DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
METHOD AND SYSTEM FOR DETERMINING A CAUSE OF AN ANOMALY IN A NETWORK
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to a communication network and more particularly relates to anomaly detection in the communication network.
BACKGROUND OF THE INVENTION
[0002] A communication network is subjected to massive exchange of information over a certain time frame. However, due to this, in case of a failure or any error in the network there is a possible delay in identifying and figuring out the exact cause of the error.
[0003] In conventional ways, to analyse root cause of certain errors in the network, the massive available data are to be analysed manually which is time consuming and with possibility of manual error/miscalculation. Additionally, it is performed with several systems simultaneously adding onto information overload. Therefore, in the above cases, it becomes necessary to implement a single system to go through every available data in order to optimally correlate the data and identify the root cause of the unprecedented errors in the network. However, the current available solutions are not able to offer the required optimization and also are prone to errors/miscalculation.
[0004] Therefore, there arises a need for a system and method to correlate available data from multiple systems/sources optimally to substantially reduce effort and time consumed during root cause analysis. In particular, there is a need to provide solutions that require performing efficient analysis of data flow from multiple systems/sources simultaneously, solving minor errors automatically and generating a detailed log of root cause analysis. In other words, there is a need for a solution with minimal time and manual effort.
SUMMARY OF THE INVENTION
[0005] One or more embodiments of the present disclosure provide a method and system for determining a cause of an anomaly in a network.
[0006] In one aspect of the present invention, the system for determining the cause of the anomaly in the network is disclosed. The method includes a step of receiving one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes from a user interface. The method includes the step of defining a workflow and a correlation model. The workflow is defined based on the relationship rules and the one or more correlation nodes as received from the user interface. The method further includes the step of executing the workflow upon receipt of at least one alert. The at least one alert is received in response to presence of the anomaly in a data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data. The method further includes the step of analysing the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data of the one or more correlation nodes utilizing the correlation model. The method further includes the step of determining the cause of the anomaly based on the analysis of the data.
[0007] In an embodiment, the relationship rules are at least one of, start provision, success, failure, and retry.
[0008] In an embodiment, the correlation model is configured to analyse and prioritize data relationships from correlation nodes based on predefined rules to identify the root cause of network anomalies.
[0009] In an embodiment, the one or more correlation nodes is at least one of an alarm node, a counter node, a probing data, an infra-metric node, and a CDR node.
[0010] In an embodiment, wherein the one or more correlation nodes are defined as per data required to determine a correlation between the one or more correlation nodes.
[0011] In an embodiment, wherein the one or more processors, is configured to generate a report including the determined cause of the anomaly based the analysis of the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data.
[0012] In an embodiment, the response to determining the cause of the anomaly, the method further comprises at least one of the steps of initiating, auto trouble shooting in response to determining of cause of the anomaly based the analysis of the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data and transmitting a service request to the user interface.
[0013] In an embodiment, the upon execution of the workflow, a JavaScript Object Notation (JSON) request is transmitted to a correlation unit.
[0014] In an embodiment, the one or more processors are configured to execute a plurality of workflows upon receipt of a plurality of alerts.
[0015] In another aspect of the present invention, the system of determining the cause of the anomaly in the network is disclosed. The system includes a receiving unit configured to receive one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes from a user interface. The system further includes a definition unit configured to define a workflow and a correlation model, the workflow is defined based on the relationship rules and the one or more correlation nodes as received from the user interface. The system further includes an execution unit configured to execute the workflow upon receipt of at least one alert, the at least one alert is received in response to presence of the anomaly in a data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data. The system further includes an analyser unit, configured to analyse the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data of the one or more correlation nodes utilizing the correlation model. The system further includes a determination unit, configured to determine the cause of the anomaly based on the analysis of the data.
[0016] In another aspect of the invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions is disclosed. The computer-readable instructions are executed by a processor. The processor is configured to receive, one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes from a user interface. The processor is configured to define a workflow and a correlation model, the workflow is defined based on the relationship rules and the one or more correlation nodes as received from the user interface. The processor is further configured to execute, the workflow upon receipt of at least one alert, the at least one alert is received in response to presence of the anomaly in a data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data. The processor is further configured to analyse, the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data of the one or more correlation nodes utilizing the correlation model. The processor is further configured to determine, the cause of the anomaly based on the analysis of the data.
