DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
METHOD AND SYSTEM FOR MANAGEMENT ONE OR MORE ALARMS IN A NETWORK
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention generally relates to wireless communication networks, and more particularly relates to a method and system for management of one or more alarms in the wireless communication networks.
BACKGROUND OF THE INVENTION
[0002] In a Network Management System (NMS), alarms are an essential component for detecting and resolving issues within the network. When a problem arises, the alarm is raised, and once the issue is resolved, the alarm is cleared. However, in real-time scenarios, a large number of alarms can be raised and cleared repetitively within short timeframes, resulting in overlapping raise and clear events.
[0003] The existing NMS architecture includes an NMS collector that consumes alarms from a Network Element (NE) and delivers them to a Fault Processor (FP) through a message stream. The FP component plays a crucial role in processing the alarms based on their raise and clear events. Upon the raise event, the alarm is passed through an enrichment processor and inserted into persist storage. This stage involves eligibility-based traversals for correlating similar types of alarms and initiating actions such as Trouble Ticket (TT) creation and Workflow State Machine (WSM) stages.
[0004] On the other hand, when the clear event occurs, the alarm traffic is accepted, and a clearance operation is performed. Subsequently, the traffic is forwarded for TT termination. In case of unidentified clearance alarms, data is produced to the Retry FP for further processing. The Retry FP attempts to associate the unidentified clear alarms with raise events using a configured number of retries.
[0005] To optimize the NMS alarm processing and overcome the challenges posed by overlapping raise and clear events, there is a need for a Fluctuation Handling System at the FP level.
[0006] Thus, there is a need for a solution which solves the above problem, particularly for managing one or more alarms in the network.
BRIEF SUMMARY OF THE INVENTION
[0007] One or more embodiments of the present disclosure provide a method and system for management of one or more alarms in a network.
[0008] In one aspect of the present invention, the method for management of the one or more alarms in the network is disclosed. The method includes the step of receiving, by one or more processors, the one or more alarms from a network element. The method includes the step of analyzing, by the one or more processors, the one or more alarms to identify a type of the one or more alarms. The method includes the step of storing, by the one or more processors, each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms being one of a raise alarm and a clear alarm, respectively. The method includes the step of combining, by the one or more processors, each of the raise alarms with an identical time stamp to form a single raise alarm in the raise bucket and each of the clear alarms with an identical time stamp to form a single clear alarm in the clear bucket. The method includes the step of subsequent to combining, comparing, by the one or more processors, on completion of a predefined time period, each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of raise and clear alarms that correspond to each other. The method includes the step of archiving, by the one or more processors, the one or more pairs of the raise and clear alarm that correspond to each other basis the comparison.
[0009] In one embodiment, the raise alarm with no identical timestamp is stored as a new entry in raise bucket and the clear alarm with no identical timestamp is stored as a new entry in the clear bucket.
[0010] In another embodiment, the raise and the clear alarms that do not correspond to each other are processed as per a predefined alarm processing routine, wherein the predefined alarm processing routine includes actions corresponding to handling the one or more alarms and initiate appropriate actions for resolution of the alarms, such as enrichment, correlation, and trouble ticket generation.
[0011] In yet another embodiment, the raise alarms are received in response to triggering of one of an issue and an anomaly in the network and the clear alarms correspond to one of resolution and clearing of the one or more alarms.
[0012] In yet another embodiment, subsequent to storing each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms, the method further includes the step of comparing, by the one or more processors, for a predefined time period, each of the raise alarms available in the raise bucket to each other and each of the clear alarms available in the clear bucket to each other. The method further includes the step of identifying, by the one or more processors, raised alarms configured to be cleared within the predefined time period based on the comparison. The method further includes the step of archiving, by the one or more processors, the identified alarms, and thereby avoid predefined alarm processing routine for the identified alarms.
[0013] In yet another embodiment, the predefined time period is defined by one of a network provider and an autonomous body based on a predictive analysis.
[0014] In yet another embodiment, archiving the one or more pairs of the raise and clear alarm aids in retaining a record of the alarm and a corresponding resolution.
[0015] In yet another embodiment, each of the raise and the clear alarms received are stored in multiple raise and clear buckets based on a time period of receipt of each of the raise and the clear alarms.
[0016] In another aspect of the present invention, the system for management of the one or more alarms in the network is disclosed. The system includes a receiving unit configured to receive, the one or more alarms from a network element. The system includes an analyzing unit configured to analyze, the one or more alarms to identify a type of the one or more alarms. The system includes a storing unit configured to store, each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms being one of a raise alarm and a clear alarm, respectively. The system includes a combining unit configured to combine, each of the raise alarms with an identical time stamp to form a single raise alarm in the raise bucket and each of the clear alarms with an identical time stamp to form a single clear alarm in the clear bucket. The system includes a comparing unit configured to compare, on completion of a predefined time period, each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of raise and clear alarms that correspond to each other. The system includes an archiving unit configured to archive, the one or more pairs of the raise and clear alarm that correspond to each other basis the comparison.
