DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
SYSTEM AND METHOD FOR DETECTING ANOMALIES IN A COMMUNICATION NETWORK

2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to the field of wireless communication systems, more particularly relates to a method and system for detecting anomalies in a communication network.
BACKGROUND OF THE INVENTION
[0002] In general, the present telecommunications world has a large network infrastructure and a significant data volume across the network. As a result, identifying the cause of a network failure is not only time-consuming but also requires a substantial amount of effort. End-users are required to manually analyze large volumes of data by comparing them with previous incoming data, even if provided in the form of periodic (daily and/or hourly) reports. Furthermore, end-users have to identify the reasons for the failure. Even with a live streaming data dashboard, users have to continuously monitor the data flow to detect any significant deviations.
[0003] Therefore, there is a need for a solution that substantially reduces the burden of manual work for issue detection, making the process more time efficient. It is also desirable to have a solution that helps identify deviations from past data behavior, pinpoint anomalies for proactive monitoring.
SUMMARY OF THE INVENTION
[0004] One or more embodiments of the present disclosure provide a method and system detecting anomalies in a communication network.
[0005] In one aspect of the present invention, a method for detecting anomalies in a communication network is disclosed. The method includes the step of receiving, by one or more processors, at a trained model, a generated file pertaining to current data of a plurality of Network Functions (NFs). The method further includes the step of detecting in real time, by the one or more processors, one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs utilizing the trained model. The method further includes the step of notifying, by the one or more processors, a user in a real time pertaining to the detected one or more anomalies.
[0006] In one embodiment, the step of receiving the generated file pertaining to the current data of the plurality of NFs at the trained model, includes the steps of, collecting, by the one or more processors, the current data pertaining to the plurality of NFs. Further, writing and storing, by the one or more processors, the current data pertaining to the plurality of NFs in a file system, utilizing an Artificial Intelligence Data Record (AIDR). Furthermore, transmitting, by the one or more processors, the current data to a conductor, and from the conductor to at least one of, a normalizer or a message broker to preprocess the current data. Thereafter, retrieving, by the one or more processors, utilizing the AIDR, the pre-processed current data to generate the file pertaining to the current data of plurality of NFs and transmitting, by the one or more processors, the generated file as an input to the trained model
[0007] In another embodiment, the generated file is related to a machine-readable data generated by the one or more processors utilizing the AIDR in at least one of, a vectorized form which is provided as the input to the trained model.
[0008] In yet another embodiment, the trained model is trained with the generated file of the current data and historical data pertaining to the plurality of NFs.
[0009] In yet another embodiment, the trained model is at least one of, an Artificial Intelligence/Machine Learning (AI/ML) model.
[0010] In yet another embodiment, the method comprises the step of notifying, by the one or more processors, the at least one user equipment on receipt of the request pertaining to the callback service at the at least one instance.
[0011] In yet another embodiment, the step of detecting in real time, by the one or more processors, one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs utilizing the trained model, includes the steps of, comparing, by the one or more processors, utilizing the trained model, the generated file with the one or more parameters pertaining to the current data of the plurality of NFs with the one or more parameters of the historical data pertaining to the plurality of NFs. Further, in response to determining, by the one or more processors, deviation in the one or more parameters pertaining to the current data compared to the one or more parameters pertaining to the historical data of the plurality of NFs, detecting, by the one or more processors, presence of the one or more anomalies related to the plurality of NFs.
[0012] In yet another embodiment, the trained model learns the one or more parameters of the current data and the historical data that include at least one of, trends, patterns, behavior, clear code values and tolerance level of network failure at each layer from the historical data pertaining to the plurality of NFs.
[0013] In yet another embodiment, the one or more anomalies are related to procedure-based faults, overall clear codes, and specific error codes pertaining to the plurality of NFs.
[0014] In yet another embodiment, the step of, notifying, by the one or more processors, a user in a real time pertaining to the detected one or more anomalies further includes a step of recommending, by the one or more processors, the user one or more remedial actions to resolve the detected one or more anomalies.
