FORM 2
THE PATENTS ACT, 1970 (39 OF 1970) & THE PATENT RULES, 2003
COMPLETE SPECIFICATION
(See section 10 and rule 13)
“METHOD AND SYSTEM FOR PREDICTING AN ANOMALY ASSOCIATED WITH A USER EQUIPMENT (UE)”
We, Jio Platforms Limited, an Indian National, of Office - 101, Saffron, Nr. Centre Point, Panchwati 5 Rasta, Ambawadi, Ahmedabad - 380006, Gujarat, India.
The following specification particularly describes the invention and the manner in which it is to be performed.

METHOD AND SYSTEM FOR PREDICTING AN ANOMALY ASSOCIATED WITH A USER EQUIPMENT (UE)
FIELD OF INVENTION
[0001] Embodiments of the present disclosure generally relate to network performance management systems. More particularly, embodiments of the present disclosure relate to methods and systems for predicting an anomaly associated with a User Equipment (UE).
BACKGROUND
[0002] The following description of the related art is intended to provide background information pertaining to the field of the disclosure. This section may include certain aspects of the art that may be related to various features of the present disclosure. However, it should be appreciated that this section is used only to enhance the understanding of the reader with respect to the present disclosure, and not as admissions of the prior art.
[0003] Wireless communication technology has rapidly evolved over the past few decades, with each generation bringing significant improvements and advancements. The first generation of wireless communication technology was based on analog technology and offered only voice services. However, with the advent of the second generation (2G) technology, digital communication and data services became possible, and text messaging was introduced. The third generation (3G) technology marked the introduction of high-speed internet access, mobile video calling, and location-based services. The fourth generation (4G) technology revolutionized wireless communication with faster data speeds, better network coverage, and improved security. Currently, the fifth generation (5G) technology is being deployed, promising even faster data speeds, low latency, and the ability to connect multiple devices simultaneously. With each generation, wireless

communication technology has become more advanced, sophisticated, and capable of delivering more services to its users.
[0004] In wireless networks, the user equipment or a group of user equipment may be connected to various network components inside a network for performing various tasks such as establishing calls, etc. However, these tasks may not be performed efficiently due to various reasons, for example, a call session may not be established successfully in case the user device is not able to latch with the network properly, or a base station is not functioning properly, etc.
[0005] These reasons may lead to abnormal behavior of user devices in a particular region at certain times. This data may be consumed by various systems to analyze the normal and/or abnormal behavior of user devices and reasons for the same. In the existing systems, only statistics related to the behavior of user devices were collected, and no prediction could be made using these statistics. Thus, a pro-active approach for mitigating the challenges related to the user devices behaving abnormally at certain times at certain location have not been implemented.
[0006] Thus, there exists an imperative need in the art to provide a method and a system for predicting and analysing abnormal behaviour of user equipment or a group of user equipment, which the present disclosure aims to address.
SUMMARY
[0007] This section is provided to introduce certain aspects of the present disclosure in a simplified form that are further described below in the detailed description. This summary is not intended to identify the key features or the scope of the claimed subject matter.
[0008] An aspect of the present disclosure may relate to a method for predicting an anomaly associated with a User Equipment (UE). The method comprises receiving,

by a transceiver unit, a request from the UE. Then based on the received request, the method further comprises obtaining, by a control unit, one or more device attributes associated with the UE, wherein the one or more device attributes comprises at least one of a location attribute of the UE, a network traffic detail, and a number of connected UEs in a network. The method further comprises providing, by a prediction unit, the one or more device attributes as an input to a sub-system, wherein the sub-system is trained based on a first set of training attributes of a plurality of UEs within the network, the first set of training attributes being indicative of operational performance and a set of previously occurred anomalies of the plurality of UEs. The method further comprises receiving, by the prediction unit, an analysis of the one or more device attributes from the sub-system. Then based on the received analysis, the method further comprises predicting, by the prediction unit, an anomaly associated with said UE.
[0009] In an exemplary aspect of the present disclosure, upon determining that a pre-defined amount of time, greater than a threshold, has been elapsed between the received request and a previously received request from said UE, the prediction unit is configured to process the one or more device attributes using a retrained sub¬system to predict the anomaly associated with the UE. The sub-system is retrained based on a second set of training attributes and the first set of training attributes of said UE, the second set of training attributes being indicative of operational performance of said UE during a predefined time instance.
[0010] In another exemplary aspect of the present disclosure, to process the one or more device attributes, the method further comprises the one or more device attributes are provided as an input to the retrained sub-system by the prediction unit, an analysis of the one or more device attributes is performed using the retrained sub-system, and a processing of the one or more device attributes is performed based on the analysis, wherein the processing includes the prediction of the anomaly associated with the UE.

[0011] In another exemplary aspect of the present disclosure, the second set of training attributes are obtained from one or more probing units.
[0012] In another exemplary aspect of the present disclosure, the method further comprises receiving, by the transceiver unit, a plurality of periodic requests from the UE.
[0013] In another exemplary aspect of the present disclosure, the method encompasses authenticating, by the control unit, the received request and the one or more device attributes are obtained from the UE based on a successful authentication of the received request.
[0014] In another exemplary aspect of the present disclosure, based on the successful authentication of the received request, the method further encompasses transmitting, by the transceiver unit, an acknowledgement to the UE.
[0015] In another exemplary aspect of the present disclosure, upon receiving a first request from the plurality of periodic requests from the UE, the method encompasses authenticating, by the control unit, the first request. Then based on a successful authentication of the first request, the method encompasses, obtaining, by the control unit, the one or more device attributes from the UE.
[0016] In another exemplary aspect of the present disclosure, based on the predicted anomaly associated with said UE, the method further encompasses generating, by the prediction unit, a performance report. Then the method encompasses transmitting, by the transceiver unit, the generated performance report to said UE.
[0017] In another exemplary aspect of the present disclosure, the sub-system is configured at a network data analytics function (NWDAF) of the network.

[0018] Another aspect of the present disclosure may relate to a system for predicting an anomaly associated with a User Equipment (UE). The system comprises a transceiver unit, a control unit, and a prediction unit connected to each other. The transceiver unit is configured to receive a request from the UE. The control unit is configured to obtain one or more device attributes associated with the UE, based on the received request, wherein the one or more device attributes comprise at least one of a location attribute of the UE, a network traffic detail, and a number of connected UEs in a network. The prediction unit is configured to provide the one or more device attributes as an input to a sub-system, wherein the sub-system is trained based on a first set of training attributes of a plurality of UEs within the network, the first set of training attributes being indicative of operational performance and a set of previously occurred anomalies of the plurality of UEs. The prediction unit is further configured to receive an analysis of the one or more device attributes from the sub-system. The prediction unit is further configured to, based on the received analysis, predict an anomaly associated with said UE.
[0019] Another aspect of the present disclosure may relate to user equipment for predicting an anomaly. The UE comprises a transmitter unit, and a receiver unit. The transmitter unit is configured to transmit to a system, a request to predict an anomaly associated with the UE. The receiver unit is configured to receive from the system, a response to the request. The response to the request comprises an information of the anomaly associated with said UE. The response is generated at the system based on receiving, by a transceiver unit, the request from the UE. The generation of the response is based on obtaining, by a control unit, one or more device attributes associated with the UE based on the received request. The one or more device attributes comprises at least one of a location attribute of the UE, a network traffic detail, and a number of connected UEs in a network. The generation of the response is further based on providing, by a prediction unit, the one or more device attributes as an input to a sub-system. The sub-system is trained based on a first set of training attributes of a plurality of UEs within the network, the first set

of training attributes being indicative of operational performance and a set of previously occurred anomalies of the plurality of UEs. The generation of the response is further based on receiving, by the prediction unit, an analysis of the one or more device attributes from the sub-system. The generation of the response is further based on predicting, by the prediction unit, the anomaly associated with said UE based on the received analysis.
[0020] Yet another aspect of the present disclosure may relate to a non-transitory computer readable storage medium storing one or more instructions for predicting an anomaly associated with a User Equipment (UE), the instructions include executable code which, when executed by one or more units of a system, causes: a transceiver unit of the system to receive a request from the UE. The instruction further causes a control unit to obtain one or more device attributes associated with the UE based on the received request, wherein the one or more device attributes comprise at least one of a location attribute of the UE, a network traffic detail, and a number of connected UEs in a network. The instructions further cause a prediction unit to provide the one or more device attributes as an input to a sub-system, wherein the sub-system is trained based on a first set of training attributes of a plurality of UEs within the network, the first set of training attributes being indicative of operational performance and a set of previously occurred anomalies of the plurality of UEs. The instructions further cause the prediction unit to receive an analysis of the one or more device attributes from the sub-system. The instructions further cause the prediction unit to, based on the received analysis, predict an anomaly associated with said UE.
OBJECTS OF THE DISCLOSURE
[0021] Some of the objects of the present disclosure, which at least one embodiment disclosed herein satisfies are listed herein below.