[0017] In another aspect of the present invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by a processor is disclosed. The processor is configured to receive one or more alarms from a network element. The processor is configured to analyze one or more alarms to identify a type of the one or more alarms. The processor is configured to store each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms being one of a raise alarm and a clear alarm, respectively. The processor is configured to combine each of the raise alarms with an identical time stamp to form a single raise alarm in the raise bucket and each of the clear alarms with an identical time stamp to form a single clear alarm in the clear bucket. The processor is configured to compare, on completion of a predefined time period, each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of raise and clear alarms that correspond to each other. The processor is configured to archive one or more pairs of the raise and clear alarm that correspond to each other basis the comparison.
[0018] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.
BRIEF DESCRIPTION OF THE DRAWINGS
[0019] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0020] FIG. 1 is an exemplary block diagram of an environment for management of one or more alarms in a network, according to one or more embodiments of the present disclosure;
[0021] FIG. 2 is an exemplary block diagram of a system for management of the one or more alarms in the network, according to one or more embodiments of the present disclosure;
[0022] FIG. 3 is a schematic representation of an architecture for the system of FIG.2, according to one or more embodiments of the present disclosure;
[0023] FIG. 4 is an exemplary operation for storing the one or more alarms receiving during the predefined time period, according to one or more embodiments of the present disclosure;
[0024] FIG. 5 is a flow diagram illustrating a method for management of the one or more alarms in the network, according to one or more embodiments of the present disclosure;
[0025] FIG. 6 is a flow diagram illustrating a method for storing each of the one or more alarms into one of a raise bucket and a clear bucket, according to one or more embodiments of the present disclosure; and
[0026] FIG.7 is a flowchart illustrating a method for fluctuation handling of the one or more alarms in the network, according to one or more embodiments of the present disclosure.
[0027] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0028] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0029] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0030] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0031] The present invention discloses a system and method for management of one or more alarms in a network. The system introduces innovative mechanisms, including separate raise and clear buckets, a predefined time period, and batch processing, to streamline fault management and improve system performance. By addressing the challenges posed by overlapping alarms, the invention enhances the accuracy and efficiency of alarm processing in a Network Management System (NMS), leading to optimized network operations.
[0032] In an example, by utilizing the aforementioned concepts of the raise and clear buckets and the configurable predefined timestamp, the fluctuation alarms are identified and directly stored in the archives without performing the routine fault management steps, thus optimizing the fault management procedures to save on processing and network resources, and associated time.
[0033] FIG. 1 illustrates an exemplary block diagram of an environment 100 for management of one or more alarms in a network 105, according to one or more embodiments of the present disclosure. The environment 100 includes the network 105, a network element 110, a server 115, and a system 120. The network element 110 refers to any specific component within the network 105 that generates the one or more alarms.
[0034] For the purpose of description and explanation, the description will be explained with respect to one or more network elements 110, or to be more specific will be explained with respect to a first network element 110a, a second network element 110b, and a third network element 110c, and should nowhere be construed as limiting the scope of the present disclosure.
[0035] In an embodiment, each of the first network element 110a, the second network element 110b, and the third network element 110c is one of, but are not limited to, hubs, switches, routers, bridges, gateways, modems, repeaters, and access points.
[0036] Each of the first network element 110a, the second network element 110b, and the third network element 110c is configured to transmit the one or more alarms via the network 105.
[0037] The network 105 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 105 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0038] The network 105 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth. The network 105 may also include, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, a VOIP or some combination thereof.
[0039] The environment 100 includes the server 115 accessible via the network 105. The server 115 may include by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, one or more processors executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defence facility side, or any other facility that provides service.
[0040] The environment 100 further includes the system 120 communicably coupled to the server 115 and each of the first network element 110a, the second network element 110b, and the third network element 110c via the network 105. The system 120 is configured for management of one or more alarms in the network 105. The system 120 is adapted to be embedded within the server 115 or is embedded as the individual entity.
[0041] Operational and construction features of the system 120 will be explained in detail with respect to the following figures.
