 performs steps to find all messages for this BSSAP sequence. The steps performed by LMM 216 for various DTAP/BSSMAP and SCCP messages in FIGS. 8A-8D are:

[0067] DTAP Setup message

[0068] Step 1. Searching forward, find the next DTAP Setup message with a Called Party field that matches this Phone Number.

[0069] Back to SCCP Connection Confirm

[0070] Step 2. Searching backward, find the next SCCP Connection Confirm message whose Source or Destination Local Reference field matches the Destination Local Reference of the message found in Step 1 and the Origination and Destination Point Codes match (possibly reversed), those of the message found in Step 1.

[0071] Back to SCCP Connection Request

[0072] Step 3. Searching backward, find the next SCCP Connection Request message whose Source Local Reference field matches the Destination Local Reference of the message found in Step 2 and the Origination and Destination Point Codes match (possibly reversed), those of the message found in Step 2.

[0073] Rest of A-Interface Connection

[0074] Step 4. Searching forward, find the next SCCP message whose Source or Destination Local Reference field matches the Source or Destination Local Reference of the message found in Step 3 and the Origination and Destination Point Codes match (possibly reversed), those of the message found in Step 3.

[0075] Go Back to DTAP Setup

[0076] Step 5. Searching backward, find the next DTAP Setup message with a Called Party field that matches the Called Party field found in Step 1. (The same Setup message found in Step 1.)

[0077] LMM 220 performs steps to find associated MAP SendRoutingInfo(SRI) Begin and End. The steps performed by LMM 220 for various MAP and TCAP messages illustrated in FIGS. 8A-8D are:

[0078] Send Routing Info

[0079] Step 6. Searching forward, find the next MAP Send Routing Info message whose MSISDN number matches the Called Party field found in Step 1.

[0080] Send Routing Info Response

[0081] Step 7. Searching forward, find the next TCAP message whose Originating or Destination Transaction ID matches the Originating or Destination Transaction ID found in Step 6. This will be the response to MAP Send Routing Info message found in Step 6.

[0082] Go Back to Send Routing Info

[0083] Step 8. Searching backward, find the same MAP Send Routing Info message found in Step 6.

[0084] Find associated MAP ProvideRoamingNumber(PRN) Begin and End.

[0085] Provide Roaming Number

[0086] Step 9. Searching forward, find the next MAP Provide Roaming Number message whose IMSI number matches the IMSI of the message found in Step 7.

[0087] Provide Roaming Number Response

[0088] Step 10. Searching forward, find the next TCAP message whose Originating or Destination Transaction ID matches the Originating or Destination Transaction ID found in Step 6. This will be the response to MAP Provide Roaming Number message found in Step 9.

[0089] LMM 222 performs steps to find BSSMAP Paging Broadcast message. The steps performed by LMM 222 for various DTAP, BSSMAP, and SCCP messages illustrated in FIGS. 8A-8D are:

[0090] BSSMAP Paging message

[0091] Step 11. Searching forward, find the next BSSMAP Paging message whose Mobile ID field matches the IMSI field found in Step 7.

[0092] Find entire associated BSSAP Paging Response sequence.

[0093] DTAP Paging Response

[0094] Step 12. Searching forward, find the next DTAP Paging Response message whose TMSI field matches the TMSI field found in Step 11.

[0095] Connection Confirm

[0096] Step 13. Searching forward, find the next SCCP Connection Confirm message whose Source or Destination Local Reference field matches the Source or Destination Local Reference of the message found in Step 12.

[0097] Rest of A-Interface Connection

[0098] Step 14. Searching forward, find all SCCP messages whose Source or Destination Local Reference field matches the Source or Destination Local Reference of the message found in Step 13 and the Origination and Destination Point Codes match (possibly reversed), those of the message found in Step 13, stopping when one of these message is an SCCP Release Complete message.

[0099] A simplified call trace example will now be described using a network monitoring system according to the present invention. In the call trace example provided below, it is assumed that user 226 wishes to trace the next mobile call that is placed to the telephone number 919-460-5500. As such, user 226 enters the appropriate trace instructions via a user interface associated with central message correlating platform 214.