[0022] It is an object of the present disclosure to provide a system and a method for predicting an anomaly associated with a User Equipment (UE).
[0023] It is an object of the present disclosure to provide a system and a method which uses artificial intelligence and/or machine learning models to make predictions for abnormal behaviour of user devices at certain locations during certain time.
[0024] It is another object of the present disclosure to provide a solution that provides a pro-active approach for mitigating the challenges related to the user devices behaving abnormally at certain time at certain location.
[0025] It is yet another object of the present disclosure to provide a solution to predict and analyse behaviour of user equipment that uses historical data to make predictions for normal or abnormal behaviour of devices.
DESCRIPTION OF THE DRAWINGS
[0026] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Also, the embodiments shown in the figures are not to be construed as limiting the disclosure, but the possible variants of the method and system according to the disclosure are illustrated herein to highlight the advantages of the disclosure. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components or circuitry commonly used to implement such components.

[0027] FIG. 1 illustrates an exemplary block diagram representation of a system architecture.
[0028] FIG. 2 illustrates an exemplary block diagram of a computing device upon
5 which the features of the present disclosure may be implemented in accordance with
exemplary implementation of the present disclosure.
[0029] FIG. 3 illustrates an exemplary block diagram of a system for predicting an
anomaly associated with a User Equipment (UE), in accordance with exemplary
10 implementations of the present disclosure.
[0030] FIG. 4 illustrates a method flow diagram for predicting an anomaly associated with a User Equipment (UE), in accordance with exemplary implementations of the present disclosure. 15
[0031] The foregoing shall be more apparent from the following more detailed description of the disclosure.
DETAILED DESCRIPTION
20
[0032] In the following description, for the purposes of explanation, various specific details are set forth in order to provide a thorough understanding of embodiments of the present disclosure. It will be apparent, however, that embodiments of the present disclosure may be practiced without these specific
25 details. Several features described hereafter may each be used independently of one
another or with any combination of other features. An individual feature may not address any of the problems discussed above or might address only some of the problems discussed above.
30 [0033] The ensuing description provides exemplary embodiments only, and is not
intended to limit the scope, applicability, or configuration of the disclosure. Rather,
9

the ensuing description of the exemplary embodiments will provide those skilled in
the art with an enabling description for implementing an exemplary embodiment.
It should be understood that various changes may be made in the function and
arrangement of elements without departing from the spirit and scope of the
5 disclosure as set forth.
[0034] Specific details are given in the following description to provide a thorough
understanding of the embodiments. However, it will be understood by one of
ordinary skill in the art that the embodiments may be practiced without these
10 specific details. For example, circuits, systems, processes, and other components
may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail.
[0035] Also, it is noted that individual embodiments may be described as a process
15 which is depicted as a flowchart, a flow diagram, a data flow diagram, a structure
diagram, or a block diagram. Although a flowchart may describe the operations as
a sequential process, many of the operations may be performed in parallel or
concurrently. In addition, the order of the operations may be re-arranged. A process
is terminated when its operations are completed but could have additional steps not
20 included in a figure.
[0036] The word “exemplary” and/or “demonstrative” is used herein to mean serving as an example, instance, or illustration. For the avoidance of doubt, the subject matter disclosed herein is not limited by such examples. In addition, any
25 aspect or design described herein as “exemplary” and/or “demonstrative” is not
necessarily to be construed as preferred or advantageous over other aspects or designs, nor is it meant to preclude equivalent exemplary structures and techniques known to those of ordinary skill in the art. Furthermore, to the extent that the terms “includes,” “has,” “contains,” and other similar words are used in either the detailed
30 description or the claims, such terms are intended to be inclusive—in a manner
10

similar to the term “comprising” as an open transition word—without precluding any additional or other elements.
[0037] As used herein, a “processing unit” or “processor” or “operating processor”
5 includes one or more processors, wherein processor refers to any logic circuitry for
processing instructions. A processor may be a general-purpose processor, a special purpose processor, a conventional processor, a digital signal processor, a plurality of microprocessors, one or more microprocessors in association with a Digital Signal Processing (DSP) core, a controller, a microcontroller, Application Specific
10 Integrated Circuits, Field Programmable Gate Array circuits, any other type of
integrated circuits, etc. The processor may perform signal coding data processing, input/output processing, and/or any other functionality that enables the working of the system according to the present disclosure. More specifically, the processor or processing unit is a hardware processor.
15
[0038] As used herein, “a user equipment”, “a user device”, “a smart-user-device”, “a smart-device”, “an electronic device”, “a mobile device”, “a handheld device”, “a wireless communication device”, “a mobile communication device”, “a communication device” may be any electrical, electronic and/or computing device
20 or equipment, capable of implementing the features of the present disclosure. The
user equipment/device may include, but is not limited to, a mobile phone, smart phone, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, wearable device or any other computing device which is capable of implementing the one or more features of the present disclosure. Also, the user
25 device may contain at least one input means configured to receive an input from
unit(s) which are required to implement the one or more features of the present disclosure.
[0039] As used herein, “storage unit” or “memory unit” refers to a machine or
30 computer-readable medium including any mechanism for storing information in a
form readable by a computer or similar machine. For example, a computer-readable
11

medium includes read-only memory (“ROM”), random access memory (“RAM”),
magnetic disk storage media, optical storage media, flash memory devices or other
types of machine-accessible storage media. The storage unit stores at least the data
that may be required by one or more units of the system to perform their respective
5 functions.
[0040] As used herein “interface” or “user interface refers to a shared boundary
across which two or more separate components of a system exchange information
or data. The interface may also be referred to a set of rules or protocols that define
10 communication or interaction of one or more modules or one or more units with
each other, which also includes the methods, functions, or procedures that may be called.
[0041] All modules, units, components used herein, unless explicitly excluded
15 herein, may be software modules or hardware processors, the processors being a
general-purpose processor, a special purpose processor, a conventional processor, a
digital signal processor (DSP), a plurality of microprocessors, one or more
microprocessors in association with a DSP core, a controller, a microcontroller,
Application Specific Integrated Circuits (ASIC), Field Programmable Gate Array
20 circuits (FPGA), any other type of integrated circuits, etc.
[0042] As used herein the transceiver unit include at least one receiver and at least
one transmitter configured respectively for receiving and transmitting data, signals,
information or a combination thereof between units/components within the system
25 and/or connected with the system.
[0043] As discussed in the background section, the current known solutions have
several shortcomings. The present disclosure aims to overcome the above-
mentioned and other existing problems in this field of technology by providing
30 method and system of predicting an anomaly associated with a User Equipment
(UE).
12