[0042] FIG. 2 illustrates an exemplary block diagram of the system 120 for management of the one or more alarms in the network 105, according to one or more embodiments of the present disclosure. The system 120 includes one or more processors 205, a memory 210, an interface unit 215, a distributed I/O cache 260, and a database 265. The one or more processors 205, hereinafter referred to as the processor 205 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions. As per the illustrated embodiment, the system 120 includes one processor 205. However, it is to be noted that the system 120 may include multiple processors as per the requirement and without deviating from the scope of the present disclosure.
[0043] Among other capabilities, the processor 205 is configured to fetch and execute computer-readable instructions stored in the memory 210. The memory 210 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to create or share data packets over a network service. The memory 210 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as EPROMs, FLASH memory, unalterable memory, and the like.
[0044] The interface unit 215 includes a variety of interfaces, for example, interfaces for a Graphical User Interface (GUI), a web user interface, a Command Line Interface (CLI), and the like. The interface unit 215 facilitates communication of the system 125. In one embodiment, the interface unit 215 provides a communication pathway for one or more components of the system 125. Examples of the one or more components include, but are not limited to, the network element 110, the distributed I/O cache 260, and the database 265.
[0045] In an embodiment, the distributed I/O cache 260 is a memory layer that temporarily stores the data pertaining to the one or more alarms that is being transferred between a first network element 110a and a Central Processing Unit (CPU). The primary purpose of the distributed I/O cache 260 is to speed up data access times and improve the overall efficiency of data processing. The distributed I/O cache 260 performs faster TPS processing, which reduces latency, increases throughput, and optimizes utilization of resources, thus improving system performance, reduces load, and enhances user experience.
[0046] The database 265 is configured to store data pertaining to the one or more alarms. Further, the database 265 provides structured storage, support for complex queries, and enables efficient data retrieval and analysis. The database 265 is one of, but is not limited to, one of a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a Input/ Output (I/O) cache databases, and so forth. The foregoing examples of database types are non-limiting and may not be mutually exclusive e.g., a database can be both commercial and cloud-based, or both relational and open-source, etc.
[0047] Further, the processor 205, in an embodiment, may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 205. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 205 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for processor 205 may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 210 may store instructions that, when executed by the processing resource, implement the processor 205. In such examples, the system 120 may comprise the memory 210 storing the instructions and the processing resource to execute the instructions, or the memory 210 may be separate but accessible to the system 120 and the processing resource. In other examples, the processor 205 may be implemented by electronic circuitry.
[0048] In order for the system 120 to manage the one or more alarms in the network 105, the processor 205 includes a receiving unit 220, an analyzing unit 225, a storing unit 230, a combining unit 235, a comparing unit 240, an identifying unit 245 and an archiving unit 250 communicably coupled to each other for managing the one or more alarms in the network 105.
[0049] The receiving unit 220, the analyzing unit 225, the storing unit 230, the combining unit 235, the comparing unit 240, the identifying unit 245 and the archiving unit 250 in an embodiment, may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 205. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 205 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 210 may store instructions that, when executed by the processing resource, implement the processor. In such examples, the system 120 may comprise the memory 210 storing the instructions and the processing resource to execute the instructions, or the memory 210 may be separate but accessible to the system 120 and the processing resource. In other examples, the processor 205 may be implemented by electronic circuitry.
[0050] The receiving unit 220 is configured to receive the one or more alarms from the network element 110. The one or more alarms are notifications or alerts generated by the network element 110 when it detects a fault, anomaly, or significant event.
[0051] Upon receiving the one or more alarms from the network element 110, the analyzing unit 225 is configured to analyze the one or more alarms to identify a type of the one or more alarms. In an embodiment, the type of the one or more alarms being one of a raise alarm and a clear alarm. The analyzing unit 225 is configured to process the one or more alarms data to determine the details of the one or more alarms to identify its type, severity, source, and possible causes. Each alarm contains specific information such as the type of fault, the affected component, the time of occurrence, and possibly additional diagnostic data.
[0052] Upon analyzing the one or more alarms to identify the type of the one or more alarms, the storing unit 230 is configured to store each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms being one of the raise alarm and the clear alarm, respectively. The raise alarms are received in response to triggering of one of the issues and the anomaly in the network 105. The clear alarms are received in correspond to one of resolution and clearing of the one or more alarms. In an embodiment, the raise bucket and the clear bucket are referred to as the distributed I/O cache 260.
[0053] Upon storing each of the one or more alarms into one of the raise bucket and the clear bucket, the combining unit 235 is configured to combine each of the raise alarms with an identical time stamp to form a single raise alarm in the raise bucket and each of the clear alarms with an identical time stamp to form a single clear alarm in the clear bucket. In one embodiment, the raise alarm with no identical timestamp is stored as a new entry in the raise bucket and the clear alarm with no identical timestamp is stored as a new entry in the clear bucket.
