FORM 2
THE PATENTS ACT, 1970 (39 OF 1970) & THE PATENT RULES, 2003
COMPLETE SPECIFICATION
(See section 10 and rule 13)
“METHOD AND SYSTEM FOR PERFORMING ROOT CAUSE ANALYSIS FOR ONE OR MORE NETWORK FUNCTIONS
(NFs)”
We, Jio Platforms Limited, an Indian National, of Office - 101, Saffron, Nr. Centre Point, Panchwati 5 Rasta, Ambawadi, Ahmedabad - 380006, Gujarat, India.
The following specification particularly describes the invention and the manner in which it is to be performed.

METHOD AND SYSTEM FOR PERFORMING ROOT CAUSE ANALYSIS FOR ONE OR MORE NETWORK FUNCTIONS (NFs)
FIELD OF INVENTION
5
[0001] Embodiments of the present disclosure relate generally to the field of wireless communication. More particularly, embodiment of the present disclosure relates to a method and system for performing root cause analysis for one or more network functions (NFs). 10
BACKGROUND
[0002] The following description of the related art is intended to provide
background information pertaining to the field of the disclosure. This section may
15 include certain aspects of the art that may be related to various features of the
present disclosure. However, it should be appreciated that this section is used only to enhance the understanding of the reader with respect to the present disclosure, and not as admissions of the prior art.
20 [0003] Network performance management systems typically track network
elements and data from network monitoring tools and combine and process such data to determine key performance indicators (KPI) of the network. Integrated performance management systems provide the means to visualize the network performance data so that network operators and other relevant stakeholders are able
25 to identify the service quality of the overall network, and individual/ grouped
network elements. By having an overall as well as detailed view of the network performance, the network operators can detect, diagnose and remedy actual service issues, as well as predict potential service issues or failures in the network and take precautionary measures accordingly.
30
2

[0004] The network performance management system monitors and collects data
from various network elements and monitoring tools. These monitored values or
Clear Codes values are configured for identifying different events during processing
of any service request. Clear codes are unique codes which describe valuable
5 information of the state of the network function. Clear Codes contain description of
all cause codes and event codes reported by different program blocks running on network elements. Clear Codes provide very useful information to analyse the exact root cause of any error in a network element. Apart from these, clear codes can also be used for identifying the key successful events during the execution of a process.
10 For example, during a voice call communication, when a call flow starts, different
network functions and elements generate different Clear Codes, which describe the success or failure events, and the like, for particular network elements during the communication going on between calling and called party. Through monitoring of these Clear Codes, any issue or error or failure can be analysed for identifying root
15 cause of problems. However, the existing solutions have various limitations for
analysing Clear Codes and finding the root cause factors of problems due to complex configurations, formats and manual efforts. The Clear Codes are 32 characters format codes, which are hard to analyse and to understand for a user, and there may be large number of Clear Codes for an ongoing requested service.
20 Further, there is no such effective system and method which performs root cause
analysis with Clear Codes using Artificial Intelligence/ Machine Learning (AI/ML).
[0005] To detect the root cause analysis (RCA), an AI/ML model uses a decision
tree model to self-train the AI/ML model based on the digits of the clear codes, as
25 each digit of a clear code signifies a particular information.
[0006] For example: First set of digits in the clear code is used to identify the result,
whether it is a success or an error (internal/external). Second set of digits depict the
network procedures. Third set of digits depict the type of interface, e.g.,
30 ingress/egress, respective of response codes. Fourth set of digits depict error codes.
A probing solution in a network captures traffic from network elements. Based on
3

these error codes, a probing solution determines the automatic root cause analysis (RCA). Additionally, it finds the RCA for network functions based on errors (external), interfaces (egress), and procedures (network).
5 [0007] Thus, there exists an imperative need in the art to provide a solution that can
overcome these and other limitations of the existing solutions.
SUMMARY
10 [0008] This section is provided to introduce certain aspects of the present disclosure
in a simplified form that are further described below in the detailed description. This summary is not intended to identify the key features or the scope of the claimed subject matter.
15 [0009] An aspect of the present disclosure may relate to a method for performing
root cause analysis for one or more network functions (NFs), the method comprising: receiving, a network data from one or more NFs, by a data collector unit. The method further comprises transmitting, the network data by the data collector unit to an ingestion layer. The method further comprises processing, the
20 network data received from the one or more NFs, by the ingestion layer. The method
further comprises converting, the processed network data to a normalized network data, by a normalization layer. The method further comprises storing, the normalized network data in at least one of a first database and a second database, by the normalization layer. The method further comprises retrieving, the normalized
25 network data from the at least one of the first database and the second database, by
a training layer. The method further comprises identifying, an anomaly associated with the one or more NFs, based on the normalized network data, by the training layer. The method further comprises transmitting, the identified anomaly, by the training layer to an analyser layer, for performing, a root cause analysis based on
30 the identified anomaly.
4

[0010] In an exemplary aspect of the present disclosure, the network data comprises one or more network codes comprising unique identifiers in a sequential string format, received from the one or more NFs.
5 [0011] In an exemplary aspect of the present disclosure, processing the network
data received from the one or more NFs by the ingestion layer comprises compressing the network data.
[0012] In an exemplary aspect of the present disclosure, the first database is a
10 Distributed Data Lake.
[0013] In an exemplary aspect of the present disclosure, the second database is a Distributed File System.
15 [0014] In an exemplary aspect of the present disclosure, the method further
comprises receiving, a request for real time trend data associated with the one or more NFs at a user interface; sending, the request to the analyser layer, wherein, the analyser layer further retrieves the normalised network data via a streaming engine from the second database; generating, a real-time trend report based on the retrieved
20 normalised network data, to be displayed at the user interface.
[0015] In an exemplary aspect of the present disclosure, the method further comprises receiving, a request for forecasting trend data associated with the one or more NFs, at the user interface. The method further comprises sending, the request
25 to the training layer, wherein the training layer further processes the request to
generate a forecasting trend data. The method further comprises transmitting, the generated forecasting trend data, by the training layer to the analyser layer. The method further comprises generating, a forecasting trend report based on the generated forecasting trend data, by the analyser layer, to be displayed at the user
30 interface.
5

[0016] In an exemplary aspect of the present disclosure, the training layer is trained based on a decision tree model to identify an anomaly related to the one or more NFs.
5 [0017] In an exemplary aspect of the present disclosure, wherein prior to
transmitting, by the training layer, the anomaly to an analyser layer to perform a
root cause analysis the method comprises receiving, a request for performing root
cause analysis at the user interface. The method further comprises performing, the
root cause analysis based on the anomaly, by the analyser layer. The method further
10 comprises generating, a root cause analysis report based on performing the root
cause analysis, by the analyser layer.
[0018] In an exemplary aspect of the present disclosure, post generating, the root
cause analysis report, the method comprises displaying, the root cause analysis
15 report at the user interface.
[0019] Another aspect of the present disclosure may relate to a system for performing root cause analysis for one or more network functions (NFs), the system comprises: a data collector unit configured to: receive a network data from one or
20 more NFs; transmit the network data to an ingestion layer. The ingestion layer is
configured to process the network data, and send, to a normalization layer, the processed network data. The normalization layer is configured to convert the processed network data to a normalized network data, store, the normalized network data to at least one of a first database and a second database. The system further
25 comprises a training layer configured to retrieve the normalized network data from
the at least one of the first database and the second database, identify, an anomaly associated with the one or more NFs based on the normalized network data and transmit, the anomaly to an analyser layer to perform a root cause analysis.
30 [0020] Yet another aspect of the present disclosure may relate to a non-transitory
computer readable storage medium storing instruction for performing root cause
6