[0044] FIG. 1 illustrates an exemplary block diagram representation of a system
architecture, in accordance with exemplary implementation of the present
disclosure. As shown in fig. 1, the system architecture [100] includes a user
5 equipment (UE) [102], a network data analytics function (NWDAF) [104], an
access and mobility management function (AMF) [106], one or more probing units
[108], a database [110], a sub-system [112], and a user interface for the network
data analytics function (NWDAF UI) [114], wherein all the components are
assumed to be connected to each other in a manner as obvious to the person skilled
10 in the art for implementing features of the present disclosure.
[0045] User Equipment (UE) [102] may refer to a device used by an end user for communication via a telecommunication network.
15 [0046] Network Data Analytics Function (NWDAF) [104] is a 5G core network
function responsible for collecting data from user equipment, network functions, and operations, administration, and maintenance (OAM) systems, etc. from telecommunication networks that can be used for analytics.
20 [0047] Access and Mobility Management Function (AMF) [106] is a 5G core
network function responsible for managing access and mobility aspects, such as UE registration, connection, and reachability. It also handles mobility management procedures like handovers and paging.
25 [0048] Probing unit [108] may refer to a component which is responsible for
monitoring and analysing the network activity and may also perform preventive actions based on the analysis and monitoring of the network entity. The one or more probing units may perform a first probing solution, and/or a second probing solution. The first probing solution is implemented by a probing agent which
30 collects core network data from the network. The second probing solution is
13

implemented by a probing agent which collects data associated with radio access networks.
[0049] Database [110] may refer to a repository or a storage device used for storing
5 data within the telecommunications network.
[0050] Sub-system [112] may refer to a component within the NWDAF [104] used for prediction of anomalies associated with the UE [102]. The sub-system may also be a trained machine learning based model. 10
[0051] The user interface for the network data analytics function (NWDAF UI) [114] may refer to an interface used for communicating with the network data analytics function (NWDAF) [104] within the telecommunication network.
15 [0052] The NWDAF [104] communicates with the AMF [106] for collecting the
information related to the UEs [102]. The NWDAF [104] also communicates with the one or more probing units for collecting the data associated with the core network, and for collecting the data associated with a radio access network (RAN). The NWDAF also communicates with the database [110] for inserting and receiving
20 the data. The NWDAF then communicates with the sub-system [112] for predicting
exception trends and transfers the received information. The exception trends may be associated with a trend or a pattern of exceptions (based on a use case, an exception is one of: a trend/scenario with no anomaly, and a trend/scenario with a specific anomaly) from a network exposure function. This exception trends and
25 received information is used for training and retraining of the sub-system [112]. The
UE [102] and the NWDAF [104] communicates with each other to provide subscribed abnormal behaviour analytics. The UE [102] also communicates with the NWDAF UI [114] for closed loop reporting in case of a high data traffic. The UE [102] also communicates with the sub-system [112] directly for closed loop
30 forecasting to predict abnormal behaviour trends and analytics. The NWDAF [104]
also communicates with the NWDAF UI [114] for visualisation of prediction of the
14

anomaly associated with the UE [102] between the communication of the UE [102]
and the prediction of the trend. The closed loop reporting in a system is a continuous
feedback mechanism to monitor and adjust such system’s operation based on the
output or results, such closed loop reporting allows to self-regulate and maintain
5 stability or achieve a desired outcome.
[0053] FIG. 2 illustrates an exemplary block diagram of a computing device [200] upon which the features of the present disclosure may be implemented in accordance with exemplary implementation of the present disclosure. In an
10 implementation, the computing device [200] may implement a method for
predicting an anomaly associated with a User Equipment (UE) [102] utilising the system [300]. In another implementation, the computing device [200] itself implements the method for predicting an anomaly associated with a User Equipment (UE) [102] using one or more units configured within the computing
15 device [200], wherein said one or more units are capable of implementing the
features as disclosed in the present disclosure.
[0054] The computing device [200] may include a bus [202] or other communication mechanism for communicating information, and a hardware
20 processor [204] coupled with bus [202] for processing information. The hardware
processor [204] may be, for example, a general-purpose microprocessor. The computing device [200] may also include a main memory [206], such as a random-access memory (RAM), or other dynamic storage device, coupled to the bus [202] for storing information and instructions to be executed by the processor [204]. The
25 main memory [206] also may be used for storing temporary variables or other
intermediate information during execution of the instructions to be executed by the processor [204]. Such instructions, when stored in non-transitory storage media accessible to the processor [204], render the computing device [200] into a special-purpose machine that is customized to perform the operations specified in the
30 instructions. The computing device [200] further includes a read only memory
15

(ROM) [208] or other static storage device coupled to the bus [202] for storing static information and instructions for the processor [204].
[0055] A storage device [210], such as a magnetic disk, optical disk, or solid-state
5 drive is provided and coupled to the bus [202] for storing information and
instructions. The computing device [200] may be coupled via the bus [202] to a display [212], such as a cathode ray tube (CRT), Liquid crystal Display (LCD), Light Emitting Diode (LED) display, Organic LED (OLED) display, etc. for displaying information to a computer user. An input device [214], including
10 alphanumeric and other keys, touch screen input means, etc. may be coupled to the
bus [202] for communicating information and command selections to the processor [204]. Another type of user input device may be a cursor controller [216], such as a mouse, a trackball, or cursor direction keys, for communicating direction information and command selections to the processor [204], and for controlling
15 cursor movement on the display [212]. The input device typically has two degrees
of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allow the device to specify positions in a plane.
[0056] The computing device [200] may implement the techniques described
20 herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware
and/or program logic which in combination with the computing device [200] causes
or programs the computing device [200] to be a special-purpose machine.
According to one implementation, the techniques herein are performed by the
computing device [200] in response to the processor [204] executing one or more
25 sequences of one or more instructions contained in the main memory [206]. Such
instructions may be read into the main memory [206] from another storage medium,
such as the storage device [210]. Execution of the sequences of instructions
contained in the main memory [206] causes the processor [204] to perform the
process steps described herein. In alternative implementations of the present
30 disclosure, hard-wired circuitry may be used in place of or in combination with
software instructions.
16

[0057] The computing device [200] also may include a communication interface
[218] coupled to the bus [202]. The communication interface [218] provides a two-
way data communication coupling to a network link [220] that is connected to a
5 local network [222]. For example, the communication interface [218] may be an
integrated services digital network (ISDN) card, cable modem, satellite modem, or
a modem to provide a data communication connection to a corresponding type of
telephone line. As another example, the communication interface [218] may be a
local area network (LAN) card to provide a data communication connection to a
10 compatible LAN. Wireless links may also be implemented. In any such
implementation, the communication interface [218] sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.
15 [0058] The computing device [200] can send messages and receive data, including
program code, through the network(s), the network link [220] and the communication interface [218]. In the Internet example, a server [230] might transmit a requested code for an application program through the Internet [228], the ISP [226], the local network [222], the host [224] and the communication interface
20 [218]. The received code may be executed by the processor [204] as it is received,
and/or stored in the storage device [210], or other non-volatile storage for later execution.
[0059] Referring to FIG. 3, an exemplary block diagram of a system [300] for
25 predicting an anomaly associated with a User Equipment (UE) [102], is shown, in
accordance with the exemplary implementations of the present disclosure. The
system [300] comprises at least one transceiver unit [302], at least one control unit
[304], at least one prediction unit [306], and at least one storage unit [308]. Also,
all of the components/ units of the system [300] are assumed to be connected to
30 each other unless otherwise indicated below. Also, in Fig. 3 only a few units are
shown, however, the system [300] may comprise multiple such units or the system
17

[300] may comprise any such numbers of said units, as required to implement the features of the present disclosure. Further, in an implementation, the system [300] may be present in a server or a network entity. In yet another implementation, the system [300] may be connected to the server/ network entity. 5
[0060] The system [300] is configured for predicting an anomaly associated with a User Equipment (UE) [102], with the help of the interconnection between the components/units of the system [300]. The anomaly may refer to an observation which deviates from other observations. The anomalies may also refer to instances
10 or collections of data that occur very rarely in the data set and may impact
operations of the UE [102]. The anomalies may also refer to a point or collection of points that is relatively distant from other points in multi-dimensional space of features. The anomalies can also be the patterns in data that do not conform to a well-defined notion of normal behaviour. In simpler terms, in an implementation,
15 the anomalies may be the problems or network issues that are caused in the
communication between the telecommunication network and the UE [102]. For example, an anomaly associated with the UE [102] in the network may be a call drop which indicates sudden disconnection of an active call in a particular time duration and that exceeds a predefined acceptable threshold associated with the call
20 drop. In another example, an anomaly associated with the UE [102] in the network
may be a low network strength that indicates a consistent low signal strength that force a frequent switching between different network strengths such as 4G to 3G, 5G to 4G, and alike. In another example, an anomaly associated with the UE [102] in the network may be a failure of current session which indicates an unexpected
25 termination of an active data session and/or a frequent network session failures
within a time period. Further, the anomaly associated with the UE [102] in the network may include any such like anomaly that may be appreciated by a person skilled in the art to be associated with the associated with the UE [102] in the network.
30
18