[0017] In another aspect of invention, User Equipment (UE) is disclosed. The UE includes one or more primary processors communicatively coupled to one or more processors, the one or more primary processors coupled with a memory. The processor causes the UE to transmit, one or more inputs pertaining to one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes via a user interface.
[0018] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.
BRIEF DESCRIPTION OF THE DRAWINGS
[0019] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0020] FIG. 1 is an exemplary block diagram of an environment for determining a cause of an anomaly in a network, according to one or more embodiments of the present invention;
[0021] FIG. 2 is an exemplary block diagram of a system for determining the cause of the anomaly in the network, according to one or more embodiments of the present invention;
[0022] FIG. 3 is a schematic representation of a workflow of the system of FIG. 1, according to the one or more embodiments of the present invention;
[0023] FIG. 4 is an exemplary block diagram of an architecture implemented in the system of the FIG. 2, according to one or more embodiments of the present invention;
[0024] FIG. 5 is a signal flow diagram for determining the cause of the anomaly in the network, according to one or more embodiments of the present invention; and
[0025] FIG. 6 is a schematic representation of a method of determining the cause of the anomaly in the network, according to one or more embodiments of the present invention.
[0026] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0027] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0028] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0029] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0030] FIG. 1 illustrates an exemplary block diagram of an environment 100 for determining a cause of an anomaly in a network, according to one or more embodiments of the present disclosure. In this regard, the environment 100 includes a User Equipment (UE) 110, a server 115, a network 105 and a system 120 communicably coupled to each other for determining the cause of the anomaly in the network 105.
[0031] In an embodiment, the anomaly refers to any irregularity or deviation from the expected normal behavior within network data. The anomaly indicates an unusual or unexpected condition that could signify the potential problem or failure in the network 105. The anomaly involves, but not limited to latency anomalies, connection failures, configuration errors, and device behavior anomalies.
[0032] As per the illustrated embodiment and for the purpose of description and illustration, the UE 110 includes, but not limited to, a first UE 110a, a second UE 110b, and a third UE 110c, and should nowhere be construed as limiting the scope of the present disclosure. In alternate embodiments, the UE 110 may include a plurality of UEs as per the requirement. For ease of reference, each of the first UE 110a, the second UE 110b, and the third UE 110c, will hereinafter be collectively and individually referred to as the “User Equipment (UE) 110”.
[0033] In an embodiment, the UE 110 is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as a smartphone, virtual reality (VR) devices, augmented reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0034] The environment 100 includes the server 115 accessible via the network 105. The server 115 may include, by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, one or more processors executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0035] The network 105 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 105 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0036] The network 105 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth. The network 105 may also include, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, a VOIP or some combination thereof.
[0037] The environment 100 further includes the system 120 communicably coupled to the server 115 and the UE 110 via the network 105. The system 120 is configured to determine the cause of the anomaly in the network 105. As per one or more embodiments, the system 120 is adapted to be embedded within the server 115 or embedded as an individual entity.
[0038] Operational and construction features of the system 120 will be explained in detail with respect to the following figures.
[0039] FIG. 2 is an exemplary block diagram of the system 120 for determining the cause of the anomaly in the network 105, according to one or more embodiments of the present invention.
[0040] As per the illustrated embodiment, the system 120 includes one or more processors 205, a memory 210, a user interface 215, and a database 220. For the purpose of description and explanation, the description will be explained with respect to one processor 205 and should nowhere be construed as limiting the scope of the present disclosure. In alternate embodiments, the system 120 may include more than one processor 205 as per the requirement of the network 105. The one or more processors 205, hereinafter referred to as the processor 205 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0041] As per the illustrated embodiment, the processor 205 is configured to fetch and execute computer-readable instructions stored in the memory 210. The memory 210 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to create or share data packets over a network service. The memory 210 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0042] In an embodiment, the user interface 215 includes a variety of interfaces, for example, interfaces for a graphical user interface, a web user interface, a Command Line Interface (CLI), and the like. The user interface 215 facilitates communication of the system 120. In one embodiment, the user interface 215 provides a communication pathway for one or more components of the system 120. Examples of such components include, but are not limited to, the UE 110 and the database 220.