[0100] The trace begins by searching for a DTAP signaling message with a Called Number parameter value equal to 919-460-5500, as generally indicated in trace sequence number 1 shown in table 350 of FIG. 5. Following the general processes described above for MCP operation, it will be appreciated that a correlator process 308 generates a filter criteria set in response to the user call trace request. This filter criteria set is processed by a filter manager 306, communication interface 302, and ultimately delivered to the only two LMM units that are provisioned in system 212 to monitor links that support DTAP type signaling traffic, LMM 216 and LMM 222. It will, however, be further appreciated that the filter criteria set could be delivered to all LMM units regardless of the type of signaling communication links that each LMM is adapted to monitor. Such a LMM specific filter criteria delivery described herein is not essential to the operation of the present invention, but simply yields a more efficient use of bandwidth resources in the data network 224.

[0101] FIG. 9 illustrates various message types and parameters that may be correlated by the filter criteria. For example, in FIG. 9, DTAP message 500 includes a called number parameter 502, a temporary mobile subscriber identifier (TMSI)_parameter 504, a source local reference number (SLRN) parameter 506, and a destination local reference number (DLRN) parameter 508. BSSMAP message 520 includes a TMSI parameter 522, a mobile ID parameter 524, a SLRN parameter 526, and a DLRN parameter 528. MAP message 540 includes an MSISDN parameter 542, an IMSI parameter 544, and a transaction ID 546. Various combinations of these differing parameters may be used to correlate messages associated with a mobile call, as will be discussed in more detail below.

[0102] LMM 216 and LMM 222 receive the filter criteria set and assert the filter criteria against their message buffers. It is assumed in this example that a DTAP message 500, as shown in FIG. 9, is located by LMM 216. In this case called number parameter 502 of DTAP message 500 matches the user specified number to be traced, so the filter assertion process residing on LMM 216 makes a copy of the DTAP message and forwards the message via TCP/IP network 224 to the central processing platform 214. Correlator process 308 (shown in FIG. 4) residing on central processing platform 214 receives the selected DTAP signaling message sent from LMM 216 and subsequently examines the SLRN parameter 506 contained in the DTAP message. The value of the SLRN parameter, 1111100, is used by correlator process 308 to construct a second filter criteria set that is intended to search for an associated BSSMAP Assignment Complete message. In a manner analogous to the first filter set, this second filter criteria set is passed to a filter manager, communication interface, and ultimately delivered to the only two LMM units that are provisioned in system 212 to monitor links that support BSSMAP type signaling traffic, LMM 216 and LMM 222.

[0103] As indicated in FIGS. 8 and 9, it is assumed that a second message that satisfies the second filter criteria is located by LMM 216. This second message is BSSMAP message 520, shown in FIG. 9. It will be appreciated that the DLRN of BSSMAP message 520 matches the SLRN of the first DTAP message 500. Consequently, a copy of BSSMAP message 520 is sent by LMM 216 to the central processing platform 214, for further inclusion in the call trace and eventual presentation to the user.

[0104] In response to receiving the BSSMAP message 520 that matches the second filter criteria, central processing platform prepares a third filter criteria set and distributes the third filter criteria set only to LMM 220. In this case, the particular filter criteria set is concerned with locating a MAP message that contains an MSISDN parameter value that matches the called number parameter value of the DTAP message 500. Since LMM 220 is the only LMM unit in monitoring system 212 that is provisioned to monitor MAP signaling traffic, the filter criteria set is sent only to LMM 220. Once again, it is assumed that a matching MAP message 540 is located by LMM 220 and subsequently returned to platform 214. As shown in FIG. 9, the selected MAP message 540 includes an MSISDN parameter value of 919460550, which matches the DTAP called number parameter value of 9194605500.

[0105] From FIG. 8 it will be appreciated that by following the process described above whereby one located signaling message involved in a traced call is used to glean information related to the next signaling message for which to search, a complete and comprehensive call trace sequence can be obtained and presented to a user. Furthermore, such call traces can include signaling messages associated with a call trace that are transmitted between an air-interface BSS and an MSC node in a wireless network. By enabling individual LMM units to intelligently and selectively search a communication link for signaling messages associated with a particular call, a considerable savings is realized in the processing power and resources required of a central processing platform. Additionally, bandwidth requirements are significantly reduced in the TCP/IP or equivalent network which facilitates communication between the central processing platform and LMM units.

[0106] Subsequent address message (SAM) processing may be performed for a called number type trace, where an ITU-based SS7 protocol is being employed. More particularly, SAM processing may be required in ISDN user part (ISUP) and/or telephone user part (TUP) called number type mobile call traces. Those skilled in the art of telecommunications will appreciate that SAM messages are used in ITU-based SS7 protocols to continuously forward as many of the called number digits as possible while the caller is still dialing. In such scenarios, the first group of dialed digits is sent in the called number field of an ISUP initial address message (IAM), with any “straggler” digits being subsequently sent in one or more associated SAM messages. In order to provide a called number trace on a called number that may be split up across multiple SS7 messages, it is necessary to perform partial matching and scanning in order to re-create the complete called number from the plurality of related SS7 messages.