[0015] In another aspect of the present invention, a system for detecting anomalies in a communication network is disclosed. The system includes a transceiver configured to receive at a trained model, a generated file pertaining to current data of a plurality of Network Functions (NFs). The system further includes a detection unit, configured to detect in real time, one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs utilizing the trained model. The system further includes a notification unit, configured to, notify, a user in a real time pertaining to the detected one or more anomalies.
[0016] In another aspect of the present invention, a User Equipment (UE) is disclosed. One or more primary processors communicatively coupled to one or more processors. The one or more primary processors coupled with a memory. The memory stores instructions which when executed by the one or more primary processors causes the UE to transmit a request to detect anomalies in a communication network and receive notification from the one or more processors pertaining to the detected one or more anomalies.
[0017] In yet another aspect of the present invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by a processor. The processor is configured to receive at a trained model, a generated file pertaining to current data of a plurality of Network Functions (NFs). The processor is further configured to detect in real time, one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs utilizing the trained model. The processor is further configured to notify, a user in a real time pertaining to the detected one or more anomalies.
[0018] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.
BRIEF DESCRIPTION OF THE DRAWINGS
[0019] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0020] FIG. 1 is an exemplary block diagram of an environment for detecting anomalies in a communication network, according to one or more embodiments of the present invention;
[0021] FIG. 2 is an exemplary block diagram of a system for detecting anomalies in a communication network, according to one or more embodiments of the present invention;
[0022] FIG. 3 is an exemplary flow diagram of the system of FIG. 2, according to one or more embodiments of the present invention;
[0023] FIG. 4 is an exemplary signal flow diagram illustrating the flow for detecting anomalies in a communication network, according to one or more embodiments of the present disclosure; and
[0024] FIG. 5 is a flow diagram of a method for detecting anomalies in a communication network, according to one or more embodiments of the present invention.
[0025] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0026] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0027] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0028] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0029] The present disclosure provides describes about the prediction of anomalies in a communication network. The invention utilizes an Artificial Intelligence/Machine Learning (AI/ML) model for prediction of anomalies in real time related to a plurality of Network Functions (NFs) in the communication network. The invention provides notifications regarding the predicted one or more anomalies to the user and further provides recommendations to the user pertaining to one or more remedial actions to resolve the predicted one or more anomalies.
[0030] Referring to FIG. 1, FIG. 1 illustrates an exemplary block diagram of an environment 100 for detecting anomalies in a communication network, according to one or more embodiments of the present invention. The environment 100 includes, a User Equipment (UE) 102, a server 104, a communication network 106, a system 108, and a plurality of Network Functions (NFs) 110. The UE 102 aids a user to interact with the system 108 by transmitting a request to detect anomalies in the communication network 106.
[0031] For the purpose of description and explanation, the description will be explained with respect to one or more user equipment’s (UEs) 102, or to be more specific will be explained with respect to a first UE 102a, a second UE 102b, and a third UE 102c, and should nowhere be construed as limiting the scope of the present disclosure. Each of the at least one UE 102 namely the first UE 102a, the second UE 102b, and the third UE 102c is configured to connect to the server 104 via the communication network 106. Each of the at least one UE 102 pertains to the user requesting to detect anomalies.
[0032] In an embodiment, each of the first UE 102a, the second UE 102b, and the third UE 102c is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as Virtual Reality (VR) devices, Augmented Reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0033] The communication network 106 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The communication network 106 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0034] The communication network 106 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth. The communication network 106 may also include, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, a VOIP or some combination thereof.
[0035] The environment 100 includes the server 104 accessible via the communication network 106. The server 104 may include by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, a processor executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0036] The environment 100 includes the plurality of Network Functions (NFs) 110 communicably coupled to the server 104 via the communication network 106. A Network Function (NF) is a functional building block within a network infrastructure or the communication network 106, which has well-defined external interfaces and a well-defined functional behavior. In particular, a NF is often a network node or a physical appliance. For example, the plurality of Network Functions (NFs) 110 includes at least one of, but not limited to, an Access and Mobility Management Function (AMF), a Session Management Function (SMF), a User plane function (UPF), and Policy Control Function (PCF).