[0043] The database 220 is one of, but not limited to, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of database 220 types are non-limiting and may not be mutually exclusive e.g., a database can be both commercial and cloud-based, or both relational and open-source, etc.
[0044] In order for the system 120 to determine the cause of the anomaly in the network 105, the processor 205 includes one or more modules. In one embodiment, the one or more modules/units includes, but not limited to, a receiving unit 225, a definition unit 230, an execution unit 235, a correlation unit 240, an analyser unit 245, a generation unit 250, and a determination unit 255 communicably coupled to each other for determining the cause of the anomaly in the network 105.
[0045] In one embodiment, each of the receiving unit 225, the definition unit 230, the execution unit 235, the correlation unit 240, the analyser unit 245, the generation unit 250, and the determination unit 255 can be used in combination or interchangeably for determining the cause of the anomaly in the network 105.
[0046] The receiving unit 225, the definition unit 230, the execution unit 235, the correlation unit 240, the analyser unit 245, the generation unit 250, and the determination unit 255, in an embodiment, may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 205. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 205 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 210 may store instructions that, when executed by the processing resource, implement the processor. In such examples, the system 120 may comprise the memory 210 storing the instructions and the processing resource to execute the instructions, or the memory 210 may be separate but accessible to the system 120 and the processing resource. In other examples, the processor 205 may be implemented by electronic circuitry.
[0047] In an embodiment, the receiving unit 225 is configured to receive one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes from the user interface 215. The one or more inputs refer to the information provided by the user through the user interface 215. The one or more inputs includes, one or more correlation node, and one or more relationship rules. The one or more correlation node are the specific elements or points within the network 105 which are relevant for the correlation. The one or more correlation nodes includes, but not limited to, data points, devices, or events that need to be analysed together to identify the cause of the anomaly. The one or more relationship rules define how the correlation nodes are related and to each other and used to create the correlation model that helps in analysing the data to determine cause of anomaly.
[0048] In an embodiment, the the one or more correlation nodes is at least one of, an alarm node, a counter node, a probing data, an infra-metric node, and a Call Data Record (CDR) node. The one or more correlation nodes are defined as per data required to determine a correlation between the one or more correlation nodes. The one or more correlation node serves as a source of data related to various aspects of the network performance and status. The data from correlation nodes is used to identify and understand various aspects of the network performance. The correlation node data is provided as input into the correlation model to analyse and determine the root cause of anomalies. The one or more correlation nodes collects and provides specific types of data that are essential for diagnosing network anomalies. The one or more correlation nodes gather data such as alarms node, counter node, probing node, infra-matric node, CDR node.
[0049] In an embodiment, the alarms node reports the alerts or/and error messages indicating potential issues. The counter node provides performance metrics like such as, but not limited to traffic volume and error rates. The probing node captures real-time traffic and performance metrics. The infra-metric node monitors infrastructure-related metrics such as, but not limited to temperature and power usage. The CDR node handles the records related to communications transactions, such as, but not limited, call durations and data usage.
[0050] In an embodiment, the relationship rules are at least one of, start provision, success, failure, and retry. The relationship rules are configured to analyse and correlate the data received from different nodes. The data includes, but is not limited to, a alarm data, a counter data, a Call Data Record (CDR) data, a probing data. The relationship rules help to understand how the data from one node might impact or relate to the data from another node
[0051] In an embodiment, the start provision rule is used to indicate the initiation of the process or/and task and defines the conditions under which the provisioning or setup process begins. The success rule indicates the process or/and task has been completed successfully. The success rule specifies the conditions under which the process is considered successful. The failure rule is used when the process or/and task does not complete successfully. The failure rule defines the conditions under which the process is considered to have failed. The retry rule specifies the conditions under which the failed process should be retried. The retry rule determines how many times and under what conditions the process should be attempted again. For example, base station configuration retry, network slice provisioning retry, subscriber service activation retry, and software upgrade retry.
[0052] Upon receiving the one or more inputs, the definition unit 230 is configured to define a workflow and a correlation model. The workflow is defined based on the relationship rules and the one or more correlation nodes as received from the user interface 215. The workflow specifies how the data from different nodes should be processed and analysed based on the one or more relationship rules.