analysis for one or more network functions (NFs), the instructions include
executable code which, when executed by one or more units of a system, causes a
data collector unit to receive a network data from one or more NFs. Further, the
instructions include executable code which, when executed causes the data collector
5 unit to transmit the network data to an ingestion layer. Further, the instructions
include executable code which, when executed causes the ingestion layer to process the network data, and send, to a normalization layer, the processed network data. Further, the instructions include executable code which, when executed causes the normalization layer of the system to convert the processed network data to a
10 normalized network data and store, the normalized network data to at least one of a
first database and a second database. Further, the instructions include executable code which, when executed causes a training layer to retrieve the normalized network data from the at least one of the first database and the second database, identify, an anomaly associated with the one or more NFs based on the normalized
15 network data and transmit, the anomaly to an analyser layer to perform a root cause
analysis.
OBJECTS OF THE DISCLOSURE
20 [0021] Some of the objects of the present disclosure, which at least one
embodiment disclosed herein satisfies are listed herein below.
[0022] It is an object of the present disclosure to provide a system and a method for performing root cause analysis for one or more network functions (NFs). 25
[0023] It is another object of the present disclosure to provide a method and a system for proactively identifying and addressing the network issues using AI/ML based techniques with Clear codes on the fly.
30 [0024] It is another object of the present disclosure to provide a method and a
system for providing AI/ML based technique with Clear codes describing an easier
7

user understandable string format to know root cause factors of occurring problems in the network.
DESCRIPTION OF THE DRAWINGS
5
[0025] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale,
10 emphasis instead being placed upon clearly illustrating the principles of the present
disclosure. Also, the embodiments shown in the figures are not to be construed as limiting the disclosure, but the possible variants of the method and system according to the disclosure are illustrated herein to highlight the advantages of the disclosure. It will be appreciated by those skilled in the art that disclosure of such
15 drawings includes disclosure of electrical components or circuitry commonly used
to implement such components.
[0026] FIG. 1 illustrates an exemplary block diagram of a computing device [100]
upon which the features of the present disclosure may be implemented in
20 accordance with exemplary implementation of the present disclosure.
[0027] FIG. 2 illustrates an exemplary block diagram of a system [200] for performing root cause analysis for one or more network functions (NFs), in accordance with exemplary implementations of the present disclosure. 25
[0028] FIG. 3 illustrates a method flow diagram [300] for performing root cause analysis for one or more network functions (NFs), in accordance with exemplary implementations of the present disclosure.
8

[0029] FIG. 4 illustrates an exemplary architecture diagram of a system [400] for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention.
5 [0030] FIG. 5 illustrates an exemplary flow diagram [500] of data normalization
and storage for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention.
[0031] FIG. 6 illustrates a flow diagram [600] of analyser usage for performing root
10 cause analysis for one or more network functions (NFs), in accordance with the
exemplary embodiments of the present invention.
[0032] FIG. 7 illustrates a system architecture [700] for performing root cause
analysis for one or more network functions (NFs), in accordance with the exemplary
15 embodiments of the present invention.
[0033] The foregoing shall be more apparent from the following more detailed description of the disclosure.
20 DETAILED DESCRIPTION
[0034] In the following description, for the purposes of explanation, various specific details are set forth in order to provide a thorough understanding of embodiments of the present disclosure. It will be apparent, however, that
25 embodiments of the present disclosure may be practiced without these specific
details. Several features described hereafter may each be used independently of one another or with any combination of other features. An individual feature may not address any of the problems discussed above or might address only some of the problems discussed above.
30
9

[0035] The ensuing description provides exemplary embodiments only, and is not
intended to limit the scope, applicability, or configuration of the disclosure. Rather,
the ensuing description of the exemplary embodiments will provide those skilled in
the art with an enabling description for implementing an exemplary embodiment.
5 It should be understood that various changes may be made in the function and
arrangement of elements without departing from the spirit and scope of the disclosure as set forth.
[0036] Specific details are given in the following description to provide a thorough
10 understanding of the embodiments. However, it will be understood by one of
ordinary skill in the art that the embodiments may be practiced without these specific details. For example, circuits, systems, processes, and other components may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail. 15
[0037] Also, it is noted that individual embodiments may be described as a process
which is depicted as a flowchart, a flow diagram, a data flow diagram, a structure
diagram, or a block diagram. Although a flowchart may describe the operations as
a sequential process, many of the operations may be performed in parallel or
20 concurrently. In addition, the order of the operations may be re-arranged. A process
is terminated when its operations are completed but could have additional steps not included in a figure.
[0038] The word “exemplary” and/or “demonstrative” is used herein to mean
25 serving as an example, instance, or illustration. For the avoidance of doubt, the
subject matter disclosed herein is not limited by such examples. In addition, any
aspect or design described herein as “exemplary” and/or “demonstrative” is not
necessarily to be construed as preferred or advantageous over other aspects or
designs, nor is it meant to preclude equivalent exemplary structures and techniques
30 known to those of ordinary skill in the art. Furthermore, to the extent that the terms
“includes,” “has,” “contains,” and other similar words are used in either the detailed
10

description or the claims, such terms are intended to be inclusive in a manner similar to the term “comprising” as an open transition word without precluding any additional or other elements.
5 [0039] As used herein, a “processing unit” or “processor” or “operating processor”
includes one or more processors, wherein processor refers to any logic circuitry for processing instructions. A processor may be a general-purpose processor, a special purpose processor, a conventional processor, a digital signal processor, a plurality of microprocessors, one or more microprocessors in association with a Digital
10 Signal Processing (DSP) core, a controller, a microcontroller, Application Specific
Integrated Circuits, Field Programmable Gate Array circuits, any other type of integrated circuits, etc. The processor may perform signal coding data processing, input/output processing, and/or any other functionality that enables the working of the system according to the present disclosure. More specifically, the processor or
15 processing unit is a hardware processor.
[0040] As used herein, “a user equipment”, “a user device”, “a smart-user-device”, “a smart-device”, “an electronic device”, “a mobile device”, “a handheld device”, “a wireless communication device”, “a mobile communication device”, “a
20 communication device” may be any electrical, electronic and/or computing device
or equipment, capable of implementing the features of the present disclosure. The user equipment/device may include, but is not limited to, a mobile phone, smart phone, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, wearable device or any other computing device which is capable
25 of implementing the features of the present disclosure. Also, the user device may
contain at least one input means configured to receive an input from unit(s) which are required to implement the features of the present disclosure.
[0041] As used herein, “storage unit” or “memory unit” refers to a machine or
30 computer-readable medium including any mechanism for storing information in a
form readable by a computer or similar machine. For example, a computer-readable
11

medium includes read-only memory (“ROM”), random access memory (“RAM”),
magnetic disk storage media, optical storage media, flash memory devices or other
types of machine-accessible storage media. The storage unit stores at least the data
that may be required by one or more units of the system to perform their respective
5 functions.
[0042] As used herein “interface” or “user interface” refers to a shared boundary
across which two or more separate components of a system exchange information
or data. The interface may also be referred to a set of rules or protocols that define
10 communication or interaction of one or more modules or one or more units with
each other, which also includes the methods, functions, or procedures that may be called.
[0043] All modules, units, components used herein, unless explicitly excluded
15 herein, may be software modules or hardware processors, the processors being a
general-purpose processor, a special purpose processor, a conventional processor, a
digital signal processor (DSP), a plurality of microprocessors, one or more
microprocessors in association with a DSP core, a controller, a microcontroller,
Application Specific Integrated Circuits (ASIC), Field Programmable Gate Array
20 circuits (FPGA), any other type of integrated circuits, etc.
[0044] Root Cause Analysis involves the detection and evaluation of anomalies or
deviations in network performance by comparing real-time trends against
established secondary data (e.g., normal operational data, threshold data, historical
25 trend data).
[0045] As used herein the transceiver unit includes at least one receiver and at least
one transmitter configured respectively for receiving and transmitting data, signals,
information or a combination thereof between units/components within the system
30 and/or connected with the system.
12