[0037] The environment 100 further includes the system 108 communicably coupled to the server 104, the plurality of NFs 110, and the UE 102 via the communication network 106. The system 108 is adapted to be embedded within the server 104 or is embedded as the individual entity.
[0038] Operational and construction features of the system 108 will be explained in detail with respect to the following figures.
[0039] FIG. 2 is an exemplary block diagram of the system 108 for detecting anomalies in a communication network, according to one or more embodiments of the present invention.
[0040] As per the illustrated and preferred embodiment, the system 108 for detecting anomalies in a communication network 106, the system 108 includes one or more processors 202, a memory 204, a file system 206, an Artificial Intelligence Data Record (AIDR) 216, a conductor 218, a Normalizer or a Message Broker 220. The one or more processors 202 includes a transceiver 208, a detection unit 210, a notification unit 212, and a trained model 214. The one or more processors 202, hereinafter referred to as the processor 202, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions. However, it is to be noted that the system 108 may include multiple processors as per the requirement and without deviating from the scope of the present disclosure. Among other capabilities, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204.
[0041] As per the illustrated embodiment, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204 as the memory 204 is communicably connected to the processor 202. The memory 204 is configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed for detecting anomalies in the communication network 106. The memory 204 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0042] As per the illustrated embodiment, the file system 206 is configured to store data pertaining to the plurality of NFs. The file system 206 is one of, but not limited to, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of file system 206 types are non-limiting and may not be mutually exclusive e.g., the database can be both commercial and cloud-based, or both relational and open-source, etc.
[0043] In an embodiment, initially a request is transmitted by the user via the UE 102 to detect the anomalies in the communication network 106. In an alternate embodiment, there is no requirement for the user to transmit the request for the detection of the anomalies in the communication network 106 as the system 108 is capable of automatically detecting the anomalies in the communication network 106 in real time.
[0044] In an embodiment, the transceiver 208 of the processor 202 is configured to receive a generated file pertaining to current data of a plurality of NFs 110 at the trained model 214. Initially, the current data pertaining to the plurality of NFs 110 is collected by the transceiver 208. Further, the collected current data pertaining to the plurality of NFs 110 is written/stored in the file system 206 utilizing the AIDR 216. In one embodiment, the current data is the incoming data such as streaming data records, call detailed records, or summary logs pertaining to the plurality of NFs 110 flowing through the communication network 106. In other words, recent data pertaining to the plurality of NFs 110 is collected in order to generate the file. For example, in order to generate the file, the last 1 hour data pertaining to the plurality of NFs 110 is inferred as the current data.
[0045] Furthermore, the transceiver 208 transmits the current data to the conductor 218, and from the conductor 218 the current data is transmitted to the at least one of, the normalizer or the message broker 220 to preprocess the current data. In one embodiment, the conductor 218 performs the current data enrichment. The data enrichment is a process of enhancing the current data by adding information received from external sources or existing datasets to improve the quality of the current data. For example, the user might enrich the current data with the data stored in the file system 206. Normalizer performs the normalization which refers to a process that makes something more normal or regular. For example, the normalizer removes the null values, irrelevant values from the current data. The message broker enables applications, systems and services to communicate with each other and exchange information by translating messages between formal messaging protocols.
[0046] Thereafter, the transceiver 208 retrieves the pre-processed current data utilizing the AIDR 216 to generate the file pertaining to the current data of plurality of NFs 110. In particular, the AIDR 216 polls the current data and generates the file in the file system 206. In one embodiment, the transceiver 208 of the processor 202 is configured to receive the generated file pertaining to current data of the plurality of NFs 110 as an input to the trained model 214.
[0047] In an embodiment, the trained model 214 receives the generated file pertaining to current data of the plurality of NFs 110. The generated file is related to a machine-readable data generated by the processor 202 utilizing the AIDR 216 in at least one of, but not limited to, a vectorized form which is provided as the input to the trained model 214. The trained model is at least one of, but not limited to, an Artificial Intelligence/Machine Learning (AI/ML) model.