[0054] Upon combining each of the raise alarms and clear alarms with the identical time stamp, the comparing unit 240 is configured to compare each of the raise alarms available in the raise bucket to each other and each of the clear alarms available in the clear bucket to each other for a predefined time period. In an embodiment, the predefined time period is defined by one of a network provider and an autonomous body based on a predictive analysis. The predictive analysis is performed by using an Artificial Intelligence (AI)/Machine Learning (ML) model 255. The AI/ML model 255 is trained in Network Function (NF), NF types, NF service, requests/responses, and raise alarms, clear alarms timestamps to predict a dynamic time window for a particular raised alarm. Each of the raise and the clear alarms received are stored in multiple raise and clear buckets based on a time period of receipt of each of the raise and the clear alarms.
[0055] Upon comparing of the raise and clear alarms in the raise and clear buckets, the identifying unit 245 is configured to identify the raised alarms configured to be cleared within the predefined time period based on the comparison. Further, the comparing unit 240 is configured to compare each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of the raise and clear alarms that correspond to each other based on completion of the predefined time period.
[0056] Upon comparing each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket, the archiving unit 250 is configured to archive the identified alarms, and thereby avoid predefined alarm processing routine for the identified alarms. The raise and the clear alarms that do not correspond to each other are processed as per the predefined alarm processing routine. In an embodiment, the predefined alarm processing routine includes actions corresponding to handling the one or more alarms and initiating appropriate actions for resolution of the alarms, such as enrichment, correlation, and Trouble Ticket (TT) generation.
[0057] Further, the archiving unit 250 is configured to archive the one or more pairs of the raise and clear alarm that correspond to each other basis on the comparison. The one or more pairs of the raise and clear alarm aids in retaining a record of the one or more alarms and a corresponding resolution. The record of the one or more alarms and the corresponding resolution enables performance evaluation of the NMS and the network element 110. The network provided analyses the plurality of metrics such as mean time to repair (MTTR), resolution rates, and downtime durations based on the one or more pairs of raise and clear alarm data. By doing so, the system 120 improves processing efficiency by collecting one or more alarms within the predefined time period and handling the one or more alarms in batches rather than individually, which is beneficial for the NMS dealing with a high volume of alarms, minimizing redundant processing to improve memory space, improving processing speed, and optimizing system performance.
[0058] FIG. 3 is a schematic representation of an architecture 300 for the system 120 of FIG.2, according to one or more embodiments of the present disclosure.
[0059] The collector unit 305 collects stream data from the network element 110, parses and transforms the stream data into alarms of standardized format, and pushes the one or more alarms into an alarm stream. The alarms can be of two types, the raise alarm and the clear alarm. The stream data includes Fault, Configuration, Accounting, Performance, and Security (FCAPs) information.
[0060] The collector unit 305 receives FCAPs data over different protocols, such as, but not limited to, SNMP (Simple Network Management Protocol), syslog, Representational State Transfer (REST), Simple Object Access Protocol (SOAP), or Kafka, from the network element 110. The collector unit 305 converts the FCAPs data into a generic alarm format, making it compatible with the system's processing requirements. Upon conversion, the collector unit 305 forwards the one or more alarms to the FM master unit 310 for further processing.
[0061] The FM master unit 310 consumes the one or more alarms from the alarm stream and stores them into the distributed I/O cache 260. Upon identifying that the one or more alarms are already stored, the FM master unit 310 updates occurrence count and the timestamp array of the one or more alarms in the distributed I/O cache 260.
[0062] The FM raise unit 320 fetches the one or more alarms from the distributed I/O cache 260 based on their unique identifiers and performs various operations on the one or more alarms, such as planned event processing, AI-based correlation to identify patterns or related events, and trouble ticketing to initiate incident management processes. The FM raise unit 320 also updates metadata associated with the one or more alarms, enriches the one or more alarms with additional information or context, and inserts them into the database 265.
[0063] The FM clear unit 315 retrieves the clear alarms corresponding to the unique alarm identifiers from the distributed I/O cache 260 and checks the database 265 for presence of associated raise alarms. The FM clear unit 315 deletes the raise alarms from an active section when the associated raise alarms are identified to be present and stream the clear alarms for retrying when the associated raise alarms are identified to be absent. After deleting the raise alarms from the active section, the FM clear unit 315 adds clearance metadata to the one or more alarms and stores them in an archived section of the database 265.
[0064] The FM retry unit 325 checks the database 265 for presence of the raise alarms corresponding to retry alarm data and deletes the raise alarms from the active section when identified to be present. If the raise alarms are not found, the FM retry unit 325 increments the retry count and reproduces the data into the retry stream for subsequent retries. This non-blocking retry mechanism avoids unnecessary blocking of application threads and enables handling of exceptional cases or delayed processing. The FM callback unit 330 is configured to accept the traffic from the processor 205 and update physical/logical enrichment and forward the data further for correlation and TT creation.