[0046] As discussed in the background section, the current known solutions have
several shortcomings. The present disclosure aims to overcome the above-
mentioned and other existing problems in this field of technology by providing
method and system of performing root cause analysis for one or more network
5 functions (NFs).
[0047] As discussed in the background section, the current known solutions have
several shortcomings. The present disclosure aims to overcome the above-
mentioned and other existing problems in this field of technology by providing
10 method and system for an AI/ML based proactive root cause analysis with
sequential occurrence of Clear codes for analysis.
[0048] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the accompanying drawings.
15
[0049] FIG. 1 illustrates an exemplary block diagram of a computing device [100] upon which the features of the present disclosure may be implemented in accordance with exemplary implementation of the present disclosure. In an implementation, the computing device [100] may also implement a method for
20 managing performance data of a node in a network utilising the system. In another
implementation, the computing device [100] itself implements the method for managing performance data of a node in a network using one or more units configured within the computing device [100], wherein said one or more units are capable of implementing the features as disclosed in the present disclosure.
25
[0050] The computing device [100] may include a bus [102] or other communication mechanism for communicating information, and a hardware processor [104] coupled with bus [102] for processing information. The hardware processor [104] may be, for example, a general-purpose microprocessor. The
30 computing device [100] may also include a main memory [106], such as a random-
access memory (RAM), or other dynamic storage device, coupled to the bus [102]
13

for storing information and instructions to be executed by the processor [104]. The
main memory [106] also may be used for storing temporary variables or other
intermediate information during execution of the instructions to be executed by the
processor [104]. Such instructions, when stored in non-transitory storage media
5 accessible to the processor [104], render the computing device [100] into a special-
purpose machine that is customized to perform the operations specified in the instructions. The computing device [100] further includes a read only memory (ROM) [108] or other static storage device coupled to the bus [102] for storing static information and instructions for the processor [104].
10
[0051] A storage device [110], such as a magnetic disk, optical disk, or solid-state drive is provided and coupled to the bus [102] for storing information and instructions. The computing device [100] may be coupled via the bus [102] to a display [112], such as a cathode ray tube (CRT), Liquid crystal Display (LCD),
15 Light Emitting Diode (LED) display, Organic LED (OLED) display, etc. for
displaying information to a computer user. An input device [114], including alphanumeric and other keys, touch screen input means, etc. may be coupled to the bus [102] for communicating information and command selections to the processor [104]. Another type of user input device may be a cursor controller [116], such as a
20 mouse, a trackball, or cursor direction keys, for communicating direction
information and command selections to the processor [104], and for controlling cursor movement on the display [112]. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allow the device to specify positions in a plane.
25
[0052] The computing device [100] may implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and/or program logic which in combination with the computing device [100] causes or programs the computing device [100] to be a special-purpose machine.
30 According to one implementation, the techniques herein are performed by the
computing device [100] in response to the processor [104] executing one or more
14

sequences of one or more instructions contained in the main memory [106]. Such
instructions may be read into the main memory [106] from another storage medium,
such as the storage device [110]. Execution of the sequences of instructions
contained in the main memory [106] causes the processor [104] to perform the
5 process steps described herein. In alternative implementations of the present
disclosure, hard-wired circuitry may be used in place of or in combination with software instructions.
[0053] The computing device [100] also may include a communication interface
10 [118] coupled to the bus [102]. The communication interface [118] provides a two-
way data communication coupling to a network link [120] that is connected to a
local network [122]. For example, the communication interface [118] may be an
integrated services digital network (ISDN) card, cable modem, satellite modem, or
a modem to provide a data communication connection to a corresponding type of
15 telephone line. As another example, the communication interface [118] may be a
local area network (LAN) card to provide a data communication connection to a
compatible LAN. Wireless links may also be implemented. In any such
implementation, the communication interface [118] sends and receives electrical,
electromagnetic or optical signals that carry digital data streams representing
20 various types of information.
[0054] The computing device [100] can send messages and receive data, including program code, through the network(s), the network link [120] and the communication interface [118]. In the Internet example, a server [130] might
25 transmit a requested code for an application program through the Internet [128], the
ISP [126], the local network [122], the host [124] and the communication interface [118]. The received code may be executed by the processor [104] as it is received, and/or stored in the storage device [110], or other non-volatile storage for later execution.
30
15

[0055] Referring to FIG. 2, an exemplary block diagram of a system [200] for
performing root cause analysis for one or more network functions (NFs), is shown,
in accordance with the exemplary implementations of the present disclosure. The
system [200] comprises at least one data collector unit [202], at least one ingestion
5 layer [204], at least one normalization layer [206], at least one analyser layer [208],
at least one streaming engine [210], at least one training layer [212], at least one second database [214], at least one first database [216] and at least one user interface [218]. Also, all of the components/ units of the system [200] are assumed to be connected to each other unless otherwise indicated below. As shown in the
10 figures all units shown within the system [200] should also be assumed to be
connected to each other. Also, in FIG. 2 only a few units are shown, however, the system [200] may comprise multiple such units or the system [200] may comprise any such numbers of said units, as required to implement the features of the present disclosure. Further, in an implementation, the system [200] may reside in a server
15 or a network entity.
[0056] The system [200] is configured for performing root cause analysis for one or more network functions (NFs), with the help of the interconnection between the components/units of the system [200].
20
[0057] In order to perform a root cause analysis for one or more network functions (NFs) the data collector unit [202] is configured to receive a network data from one or more NFs. The data collector unit [202] is further configured to transmit the network data to an ingestion layer [204].
25
[0058] In an implementation of the present disclosure, the purpose of performing root cause analysis is to identify the fundamental issue causing network troubles. The data collector unit [202] is responsible for receiving and storing network data received from multiple NFs. The network data comprises one or more network
30 codes comprising unique identifiers in a sequential string format received from the
one or more NFs. The network data includes metrics such as traffic volumes, error
16

rates and latency. In an implementation, the network data may represent Clear Code
values, which are configured for identifying different events during processing of
any service request. Clear codes are unique codes which describe valuable
information of the state of the network function. Clear Codes contain description of
5 all cause codes and event codes reported by different program blocks running on
network elements. Clear Codes provide very useful information to analyse the exact root cause of any error in a network element. Apart from these, clear codes can also be used for identifying the key successful events during the execution of a process.
10 [0059] Thereafter, the ingestion layer [204] is configured to process the network
data, and send, to a normalization layer [206], the processed network data.
[0060] In an implementation of the present disclosure, the ingestion layer [204] is
configured to process the network data by compressing the network data received
15 from the one or more NFs. Moreover, the ingestion layer [204] fetches the data from
the data collector unit [202], compresses it and sends it to the normalization layer over File Transfer Protocol (FTP).
[0061] Also, the normalization layer [206] is configured to convert the processed
20 network data to a normalized network data. Further, the normalization layer [206]
is configured to store, the normalized network data to at least one of a first database
[216] and a second database [214]. In an implementation, the normalization layer
[206] receives the network data from the ingestion layer [204], it then pre-processes
the network data based on predefined metadata and rules (fieldname and type), such
25 that the network data may be ready to be stored in the corresponding data sources,
such first database [216] and second database [214].
[0062] In an implementation of the present disclosure, the process of converting
the processed network data to normalized network data by the normalization layer
30 [206] begins with the receipt of the processed data from the ingestion layer [204].
This data might be in various formats and structures, depending on the source NFs.
17