[0053] In an embodiment, the workflow is used to describe the necessary steps to fulfil certain management purposes. The workflow is composed of one or more management tasks. The completion of each workflow task may be accomplished by humans, or accomplished by telecom system with human assistance, or accomplished by telecom system without human intervention. The autonomy capabilities of the tasks in the workflow may impact the network autonomy level. The tasks in the workflow may be categorized into, but not limited to, intent translation, awareness, analysis, decision, and execution.
[0054] In an embodiment, the workflow intent translation involves tasks that convert network or service intent from an operator or customer into detailed management operations, potentially affecting awareness, analysis, decision, and execution tasks, and translates detailed network and service information into intent fulfillment information, such as whether the intent is satisfied. The workflow awareness encompasses tasks that monitor network information, including, but not limited to, network performance, anomalies, and events. The workflow analysis group of tasks which analyse the obtained network information which includes, but not limited to, network status, network issues, or based on the historical network information to further predict the future change trend of the above network status and make recommendation for decision. The workflow decision tasks involve evaluating and deciding the necessary management operations for execution. For example, network configuration and/or adjustments. The workflow execution involves the group of tasks which execute the management operations.
[0055] The correlation model is configured to analyse and prioritize data relationships from correlation nodes based on predefined rules to identify the root cause of network anomalies. The predefined rules within the correlation model refer to the specific guidelines and criteria set up to help the system to analyse and interpret data effectively. The predefined rules are used to identify and prioritize relationships between different types of data, but not limited to the alarms data, the counters data, the CDR data, and the probing data.
[0056] In an embodiment, the alarm data refers to notifications or alerts generated by network equipment or monitoring systems when the condition or threshold is exceeded, indicating the potential issue or/and fault in the network 105. For example, network equipment alarm, and signal strength alarm.
[0057] The counter data consists of numerical measurements or counts that track various performance metrics and occurrences of specific events within the network 105. The counters are used to monitor network health and performance.
[0058] The CDR data are detailed logs that track all types of communication activities. The CDR data includes such as but not limited to phone calls, text messages, and data usage. The CDR data helps operators by understanding how services are used. The operators refer to the individuals or entities responsible for managing and maintaining the network infrastructure which includes, but not limited to, network service providers, network engineers and technicians. By examining the CDR data, the operators may identify and resolve issues with network performance, such as, but not limited to dropped calls and slow internet speeds. The operators use CDR data to keep an eye on how the network 105 is performing and make improvements. The CDR data helps to secure the network 105 runs well and meets the needs of the users.
[0059] The probing data is collected from the probing data one or more monitoring tools deployed in the network 105 to capture real-time traffic and performance metrics. The probing data may be physical or virtual and provides detailed insights into the network behavior. Further, the probing data may analyse latency issues utilizing the probing data by deploying the probing data in various segments of the network 105. The probing data continuously collect the data and identify anomaly with high latency, the probing data analyse traffic flow, cross-reference with other data and root cause analysis, after the analysation the probing data root causes generate reports and implement the solution.
[0060] The correlation model integrates data from various sources, including the alarm data, the counter data, the CDR data, and the probing data. The correlation model provides the complete view of network performance and behavior by correlating data from different network components. The network components include, but are not limited to, radio access network, core network, signaling and control systems, and application servers.
[0061] The correlation model also helps to identify patterns and relationships between different network events. The patterns refer to recurring or expected behaviors in network data that are considered normal or typical wherein the relationships refer to how different data points and events interact with each other within the network 105. The pattern and relationships enable the correlation model to detect and diagnose anomalies effectively. The correlation models are used to detect anomalies by identifying deviations from normal behavior patterns in the data, which may indicate potential issues or emerging problems. The correlation model facilitates includes, but not limited to network performance degradation, service outage detection, hardware failure, security threat and configuration issue.
[0062] In an embodiment, the network performance degradation integrates data from the alarm node and counter nodes. The network performance degradation analyses the relationships between the data points and identifies congestion in the network 105 causing latency. The service outage detection of the correlation model combines the data from the probing nodes and the CDR node, applies correlation rules to understand how the error and call quality issues are related, and identifies the potential service outage detection. The correlation model further analyses counter nodes and infra-metric nodes to suggest if high temperatures might be causing hardware components to fail or malfunction, leading to an increase in error rate. The configuration issue of the correlation model combines the data from alarm node and counter node to identify that configuration errors might be impacting traffic flow or causing misconfigurations that lead to abnormal traffic patterns.