[0065] The Enrichment Engine (EE) 335 is configured to enhance the information provided by the network element 110, the one or more alarms sent by the network element 110 have limited and specific attributes associated with the current state of the network element 110. The EE 335 is configured add to one or more parameters of the information. The one or more parameters include, but not limited to, a physical location of the network element 110, a site identifier (SITE), a shelf identifier (SHELF) and a port identifier (PORT) of the network element 110 based on the prestored data according to the Network Element Identifier (NEID). The prestored data combined with state data in the one or more alarms are further utilized to correlate the one or more alarms having common event triggers to be associated with each other.
[0066] The Correlation Engine (CE) 340 is configured to associate one or more alarms within a timeframe which might have similar trigger conditions based on the attributes in the enriched alarm updated by the EE 335. The enriched alarm contains the state data provided by the network element 110 and the physical and logical enrichment data added by the EE 335. The correlated alarms associated together by means of a correlation identifier (ID) and a common trouble ticket is raise for resolving the related fault that triggered the one or more alarms.
[0067] FIG. 4 illustrates an exemplary operation for storing the one or more alarms received during the predefined time period, according to one or more embodiments of the present disclosure.
[0068] The exemplary embodiment as illustrated includes a plurality of buckets B0 to Bn. Further, the plurality of buckets B0 to B8 include both the raise and the clear bucket. When the one or more alarms from a current bucket, such as the bucket B3 are being processed, any incoming new alarms is configured to be stored in an alternate bucket.
[0069] In this regard, for the purpose of explanation, the predefined time period is set to 5 seconds by the network operator. Accordingly, the incoming new alarm is configured to be stored in the bucket B8. Alternatively, if the predefined time period is set to 2 seconds, the incoming new alarm is configured to be stored in the bucket B5.
[0070] FIG. 5 is a flow diagram illustrating a method 500 for management of the one or more alarms in the network 105, according to one or more embodiments of the present disclosure.
[0071] At step 505, the method 500 includes the step of receiving the one or more alarms from the network element 110 by the receiving unit 220. The one or more alarms are notifications or alerts generated by the network element 110 when it detects a fault, anomaly, or significant event.
[0072] At step 510, the method 500 includes the step of analyzing the one or more alarms to identify a type of the one or more alarms by the analyzing unit 225. In an embodiment, the type of the one or more alarms being one of the raise alarm and the clear alarm. The analyzing unit 225 is configured to process the one or more alarms data to determine the details of the one or more alarms to identify its type, severity, source, and possible causes.
[0073] At step 515, the method 500 includes the step of storing each of the one or more alarms into one of a raise bucket and a clear bucket by the storing unit 230 based on the type of the one or more alarms being one of the raise alarm and the clear alarm, respectively. The raise alarms are received in response to triggering of one of the issue and the anomaly in the network 105. The clear alarms are received in correspond to one of resolution and clearing of the one or more alarms.
[0074] At step 520, the method 500 includes the step of combining each of the raise alarms with an identical time stamp to form a single raise alarm in the raise bucket and each of the clear alarms with an identical time stamp to form a single clear alarm in the clear bucket by the combining unit 235. In one embodiment, the raise alarm with no identical timestamp is stored as a new entry in the raise bucket and the clear alarm with no identical timestamp is stored as a new entry in the clear bucket.
[0075] At step 525, the method 500 includes the step of comparing each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of the raise and clear alarms that correspond to each other by the comparing unit 240 based on completion of the predefined time period.
[0076] At step 530, the method 500 includes the step of archiving the one or more pairs of the raise and clear alarm that correspond to each other basis on the comparison by the archiving unit 250. The one or more pairs of the raise and clear alarm aids in retaining a record of the one or more alarms and a corresponding resolution. The record of the one or more alarms and the corresponding resolution enables performance evaluation of the NMS and the network element 110. By doing so, the method 500 enables improving processing efficiency by collecting one or more alarms within the predefined time period and handling the one or more alarms in batches rather than individually, which is beneficial for the NMS dealing with a high volume of alarms, minimizing redundant processing to improve memory space, improving processing speed, and optimizing system performance.
[0077] FIG. 6 is a flow diagram illustrating a method 515 for storing each of the one or more alarms into one of the raise bucket and the clear bucket, according to one or more embodiments of the present disclosure.
[0078] At step 605, the method 515 includes the step of comparing each of the raise alarms available in the raise bucket to each other and each of the clear alarms available in the clear bucket to each other for the predefined time period by the comparing unit 240. In an embodiment, the predefined time period is defined by one of a network provider and an autonomous body based on a predictive analysis. The predictive analysis is performed by using an Artificial Intelligence (AI) model (not shown in FIG). The AI model is trained on a Network Function (NF), NF types, NF service, requests/responses, and raise alarms, clear alarms timestamps to predict a dynamic time window for a particular raised alarm. Each of the raise and the clear alarms received are stored in multiple raise and clear buckets based on a time period of receipt of each of the raise and the clear alarms.
[0079] At step 610, the method 515 includes the step of identifying the raised alarms configured to be cleared within the predefined time period based on the comparison by the identifying unit 245. Further, the comparing unit 240 is configured to compare each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of the raise and clear alarms that correspond to each other based on completion of the predefined time period.