The normalization layer [206] regulates the network data into a format. This may
involve converting different data types into a unified schema and handling missing
values. Further, normalized network data refers to network information that has
been transformed to a standardized structure, eliminating differences and
5 inconsistencies. The normalization layer [206] post processing the data, stores the
normalized network data in the first database [216] as well as in second database [214].
[0063] In an example, the first database [216] is a distributed data lake and the
10 second database [214] is a distributed file system. The first database [216],
described as a distributed data lake, is designed to store large volumes of diverse data types. The second database [214] is described as a distributed file system, which ensures data is stored across multiple nodes or servers.
15 [0064] Then, the training layer [212] is configured to retrieve the normalized
network data from the at least one of the first database [216] and the second database [214]. The databases respond to the query by the training layer [212] by locating the requested normalized network data within their respective storage structures. The data is then fetched and transferred back to the training layer [212]
20 in a format that is ready for further analysis.
[0065] Furthermore, the training layer [212] is configured to identify, an anomaly associated with the one or more NFs based on the normalized network data. In an example, identifying an anomaly by the training layer [212] involves analysing the
25 normalized network data to detect deviations from expected patterns or behaviours.
The training layer [212] employs machine learning algorithms, such as a decision tree model, to evaluate the normalized data. By comparing the current data with the past data, the training layer [212] can identify irregularities that signify potential anomalies. These anomalies may indicate performance issues, security breaches,
30 within the network functions. An anomaly associated with the network functions
(NFs) can be any deviation from normal patterns that may indicate a problem.

Examples include unusually high error rates and sudden drops in network performance. Also, the training layer [212] is further configured to transmit, the anomaly to an analyser layer [208] to perform a root cause analysis.
5 [0066] In an example, wherein prior to transmitting, by the training layer [212], the
anomaly to an analyser layer [208] to perform a root cause analysis, the system
comprises the user interface [218] configured to receive a request for performing
root cause analysis. Further, the analyser layer [208] is configured to perform the
root cause analysis based on the anomaly. Then, the analyser layer [208] configured
10 to generate a root cause analysis report based on performing the root cause analysis.
[0067] Further, post generating, by the analyser layer [208], the root cause analysis report, the analyser layer [208] is configured to display the root cause analysis report at the user interface [218].
15
[0068] In an implementation of the present disclosure, the training layer [212] employs machine learning techniques to analyse the data, identify anomalies in network functions. Then, the training layer [212] is trained based on a decision tree model to identify an anomaly related to the one or more NFs. The anomaly is an
20 unexpected or irregular event or data point within the network functions. Examples
of anomalies may include high error rates, latency variation and unauthorised access attempts. The training layer [212] runs multiple Artificial Intelligence (AI)/Machine Learning (ML) algorithms continuously to find any failure scenario and send data to the analyser layer [208]. After feeding the Clear Codes to AI/ML
25 algorithms, the training layer [212] has the capability to generate the root cause of
network functions in case of any failure code it gets from the Clear Codes data. This way proactive identification is achieved to address any issue in the network without any manual intervention to perform the root cause analysis.
30 [0069] The system further comprises a user interface [218] configured to receive a
request for real time trend data associated with the one or more NFs and send, the
19

request to the analyser layer [208]. In an example, the user interface [218] is
designed to receive input from users, such as requests for real-time trend data
related to network traffic volumes, error rates and user login attempts. The real-time
trend data provides insights into the current performance and behaviour of network
5 functions. This data is continuously updated, allowing users to monitor and analyse
the network’s status and trends as they occur in real-time.
[0070] In an example the analyser layer [208] is further configured to retrieve the normalised network data via a streaming engine [210] from the second database
10 [214]. The analyser layer [208] is further configured to generate, a real-time trend
report to be displayed at the user interface [218]. In an example, the analyser layer [208] not only performs root cause analysis but also handles requests for real-time trend data. It retrieves normalized network data from the second database [214] via a streaming engine [210] and generates reports that display ongoing trends and
15 patterns, which are then sent to the user interface [218] for user viewing. The
streaming engine facilitates real-time data processing by continuously collecting and transmitting data from the database to the analyser layer [208]. This setup allows the analyser layer [208] to access up-to-date data without the need for batch processing. The streaming engine [210] is the technology or platform that enables
20 the continuous processing and delivery of data in real-time. An example of a
streaming engine is Apache Kafka, which is widely used for building real-time data pipelines and streaming applications.
[0071] The retrieved normalized network data includes processed information from
25 various network functions. This data could encompass performance metrics, error
logs, traffic statistics and user activity records. The real-time trend report based on this data may include for example, User Equipment (UE) mobility information, UE communication information, UE abnormal behaviour information.
30 [0072] In an example, the real-time trend report generated by the analyser layer
[208] provides a comprehensive overview of the ongoing performance and

behaviour of network functions. This report is designed to be displayed on the user interface [218].
[0073] The user interface [218] is further configured to receive a request for a
5 forecasting trend data associated with the one or more NFs and send, the request to
the training layer [212].
[0074] In an example, the user interface [218] enables users to input requests for
specific actions, such as requesting forecasting trend data. This request is captured
10 by the user interface [218] and transmitted to the training layer [212]. The
forecasting trend data involves analysing past and current network data to predict future behaviours and trends. In an example, forecasting trend data may be for example, an anticipated increases in data traffic and expected error rates.
15 [0075] Further, the training layer [212] is further configured to process the request
to generate a forecasting trend data. The, the analyser layer [208] is further configured to receive the forecasting trend data from the training layer [212] and generate, a forecasting trend report to be displayed at the user interface [218].
20 [0076] In an example, the training layer [212] processes requests for forecasting
trend data. It utilizes historical and current network data to generate predictions about future trends. The analyser layer [208] receives the forecasting trend data from the training layer [212] and generates a forecasting trend report. This report provides a detailed overview of the predicted future trends in network functions,
25 based on the forecasting data generated by the training layer.
[0077] In an example, the user interface [218] enables users to input requests for
specific actions, such as performing a root cause analysis. Before the training layer
[212] transmits an identified anomaly to the analyser layer [208], it ensures the
30 anomaly is properly detected and prepared for further analysis.