[0048] The trained model 214 is trained with the generated file of the current data and historical data pertaining to the plurality of NFs 110 in the communication network 106. The trained model 214 learns one or more parameters of the current data and the historical data that include at least one of, but not limited to, trends, patterns, behavior, clear code values and tolerance level of network failure at each layer from the historical data pertaining to the plurality of NFs 110. In one embodiment, the each layer pertains to at least one of, but not limited to, a geographical layer and a logical layer. For example, the trained model 214 learns one or more parameters pertaining to the network failure at the geographical layer such as a circle, a cluster and a city. Furthermore, the trained model 214 learns one or more parameters pertaining to the network failure at the one or more instances of NFs 110. The historical data is used to analyze past network performance and identify trends or patterns. The trained model 214 is configured to analyze the trends over time, such as gradual increases in bandwidth usage or recurring patterns of downtime, which aids in understanding the long-term behavior of the plurality of NFs 110.
[0049] In an embodiment, the trained model 214 is at least one of, but not limited to a generative Artificial/Intelligence (AI) model. In particular, the generative AI model utilizes at least one of, but not limited to, a deep learning, neural networks, and a machine learning to detect one or more anomalies. These generative AI models learn from patterns, trends, and relationships pertaining to the plurality of NFs 110 to facilities in detecting one or more anomalies. The generative AI have capability to accept a feed or inputs in one or more formats such as file, text, image, audio, video, and code and generate new content into any of the modalities mentioned.
[0050] In an embodiment, the detection unit 210 of the processor 202 is configured to detect one or more anomalies in real time related to the generated file pertaining to the current data of the plurality of NFs 110 utilizing the trained model 214. The one or more anomalies are related to at least one of, but not limited to, a procedure-based faults, overall clear codes, and specific error codes pertaining to the plurality of NFs 110. In other words, the one or more anomalies pertains to abnormal scenario of the plurality of NFs 110. In particular, the detection unit 210 utilizes the trained model 214 to predict and forecasts future issues related to the plurality of NFs 110 in real time.
[0051] In one embodiment, a Machine Learning (ML) logic such as, but not limited to, a Waterfall ML logic, is applied by the detection unit 210 to detect one or more anomalies in advance. Examples of ML logics or techniques that are used to detect one or more anomalies includes but not limited to, a multiple decision logic, a two-factor logic, a scalar boost logic, a periodic logic, and a heuristic logic. These logics are applied based on the historical data of the plurality of NFs 110.
[0052] In an embodiment, the notification unit 212 of the processor 202 is configured to notify the user via the UE 102 in a real time pertaining to the detected one or more anomalies. In particular, the notification unit 212 indicates the user regarding a potential problem in the future. Further, the notification unit 212 recommends the user one or more remedial actions to resolve the detected one or more anomalies. For example, the one or more remedial actions includes at least one of but not limited to, troubleshooting the NF which includes one or more anomalies, and replacing the NF with another NF or generating a trouble ticket (TT).
[0053] For example, let us assume a specific task is allocated to the at least one of the NF among the plurality of NFs 110. In order to execute the specific task, a predefined procedure is to be followed by the least one of the NF. In one scenario, while executing the specific task, when the least one of the NF is not following the predefined procedure, then utilizing the trained model 214, the detection unit 210 determines the deviation from predefined procedure in real time and predicts one or more anomalies regarding the potential problem in the future. Further, the user is notified in real time regarding the one or more anomalies so that user may take one or more remedial actions to resolve the detected one or more anomalies.
[0054] The transceiver 208, the detection unit 210, the notification unit 212, and the trained model 214 in an exemplary embodiment, are implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 202. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 202 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 204 may store instructions that, when executed by the processing resource, implement the processor 202. In such examples, the system 108 may comprise the memory 204 storing the instructions and the processing resource to execute the instructions, or the memory 204 may be separate but accessible to the system 108 and the processing resource. In other examples, the processor 202 may be implemented by electronic circuitry.
[0055] FIG. 3 illustrates an exemplary block diagram of an architecture for the system 108, according to one or more embodiments of the present invention. More specifically, FIG. 3 illustrates the system 108 for detecting anomalies in a communication network 106. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the UE 102 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0056] FIG. 3 shows communication between the UE 102, the system 108, and the plurality of NFs 110. For the purpose of description of the exemplary embodiment as illustrated in FIG. 3, the UE 102, and the plurality of NFs 110 uses a network protocol connection to communicate with the system 108. In an embodiment, the network protocol connection is the establishment and management of communication between the UE 102, the system 108, and the plurality of NFs 110, over the communication network 106 (as shown in FIG. 1) using a specific protocol or set of protocols. The network protocol connection includes, but not limited to, Session Initiation Protocol (SIP), System Information Block (SIB) protocol, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Simple Network Management Protocol (SNMP), Internet Control Message Protocol (ICMP), Hypertext Transfer Protocol Secure (HTTPS) and Terminal Network (TELNET).