[0107] For example, in the event that a called number trace has been requested, the correlator process 308 (FIG. 4) will determine whether the ISUP signaling protocol is ITU-based. If the ISUP signaling protocol is, in fact determined to be ITU-based, this simply indicates the potential presence of SAM messages. Correlator process 308 subsequently compares the digits stored in a first received ISUP IAM message with the trace digits requested by the user. If the digits in the first ISUP IAM message match exactly with the digits from the user (i.e., a perfect match), then no scanning must be done for SAM messages.

[0108] If there are fewer digits in the first ISUP IAM than the user has requested, and those ‘n’ digits do not match the first ‘n’ trace digits that the user has requested, then there is no need to perform SAM scanning, as the called numbers will not match.

[0109] However, if there are fewer digits in the first ISUP IAM than the user has requested, and those ‘n’ digits exactly match the first ‘n’ user specified trace digits, then the correlator process 308 initiates a scan for relevant SAM messages. This SAM scan is performed by finding all ISUP messages within a user-adjustable timeframe with the same OPC/DPC/CIC as the first ISUP IAM message. It will be appreciated that this “scan” is performed in a manner analogous to the basic tracing technique disclosed and discussed above. That is, one or more appropriate filter criteria sets are generated by the correlator process 308 and subsequently delivered to all appropriately provisioned LMM units in the monitoring system. Those LMMs receiving the filter criteria are adapted to search all monitored signaling messages within their storage buffers for matching SAM messages. Copies of any matching SAM messages are subsequently returned to the correlator 308 for further processing. Once all related SAM messages have been found within this block of time, the associated SAM address digits are reconstituted into the actual called number. If there is a match, then the call trace continues as usual. If there is no match, then the next IAM received by the correlator 308 is examined, and the process continues.

[0110] An alternate embodiment of a network monitoring system of the present invention is shown in FIG. 10 that includes a billing process or subsystem 600. Billing process 600 is communicatively coupled to message collector process (MCP) 300, which has been described above in detail. Billing process 600 includes a billing record generator process 602 and a billing rate database process 604. Billing record generator process 602 is adapted to receive a related sequence of mobile call signaling messages from MCP 300, and to subsequently generate an associated billing record. The billing record is passed to the user interface process 304 for presentation to a user. Such billing records may be used to invoice customers or network operators for services facilitated by one or more of the observed mobile call signaling messages. The billing rate database 604 is adapted to communicate billing rate information to the billing record generator process 602. A sample billing rate database structure is presented in FIG. 11. As indicated in FIG. 11, a number of sample billing rules are contained within a table structure associated with the billing rate database 604. The sample table or database record structure presented includes a message type field 610, a message parameter field 612, a parameter value field 614, and a billing rate field 616. Based on this simplified example data structure implementation, a first billing rate rule could specify that any observed call sequence including a DTAP message with a called number parameter value of 9195551212 should be billed at a rate of $0.05 per occurrence. As indicated in FIG. 11, wild card values may be used in the specification of message types and parameter values.

[0111] It will be appreciated that the billing rate database shown in FIG. 11 is greatly simplified for the purposes of concept explanation. In practice, considerably more complex billing rate databases structures and rules may be employed by network operators, depending upon particular network architectures and billing requirements.

[0112] Illustrated in FIG. 12 is a sample implementation of a billing subsystem equipped network monitoring system of the present invention. More particularly, FIG. 12 includes a sample mobile communication network 650, which is similar in function and form to network 450 previously described. Adapted to monitor network 650 is a network monitoring system 660 of the present invention. Again, monitoring system 660 functions in a manner similar to that of monitoring system 212 as previously described herein. However, as compared to system 212, monitoring system 660 further includes the billing process or subsystem 600 that facilitates the generation of a billing record that is associated with one or more mobile call signaling messages that are observed by LMM units provisioned throughout the monitored network. Thus, using network monitoring system 660, a network operator has the ability to simultaneously perform end-to-end type mobile call traces and generate associated billing records or invoices.

[0113] It will be understood that various details of the invention may be changed without departing from the scope of the invention. Furthermore, the foregoing description is for the purpose of illustration only, and not for the purpose of limitation-the invention being defined by the claims.