DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
METHOD AND SYSTEM FOR MONITORING NETWORK FUNCTIONS IN A NETWORK
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention generally relates to wireless communication networks, and more particularly relates to a method and system for monitoring Network Functions (NFs) in the networks.
BACKGROUND OF THE INVENTION
[0002] In a wireless communication network such as a 5G network, there are many Network Functions (NFs). Further, there are hundreds of network instances for each NF. Each NF supports multiple error codes or clear codes for different 10 procedures. If an error arises in one of the instances of one of the NFs, it is very difficult to identify which network instance caused the error. It is also difficult to identify the type of the error and the quantum of the error in each time frame. This causes difficulties in debugging the issues. Further, a user cannot identify and track all the instances in real time.
[0003] Therefore, there is a need for an advancement of a system and method that can overcome at least one of the above shortcomings, particularly to monitor the network instances and identify and track the errors in the network instances in real-time.
BRIEF SUMMARY OF THE INVENTION
[0004] One or more embodiments of the present disclosure provide a method and system for monitoring network functions in a network.
[0005] In one aspect of the present invention, the method for monitoring the network functions in the network is disclosed. The method includes the step of receiving, by one or more processors, one or more user defined policies from one or more users via a User Interface (UI). The method includes the step of monitoring, by the one or more processors, utilizing a trained model, at least one of, multiple instances of the network functions, a plurality of attributes pertaining to the multiple instances of the network functions and one or more tasks performed by the network functions based on one or more user defined policies. Further, the method includes the step of notifying, in real time, by the one or more processors, one or more users about occurrence of a breach when, abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions.
[0006] In one embodiment, the one or more processors, detects abnormality with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions by comparing, utilizing the trained model, a clear code count pertaining to each of the multiple instances of the network functions with a predefined threshold value for a given time. Each of the one or more attributes with similar historical attributes. One or more tasks performed by each of the network functions with a task associated threshold defined by the one or more user defined policies. Further, the method includes detecting, by the one or mor processors, utilizing the trained model, the abnormality in at least one of the one or more multiple instances of network functions when a predefined clear code count exceeds the predefined threshold value for the given time, the one or more of the attributes deviating when compared to the similar historical attributes, and the one or more tasks performed by each of the network functions deviating when compared to the task associated threshold defined by the one or more user defined policies.
[0007] In another embodiment, the method further includes the steps of assigning, by the one or more processors, severity levels of clear codes based on urgency or impact. The severity levels include at least one of, critical, major, minor, or informational. The method further includes the steps of dividing, by the one or more processors, the clear codes based on the assigned severity levels.
[0008] In yet another embodiment, the one or more user defined policies include at least one of, notification policy and alert policy.
[0009] In yet another embodiment, the one or more user defined policies specifies, at least one of, one or more thresholds based on which notifications and alerts are triggered and notifications and alerts are routed to the appropriate one or more users.
[0010] In yet another embodiment, the method further includes the step of, notifying in real time, the one or more users about occurrence of the breach when, the abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the tasks performed by the network functions, further include the step of generating, by the one or processors, reports related to the alerts and the notifications for tracking, analysis and compliance purposes.
[0011] In yet another embodiment, the one or more user defined policies are stored in a database.
[0012] In another aspect of the present invention, the system for monitoring network functions in the network is disclosed. The system includes a transceiver, configured to, receive, one or more user defined policies from one or more users via a User Interface (UI). The system includes a monitoring unit, configured to, monitor, utilizing a trained model, at least one of, multiple instances of the network functions, a plurality of attributes pertaining to the multiple instances of the network functions and one or more tasks performed by the network functions based on one or more user defined policies. The system further includes a notification unit, configured to notify in real time, one or more users about occurrence of a breach when, abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the tasks performed by the network functions.
[0013] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS
[0014] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0015] FIG. 1 is an exemplary block diagram of an environment for monitoring network functions in a network, according to one or more embodiments of the present disclosure;
[0016] FIG. 2 is an exemplary block diagram of a system for monitoring the network functions in the network, according to one or more embodiments of the present disclosure;
[0017] FIG. 3 is a schematic representation of workflow of the system of FIG. 2, according to one or more embodiments of the present disclosure;
[0018] FIG. 4 is an exemplary block diagram of an architecture that can be implemented in the system of FIG. 2, according to one or more embodiments of the present disclosure; and
[0019] FIG. 5 is a flow diagram illustrating a method for monitoring network functions in the network, according to one or more embodiments of the present disclosure.
[0020] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0021] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0022] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0023] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0024] The present disclosure provides a system and a method for monitoring multiple instances of network functions and tracking errors generated by the instances. In an embodiment, the present disclosure provides a system for monitoring multiple instances of the network functions in real-time and checking if the multiple instances of the network functions breach a predefined threshold. If the multiple instances of the network functions breach the predefined threshold, the system notifies an end user about the breach. Doing so aids in reducing the time required to identify and debug errors in the multiple instances of the network functions.