[0080] At step 616, the method 515 includes the step of archiving the identified alarms by the archiving unit 250 based on comparing each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket, and thereby avoid predefined alarm processing routine for the identified alarms. The raise and the clear alarms that do not correspond to each other are processed as per the predefined alarm processing routine. In an embodiment, the predefined alarm processing routine includes actions corresponding to handling the one or more alarms and initiating appropriate actions for resolution of the alarms, such as enrichment, correlation, and Trouble Ticket (TT) generation.
[0081] FIG.7 is a flowchart illustrating a method 700 for fluctuation handling of the one or more alarms in the network 105, according to one or more embodiments of the present disclosure.
[0082] At step 702, the raise alarm flows through an enrichment processor and inserts the raise alarm into the distributed I/O cache 260, the raise alarm has different levels of eligibility-based traversals for correlating the similar type of alarms, Trouble Ticket (TT) and Workflow State Machine (WSM) stages.
[0083] Similarly, when the clear alarm, accept the traffic and perform clearance operation and forward the traffic further for TT termination. If the one or more alarms are not cleared, then it retries the unidentified clear alarms and try to associate it with the raise events with configured number of retries.
[0084] At step 704, determining whether the raise alarm and the clear alarm occur in the raise bucket and the clear bucket with the same timestamp.
[0085] If the raise alarm occurs, check if there are common alarms in the raise bucket with the same timestamp. If yes, merge the one or more alarms together as the single alarm in the raise bucket. If not, add the raise alarm as the new entry in the raise bucket.
[0086] Similarly, when the clear alarm occurs, check if there are common alarms in the clear bucket with the same timestamp. If yes, merge the one or more alarms together as the single alarm in the clear bucket. If not, add the clear alarm as the new entry in the clear bucket.
[0087] At step 706, After the delay period elapses, a separate process or job is scheduled to compare the alarms in the raise and clear buckets. If the raise alarm and the clear alarm have any common alarms in the raise bucket and which have a corresponding raise or clear event within the delay, directly send them for archival.
[0088] At step 708, for the remaining alarms, continue with the normal lifecycle process for raise and clear events. The fluctuation handling job allows you to gather raise and clear alarms occurring within the same duration and store them in the separate buckets. The delay period gives time for potential overlapping alarms to be collected. The scheduled job handles the comparison and further processing of the one or more alarms, either sending them directly to archival or following the normal lifecycle process
[0089] The present invention discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by a processor 205 is disclosed. The processor 205 is configured to receive one or more alarms from a network element. The processor 205 is configured to analyze one or more alarms to identify a type of the one or more alarms. The processor 205 is configured to store each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms being one of a raise alarm and a clear alarm, respectively. The processor 205 is configured to combine each of the raise alarms with an identical time stamp to form a single raise alarm in the raise bucket and each of the clear alarms with an identical time stamp to form a single clear alarm in the clear bucket. The processor 205 is configured to compare, on completion of a predefined time period, each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of the raise and clear alarms that correspond to each other. The processor 205 is configured to archive one or more pairs of the raise and clear alarm that correspond to each other basis the comparison.
[0090] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-6) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0091] The present disclosure incorporates technical advancement of comparing each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of the raise alarm and the clear alarm that correspond to each other based on completion of the predefined time period. The present invention generates the one or more alarms within the predetermined time period and handles them in batches rather than individually, which minimizes redundant processing, improves processing speed and optimizes system performance.
[0092] The present disclosure incorporates the advantage of:
[0093] Overlapping Issue Resolution: By introducing separate raise and clear buckets and grouping alarms with the identical timestamp, the present invention effectively resolves the issue of overlapping raise and clear events, reducing the chances of conflicting or inaccurate alarm states. This streamlines the alarm management process and ensures accurate tracking of alarm events.
[0094] Efficient Processing: By collecting the one or more alarms within the predefined time period, will process them in a batch manner rather than individually. In this regard, the present invention improves the efficiency of alarm handling, especially when dealing with a high volume of alarms. The scheduled job to compare the alarms in the buckets enables streamlined processing and reduces the processing overhead. The present invention optimizes the lifecycle process for repetitive alarms by minimizing the DB hits for insertion, updating and deletion.
[0095] Improved Accuracy: By avoiding the processing of individual overlapping alarms, the approach helps maintain the accuracy and integrity of alarm states. Grouping them together reduces the risk of inconsistencies or false alarm states caused by conflicting raise and clear events.
[0096] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS
[0097] Environment - 100
[0098] Network - 105
[0099] Network Element- 110
[00100] Server - 115
[00101] System - 120
[00102] Processor -205
[00103] Memory – 210
[00104] Interface unit – 215
[00105] Receiving unit- 220
[00106] Analyzing unit - 225
[00107] Storing unit- 230
[00108] Combining unit- 235
[00109] Comparing unit- 240
[00110] Identifying unit-245
[00111] Archiving unit-250
[00112] AI/ML model-255
[00113] Distributed I/O cache-260
[00114] Database- 265
[00115] One or more primary processors – 305
[00116] Memory of user equipment – 310.