[0061] Initially, the transceiver unit [302] is configured to receive a request from
the UE [102]. The request may refer to a request for prediction of the anomaly
associated with the UE [102]. The request may also be sent by the UE [102] via
some other network function managing the UEs [102]. The request may also be sent
5 directly by some other network function which seeks to predict the anomaly
associated with the UE [102]. The request may also be received from one or more UEs [102] in a certain area of interest. The certain area of interest may be such as a location for which the anomaly is to be detected.
10 [0062] The present disclosure further encompasses that the control unit [304] can
also be further configured to authenticate the received request and based on a successful authentication of the received request, the one or more device attributes are obtained from the UE [102]. The authentication of the received request may be done by the NWDAF [104] to check whether the request is valid or not. If the
15 request is valid then it is considered as the successful authentication of the received
request. In other words, the successful authentication is the event when the request is a valid request.
[0063] The present disclosure further discloses that based on the successful
20 authentication of the received request, the transceiver unit [302] is configured to
transmit an acknowledgement to the UE [102]. The acknowledgement refers to a confirmation that the request has been received by the system [300], and that the process for prediction of anomalies has been initiated at the system [300].
25 [0064] The present disclosure further encompasses that the transceiver unit [302]
may also be configured to receive a plurality of periodic requests from the UE [102]. The plurality of periodic requests may refer to the request for prediction of the anomaly associated with the UE [102] which are received several times at a several periods of time.
30
19

[0065] The present disclosure further encompasses that upon receiving a first
request from the plurality of periodic requests from the UE, the control unit [304]
is configured to authenticate the first request. After, the authentication of the first
request, and based on the successful authentication of the first request, the control
5 unit [304] is configured to obtain the one or more device attributes from the UE
[102] for each of the first and subsequent requests. The first request is the request which is received initially in case of the plurality of periodic requests.
[0066] Based on the received request, the control unit [304] is configured to obtain
10 one or more device attributes associated with the UE [102]. The one or more device
attributes are obtained. The one or more device attributes comprises at least one of a location attribute of the UE [102], a network traffic detail, and a number of connected UEs in a network. The one or more device attributes are the attributes associated with the UE [102] and the connection of the UE [102] with the
15 telecommunication network. The one or more device attributes are obtained for
detecting network related issues such as a severe drop in the quality of service (QoS). The QoS can be dropped due to factors such as a call drop, a network strength, and a session failure, etc. The issues may be recurrent and may be due to high number of subscribers. The one or more device attributes can be obtained
20 directly by the UE [102]. The one or more device attributes can also be obtained by
some other network function or the database [110] which may be responsible for collection and maintenance of the records associated with the one or more device attributes. The one or more device attributes may also be obtained in real-time. The one or more device attributes can also be obtained via an entity which may obtain
25 the one or more device attributes through a controller via a sensor, such as a location
sensor.
[0067] The location attribute of the UE [102] may refer to a data associated with
the geo-location of the UE [102]. The location attribute may be directly received
30 from the UE [102] and may also be received from the telecommunication network
via some network functions responsible for detection of the location of the UE
20

[102]. The network traffic detail may refer to a data associated with the traffic levels
of the connection between the UE [102] and the telecommunication network.
Further, as used herein, the network traffic details may refer to an amount data
transmitted over a network, wherein the amount data may indicated a traffic
5 volume, a speed of data transmission, a type of data such as uplink or downlink,
and alike. Further, the network traffic details may signify a network usage patterns, including the number of connected UEs, data transfer rates, and an amount of network traffic generated along with details of sources of said network traffic. Furthermore, in an implementation the network traffic details may include an
10 information on a packet loss, a latency, and other performance metrics such as a
Quality of Service (QoS) metric. The number of connected UEs in the network refers to the number of UEs [102] that are connected with the telecommunication network in a certain area of interest. The number of connected UEs in the network may be obtained by some other network function. The network may refer to the
15 telecommunication network as a whole which may include such as a 5G core
telecommunication network, a Third-generation Partnership Project (3GPP) based telecommunication network or in an implementation, the Long-Term Evolution (LTE) based telecommunication network, and the like.
20 [0068] After the one or more device attributes are obtained, the control unit [304]
provides the one or more device attributes to the prediction unit [306], then the prediction unit [306] is configured to provide the one or more device attributes as an input to the sub-system [112]. The sub-system [112] is trained based on a first set of training attributes of a plurality of UEs [102] within the network. The first set
25 of training attributes being indicative of operational performance and a set of
previously occurred anomalies of the plurality of UEs [102].
[0069] The input refers to the one or more device attributes among other inputs
required for the functioning of the sub-system [112]. The sub-system [112] is the
30 component required for prediction of the anomalies associated with the UE [102].
The present disclosure further discloses that the sub-system [112] may be
21

configured at the NWDAF [104] of the network. The present disclosure further discloses that the sub-system [112] may be an Artificial Intelligence (AI) based engine. The sub-system [112] may be a pre-trained machine learning model which is trained based at least on the first set of training attributes. 5
[0070] The AI based engine may refer to a component or a computing device used for training the sub-system [112]. The AI based engine may utilise various machine learning technologies in order to take decisions regarding different operations. The AI based engine takes a data associated with behaviour of the UE [102] as an input
10 and then pre-processes and filters the data based on the inputs. For example, for
pre-processing the data columns may be arranged or derived in accordance with the parameters determined to train the sub-system [112]. Further, for filtering or normalization, the UE specific location may be used to filter the UE behaviour data, or a set of specific ranges may be selected over the data set to filter the data. Once
15 the data is normalized then the sub-system [112] selects the appropriate anomaly-
based AI model based on the received input parameters and expected output.
[0071] The techniques used for training the sub-system [112] may be a gradient boosted decision tree model-based technique and/or a decision tree model-based
20 technique. Further, a hyper parameter value may be defined before the technique
begins to train the sub-system [112] based on at least one of tuned parameters defined by the NWDAF [104] or auto tuned parameters defined by the sub-system [112]. Once, the data is trained for the anomaly pattern the same output is then provided to NWDAF [104] for further analysis by the AI based engine.
25
[0072] As used herein, the “gradient boosted decision tree model-based technique” may refer to an approach that combines multiple decision trees to create a powerful predictive model. The gradient boosted decision tree model-based technique may be used to train the sub-system [112] by iteratively training multiple decision trees
30 on the historical data associated with the UE [102] and optimizing the loss function
using gradient descent. Each decision tree from the multiple decision trees may be
22

trained on a subset of the historical data, and the outputs of the multiple decision trees may be combined using a weighted sum to produce the final prediction i.e., detect the anomaly.
5 [0073] As used herein, the “decision tree model-based technique” may refer to an
approach that uses a tree-like model to classify the historical data associated with
the UE [102]. The decision tree model-based technique may be used to train the
sub-system [112] by repeatedly partitioning the historical data into smaller subsets
based on the values of input features such as signal strength for creating a tree-like
10 structure, wherein internal nodes in the tree represents an attribute associated with
said feature. The decision tree model-based technique may select the feature using metrics such as a quality of service (QoS) metric.
[0074] As used herein, the “a hyper parameter value” may refer to a configuration
15 setting used in the training of the sub-system [112] based on said technique such as
the gradient boosted decision tree model-based technique and/or the decision tree
model-based technique. Further, the hyper parameter values may comprise a set of
values that are defined before the training process begins such as threshold values,
and optimal values associated with the one or more device attributes of the UE
20 [102].
[0075] The first set of training attributes being indicative of operational performance may refer to attributes which comprises information associated with
25 the performance of the UE [102] within the telecommunication network, the
operation of the UE [102] within the telecommunication network, the operation or performance of the communication between the UE [102] and the telecommunication networks, and other indicators of performance of the operation of the UE [102] and the telecommunication network such as a UE signal strength,
30 a UE data throughput, a UE latency, UE packet loss, a UE handover success rate
and alike. The indication of the operation of the UE [102] can be assessed based on
23