[0063] Thereafter, the execution unit 235 is configured to execute the workflow upon receipt of at least one alert from the correlation node. The at least one alert is received in response to presence of the anomaly in the data pertaining to at least one of, the alarm data, the counter data, the CDR data, and the probing data.
[0064] In an embodiment, the alarm data refers to notifications or alerts generated by network equipment or monitoring systems when the condition or threshold is exceeded, indicating the potential issue or/and fault in the network 105. For example, network equipment alarm, and signal strength alarm.
[0065] In an embodiment, upon execution of the workflow by the execution unit 235, a JavaScript Object Notation (JSON) request is transmitted to the correlation unit 240. The correlation unit 240 serves as a crucial component in analysing and interpreting data to improve the network management. The correlation unit 240 facilitates one of, but not limited to, aggregating data from various sources, identifying relationships and patterns, detecting and diagnosing faults, optimizing performance, and providing real-time monitoring and predictive insights and enabling informed decision-making and thereby enhancing overall operational efficiency and reliability. The correlation unit 240 is configured to analyse to improve network performance and efficiency. The use of JSON makes certain data easily understandable and can be efficiently processed by the correlation unit 240.
[0067] The analyser unit 245 is configured to analyse the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data of the one or more correlation nodes utilizing the correlation model. The analyser unit 245 triggered manually by network operators or automatically by predefined conditions such as, but not limited to specific alerts or anomalies, collects and aggregates data from various sources like alarms, counters, CDRs, and probing data. The analyser unit 245 applies the correlation model to identify patterns and relationships within the data, generating reports and recommendations to address issues, optimize performance, and improve network reliability.
[0068] Upon analysing the data, the generation unit 250 is configured to generate the report including the determined cause of the anomaly based on the analysis of the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data. The network anomalies can be caused by various issues which includes, but not limited to, network configuration, faulty network equipment, performance degradation, traffic congestion, security breaches, faulty data transmission, system misconfigurations, external factors, and software bugs or glitches. The network configuration issues, such as incorrect settings or parameters, can lead to anomalies that affect network performance. The malfunctions or failures in network hardware, such as the failing router or switch, can cause anomalies and trigger alerts. The anomalies that may arise from performance degradation includes but not limited to, increased latency, reduced bandwidth and/and higher error rates. The excessive network traffic or congestion can lead to anomalies, affecting the overall efficiency and reliability of the network 105. The security breaches include, but not limited to attacks or unauthorized access, can cause anomalies, for example, the Distributed Denial of Service (DDoS) attack might trigger alerts. The issues with data transmission includes, but not limited to, packet loss or corruption, can be a cause of anomalies. The incorrect configurations in network management systems or monitoring tools can lead to anomalies by inadvertently affecting network operations. The system misconfigurations include, but not limited to, incorrect settings in network management systems and monitoring tools, and can lead to anomalies by inadvertently affecting network operations.
[0069] Upon analysing the data and generating the report, the determination unit 255 is configured to determine the cause of the anomaly based on the analysis of the data. In response to determining the cause of the anomaly based on analysis of the data, the determination unit 255 initiates auto trouble shooting. The troubleshooting involves the automatic execution of corrective actions based on the analysis of data to resolve anomalies, followed by notifying relevant participants through a service request. Thereafter the service request is transmitted to the user interface 215. The service request refers to the formal notification or message that is sent to the user interface 215 after the troubleshooting process has been completed.
[0070] FIG. 3 describes a preferred embodiment of the system 120 of FIG. 2, according to various embodiments of the present invention. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the first UE 110a and the system 120 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0071] As mentioned earlier in FIG. 1, each of the first UE 110a, the second UE 110b, and the third UE 110c may include an external storage device, a bus, a main memory, a read-only memory, a mass storage device, communication port(s), and a processor. The exemplary embodiment as illustrated in FIG. 3 will be explained with respect to the first UE 110a without deviating from the scope of the present disclosure and the limiting the scope of the present disclosure. The first UE 110a includes one or more primary processors 305 communicably coupled to the one or more processors 205 of the system 120.