[0078] In an example, the analyser layer [208] is responsible for conducting the
root cause analysis based on the anomalies identified by the training layer [212]. It
generates a detailed root cause analysis report that explains the origins of the
identified issues. The analyser layer [208] also handles requests received via the
5 user interface [218] for performing root cause analysis. The root cause analysis
report generated by the analyser layer [208] provides a comprehensive overview of the issues affecting network functions and their root causes. This report is intended to be displayed on the user interface [218], giving users detailed insights into the nature and origins of network anomalies.
10
[0079] Referring to FIG. 3, an exemplary method flow diagram [300] for performing root cause analysis for one or more network functions (NFs), in accordance with exemplary implementations of the present disclosure is shown. In an implementation the method [300] is performed by the system [200]. Further, in
15 an implementation, the system [200] may be present in a server device to implement
the features of the present disclosure. Also, as shown in FIG. 3, the method [300] starts at step [302].
[0080] At step 304, In order to perform root cause analysis for one or more network
20 functions (NFs), the method comprises receiving, a network data from one or more
NFs, by a data collector unit [202]. In an example, the purpose of performing root cause analysis is to identify the fundamental issue causing network troubles. The data collector unit [202] is responsible for receiving and storing network data received from multiple NFs. 25
[0081] At step 306, the method comprises, transmitting, the network data by the
data collector unit [202] to an ingestion layer [204]. In an example, the network
data comprises one or more network codes comprising unique identifiers in a
sequential string format received from the one or more NFs. The network data
30 includes metrics such as traffic volumes, error rates and latency. In an
implementation, the network data may represent Clear Codes values, which are
22

configured for identifying different events during processing of any service request.
Clear codes are unique codes which describe valuable information of the state of
the network function. Clear Codes contain description of all cause codes and event
codes reported by different program blocks running on network elements. Clear
5 Codes provide very useful information to analyse the exact root cause of any error
in a network element. Apart from these, clear codes can also be used for identifying the key successful events during the execution of a process.
[0082] At step 308, the method comprises, processing, the network data received
10 from the one or more NFs, by the ingestion layer [204]. In an implementation of the
present disclosure, the processing the network data received from the one or more
NFs by the ingestion layer [204] comprises compressing the network data.
Moreover, the ingestion layer [204] fetches the data from the data collector unit
[202], compresses it and send it to the normalization layer [206] over File Transfer
15 Protocol (FTP).
[0083] At step 310, the method comprises, converting, the processed network data
to a normalized network data, by a normalization layer [206]. In an example, the
normalization layer [206] receives the network data from the ingestion layer [204],
20 it then pre-processes the network data based on predefined metadata and rule
(fieldname and type), such that the network data may be ready to be stored in the corresponding data source, such first database [216] and second database [214].
[0084] In an implementation of the present disclosure, the process of converting
25 the processed network data to normalized network data by the normalization layer
[206] begins with the receipt of the processed data from the ingestion layer [204].
This data might be in various formats and structures, depending on the source NFs.
The normalization layer [206] regulates the network data into a format. This may
involve converting different data types into a unified schema and handling missing
30 values. Further, the normalized network data refers to network information that has
23

been transformed to a standardized structure, eliminating differences and inconsistencies.
[0085] At step 312, the method comprises, storing, the normalized network data in
5 at least one of a first database [216] and a second database [214], by the
normalization layer [206]. In an example, the first database [216] is a distributed data lake and the second database [214] is a distributed file system. The first database [216], described as a distributed data lake, is designed to store large volumes of diverse data types. The second database [214] is described as a
10 distributed file system, which ensures data is stored across multiple nodes or
servers. Thereafter, the training layer [212] is configured to retrieve the normalized network data from the at least one of the first database [216] and the second database [214]. The databases respond to this retrieval query by locating the requested normalized network data within their respective storage structures. The
15 data is then fetched and transferred back to the training layer [212] in a format that
is ready for further analysis.
[0086] Furthermore, the training layer [212] is configured to identify, an anomaly associated with the one or more NFs based on the normalized network data. In an
20 example, identifying an anomaly by the training layer [212] involves analysing the
normalized network data to detect deviations from expected patterns or behaviours. The training layer [212] employs machine learning algorithms, such as a decision tree model, to evaluate the normalized data. By comparing the current data with the past data, the training layer [212] can identify irregularities that signify potential
25 anomalies. These anomalies may indicate performance issues, security breaches,
within the network functions. Also, the training layer [212] is further configured to transmit, the anomaly to an analyser layer [208] to perform a root cause analysis. An anomaly associated with the network functions (NFs) can be any deviation from normal patterns that may indicate a problem. Examples include unusually high error
30 rates and sudden drops in network performance.

[0087] The normalization layer [206], post processing the data, stores the normalized network data in the first database as well as in second database.
[0088] At step 314, the method comprises, retrieving, the normalized network data
5 from the at least one of the first database [216] and the second database [214], by a
training layer [212]. The training layer [212], in order to identify network failure and faults, retrieves the Clear Codes from the databases to perform the fault identification.
10 [0089] In an example, prior to transmitting, by the training layer [212], the anomaly
to an analyser layer [208] to perform a root cause analysis the method comprises receiving, a request for performing root cause analysis at the user interface [218]; performing, the root cause analysis based on the anomaly, by the analyser layer [208]; and generating, a root cause analysis report based on performing the root
15 cause analysis, by the analyser layer [208].
[0090] Further, post generating, the root cause analysis report, the method comprises displaying, the root cause analysis report at the user interface [218].
20 [0091] In an implementation of the present disclosure, the training layer [212]
employs machine learning techniques to analyse the data, identifying anomalies in network functions. Then, the training layer [212] is trained based on a decision tree model to identify an anomaly related to the one or more NFs. The anomaly is an unexpected or irregular event or data point within the network functions. Examples
25 of anomalies include high error rates, latency variation and unauthorised access
attempts. The training layer [212] runs multiple Artificial Intelligence (AI)/Machine Learning (ML) algorithms continuously to find any failure scenario and send data to the analyser layer [208]. After feeding the Clear Codes to AI/ML algorithms, the training layer [212] has the capability to generate the root cause of network
30 functions in case of any failure code it gets from the Clear Codes data. This way

proactive identification is achieved to address any issue in the network without any manual intervention to perform the root cause analysis.
[0092] At step 316, the method comprises, identifying, an anomaly associated with
5 the one or more NFs, based on the normalized network data, by the training layer
[212].
[0093] At step 318, the method comprises, transmitting, the identified anomaly, by
the training layer [212] to an analyser layer [208], for performing, a root cause
10 analysis based on the identified anomaly.
[0094] The method further comprising, receiving, a request for real time trend data associated with the one or more NFs at a user interface [218]. In an example, the user interface [218] is designed to receive input from users, such as requests for
15 real-time trend data such as network traffic volumes, error rates and user login
attempts. The real-time trend data provides insights into the current performance and behaviour of network functions. This data is continuously updated, allowing users to monitor and analyse the network’s status and trends as they occur in real-time.
20
[0095] In an example, the request is sent to the analyser layer [208], wherein, the analyser layer [208] further retrieves the normalised network data via a streaming engine [210] from the second database [214] and generates, a real-time trend report based on the retrieved normalised network data, to be displayed at the user interface
25 [218]. The analyser layer [208] not only performs root cause analysis but also
handles requests for real-time trend data. It retrieves normalized network data from the second database [214] via a streaming engine [210] and generates reports that display ongoing trends and patterns, which are then sent to the user interface [218] for user viewing. The streaming engine [210] facilitates real-time data processing
30 by continuously collecting and transmitting data from the database to the analyser
layer [208]. This setup allows the analyser layer [208] to access up-to-date data
26