[0057] In an embodiment, the UE 102 includes a primary processor 302, a memory 304, and a user interface 306. In alternate embodiments, the UE 102 may include more than one primary processor 302 as per the requirement of the communication network 106. The primary processor 302, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0058] In an embodiment, the primary processor 302 is configured to fetch and execute computer-readable instructions stored in the memory 304. The memory 304 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to detect anomalies in the communication network 106. The memory 304 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0059] In an embodiment, the user interface 306 of the UE 102 includes a variety of interfaces, for example, a graphical user interface, a web user interface, a Command Line Interface (CLI), and the like. The user interface 306 is configured to allow the customer to transmit requests to detect anomalies in the communication network 106. The UE 102 transmits the request to detect anomalies to the processor 202 via the user interface 306.
[0060] For example, initially when the user requests via the UE 102 for the detection of the anomalies to the system 108, the transceiver 208 of the processor 202 receives a generated file pertaining to current data of the plurality of NF 110 at the trained model 214.
[0061] Further, the detection unit 210 utilizes the trained model to detect one or more anomalies related to the generated file in real time. Thereafter, the notification unit 212 of the processor notifies the user via the user interface 306 of the UE 102 regarding the detected one or more anomalies and provides recommendation of the multiple remedial actions to resolve the detected one or more anomalies. Advantageously, the future issue related to the plurality of NFs 110 are resolved before its occurrence.
[0062] FIG. 4 is a signal flow diagram illustrating the flow for detecting anomalies in the communication network 106, according to one or more embodiments of the present disclosure.
[0063] At step 402, using the UE 102 the user transmits the request for detecting anomalies to the processor 202 of the system 108.
[0064] At step 404, processor 202 of the system 108 receives the request from the UE 102 and further transmits a request to the AIDR 216 to collect the current data pertaining to the plurality of NFs 110.
[0065] At step 406, based on the request received, the AIDR 216 forwards the request to the plurality of NFs 110.
[0066] At step 408, the AIDR 216 receives the current data from the plurality of NFs 110. Further, the AIDR 216 stores the current data in the file system 206 and transmits current data to the conductor 218, and from the conductor to at least one of, a normalizer or a message broker 220 to preprocess the current data.
[0067] At step 410, the AIDR 216 utilizes the pre-processed current data to generate the file pertaining to the current data of plurality of NFs 110 and transmits the generated file to the trained model 214 of the processor 202.
[0068] At step 412, the processor 202 notifies the user via UE 102 in real time regarding the detected one or more anomalies and recommends remedial actions to resolve the detected one or more anomalies. The detection of the one or more anomalies is done by the processor 202 utilizing the trained model 214 which is trained with the generated file of the current data and historical data pertaining to the plurality of NFs 110.
[0069] FIG. 5 is a flow diagram of a method 500 for detecting anomalies in the communication network 106, according to one or more embodiments of the present invention. For the purpose of description, the method 500 is described with the embodiments as illustrated in FIG. 2 and should nowhere be construed as limiting the scope of the present disclosure.
[0070] At step 502, the method 500 includes the step of receiving at a trained model, a generated file pertaining to current data of a plurality of Network Functions (NFs). In one embodiment, transceiver 208 of the processor 202 is configured to receive the generated file pertaining to current data of the plurality of NFs 110 at the trained model 214. The generated file acts as an input to the trained model 214.
[0071] In one embodiment, the trained model 214 is trained with the generated file of the current data and historical data pertaining to the plurality of NFs 110. In particular, the trained model is continuously trained with the data pertaining to the plurality of the NFs 110. For example, when an administrator or a network operator is communicating with the plurality of NFs 110, the trained model 214 continuous to train utilizing the data pertaining to the plurality of NFs 110.
[0072] In one embodiment, the trained model 214 learns the one or more parameters of the current data and the historical data that include at least one of, but not limited to, trends, patterns, behavior, clear code values and tolerance level of network failure at each layer from the historical data pertaining to the plurality of NFs 110. For example, the trained model 214 learns the trends/patterns of the at least one of, but not limited to, a memory usage, a Central Processing Unit (CPU) usage, and a response time pertaining to the plurality of NFs 110.