[0072] The one or more primary processors 305 are coupled with a memory 310 storing instructions which are executed by the one or more primary processors 305. Execution of the stored instructions by the one or more primary processors 305 enables the first UE 110a transmit one or more inputs pertaining to one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes via the user interface 215.
[0073] As mentioned earlier in FIG. 2, the one or more processors 205 of the system 120 is configured for determining the cause of the anomaly in the network 105. As per the illustrated embodiment, the system 120 includes the one or more processors 205, the memory 210, the user interface 2015, and the database 220. The operations and functions of the one or more processors 205, the memory 210, the user interface 215, and the database 220 are already explained in FIG. 2. For the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition.
[0074] Further, the processor 205 includes the receiving unit 225, the definition unit 230, the execution unit 235, the correlation unit 240, the analyser unit 245, the generation unit 250, and the determination unit 255. The operations and functions of the receiving unit 225, the definition unit 230, the execution unit 235, the correlation unit 240, the analyser unit 245, the generation unit 250, and the determination unit 255 are already explained in FIG. 2. Hence, for the sake of brevity, a similar description related to the working and operation of the system 120 as illustrated in FIG. 2 has been omitted to avoid repetition. The limited description provided for the system 120 in FIG. 3, should be read with the description provided for the system 120 in the FIG. 2 above, and should not be construed as limiting the scope of the present disclosure.
[0075] FIG. 4 is an exemplary block diagram of an architecture 400 implemented in the system of the FIG. 2, according to one or more embodiments of the present invention;
[0076] The architecture 400 includes the user interface 215 operated by a user, the database 220, a Load Balancer (LB) 405, an analysis module 410, an AI/ML Layer 415, a computation engine 420, a correlation engine 425, a distributed file system 430, a caching layer 435.
[0077] The user interface 215 receives the one or more inputs from pertaining to one or more correlation nodes and one or more relationship rule. Through the user interface 215, the user sets up relationships between different data nodes, create correlation nodes, and design workflows. The user interface 215 simplifies the process of configuring to monitor and react to specific network conditions based on user-defined parameters and making the workflow creation process highly flexible and user-specific. Upon receiving the inputs from the user interface 215, the user interface 215 transmits the one or more inputs to the LB 405.
[0078] Upon receiving the inputs, the LB 405 transmits the incoming one or more inputs to the analysis module 410. The LB 405 is configured to balance the load and handle multiple workflows and requests simultaneously without degradation in performance.
[0079] Upon receiving the one or more inputs from the LB 405, the analysis module 410 defines the workflow and the correlation model and transmits to correlation engine 425. Upon execution of the workflow, the JSON request is transmitted to the correlation engine 425. The workflow is defined based on the relationship rules and the one or more correlation nodes are received from the user interface 215. The one or more correlation nodes are defined as per data required to determine the correlation between the one or more correlation nodes.
[0080] The analysis module 410 accesses the data from both the database 220 and the catching layer 435. The analysis module 410 generates the report including the determined cause of the anomaly based on the analysis of the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data. The database 220 stores data as well as the output from the root cause analysis. The database 220 acts data and analysis results. The database 220 provides the necessary data for the correlation engine 425 and analysis module 410 to perform the tasks. The database 220 stores all the data required for analysis including error data, which can be used by the AI/ML layer 415 for pattern recognition and prediction.
[0081] Upon receiving the defined workflow and the correlation model, the correlation engine 425 executes the workflow and correlation model and sends to the computational engine 420. The correlation engine 425 is executing the workflow upon receiving of at least one alert, the at least one alert is received in response to presence of the anomaly in the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data. The correlation engine 425 interacts with the data in the caching layer 435 and the data stored in the database 220.
[0082] Upon receiving the executed workflow and the correlation model from the correlation engine 425, the computation engine 420 analysis the data and transmits it to the AI/ML layer 415. The AI/ML layer 415 is component in the workflow, responsible for making predictions and deriving insights from the data processed by the computation engine 420. The AI/ML layer 415 receives analyzed data from the computation engine 420, which often includes features derived from the correlation model and the executed workflow and ensures that the data is suitable format for the AI/ML models to process effectively. Initially, the data undergoes preprocessing, which involves, but not limited to cleaning, normalization, and transformation.