without the need for batch processing. The streaming engine [210] is the technology or platform that enables the continuous processing and delivery of data in real-time. An example of a streaming engine is Apache Kafka, which is widely used for building real-time data pipelines and streaming applications. 5
[0096] The retrieved normalized network data includes processed information from
various network functions. This data could encompass headers such as,
performance metrics, error logs, traffic statistics and user activity records. The real¬
time trend report based on this data may include for example, User Equipment (UE)
10 mobility information, UE communication information, UE abnormal behaviour
information.
[0097] In an example, the real-time trend report generated by the analyser layer
[208] provides a comprehensive overview of the ongoing performance and
15 behaviour of network functions. This report is designed to be displayed on the user
interface [218].
[0098] The method further comprises, receiving, a request for forecasting trend
data associated with the one or more NFs, at the user interface [218]. In an example,
20 the user interface [218] enables users to input requests for specific actions, such as
requesting forecasting trend data. The forecasting trend data involves analysing past and current network data to predict future behaviours and trends.
[0099] Further, the method comprises sending, the request to the training layer
25 [212], wherein the training layer [212] further processes the request to generate a
forecasting trend data; transmitting, the generated forecasting trend data, by the
training layer [212] to the analyser layer [208] and generating, a forecasting trend
report based on the generated forecasting trend data, by the analyser layer [208], to
be displayed at the user interface [218]. In an example, the training layer [212]
30 processes requests for forecasting trend data. It utilizes historical and current
network data to generate predictions about future trends. The analyser layer [208]
27

receives the forecasting trend data from the training layer [212] and generates a forecasting trend report. This report provides a detailed overview of the predicted future trends in network functions, based on the forecasting data generated by the training layer. 5
[0100] In an example, the user interface [218] enables users to input requests for specific actions, such as performing a root cause analysis. Before the training layer [212] transmits an identified anomaly to the analyser layer [208], it ensures the anomaly is properly detected and prepared for further analysis.
10
[0101] In an example, the analyser layer [208] is responsible for conducting the root cause analysis based on the anomalies identified by the training layer [212]. It generates a detailed root cause analysis report that explains the origins of the identified issues. The analyser layer also handles requests received via the user
15 interface [218] for performing root cause analysis. The root cause analysis report
generated by the analyser layer [208] provides a comprehensive overview of the issues affecting network functions and their root causes. This report is intended to be displayed on the user interface [218], giving users detailed insights into the nature and origins of network anomalies.
20
[0102] Thereafter, the method terminates at step 320.
[0103] Referring to FIG. 4, an exemplary architecture diagram of a system [400] for performing root cause analysis for one or more network nodes, in accordance
25 with the exemplary embodiments of the present invention. The system [400]
comprises data collector unit [202], ingestion layer [204], normalization layer [206], analysis engine [406], Artificial Intelligence (AI)/Machine Learning (ML) [222], distributed data lake [404] and operation center [408]. Further, FIG. 4 is intended to be read in conjunction with the exemplary block diagram of a system
30 [200] as shown in FIG. 2.
28

[0104] In a preferred embodiment, in the system [400], the data collector unit [202]
stores Clear codes data collected from different network nodes in the network. As
shown in the FIG. 4, there may be multiple data collector unit [202] to collect
network data from multiple network nodes or network functions (NF), like NF1,
5 NF2, NF3. The ingestion layer [204] receives the network data from the data
collector Unit [202] and provides the same to the normalization layer [206]. The normalization layer [206] receives the network data from the ingestion layer [204], it then pre-processes the network data based on predefined metadata and rules (fieldname and type), such that the network data may be ready to be stored in the
10 distributed data lake [404]. In an example, the network data comprises one or more
network codes comprising unique identifiers in a sequential string format received from the one or more NFs. The network data includes metrics such as traffic volumes, error rates and latency. In an implementation, the network data may represent Clear Codes values, which are configured for identifying different events
15 during processing of any service request.
[0105] The distributed data lake [404], is designed to store large volumes of diverse data types.
20 [0106] The AI/ML layer [402] is adapted to perform machine learning on the
normalized network data, to identify the RCA factors or parameters from the normalized network data. In an implementation, the AI/ML layer [402] performs the same function as the training layer [212] as shown in FIG. 2.
25 [0107] The AI/ML layer [402] runs multiple AI or ML algorithms continuously to
find any failure scenario and send data to the analysis engine [406]. In an implementation, the analysis engine [406] performs the same function as the analyser layer [208] as shown in FIG. 2. After feeding the Clear Codes to AI/ML algorithms, the AI/ML layer [402] has the capability to generate the root cause of
30 network functions in case of any failure code it gets from the Clear Codes data. This

way proactive identification is achieved to address any issue in the network without any manual intervention to perform the root cause analysis.
[0108] The analysis engine [406] is further adapted to initiate the RCA operations
5 based on the identified RCA factors or parameters. The RCA report is then
transmitted by the analysis engine [406] to an operation center [408] for initiating appropriate actions. In an implementation, the analysis engine [406] performs the same function as the analyser layer [208] as shown in FIG. 2.
10 [0109] Referring to FIG. 5, which illustrates a flow diagram [500] of data storage
and AI/ML fine tuning for performing root cause analysis for one or more network functions (NFs), in accordance with the exemplary embodiments of the present invention. Further, FIG. 5 is intended to be read in conjunction with the exemplary block diagram of a system [200] as shown in FIG. 2 and the exemplary architecture
15 diagram of a system [400] as shown in FIG. 4 The systems and flow diagrams as
shown in FIG. 2 and FIG. 4 and FIG. 5 complement each other.
[0110] In the depicted system, the process begins with the Data Records [502], which store raw network data from various Network Functions (NFs) forwarding
20 the raw network data to the ingestion layer [204]. In an implementation, the network
data may represent Clear Codes values, which are configured for identifying different events during processing of any service request. Clear codes are unique codes which describe valuable information of the state of the network function. Clear Codes contain description of all cause codes and event codes reported by
25 different program blocks running on network elements. Clear Codes provide very
useful information to analyse the exact root cause of any error in a network element. Apart from these, clear codes can also be used for identifying the key successful events during the execution of a process. The ingestion layer [204] is responsible for the initial processing of the incoming network data. This initial processing by
30 the ingestion layer [204] involves compressing the raw network data. Once
processed, the network data moves to the normalization layer [206]. The
30

normalization layer [206] receives the network data, it then pre-processes the
network data based on predefined metadata and rules (fieldname and type), by
which it is transformed into a standardized format suitable for further analysis.
Thereafter, the network data may be ready to be stored in the corresponding data
5 sources, such as first database [216] and second database [214].
[0111] The normalized data is then stored in the Distributed Data Lake [404], which is designed to store large volumes of diverse data types. For analytical purposes, the Artificial Intelligence (AI)/Machine Learning (ML) [222] retrieves the
10 normalized data from the distributed data lake [404]. This AI/ML layer [402]
employs advanced machine learning algorithms to analyse the data, identifying anomalies and generating forecasting trend data. In an implementation, the AI/ML layer [402] may be present in the training layer [212] as shown in FIG. 2. Multiple AI/ML algorithms are continuously run to find any failure scenario. After the Clear
15 Codes are fed to the AI/ML layer [402], the AI/ML algorithms generate the root
cause of network functions in case of any failure code they get from the Clear Codes data. This way proactive identification is achieved to address any issue in the network without any manual intervention to perform the root cause analysis. This process by which AI/ML layer [402] continuously analyses the network data is
20 referred to as fine tuning of AI/ML algorithms to learn the deviations and trends in
the network data. By continuously analyzing the network data, the AI/ML layer [402] self-trains its algorithms.
[0112] Referring to FIG. 6, which illustrates an exemplary flow diagram [600] of
25 analyser layer usage for performing root cause analysis for one or more network
functions (NFs), in accordance with the exemplary embodiments of the present
invention. Further, FIG. 6 is intended to be read in conjunction with the exemplary
block diagram of a system [200] as shown in FIG. 2, the exemplary architecture
diagram of a system [400] as shown in FIG. 4 and the exemplary flow diagram
30 [500] as shown in FIG. 5. The systems and flow diagrams as shown in FIG. 2, FIG.
4, FIG. 5 and FIG. 6 complement each other.
[0113] The user interface [218] is designed to receive input from a user, such as
requests for real-time trend data related to network functions. The real-time trend
data provides insights into the current performance and behaviour of network
5 functions. This data is continuously updated, allowing the user to monitor and
analyse the network’s status and trends as they occur in real-time.
[0114] The request from the user is forwarded to the analyser layer [208] that not only performs root cause analysis but also handles requests for real-time trend data.
10 It retrieves normalized network data from the distributed file system [504] via a
streaming engine [210] and generates reports that display ongoing trends and patterns, which are then sent to the user interface [218] for user viewing. The streaming engine [210] is the technology or platform that enables the continuous processing and delivery of data in real-time. The distributed file system [504]
15 ensures data is stored across multiple nodes or servers. The streaming engine on
receiving the normalized network data retrieval request from the analyser layer [208], sends a request to collect data from distributed file system [504], which then sends back the raw network data to the streaming engine [210], which further forwards the raw network data to the analyser layer [208]. Further, in an
20 implementation, a normalization layer [206] may be present to normalize the raw
network data received from data collection unit [202] as shown in FIG.2, and then store the normalized network data in the distributed file system [504] and distributed data lake [404].
25 [0115] In an example, the real-time trend report generated by the analyser layer
[208] provides a comprehensive overview of the ongoing performance and behaviour of network functions. This report is designed to be displayed on the user interface [218]. The user interface [218] enables the user to input requests for specific actions, such as requesting forecasting trend data. The forecasting trend
30 data involves analysing past and current network data to predict future behaviours
and trends.