[0073] At step 504, the method 500 includes the step of detecting in real time, one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs 110 utilizing the trained model 214. In one embodiment, the detection unit 210 of the processor 202 is configured to detect one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs 110 utilizing the trained model 214. In particular, detection unit 210 utilizes the trained model 214 to compare the generated file with the one or more parameters pertaining to the current data of the plurality of NFs 110 with the one or more parameters of the historical data pertaining to the plurality of NFs 110. For example, the detection unit compares the historical data pertaining to the trends/patterns of the plurality of NFs 110 with the current data pertaining to the trends/patterns of the plurality of NFs 110.
[0074] In another example, the detection unit 210 compares the historical data pertaining to the response time of the plurality of NFs 110 with the current data pertaining to the response time of the plurality of NFs 110. In other words, the detection unit 210 compares the response time of the plurality of NFs 110 from last 10 days with the current response time of the plurality of NFs 110. In yet another example, the detection unit 210 compares the historical data pertaining to the behavior of the plurality of NFs 110 with the current data pertaining to the behavior of the plurality of NFs 110.
[0075] Further, subsequent to comparison, the detection unit 210 determines a deviation in the one or more parameters pertaining to the current data compared to the one or more parameters pertaining to the historical data of the plurality of NFs 110. Based on the determination, the detection unit 210 detects the presence of the one or more anomalies related to the plurality of NFs 110. For example, let’s us assume that at least one NF among the plurality of NFs 110 is monitored by the detection unit 210 based on which the detection unit 210 determines one or more parameters of the current data such as the clearcode of the at least one NF is varying as compared to the historical data such as the historical clearcode of the at least one NF. In other words, for a particular NF instance, if the value of a particular clearcode has started varying abnormally compared to the last hour or last day, this variation is detected as an anomaly.
[0076] In one embodiment, for example, in any procedure if a failure clearcode count starts to increase exponentially for a particular NF compared to the historical data pertaining to failure clearcode count of the particular NF, this exponential increased count is detected as an anomaly in real-time.
[0077] In one embodiment, for example, the specific error code are reported to users which represents one or more anomalies. The error code is a numeric or alphanumeric code that indicates the nature of an error. These error codes are returned from communication protocols or used within programs as a method of representing anomalous conditions.
[0078] At step 506, the method 500 includes the step of notifying a user in a real time pertaining to the detected one or more anomalies. In one embodiment, the notification unit 212 of the processor 202 is configured to notify the user on the user interface 306 of the UE 102 in a real time pertaining to the detected one or more anomalies. In particular, notification unit 212 forecast future network scenarios. For example, forecasts outcomes for the next few days such as 10 days are notified to the user. Further, the notification unit 212 recommends the user one or more remedial actions to resolve the detected one or more anomalies. For example, the notification unit 212 recommends user to perform the Root Cause Analysis (RCA) in order to resolve the detected one or more anomalies, or to perform at least one of but not limited to, troubleshooting techniques to resolve the detected one or more anomalies without impacting communication network 106 performance. Advantageously, the future issue are resolved by the user before its occurrences.
[0079] The present invention further discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by the processor 202. The processor 202 is configured to receive at the trained model 214, the generated file pertaining to current data of the plurality of Network Functions (NFs) 110. The processor 202 is further configured to detect in real time, one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs 110 utilizing the trained model 214. The processor 202 is further configured to notify, the user in a real time pertaining to the detected one or more anomalies.
[0080] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-5) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0081] The present disclosure provides technical advancement including forecasting network performance and providing an anomaly detection feature. The technique reduces the burden of the manual work to detect the anomalies which leads to time saving of the network operators/administrator. The technique utilizes a trained model to identify trends for a specific Network Function (NF), procedure, or clearcode that does not fit the normal pattern. Furthermore, the techniques enable proactive monitoring of the network elements in the communication network. The system learns from the feed, identifies deviations from past behavior, and notifies anomalies to the network operators/administrator.
[0082] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS

[0083] Environment - 100;
[0084] User Equipment (UE) - 102;
[0085] Server - 104;
[0086] Communication Network- 106;
[0087] System -108;
[0088] Plurality of Network Functions – 110;
[0089] Processor - 202;
[0090] Memory - 204;
[0091] File System – 206;
[0092] Transceiver – 208;
[0093] Detection unit – 210
[0094] Notification unit – 212;
[0095] Trained Model - 214;
[0096] AIDR – 216;
[0097] Conductor – 218;
[0098] Normalizer/Message broker – 220;
[0099] Primary processor- 302;
[00100] Memory- 304;
[00101] User Interface – 306.
,CLAIMS:CLAIMS
We Claim:
1. A method (500) for detecting anomalies in a communication network (106), the method (500) comprising the steps of:
receiving, by one or more processors (202), at a trained model (214), a generated file pertaining to current data of a plurality of Network Functions (NFs) (110);
detecting in real time, by the one or more processors (202), one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs (110) utilizing the trained model (214); and
notifying, by the one or more processors (202), a user in a real time pertaining to the detected one or more anomalies.

2. The method (500) as claimed in claim 1, wherein the step of, receiving the generated file pertaining to the current data of the plurality of NFs (110) at the trained model (214), includes the steps of:
collecting, by the one or more processors (202), the current data pertaining to the plurality of NFs (110);
writing and storing, by the one or more processors (202), the current data pertaining to the plurality of NFs (110) in a file system (206), utilizing an Artificial Intelligence Data Record (AIDR) (216);
transmitting, by the one or more processors (202), the current data to a conductor (218), and from the conductor (218) to at least one of, a normalizer or a message broker (220) to preprocess the current data;
retrieving, by the one or more processors (202), utilizing the AIDR (216), the pre-processed current data to generate the file pertaining to the current data of plurality of NFs (110); and
transmitting, by the one or more processors (202), the generated file as an input to the trained model (214).