[0025] FIG. 1 illustrates an exemplary block diagram of an environment 100 for monitoring network functions 120 in a network 105, according to one or more embodiments of the present disclosure. The environment 100 includes the network 105, a User Equipment (UE) 110, a server 115, the network functions 120 and a system 125. The UE 110 aids a user to interact with the system 125 to transmit one or more user defined policies to one or more processors 205 (as shown in FIG.2) via a User Interface (UI) 215 (as shown in FIG.2). In an embodiment, the one or more user defined policies include at least one of, a notification policy and an alert policy. In another embodiment, the one or more user defined policies are defined by a service provider. The one or more user defined policies specifies, at least one of, one or more predefined thresholds based on which notifications and alerts are triggered, and notifications and alerts are routed to the appropriate one or more users.
[0026] For the purpose of description and explanation, the description will be explained with respect to one or more UEs 110, or to be more specific will be explained with respect to a first UE 110a, a second UE 110b, and a third UE 110c, and should nowhere be construed as limiting the scope of the present disclosure. Each of the at least one UE 110 from the first UE 110a, the second UE 110b, and the third UE 110c is configured to connect to the server 115 via the network 105.
[0027] In an embodiment, each of the first UE 110a, the second UE 110b, and the third UE 110c is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as virtual reality (VR) devices, augmented reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0028] The network 105 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 105 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0029] The network 105 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth. The network 105 may also include, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, a VOIP or some combination thereof.
[0030] The environment 100 includes the server 115 accessible via the network 105. The server 115 may include by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, one or more processors executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defence facility side, or any other facility that provides service.
[0031] The environment 100 further includes the network functions 120. The network functions 120 refer to various tasks and operations that are performed within the network 105 to enable communication and data exchange between devices. The network functions 120 performs at least one of, data forwarding, routing, switching, addressing, network management, Quality of Service (QoS), and load balancing. The network functions 120 collectively enable the network 105 to operate efficiently, securely, and reliably, supporting the one or more tasks. The one or more tasks includes, but not limited to traffic routing, packet forwarding, and network monitoring.
[0032] The environment 100 further includes the system 125 communicably coupled to the server 115 and each of the first UE 110a, the second UE 110b, and the third UE 110c via the network 105. The system 125 is adapted to be embedded within the server 115 or is embedded as the individual entity. However, for the purpose of description, the system 125 is described as an integral part of the server 115, without deviating from the scope of the present disclosure.
[0033] The system 125 is further configured to employ Transmission Control Protocol (TCP) connection to identify any connection loss in the network 105 and thereby improving overall efficiency. The TCP connection is a communication standard enabling applications and the system 125 to exchange information over the network 105.
[0034] Operational and construction features of the system 125 will be explained in detail with respect to the following figures.
[0035] FIG. 2 illustrates an exemplary block diagram of the system 125 for monitoring the network functions 120 in the network 105, according to one or more embodiments of the present disclosure. The system 125 includes one or more processors 205, a memory 210, a user interface 215, and a database 235. The one or more processors 205, hereinafter referred to as the processor 205 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions. As per the illustrated embodiment, the system 125 includes one processor 205. However, it is to be noted that the system 125 may include multiple processors as per the requirement and without deviating from the scope of the present disclosure.
[0036] Among other capabilities, the processor 205 is configured to fetch and execute computer-readable instructions stored in the memory 210. The memory 210 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to create or share data packets over a network service. The memory 210 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as EPROMs, FLASH memory, unalterable memory, and the like.
[0037] The user interface 215 includes a variety of interfaces, for example, interfaces for a Graphical User Interface (GUI), a web user interface, a Command Line Interface (CLI), and the like. The user interface 215 facilitates communication of the system 125. In one embodiment, the user interface 215 provides a communication pathway for one or more components of the system 125. Examples of the one or more components include, but are not limited to, the UE 110 and the database 235.
[0038] The information related to the one or more predefined policies is stored in the database 235. The database 235 provides structured storage, support for complex queries, and enables efficient data retrieval and analysis. The database 235 is one of, but is not limited to, one of a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of database types are non-limiting and may not be mutually exclusive e.g., a database can be both commercial and cloud-based, or both relational and open-source, etc.
[0039] Further, the processor 205, in an embodiment, may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 205. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 205 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for processor 205 may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 210 may store instructions that, when executed by the processing resource, implement the processor 210. In such examples, the system 125 may comprise the memory 210 storing the instructions and the processing resource to execute the instructions, or the memory 210 may be separate but accessible to the system 125 and the processing resource. In other examples, the processor 205 may be implemented by electronic circuitry.
[0040] In order for the system 125 to monitor network functions in the network 105, the processor 205 includes a transceiver 220, a monitoring unit 225, and a notification unit 230 communicably coupled to each other for monitoring the network functions 120 in the network 105. The operation and functionality of the transceiver 220, the monitoring unit 225, and the notification unit 230 are used in combination or interchangeably to monitor the network functions in the network 105.