,CLAIMS:CLAIMS
We Claim:
1. A method (500) of management of one or more alarms in a network (105), the method (500) comprising the steps of:
receiving (505), by one or more processors (205), the one or more alarms from a network element (110);
analyzing (510), by the one or more processors (205), the one or more alarms to identify a type of the one or more alarms;
storing (515), by the one or more processors (205), each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms being one of a raise alarm and a clear alarm, respectively;
combining (520), by the one or more processors (205), each of the raise alarms with an identical time stamp to form a single raise alarm in the raise bucket and each of the clear alarms with an identical time stamp to form a single clear alarm in the clear bucket;
subsequent to combining, comparing (525), by the one or more processors (205), on completion of a predefined time period, each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of raise and clear alarms that correspond to each other; and
archiving (530), by the one or more processors (205), the one or more pairs of the raise and clear alarm that correspond to each other basis on comparison.

2. The method (500) as claimed in claim 1, wherein the raise alarm with no identical timestamp is stored as a new entry in the raise bucket and the clear alarm with no identical time stamp is stored as a new entry in the clear bucket.

3. The method (500) as claimed in claim 1, wherein the raise and the clear alarms that do not correspond to each other are processed as per a predefined alarm processing routine, wherein the predefined alarm processing routine includes actions corresponding to handling the one or more alarms and initiate appropriate actions for resolution of the alarms, such as enrichment, correlation, and trouble ticket generation.

