| 摘要 |
<p>Measures for detecting 210 unusual communication session events in a telecommunications network 200. A Markov model for events occurring in communication sessions conducted in the network is maintained. The maintaining includes assigning a probability of occurrence metric to a plurality of event sequences in the conducted communication sessions. In response to a given sequence of communication session events being assigned a probability of occurrence metric which exceeds a predetermined threshold, an unusual communication session event alert in association with the given sequence is triggered. The Markov model may be a first-order, or higher than first-order, Markov chain. More than one Markov chain may be used, such as for different time periods of the day or different groups of subscribers, and the chain(s) may also be adaptive, such that a 90% weighting factor may be applied every half-day to give a half-life to abnormal events. The main embodiment is to allow service providers to detect errors or unusual/abnormal behavior in large amounts of call/session logs/trails by flagging abnormal sequences compared to typical/normal behavior.</p> |