[0041] In an alternate embodiment, the system 125 also includes a probing agent. The probing agent acts as an intermediary between the Network Functions (NFs) 120 and the system 125. The probing agent receives the data associated with the one or more users collected by the NFs 120 and provides the collected data to the processor 205 of the system 120. The probing agent is configured to collect the data from NFs 120 and Radio Access Network (RAN) and stream the data in real time to the system 120. The probing agent is embedded in the network functions of 5G or 4G core network and the RAN. The probing agent allows to probe geographically distributed Virtualized Network Functions (VNFs)/Cloud Native Functions (CNFs).
[0042] The transceiver 220, the monitoring unit 225, and the notification unit 230 in an embodiment, may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 205. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 205 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 210 may store instructions that, when executed by the processing resource, implement the processor. In such examples, the system 125 may comprise the memory 210 storing the instructions and the processing resource to execute the instructions, or the memory 210 may be separate but accessible to the system 125 and the processing resource. In other examples, the processor 205 may be implemented by electronic circuitry.
[0043] The transceiver 220 is configured to receive the one or more user defined policies for Network Functions (NFs) 120 from the one or more users via the User Interface (UI) 215. In an embodiment, the one or more user defined policies include at least one of, the notification policy and the alert policy. The NFs 120 can be physical appliances or virtualized components running on shared hardware. The NFs 120 are designed to be modular, scalable, and can be deployed and managed using Software-Defined Networking (SDN) and Network Function Virtualization (NFV) technologies. In one embodiment, in addition to the one or more user defined policies, the associated NFs 120, such as, but not limited to, a NF type, a NF ID, a NF instance ID, and a circle is received. The one or more user defined policies are stored in the database 235. The one or more user defined policies specifies, at least one of, one or more predefined thresholds based on which notifications and alerts are triggered, and notifications and alerts are routed to the appropriate one or more users. The one or more predefined thresholds refers to a predefined limit or boundary that, when exceeded, triggers a specific action, behavior, or event within the network 105. In an embodiment, the notifications and alerts are received by the one or more users via the user interface 215. In an alternate embodiment, the notifications and alerts are received by the one or more users via a Short Message Service (SMS) and an email which are displayed on the user interface 215.
[0044] On receipt of the one or more user defined policies from the one or more users via the transceiver 220, the monitoring unit 225 is configured to monitor multiple instances of the network functions 120 utilizing a trained model. The network functions 120 are a 5G Core (5GC) network including multiple essential Network Functions (NFs) configured to work together to manage connections, sessions, mobility, and policy enforcement. The NFs 120 of 5GC network include, Access and Mobility Management Function (AMF), Session Management Function (SMF), User Plane Function (UPF), and Policy Control Function (PCF). In an exemplary embodiment, if the one or more users exceeds their data cap, the PCF can enforce the one or more user defined policy to reduce their data speed or charge them for additional usage. Each instance of the multiple instances of the network functions 120 refers to an instantiation of the network functions 120 within the network 105. The network functions 120 are perform one or more tasks within the network 105. The one or more tasks includes, but not limited to traffic routing, packet forwarding, AMF, SMF, PCF, and network monitoring. The multiple instances of the network functions 120 is configured to deploy and run multiple copies or versions of the same network function within the network 105. As per the above embodiment, the trained model includes at least one of, an Artificial Intelligence (AI), and a Machine Learning (ML).
[0045] Further, the model is trained by when attributes of each instance of the multiple instances of the network function 120 is breached based on the historical attributes. The historical attributes refer to past records or observations of network function behavior and performance. The historical attributes typically includes information such as clear code counts, error rates, traffic patterns, load, and system metrics collected over a period of time. The occurrence of the breach in each instance of the multiple instances are recorded and trained by the AI/MI model. The trained AI/ML model is utilized to check if any network instance generates a breach based on the one or more user defined policies.
[0046] Further, the monitoring unit 225 is configured to monitor a plurality of attributes pertaining to the multiple instances of the network functions 120 utilizing the trained model. The plurality of attributes plays a crucial role in defining, configuring, managing, and monitoring networking components, includes but not limited to, a router, a switch, a firewall and a gateway. In an embodiment, the plurality of attributes includes at least one of 5GC core network function, Radio Access Network (RAN), Internet Protocol (IP) address, Media Access Control (MAC) address, bandwidth, protocol, Quality of Service (QoS), and routing protocol metrics. Further, the monitoring unit 225 is configured to monitor the one or more tasks performed by the network functions based on the one or more user defined policies, utilizing the trained model. The one or more tasks includes, but not limited to the traffic routing, the packet forwarding, the AMF, the SMF, the PCF, and the network monitoring.
[0047] Upon monitoring the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions, the monitoring unit 225 is further configured to detect abnormality with respect to the at least one of, each instance of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions.