4. The method (500) as claimed in claim 1, wherein the raise alarms are received in response to triggering of one of an issue and an anomaly in the network (105) and the clear alarms correspond to one of resolution and clearing of the one or more alarms.

5. The method (500) as claimed in claim 1, wherein subsequent to storing (515) each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms, the method (500) further comprises the step of:
comparing (605), by the one or more processors (205), for a predefined time period, each of the raise alarms available in the raise bucket to each other and each of the clear alarms available in the clear bucket to each other;
identifying (610), by the one or more processors (205), raised alarms configured to be cleared within the predefined time period based on the comparison; and
archiving (615), by the one or more processors (205), the identified alarms, and thereby avoid predefined alarm processing routine for the identified alarms.

6. The method (500) as claimed in claim 1, wherein the predefined time period is defined by one of a network provider and an autonomous body based on a predictive analysis.

7. The method (500) as claimed in claim 1, wherein archiving the one or more pairs of the raise and clear alarm aid in retaining a record of the alarms and a corresponding resolution.

8. The method (500) as claimed in claim 1, wherein each of the raise and the clear alarms received are stored in multiple raise and clear buckets based on a time period of receipt of each of the raise and the clear alarms.

9. A system (120) for management of one or more alarms in a network (105), the system (120) comprising:
a receiving unit (220) configured to, receive, the one or more alarms from a network element (110);
an analyzing unit (225) configured to analyze, the one or more alarms to identify a type of the one or more alarms;
a storing unit (230) configured to store, each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms being one of a raise alarm and a clear alarm, respectively;
a combining unit (235) configured to combine, each of the raise alarms with an identical time stamp to form a single raise alarm in the raise bucket and each of the clear alarms with an identical time stamp to form a single clear alarm in the clear bucket;
a comparing unit (240) configured to compare, on completion of a predefined time period, each of the raise alarms in the raise bucket with each of the clear alarms in the clear bucket to identify one or more pairs of raise and clear alarms that correspond to each other; and
an archiving unit (250) configured to archive, the one or more pairs of the raise and clear alarm that correspond to each other basis the comparison.

10. The system (120) as claimed in claim 9, wherein the raise alarm with no identical timestamp is stored as a new entry in the raise bucket and the clear alarm with no identical time stamp is stored as a new entry in the clear bucket.

11. The system (120) as claimed in claim 9, wherein the raise and the clear alarms that do not correspond to each other are processed as per a predefined alarm processing routine, wherein the predefined alarm processing routine includes actions corresponding to handling the one or more alarms and initiate appropriate actions for resolution of the alarms, such as enrichment, correlation, and trouble ticket generation.

12. The system (120) as claimed in claim 9, wherein the raise alarms are received in response to triggering of one of an issue and an anomaly in the network (105) and the clear alarms correspond to one of resolution and clearing of the one or more alarms.

13. The system (120) as claimed in claim 9, wherein subsequent to storing each of the one or more alarms into one of a raise bucket and a clear bucket based on the type of the one or more alarms, the system (120) further comprises:
the comparing unit (240) configured to, compare, for a predefined time period, each of the raise alarms available in the raise bucket to each other and each of the clear alarms available in the clear bucket to each other;
an identifying unit (245) configured to, identify the raised alarms configured to be cleared within the predefined time period based on the comparison; and
the archiving unit (250) configured to, archive the identified alarms, and thereby avoid predefined alarm processing routine for the identified alarms.

14. The system (120) as claimed in claim 1, wherein the predefined time period is defined by one of a network provider and an autonomous body based on a predictive analysis.

15. The system (120) as claimed in claim 1, wherein the system (120) comprises:
the archiving unit (250) configured to, archive the one or more pairs of the raise and clear alarm aid in retaining a record of the alarm and a corresponding resolution.

16. The system (120) as claimed in claim 1, wherein each of the raise and the clear alarms received are stored in multiple raise and clear buckets based on a time period of receipt of each of the raise and the clear alarms.