the quality of service (QoS) of the communication between the UE [102] and the
telecommunication network. The first set of training attributes may also comprise
the one or more device attributes. The first set of training attributes may comprise
at least one of a data associated with a radio access network (RAN), a data
5 associated with core network, and the one or more device attributes. The first set of
training attributes may also comprise a trend or a pattern for exceptions from a
network exposure function. For training a data associated with a Radio Access
Network (RAN) may be used for training the sub-system [112], while the data
associated with the radio access network (RAN) may also be linked to the data
10 present in a core network such as evolved packet core (EPC) in 4G, and the one or
more device attributes.
[0076] For instance, in a 5G core network and in an evolved packet core (EPC) in 4G, a data such as a user equipment (UE) identity, a location, a network usage
15 pattern data, an application usage data, and a performance metrics data may be
present. Additionally, in the Radio Access Network (RAN), a data such as a cell ID, a radio signal strength, a radio quality, a UE transmission power, a UE reception power, and a radio resource utilization may be present. Then in said instance the RAN data can be used to train the sub-system [112] to predict anomalies associated
20 with the UE [102] and optimize network performance by linking the data present in
the core network and the device attributes, which include the UE identity, an operating system of the UE, a software version of the UE, and hardware capabilities of the UE. For example, the cell ID in the RAN data can be linked to the UE location in the EPC data, and the radio signal strength in the RAN data can be linked to the
25 UE performance metrics in the EPC data to provide a comprehensive view of the
network and device performance and for enabling the sub-system [112] to detect the anomalies associated with the UE.
[0077] The set of previously occurred anomalies of the plurality of UEs [102] may
30 refer to the record of anomalies that have been detected earlier by the UEs [102] or
24

the network. The record of anomalies contains information for issues that have been undergone by the plurality of UEs [102] in the past.
[0078] Thereafter, the sub-system [112] processes the one or more device attributes
5 and analyses the one or more device attributes. Then the prediction unit [306] is
configured to receive an analysis of the one or more device attributes from the sub¬system [112]. The analysis of the one or more device attributes is output from the sub-system [112] after the sub-system [112] analyses the one or more device attributes. The sub-system [112] provides the analysis of the one or more device
10 attributes to the prediction unit [306]. The analysis of the one or more device
attributes are such that the anomaly can be predicted based on such analysis. In other words, the analysis of the one or more device attributes is used for prediction of anomalies. For ease of understanding, let us consider an example wherein the device attribute "UE Signal Strength" is provided as input to the sub-system [112],
15 that has been trained on the first set of training attributes from the plurality of UEs
[102] within the network. Further, in said example the training attributes include a historical data on signal strength, a data throughput, and a latency, a data of previously occurred anomalies in the network such as dropped calls and failed data sessions. Then, the sub-system [112] may analyse the input "UE Signal Strength"
20 i.e., the device attribute and provides an output analysis indicating that the UE is
experiencing poor signal strength, resulting in increased latency and packet loss. Further, said analysis may also suggest that this is likely due to a previously occurred anomaly of a nearby cell tower being down for maintenance. Thereafter, based on said analysis network administrators may take measures to optimize a
25 network performance and a UE functionality, such as redirecting traffic to nearby
cell towers and/or scheduling maintenance during off-peak hours.
[0079] After the sub-system [112] provides the analysis to the prediction unit [306],
then, based on the received analysis, the prediction unit [306] is further configured
30 to predict an anomaly associated with said UE [102].
25

[0080] The present disclosure further discloses that the prediction unit [306] is
configured to process the one or more device attributes using a retrained sub-system
[112] to predict the anomaly associated with the UE [102]. The processing of the
one or more device attributes is done upon determining that a pre-defined amount
5 of time, greater than a threshold, has been elapsed between the received request and
a previously received request from said UE [102]. For determining that the pre-defined amount of time has been elapsed, the time elapsed between the received request and a previously received request is compared and if the time elapsed is greater than a threshold, it is determined that the pre-defined amount of time has
10 been elapsed. The pre-defined amount of time is a period of time which is
determined by an administrator that may be associated with a network entity an/or a service provider. The previously received request is the request which was lastly received by the transceiver unit [302] in the past. For example, the pre-defined amount of time is 5 minutes, a last received request may be received 5 minutes ago,
15 and since the 5 minutes time i.e., the pre-defined amount of time has been lapsed
since the last received request, now the one or more device attributes may be processed. The retrained sub-system [112] is the sub-system [112] which has been retrained.
20 [0081] The sub-system [112] is retrained based on a second set of training attributes
and the first set of training attributes of said UE [102], the second set of training attributes being indicative of operational performance of said UE [102] during a predefined time instance. The predefined time instance may be a time period in minutes which has been recently passed and is associated with operational
25 performance of said UE [102]. The second set of training attributes being indicative
of operational performance may refer to attributes which comprises information associated with the performance of the UE [102] within the telecommunication network, the operation of the UE [102] within the telecommunication network, the operation or performance of the communication between the UE [102] and the
30 telecommunication networks, and other indicators of performance of the operation
of the UE [102] and the telecommunication network. The indication of the operation
26

of the UE [102] can be assessed based on the quality of service (QoS) of the communication between the UE [102] and the telecommunication network.
[0082] The present disclosure further discloses that to process the one or more
5 device attributes, the one or more device attributes are provided as an input to the
retrained sub-system [112] by the prediction unit [306]. Thereafter, another analysis of the one or more device attributes is performed using the retrained sub-system [112]. After, the analysis is performed using the retrained sub-system [112], then processing of the one or more device attributes is performed based on the analysis
10 of the one or more device attributes using the retrained sub-system [112], wherein
the processing includes the prediction of the anomaly associated with the UE [102]. Further, for ease of understanding, considering a scenario wherein upon determining that the pre-defined amount of time such as 6 minutes, greater than a threshold such as 5 minutes, has elapsed between the received request and the
15 previously received request from UE [102], the prediction unit [306] may be
triggered to process the device attributes using the retrained sub-system [112] to predict the anomaly associated with UE [102]. In this scenario, the sub-system [112] is retrained based on the second set of training attributes, which includes data of the UE [102] operational performance during a predefined time instance, such as the
20 last 24 hours. Then the second set of training attributes may be combined with the
first set of training attributes, which includes historical data of the UE [102] such as a signal strength, a data throughput, and a latency, as well as a data of previously occurred anomalies. Thereafter, the prediction unit [306] may predict an occurrence of the anomaly associated with UE [102], such as a potential service disruption or
25 network congestion. For instance, the retrained sub-system [112] may predict that
UE [102] is may experience a service disruption due to a recent increase in data usage and a concurrent decrease in signal strength in the network.
[0083] The second set of training parameters may also comprise the one or more
30 device attributes. The second set of training attributes may comprise at least one of
a data associated with a radio access network (RAN), a data associated with core
27

network, and the one or more device attributes. The second set of training attributes
may also comprise a trend or a pattern for exceptions from a network exposure
function. The present disclosure further discloses that the second set of training
attributes are obtained from the one or more probing units [108]. The first probing
5 solution of the one or more probing units [108] provides the core network data, and
the second probing solution of the one or more probing units [108] provides the data associated with radio access networks.
[0084] The present disclosure further encompasses that based on the predicted
10 anomaly associated with said UE [102], the prediction unit [306] is configured to
generate a performance report. After the generation of the performance report, then the transceiver unit [302] is configured to transmit the generated performance report to said UE [102]. The performance report may refer to a report comprising information associated with the predicted anomalies, and may also comprises
15 information for suggestive actions for avoiding the anomalies, and root cause
analysis of the predicted anomalies, etc. The performance report is provided to the user so that the user can take closed loop action based on the performance report. The closed loop reporting is the action after identification of root cause for eliminating the root cause of the problem.
20
[0085] Referring to FIG. 4, an exemplary method flow diagram [400] for predicting an anomaly associated with a User Equipment (UE), in accordance with exemplary implementations of the present disclosure is shown. In an implementation the method [400] is performed by the system [300]. Further, in an
25 implementation, the system [300] may be present in a server device to implement
the features of the present disclosure. Also, as shown in Fig. 4, the method [400] starts at step [402].
[0086] The anomaly may refer to an observation which deviates from other
30 observations. The anomalies may also refer to instances or collections of data that
occur very rarely in the data set and may impact operations of the UE [102]. The
28