[0048] In one embodiment, on detection of the abnormality, the monitoring unit 225 is configured to compare a clear code count pertaining to each instance of the multiple instances of the network functions 120 with a predefined threshold value for a given time. The clear code count refers to the number of times a specific error or fault condition in the NFs 120 is resolved or cleared within a given period. Each network function instance (e.g., the AMF, the SMF, the UPF) operates within the network 105 to handle specific tasks. When an error or fault occurs (e.g., connectivity issues, session failures), an error code is generated. The system tracks the resolution of these errors using clear codes. Each time the error is resolved, the clear code is recorded. The clear code count is typically compared against the predefined threshold value to determine if the network function is within the given time. The predefined threshold value is defined by the one or more users. In an exemplary embodiment, the predefined threshold value is set to 100. When the clear code count reaches beyond the predefined threshold value within the given time (for example, 10 seconds), the notification unit 230 notifies the one or more users about the breach of the clear code count. The notification is received by the one or more users via the user interface 215.
[0049] Further, the monitoring unit 225 is configured to assign severity levels of clear codes based on urgency or impact. In an embodiment, the severity levels include at least one of, critical, major, minor, or informational. In another embodiment, the probing agent is configured to identify the severity levels of clear codes based on ingress and egress error codes received from the NFs 120. The ingress error codes related to issues detected as data enters the NFs 120. The egress error codes related to issues detected as data exits the NFs 120. The severity levels help to prioritize the clear codes and determine the appropriate response about the occurrence of the breach. The monitoring unit 225 is further configured to divide the clear codes based on the assigned severity levels.
[0050] Further, the monitoring unit 225 is configured to detect the abnormality in the multiple instances of the network functions 120 when a predefined clear code count exceeds the predefined threshold value for the given time utilizing the trained model. On detection of the abnormality with each of the instance of the multiple instances by the network functions 120 in real time, the notification unit 230 is configured to notify the one or more users about occurrence of the breach.
[0051] In another embodiment, the monitoring unit 225 is configured to compare each attribute of the one or more attributes with historical attributes to utilize the trained model. The historical attributes include at least one of the IP addresses, the MAC address, the bandwidth, and the protocol which are retrieved from the database 235. On retrieving the historical attributes, the monitoring unit 225 is configured to compare each attribute of the one or more attributes with the historical attributes to detect the abnormality of the breach of the clear code count.
[0052] In yet another embodiment, the monitoring unit 225 is configured to compare the one or more tasks performed by the network functions with a task associated threshold defined by the one or more user defined policies. In an example, the task includes packet forwarding, the task associated threshold is set to 100. When the forwarding of the packets reaches beyond the task associated threshold. On owing to this, the notification unit 230 notifies to the one or more users about the occurrence of the breach of the packet forwarding when the forwarding of the packets breach the task associated threshold.
[0053] On detection of the abnormality in the occurrence of the breach with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions 120, the notification unit 230 is configured to generate reports related to alerts and notifications for tracking, analysis and compliance purposes. In an embodiment, the reports include, but not limited to, alerts and notifications information include timestamp, and type of alert, status information, response actions, analytical insights, performance metrics, and recommendations and actions. By doing so, the system 125 reduces the time required to identify and debug the errors in the network instances, proactively monitors the network instances in real-time to facilitate tracking and identifying the errors and increases efficiency and throughput of the network 105, thus resulting reducing memory space requirement, and increasing processing efficiency of the processor 205.
[0054] FIG. 3 is a schematic representation of the system 125 in which various entities operations are explained, according to one or more embodiments of the present disclosure. Referring to FIG. 3, describes the system 125 for monitoring network functions in the network 105. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the first UE 110a for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0055] As mentioned earlier in FIG.1, In an embodiment, the first UE 110a may encompass electronic apparatuses. These devices are illustrative of, but not restricted to, personal computers, laptops, tablets, smartphones (including phones), or other devices enabled for web connectivity. The scope of the first UE 110a explicitly extends to a broad spectrum of electronic devices capable of executing computing operations and accessing networked resources, thereby providing users with a versatile range of functionalities for both personal and professional applications. This embodiment acknowledges the evolving nature of electronic devices and their integral role in facilitating access to digital services and platforms. In an embodiment, the first UE 110a can be associated with multiple users. Each user equipment 110 is communicatively coupled with the processor 205 via the network 105.
[0056] The first UE 110a includes one or more primary processors 305 communicably coupled to the one or more processors 205 of the system 125. The one or more primary processors 305 are coupled with a memory unit 310 storing instructions which are executed by the one or more primary processors 305. Execution of the stored instructions by the one or more primary processors 305 enables the first UE 110a to transmit the one or more user defined policies to the one or more processors 205 via the user interface 215.
[0057] Furthermore, the one or more primary processors 305 within the UE 110 are uniquely configured to execute a series of steps as described herein. This configuration underscores the processor 205 capability to monitor the network functions in the network 105. The operational synergy between the one or more primary processors 305 and the additional processors, guided by the executable instructions stored in the memory unit 310, facilitates a seamless monitoring of the network functions in the network 105.
[0058] As mentioned earlier in FIG.2, the one or more processors 205 of the system 125 is configured to receive the one or more user defined policies from the one or more users via the user interface 215, monitor at least one of, multiple instances of the network functions, the plurality of attributes pertaining to the multiple instances of the network functions and the one or more tasks performed by the network functions based on the one or more user defined policies, and notify in real time, the one or more users about occurrence of the breach when, abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions.