[0083] The core functionality of the AI/ML layer 415 involves applying machine learning models to the preprocessed data. The AI/ML layer 415 could include various types of algorithms, but not limited to, regression, classification, clustering, or time-series forecasting, depending on the specific task or prediction needed. The AI/ML layer 415 utilizes pre-trained models, which have been developed using historical data and trained to recognize patterns, trends, and relationships within the data. The AI/ML layer 415 processes the input data and outputs the prediction regarding the likelihood of the fault occurring. The core logic involves recognizing patterns and relationships within the data. The AI/ML layer 415 learns from historical data to identify the patterns and apply them to new data. The AI/ML layer 415 uses data-driven insights to make informed predictions and recommendations, reducing reliance on manual analysis and intuition and feedback mechanism allows the AI/ML layer 415 to adapt to new data and changing conditions, continuously improving its performance and accuracy.
[0084] The data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data of the one or more correlation nodes utilizing the correlation model. The data is stored and retrieved from the distributed file system 430. The caching layer 435 provides dynamic storage for data, ensuring that the most recent data is available for real-time analysis. The caching layer 435 stores data temporarily before it is analysed. The caching layer 435 confirms the analysis module 410 and correlation engine 425 have quick access to the latest data and facilitate timely root cause analysis. Upon receiving the analysed data from the computation engine 420, the AI/ML layer 415 applies machine learning models or artificial intelligence algorithms to enhance the workflow execution though the data. The AI/ML layer 415 is responsible for learning data and making predictions about future anomalies and also suggests improvements to workflow dynamically based on real-time data analysis, increasing the accuracy and efficiency. The machine learning model includes, but not limited to, anomaly detection model, predictive model, and clustering model.
[0085] Upon receiving the enhanced output from the AI/ML layer 415, the computation engine 420 transmits the output to the correlation engine 425. The correlation engine 425 determines the cause of the anomaly based on the analysis of the data. To determine the cause of the anomaly the correlation engine 425 involves at least one of the steps of initiating auto trouble shooting in response to determining of cause of the anomaly based the analysis of the data. The correlation engine 425 transmits the service request to the user interface 215 via analysis module 410. The analysis module 410 retrieves the analysis data from the correlation engine 425 and generates an overall report. Upon receiving the report from the analysis module 410, the completion notification will get the user through user interface 215 that the workflow execution has been successfully completed. The report provides the user with detailed observations into the anomaly and its causes.
[0086] Upon completing the workflow, the user can get the notification about the results, or any actions taken, ensuring that the user is kept informed throughout the process.
[0087] FIG. 5 is a signal flow diagram for determining the cause of the anomaly in the network 105, according to one or more embodiments of the present invention.
[0088] At step 505, the user interface 215 receives the one or more inputs pertaining to the one or more correlation nodes and one or more relationship rules between the one or more correlation nodes from the user. Upon receiving one or more inputs the user interface 215 transmits the one or more inputs to the LB.
[0089] At step 510, upon receiving the one or more inputs from the user interface 215, the LB 405 manages the distribution of incoming requests to analysis module 410. The LB 405 facilitates efficient and balanced distribution of the one more inputs.
[0090] At step 515, upon receiving the one or more inputs from the for LB 405, the analysis module 410 defines the workflow and the correlation model. The workflow is defined based on the relationship rules and the one or more correlation nodes as received from the user interface 215. The analysis module 410 accesses data from both the database 220 and the catching layer 435.
[0091] At step 520, upon processing the workflow and the correlation model executes the workflow upon receiving of at least one alert, the at least one alert is received in response to presence of the anomaly in the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data and determining the cause of the anomaly based on the analysis of the data.The JSON request is transmitted to the correlation engine 425 to validates the workflow.
[0092] At step 525, upon receiving validated workflow from the correlation engine 425, the computation engine 420 analyses the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data of the one or more correlation nodes utilizing the correlation model. the data is stored and retrieved from the distributed file system 430 and database 220.
[0093] At step 530, upon analysing the workflow and the correlation model from the computation engine 420, the computation engine 420 fetching workflow and correlation model details from the database 220 and the caching layer 435, storing results back in the caching layer 435. The caching layer 435 provides quick access storage for workflow details, allowing faster processing and retrieval compared to the database 220. The computation engine 420 fetches the workflow via AI/ML layer 415. The AI/ML layer 415 applies machine learning models or artificial intelligence algorithms to enhance the workflow execution though the specific details.