anomalies may also refer to a point or collection of points that is relatively distant
from other points in multi-dimensional space of features. The anomalies can also
be the patterns in data that do not conform to a well-defined notion of normal
behaviour. In simpler terms, in an implementation, the anomalies may be the
5 problems or network issues that are caused in the communication between the
telecommunication network and the UE [102]. For example, an anomaly associated with the UE [102] in the network may be a call drop which indicates sudden disconnection of an active call in a particular time duration and that exceeds a predefined acceptable threshold associated with the call drop. In another example,
10 an anomaly associated with the UE [102] in the network may be a low network
strength that indicates a consistent low signal strength that force a frequent switching between different network strengths such as 4G to 3G, 5G to 4G, and alike. In another example, an anomaly associated with the UE [102] in the network may be a failure of current session which indicates an unexpected termination of an
15 active data session and/or a frequent network session failures within a time period.
Further, the anomaly associated with the UE [102] in the network may include any such like anomaly that may be appreciated by a person skilled in the art to be associated with the associated with the UE [102] in the network.
20 [0087] Initially, at step [404], the method [400] comprises receiving, by a
transceiver unit [302], a request from the UE [102]. The request may refer to a request for prediction of the anomaly associated with the UE [102]. The request may also be sent by the UE [102] via some other network function managing the UEs [102]. The request may also be sent directly by some other network function
25 which seeks to predict the anomaly associated with the UE [102]. The request may
also be received from one or more UEs [102] in a certain area of interest. The certain area of interest may be such as a location for which the anomaly is to be detected.
[0088] The present disclosure further encompasses that the method [400] may also
30 further comprise authenticating by the control unit [304] the received request,
wherein the one or more device attributes are obtained from the UE [102] based on
29

a successful authentication of the received request. The authentication of the
received request may be done by the NWDAF [104] to check whether the request
is valid or not. If the request is valid then it is considered as the successful
authentication of the received request. In other words, the successful authentication
5 is the event when the request is a valid request.
[0089] The present disclosure further discloses that based on the successful
authentication of the received request, the method [400] further encompasses
transmitting by the transceiver unit [302] an acknowledgement to the UE [102]. The
10 acknowledgement refers to a confirmation that the request has been received by the
system [300], and that the process for prediction of anomalies has been initiated at the system [300].
[0090] The present disclosure further encompasses that the method [400] also
15 comprises receiving by the transceiver unit [302] a plurality of periodic requests
from the UE [102]. The plurality of periodic requests may refer to the request for prediction of the anomaly associated with the UE [102] which are received several times at a several periods of time.
20 [0091] The present disclosure further discloses that upon receiving a first request
from the plurality of periodic requests from the UE [102], the method encompasses authenticating by the control unit [304] the first request. After, the authentication of the first request, and based on a successful authentication of the first request, the method encompasses obtaining by the control unit [304] the one or more device
25 attributes from the UE [102] for each of the first and subsequent requests. The first
request is the request which is received initially in case of the plurality of periodic requests.
[0092] Thereafter, at step [406], the method [400] comprises obtaining, by a control
30 unit [304], one or more device attributes associated with the UE [102], based on the
received request, wherein the one or more device attributes comprises at least one
30

of a location attribute of the UE [102], a network traffic detail, and a number of
connected UEs in a network. The one or more device attributes are the attributes
associated with the UE [102] and the connection of the UE [102] with the
telecommunication network. The one or more device attributes are obtained for
5 detecting network related issues such as a severe drop in the quality of service
(QoS). The QoS can be dropped due to factors such as a call drop, a network strength, and a session failure, etc. The issues may be recurrent and may be due to high number of subscribers. The one or more device attributes can be obtained directly by the UE [102]. The one or more device attributes can also be obtained by
10 some other network function or the database [110] which may be responsible for
collection and maintenance of the records associated with the one or more device attributes. The one or more device attributes may also be obtained in real-time. The one or more device attributes can also be obtained via an entity which may obtain the one or more device attributes through a controller via a sensor, such as a location
15 sensor.
[0093] The location attribute of the UE [102] may refer to a data associated with the geo-location of the UE [102]. The location attribute may be directly received from the UE [102] and may also be received from the telecommunication network
20 via some network functions responsible for detection of the location of the UE
[102]. The network traffic detail may refer to a data associated with the traffic levels of the connection between the UE [102] and the telecommunication network. Further, as used herein, the network traffic details may refer to an amount data transmitted over a network, wherein the amount data may indicated a traffic
25 volume, a speed of data transmission, a type of data such as uplink or downlink,
and alike. Further, the network traffic details may signify a network usage patterns, including the number of connected UEs, data transfer rates, and an amount of network traffic generated along with details of sources of said network traffic. Furthermore, in an implementation the network traffic details may include an
30 information on a packet loss, a latency, and other performance metrics such as a
Quality of Service (QoS) metric. The number of connected UEs in the network
31

refers to the number of UEs [102] that are connected with the telecommunication
network in a certain area of interest. The number of connected UEs in the network
may be obtained by some other network function. The network may refer to the
telecommunication network as a whole which may include such as a 5G core
5 telecommunication network, a Third-generation Partnership Project (3GPP) based
telecommunication network or in an implementation, the Long-Term Evolution (LTE) based telecommunication network, and the like.
[0094] After the one or more device attributes are obtained, the control unit [304]
10 provides the one or more device attributes to the prediction unit [306], then at step
[408], the method [400] comprises providing, by the prediction unit [306], the one
or more device attributes as an input to the sub-system [112], wherein the sub¬
system [112] is trained based on a first set of training attributes of a plurality of UEs
[102] within the network, the first set of training attributes being indicative of
15 operational performance and a set of previously occurred anomalies of the plurality
of UEs [102].
[0095] The input refers to the one or more device attributes among other inputs required for the functioning of the sub-system [112]. The sub-system [112] is the
20 component required for prediction of the anomalies associated with the UE [102].
The present disclosure further discloses that the sub-system [112] may be configured at the NWDAF [104] of the network. The present disclosure further discloses that the sub-system [112] may be an Artificial Intelligence (AI) based engine. The sub-system [112] may be a pre-trained machine learning model which
25 is trained based at least on the first set of training attributes.
[0096] The AI based engine may refer to a component or a computing device used
for training the sub-system [112]. The AI based engine may utilise various machine
learning technologies in order to take decisions regarding different operations. The
30 AI based engine takes a data associated with behaviour of the UE [102] as an input
and then pre-processes and filters the data based on the inputs. For example, for
32

pre-processing the data columns may be arranged or derived in accordance with the
parameters determined to train the sub-system [112]. Further, for filtering or
normalization, the UE specific location may be used to filter the UE behaviour data,
or a set of specific ranges may be selected over the data set to filter the data. Once
5 the data is normalized then the sub-system [112] selects the appropriate anomaly-
based AI model based on the received input parameters and expected output.
[0097] The techniques used for training the sub-system [112] may be for example, a gradient boosted decision tree model and/or a decision tree model. Further, a hyper
10 parameter value is defined before the machine learning process begins based on
tuned parameters defined by the NWDAF [104] or based on auto tuned parameters defined by the sub-system [112]. Once, the data is trained for the anomaly pattern the same output is then provided to NWDAF [104] for further analysis by the AI based engine.
15
[0098] The first set of training attributes being indicative of operational performance may refer to attributes which comprises information associated with the performance of the UE [102] within the telecommunication network, the operation of the UE [102] within the telecommunication network, the operation or
20 performance of the communication between the UE [102] and the
telecommunication networks, and other indicators of performance of the operation of the UE [102] and the telecommunication network such as a UE signal strength, a UE data throughput, a UE latency, UE packet loss, a UE handover success rate and alike. The indication of the operation of the UE [102] can be assessed based on
25 the quality of service (QoS) of the communication between the UE [102] and the
telecommunication network. The first set of training attributes may also comprise the one or more device attributes. The first set of training attributes may comprise at least one of a data associated with a radio access network (RAN), a data associated with core network, and the one or more device attributes. The first set of
30 training attributes may also comprise a trend or a pattern for exceptions from a
network exposure function. For training a data associated with a Radio Access
33