[0059] As per the illustrated embodiment, the system 125 includes the one or more processors 205, the memory 210, and the interface unit 215. The operations and functions of the one or more processors 205, the memory 210, and the interface unit 215 are already explained in FIG. 2. For the sake of brevity, a similar description related to the working and operation of the system 125 as illustrated in FIG. 2 has been omitted to avoid repetition.
[0060] Further, the processor 205 includes the transceiver 220, the monitoring unit 225, and the notification unit 230. The operations and functions of the transceiver 220, the monitoring unit 225, and the notification unit 230 are already explained in FIG. 2. Hence, for the sake of brevity, a similar description related to the working and operation of the system 125 as illustrated in FIG. 2 has been omitted to avoid repetition. The limited description provided for the system 125 in FIG. 3, should be read with the description provided for the system 125 in the FIG. 2 above, and should not be construed as limiting the scope of the present disclosure.
[0061] FIG. 4 is an exemplary block diagram of an architecture 400 that can be implemented in the system of FIG. 2, according to one or more embodiments of the present disclosure. The architecture 400 of the system 120 includes the UI 215, a database 215, and a workflow 405.
[0062] The UI 215 is configured to transmit the one or more user defined policies for Network Functions (NFs) 120 from the one or more users to the workflow 215. In an embodiment, the one or more user defined policies include at least one of, the notification policy and the alert policy.
[0063] The user interface 215 includes a variety of interfaces, for example, interfaces for a Graphical User Interface (GUI), a web user interface, a Command Line Interface (CLI), and the like. The user interface 215 facilitates communication of the system 125. In one embodiment, the user interface 215 provides a communication pathway for one or more components of the system 125. Examples of the one or more components include, but are not limited to, the UE 110 and the database 235.
[0064] The workflow 405 stores the one or more user defined policies in the database 235. The one or more user defined policies specifies, at least one of, one or more predefined thresholds based on which notifications and alerts are triggered, and notifications and alerts are routed to the appropriate one or more users. Further, the workflow 405 is configured to monitor the plurality of attributes pertaining to the multiple instances of the network functions 120 utilizing the trained model. The workflow 405 is configured to monitor the one or more tasks performed by the network functions based on the one or more user defined policies, utilizing the trained model. The one or more tasks includes, but not limited to the traffic routing, the packet forwarding, the AMF, the SMF, the PCF, and the network monitoring.
[0065] The workflow 405 is configured to notifies the one or more users in real time about occurrence of the breach when, the abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions 120.
[0066] FIG. 5 is a flow diagram illustrating a method 500 for monitoring network functions 120 in the network 105, according to one or more embodiments of the present disclosure.
[0067] At step 505, the method 500 includes the step of receiving the one or more user defined policies from the one or more users via the user interface 215. The one or more user defined policies are defined by the service provider. The one or more user defined policies include at least one of the notification policy and the alert policy. The one or more user defined policies specifies, at least one of, the one or more thresholds based on which notifications and alerts are triggered, and notifications and alerts are routed to the appropriate one or more users.
[0068] At step 510, the method 500 includes the step of monitoring at least one of, multiple instances of the network functions 120, the plurality of attributes pertaining to the multiple instances of the network functions 120 and the one or more tasks performed by the network functions 120 based on the one or more user defined policies utilizing the trained model.
[0069] At step 515, the method 500 includes the step of notifying, the one or more users about occurrence of the breach when, abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions 120 in in real time.
[0070] The method further includes the step of generating reports related to alerts and notifications for tracking, analysis and compliance purposes based on the occurrence of the breach with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions 120. By doing so, the method 400 reduces the time required to identify and debug the errors in the network instances, proactively monitors the network instances in real-time to facilitate tracking and identifying the errors and increases efficiency and throughput of the network 105, thus resulting reducing memory space requirement, and increasing processing efficiency of the processor 205.
[0071] The present invention discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by a processor 205. The processor 205 is configured to receive one or more user defined policies from one or more users via a User Interface (UI). The processor 205 is configured to monitor, utilizing a trained model, at least one of, multiple instances of network functions, a plurality of attributes pertaining to the multiple instances of the network functions and tasks performed by the network functions based on one or more user defined policies. The processor 205 is further configured to notify in real time, one or more users about occurrence of a breach when, abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the tasks performed by the network functions.
[0072] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-4) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0073] The present disclosure incorporates technical advancement of proactively monitoring the multiple network instances in real-time and checks if any network instance breaches the predefined threshold. If any network instance breaches the predefined threshold, the monitoring system notifies the one or more users about the breach. By doing so, the present invention reduces the time required to identify and debug the errors in the network instances, proactively monitors the network instances in real-time to facilitate tracking and identifying the errors and increases efficiency and throughput of the network, thus resulting reducing memory space requirement, and increasing processing efficiency of the processor.
[0074] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERECE NUMERALS
[0075] Environment - 100
[0076] Network - 105
[0077] User Equipment - 110
[0078] Server – 115
[0079] Network Functions- 120
[0080] System - 125
[0081] Processor -205
[0082] Memory – 210
[0083] User Interface – 215
[0084] Transceiver - 220
[0085] Monitoring unit- 225
[0086] Notification unit- 230
[0087] Database- 235
[0088] One or more primary processors – 305
[0089] Memory – 310
[0090] Workflow- 405