3. The method (500) as claimed in claim 1, wherein the generated file is related to a machine-readable data generated by the one or more processors (202) utilizing the AIDR (216) in at least one of, a vectorized form which is provided as the input to the trained model (214).

4. The method (500) as claimed in claim 1, wherein the trained model (214) is trained with the generated file of the current data and historical data pertaining to the plurality of NFs (110).

5. The method (500) as claimed in claim 1, wherein the trained model (214) is at least one of, an Artificial Intelligence/Machine Learning (AI/ML) model.

6. The method (500) as claimed in claim 1, wherein the step of detecting in real time, by the one or more processors (202), one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs (110) utilizing the trained model (214), includes the steps of:
comparing, by the one or more processors (202), utilizing the trained model (214), the generated file with the one or more parameters pertaining to the current data of the plurality of NFs (110) with the one or more parameters of the historical data pertaining to the plurality of NFs (110);
in response to determining, by the one or more processors (202), deviation in the one or more parameters pertaining to the current data compared to the one or more parameters pertaining to the historical data of the plurality of NFs (110), detecting, by the one or more processors (202), presence of the one or more anomalies related to the plurality of NFs (110).

7. The method (500) as claimed in claim 6, wherein the trained model (214) learns the one or more parameters of the current data and the historical data that include at least one of, trends, patterns, behaviour, clear code values and tolerance level of network failure at each layer from the historical data pertaining to the plurality of NFs (110).

8. The method (500) as claimed in claim 1, wherein the one or more anomalies are related to procedure-based faults, overall clear codes, and specific error codes pertaining to the plurality of NFs (110).

9. The method (500) as claimed in claim 1, wherein the step of, notifying, by the one or more processors (202), a user in a real time pertaining to the detected one or more anomalies further includes a step of:
recommending, by the one or more processors (202), the user one or more remedial actions to resolve the detected one or more anomalies.

10. A system (108) for detecting anomalies in a communication network (106), the system (108) comprising:
a transceiver (208), configured to, receive at a trained model (214), a generated file pertaining to current data of a plurality of Network Functions (NFs) (110);
a detection unit (210), configured to, detect in real time, one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs (110) utilizing the trained model (214); and
a notification unit (212), configured to, notify, a user in a real time pertaining to the detected one or more anomalies.

11. The system (108) as claimed in claim 10, wherein the transceiver (208) is configured to receive the generated file pertaining to the current data of the plurality of NFs (110) at the trained model (214), by:
collecting, the current data pertaining to the plurality of NFs (110);
writing and storing, the current data pertaining to the plurality of NFs (110) in a file system (206), utilizing an Artificial Intelligence Data Record (AIDR) (216);
transmitting, the current data to a conductor (218), and from the conductor (218) to at least one of, a normalizer or a message broker (220) to preprocess the current data;
retrieving, utilizing the AIDR (216), the pre-processed current data to generate the file pertaining to the current data of plurality of NFs (110); and
transmitting, the generated file as an input to the trained model (214).

12. The system (108) as claimed in claim 10, wherein the generated file is related to a machine-readable data generated utilizing the AIDR (216) in at least one of, a vectorized form which is provided as the input to the trained model (214).

13. The system (108) as claimed in claim 10, wherein trained model (214) is trained with the generated file of the current data and historical data pertaining to the plurality of NFs (110).

14. The system (108) as claimed in claim 10, wherein the trained model (214) is at least one of, an Artificial Intelligence/Machine Learning (AI/ML) model.

15. The system (108) as claimed in claim 10, wherein the detection unit (210) is configured to detect in real time, one or more anomalies related to the generated file pertaining to the current data of the plurality of NFs (110) utilizing the trained model (214), by:
comparing, utilizing the trained model (214), the generated file with the one or more parameters pertaining to the current data of the plurality of NFs (110) with the one or more parameters of the historical data pertaining to the plurality of NFs (110); and
in response to determining, deviation in the one or more parameters pertaining to the current data compared to the one or more parameters pertaining to the historical data of the plurality of NFs (110), detecting, by the one or more processors (202), presence of the one or more anomalies related to the plurality of NFs (110).

16. The system (108) as claimed in claim 15, wherein the trained model (214) learns the one or more parameters of the current data and the historical data that include at least one of, trends, patterns, behaviour, clear code values and tolerance level of network failure at each layer from the historical data pertaining to the plurality of NFs (110).

17. The system (108) as claimed in claim 10, wherein the one or more anomalies are related to procedure-based faults, overall clear codes, and specific error codes pertaining to the plurality of NFs (110).

18. The system (108) as claimed in claim 10, wherein the notification unit (212) is further configured to:
recommend, the user multiple remedial actions to resolve the detected one or more anomalies.

19. A User Equipment (UE) (102), comprising:
one or more primary processors (302) communicatively coupled to one or more processors (202), the one or more primary processors (302) coupled with a memory (304), wherein said memory (304) stores instructions which when executed by the one or more primary processors (302) causes the UE (102) to:
transmit, a request to the one or more processors (202) to detect anomalies;
receive, notification from the one or more processors (202) pertaining to the detected one or more anomalies; and
wherein the one or more processors (202) is configured to perform the steps as claimed in claim 1.