Network (RAN) may be used for training the sub-system [112], while the data associated with the radio access network (RAN) may also be linked to the data present in a core network such as evolved packet core (EPC) in 4G, and the one or more device attributes. 5
[0099] The set of previously occurred anomalies of the plurality of UEs [102] may refer to the record of anomalies that have been detected earlier by the UEs [102] or the network. The record of anomalies contains information for issues that have been undergone by the plurality of UEs [102] in the past.
10
[0100] Thereafter, the sub-system [112] processes the one or more device attributes and analyses the one or more device attributes. Then at step [410], the method [400] comprises receiving, by the prediction unit [306], an analysis of the one or more device attributes from the sub-system [112].
15
[0101] Thereafter, at step [412], based on the received analysis, the method [400] comprises predicting an anomaly associated with said UE [102].
[0102] The present disclosure further discloses that upon determining that a pre-
20 defined amount of time, greater than a threshold, has been elapsed between the
received request and a previously received request from said UE [102],
encompasses processing, by the prediction unit [306], the one or more device
attributes using a retrained sub-system to predict the anomaly associated with the
UE [102]. For determining that the pre-defined amount of time has been elapsed,
25 the time elapsed between the received request and a previously received request is
compared and if the time elapsed is greater than a threshold, it is determined that
the pre-defined amount of time has been elapsed. The pre-defined amount of time
is a period of time which is determined by the implementor of the present disclosure
which may be a network entity or may also be a service provider. The previously
30 received request is the request which was lastly received by the transceiver unit
[302] in the past. For example, pre-defined amount of time is say 5 minutes a
34

previously received request may be lastly received 5 minutes ago, and since the 5 minutes time for pre-defined amount of time has been lapsed, now the one or more device attributes may be processed. The retrained sub-system [112] is the sub¬system [112] which has been retrained. 5
[0103] The sub-system [112] is retrained based on a second set of training attributes and the first set of training attributes of said UE [102], the second set of training attributes being indicative of operational performance of said UE [102] during a predefined time instance. The predefined time instance may be a time period which
10 has been recently passed. The second set of training attributes being indicative of
operational performance may refer to attributes which comprises information associated with the performance of the UE [102] within the telecommunication network, the operation of the UE [102] within the telecommunication network, the operation or performance of the communication between the UE [102] and the
15 telecommunication networks, and other indicators of performance of the operation
of the UE [102] and the telecommunication network. The indication of the operation of the UE [102] can be assessed based on the quality of service (QoS) of the communication between the UE [102] and the telecommunication network.
20 [0104] The present disclosure further discloses that to process the one or more
device attributes, the one or more device attributes are provided as an input to the retrained sub-system [112] by the prediction unit [306]. Thereafter, an analysis of the one or more device attributes is performed using the retrained sub-system [112]. After, the analysis is performed using the retrained sub-system [112], then
25 processing of the one or more device attributes is performed based on the analysis
of the one or more device attributes performed using the retrained sub-system [112], wherein the processing includes the prediction of the anomaly associated with the UE [102]. For ease of understanding, let us consider an example wherein the device attribute "UE Signal Strength" is provided as input to the sub-system [112], that has
30 been trained on the first set of training attributes from the plurality of UEs [102]
within the network. Further, in said example the training attributes include a
35

historical data on signal strength, a data throughput, and a latency, a data of
previously occurred anomalies in the network such as dropped calls and failed data
sessions. Then, the sub-system [112] may analyse the input "UE Signal Strength"
i.e., the device attribute and provides an output analysis indicating that the UE is
5 experiencing poor signal strength, resulting in increased latency and packet loss.
Further, said analysis may also suggest that this is likely due to a previously
occurred anomaly of a nearby cell tower being down for maintenance. Thereafter,
based on said analysis network administrators may take measures to optimize a
network performance and a UE functionality, such as redirecting traffic to nearby
10 cell towers and/or scheduling maintenance during off-peak hours.
[0105] The second set of training parameters may also comprise the one or more device attributes. The second set of training attributes may comprise at least one of a data associated with a radio access network (RAN), a data associated with core
15 network, and the one or more device attributes. The second set of training attributes
may also comprise a trend or a pattern for exceptions from a network exposure function. For training, a data associated with the RAN may be used for training the sub-system [112], while the data associated with the radio access network (RAN) may also be linked to the data present in a core network and the one or more device
20 attributes.
[0106] The present disclosure further discloses that the second set of training
attributes are obtained from the one or more probing units [108]. The first probing
solution of the one or more probing units [108] provides the core network data, and
25 the second probing solution of the one or more probing units [108] provides the
data associated with radio access networks.
[0107] The present disclosure further encompasses that based on the predicted
anomaly associated with said UE [102], the method encompasses generating, by the
30 prediction unit [306], a performance report. After the generation of the performance
report, the method further encompasses transmitting, by the transceiver unit [302],
36

the generated performance report to said UE [102]. The performance report may
refer to a report comprising information associated with the predicted anomalies,
and may also comprises information for suggestive actions for avoiding the
anomalies, and root cause analysis of the predicted anomalies, etc. The performance
5 report is provided to the user so that the user can take closed loop action based on
the performance report. The closed loop reporting is the action after identification of root cause for eliminating the root cause of the problem.
[0108] Thereafter, at step [414], the method [400] is terminated.
10
[0109] The present disclosure further encompasses a user equipment [102] for predicting an anomaly. The UE [102] comprises a transmitter unit, and a receiver unit. The transmitter unit is configured to transmit to a system [300], a request to predict an anomaly associated with the UE [102]. The receiver unit is configured to
15 receive from the system [300], a response to the request. The response to the request
comprises an information of the anomaly associated with said UE [102]. The response is generated at the system [300] based on receiving, by a transceiver unit [302], the request from the UE [102]. The generation of the response is further based on obtaining, by a control unit [304], one or more device attributes associated with
20 the UE [102] based on the received request. The one or more device attributes
comprises at least one of a location attribute of the UE [102], a network traffic detail, and a number of connected UEs in a network. The generation of the response is further based on providing, by a prediction unit [306], the one or more device attributes as an input to a sub-system [112]. The sub-system [112] is trained based
25 on a first set of training attributes of a plurality of UEs [102] within the network,
the first set of training attributes being indicative of operational performance and a set of previously occurred anomalies of the plurality of UEs [102]. The generation of the response is further based on receiving, by the prediction unit [306], an analysis of the one or more device attributes from the sub-system [112]. The
30 generation of the response is further based on predicting, by the prediction unit
[306], the anomaly associated with said UE [102] based on the received analysis.
37

[0110] The present disclosure further discloses a non-transitory computer readable
storage medium storing one or more instructions for predicting an anomaly
associated with a User Equipment (UE), the one or more instructions include
5 executable code which, when executed by one or more units of a system [300]
perform certain functions. The one or more instructions when executed causes a transceiver unit [302] of the system [300] to receive a request from the UE [102]. The one or more instructions when executed further causes a control unit [304] of the system [300] to obtain one or more device attributes associated with the UE
10 [102] based on the received request. The one or more device attributes comprise at
least one of a location attribute of the UE [102], a network traffic detail, and a number of connected UEs in a network. The one or more instructions when executed further causes a prediction unit [306] of the system [300] to provide the one or more device attributes as an input to a sub-system [112]. The sub-system
15 [112] is trained based on a first set of training attributes of a plurality of UEs [102]
within the network, the first set of training attributes being indicative of operational performance and a set of previously occurred anomalies of the plurality of UEs [102]. The one or more instructions when executed further cause the prediction unit [306] to receive an analysis of the one or more device attributes from the sub-system
20 [112]. The one or more instructions when executed further cause the prediction unit
[306] to, based on the received analysis, predict an anomaly associated with said UE [102].
[0111] As is evident from the above, the present disclosure provides a technically
25 advanced solution for predicting an anomaly associated with a User Equipment
(UE). The present solution uses artificial intelligence and/or machine learning
models that uses historical data to make predictions for abnormal behaviour of user
devices at certain locations during certain time. The solution provides a pro-active
approach for mitigating the challenges related to the user devices behaving
30 abnormally at certain time at certain location. This forecasting helps consumer
network nodes to take precautionary measures during the future point of time.
38

[0112] While considerable emphasis has been placed herein on the disclosed implementations, it will be appreciated that many implementations can be made and that many changes can be made to the implementations without departing from the principles of the present disclosure. These and other changes in the implementations of the present disclosure will be apparent to those skilled in the art, whereby it is to be understood that the foregoing descriptive matter to be implemented is illustrative and non-limiting.
[0113] Further, in accordance with the present disclosure, it is to be acknowledged that the functionality described for the various components/units can be implemented interchangeably. While specific embodiments may disclose a particular functionality of these units for clarity, it is recognized that various configurations and combinations thereof are within the scope of the disclosure. The functionality of specific units as disclosed in the disclosure should not be construed as limiting the scope of the present disclosure. Consequently, alternative arrangements and substitutions of units, provided they achieve the intended functionality described herein, are considered to be encompassed within the scope of the present disclosure.