,CLAIMS:CLAIMS
We Claim:
1. A method (500) for monitoring network functions in a network (105), the method (400) comprising the steps of:
receiving, by one or more processors (205), one or more user defined policies for Network Functions (NFs) from one or more users via a User Interface (UI) (215);
monitoring, by the one or more processors (205), utilizing a trained model, at least one of, multiple instances of the network functions, a plurality of attributes pertaining to the multiple instances of the network functions and one or more tasks performed by the network functions based on the one or more user defined policies; and
notifying in real time, by the one or more processors (205), the one or more users about occurrence of a breach when, abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions.

2. The method (500) as claimed in claim 1, wherein the one or more processors (205), detects abnormality with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the one or more tasks performed by the network functions, by:
comparing, utilizing the trained model:
a clear code count pertaining to each of the multiple instances of the network functions with a predefined threshold value for a given time;
each of the one or more attributes with similar historical attributes; and
one or more tasks performed by each of the network functions with a task associated threshold defined by the one or more user defined policies;
detecting, by the one or mor processors (205), utilizing the trained model, the abnormality in at least one of:
the one or more multiple instances of network functions when a predefined clear code count exceeds the predefined threshold value for the given time;
the one or more of the attributes deviating when compared to the similar historical attributes; and
the one or more tasks performed by each of the network functions deviating when compared to the task associated threshold defined by the one or more user defined policies.