[0116] In an exemplary scenario, a request from the user may be for a forecasting
trend data. The AI/ML layer [402] processes requests for forecasting trend data. It
utilizes historical and current network data to generate predictions about future
5 trends. The analyser layer [208] receives the forecasting trend data from the AI/ML
layer [402] and generates a forecasting trend report. This report provides a detailed overview of the predicted future trends in network functions, based on the forecasting data generated by the training layer.
10 [0117] Further, the user interface [218] enables the user to input requests for
specific actions, such as performing a root cause analysis. Before the AI/ML layer [402] transmits an identified anomaly to the analyser layer [208], it ensures the anomaly is properly detected and prepared for further analysis. the analyser layer [208] is responsible for conducting the root cause analysis based on the anomalies
15 identified by the AI/ML layer [402]. It generates a detailed root cause analysis
report that explains the origins of the identified issues. The analyser layer [208] also handles requests received via the user interface [218] for performing root cause analysis. The user interface [218] initiates the process by sending a data request to the analyser layer [208]. Upon receiving the request, the analyser layer [208]
20 communicates with the streaming engine [210] to fetch the required normalized
network data from the distributed file system [504]. The streaming engine [210] continuously collects and transmits data from the distributed file system [504] to the analyser layer [208]. Once the analyser layer [208] retrieves the data, it processes the information to generate the requested reports or analyses. If the
25 request involves detecting anomalies or forecasting trends, the analyser layer [208]
may also engage with the AI/ML layer [402]. After processing, the analyser layer [208] sends the results back to the user interface [218]. This output can include detailed reports on root cause analysis, real-time trends, or predictive forecasts, which are then displayed to the user.
30

[0118] The root cause analysis report generated by the analyser layer [208] provides a comprehensive overview of the issues affecting network functions and their root causes. This report is intended to be displayed on the user interface [218], giving users detailed insights into the nature and origins of network anomalies. 5
[0119] Referring to FIG. 7, which illustrates a system architecture [700] for
performing root cause analysis for one or more network functions (NFs), in
accordance with the exemplary embodiments of the present invention. Further, FIG.
7 is intended to be read in conjunction with the exemplary block diagram of a
10 system [200] as shown in FIG. 2, the exemplary architecture diagram of a system
[400] as shown in FIG. 4 and the exemplary flow diagram [500] as shown in FIG. 5. The systems and flow diagrams as shown in FIG. 2, FIG. 4, FIG. 5 and FIG. 7 complement each other.
15 [0120] The data records [502] receive and store network data from multiple
network functions (NFs). This network data includes unique identifiers, traffic volumes, error rates, and latency metrics. Clear Codes within the data provide valuable information about the state of network functions. This collected data is then transmitted to the ingestion layer [204]. The ingestion layer [204] processes
20 the received network data by compressing it and transmitting it to the normalization
layer [206] using File Transfer Protocol (FTP). This layer ensures that the data is prepared for further processing.
[0121] The normalization layer [206] converts the processed network data into a
25 normalized format, eliminating differences and inconsistencies. This standardized
data is then stored in either the distributed data lake [404] or the distributed file
system [504]. The distributed file system [504] is designed to store large volumes
of diverse data types. In an implementation, the distributed data lake [404] is same
as the first database [216] and distributed file system [504] is same as second
30 database [214] as shown in FIG. 2. The AI/ML layer [402] retrieves normalized
network data from the distributed data lake [404]. It employs machine learning
34

techniques, specifically a decision tree model, to analyse this data and identify
anomalies. These anomalies indicate unexpected or irregular events in network
functions, such as high error rates, latency variations, or unauthorized access
attempts. Upon identifying an anomaly, the AI/ML layer [402] sends this
5 information to the analyser layer [208]. The AI/ML layer [402] runs multiple
Artificial Intelligence (AI)/Machine Learning (ML) algorithms continuously to find
any failure scenario and send data to the analyser layer [208]. After feeding the
Clear Codes to AI/ML algorithms, the AI/ML layer [402] has the capability to
generate the root cause of network functions in case of any failure code it gets from
10 the Clear Codes data. This way proactive identification is achieved to address any
issue in the network without any manual intervention to perform the root cause analysis.
[0122] The analyser layer [208] performs root cause analysis based on the
15 identified anomalies. It generates detailed reports explaining the origins of the
issues and displays these reports on the user interface [218]. Additionally, the
analyser layer [208] handles real-time trend data requests by retrieving normalized
network data via the streaming engine [210] from the distributed file system [504]
and generating real-time trend reports for user display. The user interface [218]
20 allows users to request real-time trend data and forecasting trend data. The real-time
trend data provides current insights into network performance, such as traffic
volumes and error rates. The forecasting trend data, generated by the AI/ML layer
[402], predicts future network behaviours and trends based on historical data. The
user interface [218] also displays root cause analysis reports generated by the
25 analyser layer [208].
[0123] The streaming engine [210] facilitates real-time data processing by
continuously collecting and transmitting data from the distributed file system [504]
to the analyser layer [208]. This enables the analyser layer [208] to access up-to-
30 date data without batch processing, allowing for timely analysis and reporting.
[0124] The present disclosure further discloses a non-transitory computer readable
storage medium storing instruction for performing root cause analysis for one or
more network functions (NFs), the instructions include executable code which,
when executed by one or more units of a system [200], causes a data collector unit
5 [202] to receive a network data from one or more NFs. Further, the instructions
include executable code which, when executed causes the data collector unit [202] to transmit the network data to an ingestion layer [204]. Further, the instructions include executable code which, when executed causes the ingestion layer [204] to process the network data, and send, to a normalization layer [206], the processed
10 network data. Further, the instructions include executable code which, when
executed causes the normalization layer [206] to convert the processed network data to a normalized network data and store, the normalized network data to at least one of a first database [216] and a second database [214]. Further, the instructions include executable code which, when executed causes a training layer [212] to
15 retrieve the normalized network data from the at least one of the first database [216]
and the second database [214], identify, an anomaly associated with the one or more NFs based on the normalized network data and transmit, the anomaly to an analyser layer [208] to perform a root cause analysis.
20 [0125] As is evident from the above, the present disclosure provides a technically
advanced solution for performing root cause analysis for one or more network nodes. The present disclosure provides the method and system which performs network root cause analysis with Clear codes using AI/ML layer [402] or the training layer [212]. The Clear codes for success and failure call for every interface
25 (for e.g., 5G Nodes) are stored with meaning full string characters, which are
understandable to a user. The Clear codes have its defined dictionary to understand the meaning of each value inside it. After feeding this dictionary to AI/ML layer [402] based technique, it has the capability to generate the root cause factors of network functions in case of any failure code it gets from data. The present system
30 and method are more efficient and fast to process the root cause analysis for