We Claim:
1. A system [300] for predicting an anomaly associated with a User Equipment (UE) [102], the system [300] comprising:
a transceiver unit [302] configured to receive a request from the UE [102];
a control unit [304] connected at least to the transceiver unit [302], the control unit [304] is configured to obtain one or more device attributes associated with the UE [102] based on the received request, wherein the one or more device attributes comprise at least one of a location attribute of the UE [102], a network traffic detail, and a number of connected UEs in a network; and
a prediction unit [306] connected at least to the transceiver unit [302], the prediction unit [306] is configured to:
provide the one or more device attributes as an input to a sub¬system [112], wherein the sub-system [112] is trained based on a first set of training attributes of a plurality of UEs [102] within the network, the first set of training attributes being indicative of operational performance and a set of previously occurred anomalies of the plurality of UEs [102]; and
receive an analysis of the one or more device attributes from the sub-system [112]; and
based on the received analysis, predict an anomaly associated with said UE [102].
2. The system [300] as claimed in claim 1, wherein:
upon determining that a pre-defined amount of time, greater than a threshold, has been elapsed between the received request and a previously received request from said UE [102], the prediction unit [306] is configured to process the one or more device attributes using a retrained sub-system [112] to predict the anomaly associated with the UE [102], and

the sub-system [112] is retrained based on a second set of training attributes and the first set of training attributes of said UE [102], the second set of training attributes being indicative of operational performance of said UE [102] during a predefined time instance.
3. The system as claimed in claim 2, wherein to process the one or more device attributes,
the prediction unit [306] is further configured to provide the one or more device attributes as an input to the retrained sub-system [112],
the retrained sub-system [112] is further configured to perform an analysis of the one or more device attributes, and
based on the analysis, the prediction unit [306] is configured to perform a processing of the one or more device attributes, wherein the processing includes the prediction of the anomaly associated with the UE [102].
4. The system [300] as claimed in claim 2, wherein the second set of training attributes are obtained from one or more probing units [108].
5. The system [300] as claimed in claim 1, wherein the transceiver unit [302] is configured to receive a plurality of periodic requests from the UE [102].
6. The system [300] as claimed in claim 1, wherein the control unit [304] is further configured to authenticate the received request, wherein the one or more device attributes are obtained from the UE [102] based on a successful authentication of the received request.
7. The system [300] as claimed in claim 6, wherein the transceiver unit [302]:
based on the successful authentication of the received request, is configured to transmit an acknowledgement to the UE [102].

8. The system [300] as claimed in claim 5, wherein:
upon receiving a first request from the plurality of periodic requests from the UE [102], the control unit [304] is configured to authenticate the first request; and
based on a successful authentication of the first request, the control unit [304] is configured to obtain the one or more device attributes from the UE [102].
9. The system [300] as claimed in claim 1, wherein based on the predicted anomaly associated with said UE [102], the prediction unit [306] is configured to generate a performance report, and the transceiver unit [302] is configured to transmit the generated performance report to said UE [102].
10. The system [300] as claimed in claim 1, wherein the sub-system [112] is configured at a network data analytics function (NWDAF) [104] of the network.
11. A method for predicting an anomaly associated with a User Equipment (UE) [102], the method comprises:
receiving, by a transceiver unit [302], a request from the UE [102];
based on the received request, obtaining, by a control unit [304], one or more device attributes associated with the UE [102], wherein the one or more device attributes comprises at least one of a location attribute of the UE [102], a network traffic detail, and a number of connected UEs in a network;
providing, by a prediction unit [306], the one or more device attributes as an input to a sub-system [112], wherein the sub-system [112] is trained based on a first set of training attributes of a plurality of UEs [102] within the network, the first set of training attributes being indicative of operational performance and a set of previously occurred anomalies of the plurality of UEs [102];

receiving, by the prediction unit [306], an analysis of the one or more device attributes from the sub-system [112]; and
based on the received analysis, predicting, by the prediction unit [306], an anomaly associated with said UE [102].
12. The method as claimed in claim 11, the method:
upon determining that a pre-defined amount of time, greater than a threshold, has been elapsed between the received request and a previously received request from said UE [102], encompasses processing, by the prediction unit [306], the one or more device attributes using a retrained sub¬system to predict the anomaly associated with the UE [102], wherein:
the sub-system [112] is retrained based on a second set of training attributes and the first set of training attributes of said UE [102], the second set of training attributes being indicative of operational performance of said UE [102] during a predefined time instance.
13. The method as claimed in claim 12, wherein to process the one or more device attributes, the method further comprises:
the one or more device attributes are provided as an input to the retrained sub-system [112] by the prediction unit [306],
an analysis of the one or more device attributes is performed using the retrained sub-system [112], and
a processing of the one or more device attributes is performed based on the analysis, wherein the processing includes the prediction of the anomaly associated with the UE [102].
14. The method as claimed in claim 12, wherein the second set of training attributes are obtained from one or more probing units [108].

15. The method as claimed in claim 11, the method encompasses receiving by the transceiver unit [302] a plurality of periodic requests from the UE [102].
16. The method as claimed in claim 11, the method encompasses:
authenticating by the control unit [304] the received request, wherein the one or more device attributes are obtained from the UE [102] based on a successful authentication of the received request.
17. The method as claimed in claim 16, the method:
based on the successful authentication of the received request, encompasses transmitting by the transceiver unit [302] an acknowledgement to the UE [102].
18. The method as claimed in claim 15, wherein:
upon receiving a first request from the plurality of periodic requests from the UE [102], the method encompasses authenticating by the control unit [304] the first request; and
based on a successful authentication of the first request, the method encompasses obtaining by the control unit [304] the one or more device attributes from the UE [102].
19. The method as claimed in claim 11, wherein based on the predicted anomaly
associated with said UE [102], the method encompasses:
generating, by the prediction unit [306], a performance report, and transmitting, by the transceiver unit [302], the generated performance report to said UE [102].
20. The method as claimed in claim 11, wherein the sub-system [112] is
configured at a network data analytics function (NWDAF) [104] of the
network.

21. A user equipment (UE), the UE comprises:
- a transmitter unit, configured to transmit to a system [300], a request to predict an anomaly associated with the UE; and
- a receiver unit, configured to receive from the system [300], a response to the request, wherein the response comprises an information of the anomaly associated with said UE and wherein the response is generated at the system [300] based on:
o receiving, by a transceiver unit [302], the request from the UE [102],
o obtaining, by a control unit [304], one or more device attributes associated with the UE [102] based on the received request, wherein the one or more device attributes comprises at least one of a location attribute of the UE [102], a network traffic detail, and a number of connected UEs in a network,
o providing, by a prediction unit [306], the one or more device attributes as an input to a sub-system [112], wherein the sub-system [112] is trained based on a first set of training attributes of a plurality of UEs [102] within the network, the first set of training attributes being indicative of operational performance and a set of previously occurred anomalies of the plurality of UEs [102],
o receiving, by the prediction unit [306], an analysis of the one or more device attributes from the sub-system [112], and
o predicting, by the prediction unit [306], the anomaly associated with said UE [102] based on the received analysis.