3. The method (500) as claimed in claim 2, wherein the method (500) further includes the steps of:
assigning, by the one or more processors (205), severity levels of clear codes based on urgency or impact, wherein the severity levels include at least one of, critical, major, minor, or informational; and
dividing, by the one or more processors (205), the clear codes based on the assigned severity levels.

4. The method (500) as claimed in claim 1, wherein the one or more user defined policies include at least one of, a notification policy and an alert policy.

5. The method (500) as claimed in claim 1, wherein the one or more user defined policies specifies, at least one of, one or more thresholds based on which notifications and alerts are triggered and notifications and alerts are routed to the appropriate one or more users.

6. The method (500) as claimed in claim 1, wherein the step of, notifying in real time, one or more users about occurrence of the breach when, the abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the tasks performed by the network functions, further include the step of:
generating, by the one or processors (205), reports related to the alerts and the notifications for tracking, analysis and compliance purposes.

7. The method (500) as claimed in claim 1, wherein the one or more user defined policies are stored in a database (235).

8. A system (125) for monitoring network functions in a network (105), the system (125) comprising:
a transceiver (220), configured to, receive, one or more user defined policies for Network Functions (NFs) from one or more users via a User Interface (UI) (215);
a monitoring unit (225), configured to, monitor, utilizing a trained model, at least one of, multiple instances of the network functions, a plurality of attributes pertaining to the multiple instances of the network functions and one or more tasks performed by the network functions based on one or more user defined policies; and
a notification unit (230), configured to, notify in real time, one or more users about occurrence of a breach when, abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the tasks performed by the network functions.

9. The system (125) as claimed in claim 8, wherein the monitoring unit (220) detects abnormality with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the tasks performed by the network functions, by:
comparing, utilizing the trained model:
a clear code count pertaining to each of the multiple instances of the network functions with a predefined threshold value for a given time;
each of the one or more attributes with similar historical attributes; and
one or more tasks performed by each of the network functions with a task associated threshold defined by the one or more user defined policies;
detecting, utilizing the trained model, the abnormality in at least one of:
the one or more multiple instances of network functions when a predefined clear code count exceeds the predefined threshold value for the given time;
the one or more of the attributes deviating when compared to the similar historical attributes; and
the one or more tasks performed by each of the network functions deviating when compared to the task associated threshold defined by the one or more user defined policies.

10. The system (125) as claimed in claim 9, wherein the monitoring unit (220) is further configured to:
assign, severity levels of clear codes based on urgency or impact, wherein the severity levels includes at least one of, critical, major, minor, or informational; and
divide, the clear codes based on the assigned severity levels.

11. The system (125) as claimed in claim 8, wherein the one or more user defined policies include at least one of, a notification policy and an alert policy.

12. The system (125) as claimed in claim 8, wherein the one or more user defined policies specifies, at least one of, one or more thresholds based on which notifications and alerts are triggered and notifications and alerts are routed to the appropriate one or more users.

13. The system (125) as claimed in claim 8, wherein the notification unit (230), notifies in real time, one or more users about occurrence of a breach when, abnormality is detected with respect to at least one of, the one or more instances of the multiple instances, the plurality of attributes and the tasks performed by the network functions, by:
generating, reports related to alerts and notifications for tracking, analysis and compliance purposes.

14. The system (125) as claimed in claim 8, wherein the one or more user defined policies are stored in a database (235).

15. A User Equipment (UE) (110), comprising:
one or more primary processors (305) communicatively coupled to one or more processors (205), the one or more primary processors (305) coupled with a memory (310), wherein said memory (310) stores instructions which when executed by the one or more primary processors (305) causes the UE (110) to:
transmit, one or more user defined policies to one or more processors (205) via a User Interface (UI) (215); and
wherein the one or more processors (205) is configured to perform the steps as claimed in claim 1.