determining the issues and errors in network and requires no manual efforts for analysis.
[0126] While considerable emphasis has been placed herein on the disclosed
5 implementations, it will be appreciated that many implementations can be made and
that many changes can be made to the implementations without departing from the
principles of the present disclosure. These and other changes in the implementations
of the present disclosure will be apparent to those skilled in the art, whereby it is to
be understood that the foregoing descriptive matter to be implemented is illustrative
10 and non-limiting.
[0127] Further, in accordance with the present disclosure, it is to be acknowledged that the functionality described for the various components/units can be implemented interchangeably. While specific embodiments may disclose a
15 particular functionality of these units for clarity, it is recognized that various
configurations and combinations thereof are within the scope of the disclosure. The functionality of specific units as disclosed in the disclosure should not be construed as limiting the scope of the present disclosure. Consequently, alternative arrangements and substitutions of units, provided they achieve the intended
20 functionality described herein, are considered to be encompassed within the scope
of the present disclosure.

We Claim:
1. A method [300] for performing root cause analysis for one or more network
5 functions (NFs), the method comprising:
- receiving, a network data from one or more NFs, by a data collector unit [202];
- transmitting, the network data by the data collector unit [202] to an ingestion layer [204];
10 - processing, the network data received from the one or more NFs, by the
ingestion layer [204];
- converting, the processed network data to a normalized network data, by a
normalization layer [206];
- storing, the normalized network data in at least one of a first database [216]
15 and a second database [214], by the normalization layer [206];
- retrieving, the normalized network data from the at least one of the first database [216] and the second database [214], by a training layer [212];
- identifying, an anomaly associated with the one or more NFs, based on the normalized network data, by the training layer [212]; and
20 - transmitting, the identified anomaly, by the training layer [212] to an
analyser layer [208], for performing, a root cause analysis based on the identified anomaly.
2. The method [300] as claimed in claim 1, wherein the network data comprises
25 one or more network codes comprising unique identifiers in a sequential string
format, received from the one or more NFs.
3. The method [300] as claimed in claim 1, wherein processing the network data
received from the one or more NFs by the ingestion layer [204] comprises
30 compressing the network data.
38

4. The method [300] as claimed in claim 1, wherein the first database [216] is a
Distributed Data Lake.
5. The method [300] as claimed in claim 1, wherein the second database [214] is 5 a Distributed File System.
6. The method [300] as claimed in claim 1, further comprising:
- receiving, a request for real time trend data associated with the one or more
NFs at a user interface [218];
10 - sending, the request to the analyser layer [208], wherein, the analyser layer
[208] further retrieves the normalised network data via a streaming engine [210] from the second database [214];
- generating, a real-time trend report based on the retrieved normalised
network data, to be displayed at the user interface [218].
15
7. The method [300] as claimed in claim 6, further comprising:
- receiving, a request for forecasting trend data associated with the one or
more NFs, at the user interface [218];
- sending, the request to the training layer [212], wherein the training layer
20 [212] further processes the request to generate a forecasting trend data;
- transmitting, the generated forecasting trend data, by the training layer [212] to the analyser layer [208];
- generating, a forecasting trend report based on the generated forecasting trend data, by the analyser layer [208], to be displayed at the user interface
25 [218].
8. The method [300] as claimed in claim 1, wherein the training layer [212] is trained based on a decision tree model to identify an anomaly related to the one or more NFs.
30

9. The method [300] as claimed in claim 6, wherein prior to transmitting, by the
training layer [212], the anomaly to an analyser layer [208] to perform a root
cause analysis the method comprises:
- receiving, a request for performing root cause analysis at the user interface
5 [218];
- performing, the root cause analysis based on the anomaly, by the analyser layer [208]; and
- generating, a root cause analysis report based on performing the root cause analysis, by the analyser layer [208].
10
10. The method [300] as claimed in claim 9, wherein post generating, the root cause
analysis report, the method comprises:
- displaying, the root cause analysis report at the user interface [218].
15 11. A system [200] for performing root cause analysis for one or more network
functions (NFs), the system comprises:
- a data collector unit [202] configured to:
o receive a network data from one or more NFs;
o transmit the network data to an ingestion layer [204];
20 - the ingestion layer [204] configured to:
o process the network data, and o send, to a normalization layer [206], the processed network data;
- the normalization layer [206] configured to:
o convert the processed network data to a normalized network data;
25 o store, the normalized network data to at least one of a first database
[216] and a second database [214]; and
- a training layer [212] configured to:
o retrieve the normalized network data from the at least one of the first
database [216] and the second database [214],
30 o identify, an anomaly associated with the one or more NFs based on
the normalized network data;
40

o transmit, the anomaly to an analyser layer [208] to perform a root cause analysis.
12. The system [200] as claimed in claim 11, wherein the network data comprises
5 one or more network codes comprising unique identifiers in a sequential string
format received from the one or more NFs.
13. The system [200] as claimed in claim 11, wherein the ingestion layer [204] is
configured to process the network data by compressing the network data
10 received from the one or more NFs.
14. The system [200] as claimed in claim 11, wherein the first database [216] is a
Distributed Data Lake.
15 15. The system [200] as claimed in claim 11, wherein the second database [214] is
a Distributed File System.
16. The system [200] as claimed in claim 11, wherein the system further comprises:
- a user interface [218] configured to:
20 o receive a request for real time trend data associated with the one or
more NFs; o send, the request to the analyser layer [208];
- the analyser layer [208] further configured to:
o retrieve the normalised network data via a streaming engine [210]
25 from the second database [214];
o generate, a real-time trend report to be displayed at the user interface [218].
17. The system [200] as claimed in claim 16, wherein the system further comprises:
30 - the user interface [218] further configured to:
o receive a request for a forecasting trend data associated with the one or more NFs;
41

o send, the request to the training layer [212];
- the training layer [212] further configured to process the request to generate a forecasting trend data;
- the analyser layer [208] further configured to:
5 o receive the forecasting trend data from the training layer [212];
o generate, a forecasting trend report to be displayed at the user interface [218].
18. The system [200] as claimed in claim 11, wherein the training layer [212] is
10 trained based on a decision tree model to identify an anomaly related to the one
or more NFs.
19. The system [200] as claimed in claim 16, wherein prior to transmitting, by the
training layer [212], the anomaly to an analyser layer [208] to perform a root
15 cause analysis, the system comprises:
- the user interface [218] configured to receive a request for performing root cause analysis;
- the analyser layer [208] configured to perform the root cause analysis based on the anomaly;
20 - the analyser layer [208] configured to generate a root cause analysis report
based on performing the root cause analysis.
20. The system [200] as claimed in claim 19, wherein post generating, by the
analyser layer [208], the root cause analysis report, the analyser layer [208] is
25 configured to display the root cause analysis report at the user interface [218].