[0094] At step 535, upon analysing the computation engine 420 processes the results from the correlation engine 425 and transmits the workflow and correlation model output to correlation engine 425. The correlation engine 425 send the output to the analysis module 410.
[0095] At step 540, upon receiving the output from the correlation engine 425, the correlation module transmits the output data to the analysis module 410, The analysis module 410 analyses the data and transmits to user interface via LB 405.
[0096] At step 545, upon receiving the notification from the analysis module 410, the completion notification will get the user through user interface 215 that the workflow execution has been successfully completed.
[0097] FIG. 6 is a schematic representation of a method 600 of determining the cause of the anomaly in the network 105, according to one or more embodiments of the present invention. For the purpose of description, the method 600 is described with the embodiments as illustrated in FIG. 2 and should nowhere be construed as limiting the scope of the present disclosure.
[0098] At step 605, the method 600 includes the step of receiving one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes from the user interface 215. The one or more relationship rules is at least one of, start provision, success, failure, and retry.
[0099] At step 610, the method 600 includes the step of defining the workflow and the correlation model. The workflow is defined based on the relationship rules and the one or more correlation nodes as received from the user interface 215. The correlation model is configured to analyse and prioritize data relationships from correlation nodes based on predefined rules to identify the root cause of network anomalies.
[00100] At step 615, the method 600 includes the step of executing the workflow upon receipt of at least one alert, the at least one alert is received in response to identification of the anomaly in the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data. Upon execution of the workflow, the JSON request is transmitted to the correlation unit 240.
[00101] At step 620, the method 600 includes the step of analysing the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data of the one or more correlation nodes utilizing the correlation model. The one or more correlation nodes is at least one of the alarm node, the counter node, the probing data, the infra-metric node, and the CDR node. The one or more correlation nodes are defined as per data required to determine the correlation between the one or more correlation nodes.
[00102] At step 625, the method 600 includes the step of determining the cause of the anomaly based on the analysis of the data. In response to determining the cause of the anomaly the method 600 further comprises at least one of the steps of initiating auto trouble shooting in response to determining cause of the anomaly based on analysis of the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data and transmitting the service request to the user interface 215.
[00103] The present invention further discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by processor 205. The processor 205 is configured to receive one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes from the user interface 215. The processor 205 is further configured to define the workflow and the correlation model. The workflow is defined based on the relationship rules and the one or more correlation nodes as received from the user interface 215. The processor 205 is further configured to execute the workflow upon receipt of at least one alert, the at least one alert is received in response to presence of the anomaly in the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data. The processor 205 is further configured to analyse the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data of the one or more correlation nodes utilizing the correlation model. The processor 205 is further configured to determine the cause of the anomaly based on the analysis of the data.
[00104] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-6) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[00105] The present disclosure incorporates technical advancement aimed at improving operational efficiency. The present invention is designed to optimize analysis and minimize computational efforts. By dynamically correlating historical data with real-time monitoring data, the system ensures the generation of accurate and error-free outputs, allowing users to observe and act on precise information. To analyse the root causes of the network errors the corelating the data from the multiple sources provides users with the flexibility to perform root cause analysis across various data. The system enhances its functionality by automatically initiating predefined workflows in response to abnormal events, ensuring a streamlined and efficient approach to troubleshooting and resolving issues.
[00106] The present invention offers multiple advantages, offers efficient error detection and resolution through automated workflows, reducing manual effort and minimizing network downtime. It is scalable, adaptable, and supports real-time monitoring, allowing for proactive anomaly detection and immediate response. With enhanced data integration and AI/ML-driven insights, the system improves decision-making and network reliability. The user-friendly interface allows for easy customization, while robust data storage ensures security and reliability.
[00107] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.
REFERENCE NUMERALS

[00108] Environment- 100
[00109] User Equipment (UE) - 110
[00110] Server - 115
[00111] Network- 105
[00112] System -120
[00113] Processor - 205
[00114] Memory - 210
[00115] User interface - 215
[00116] Database - 220
[00117] Receiving unit - 225
[00118] Definition unit - 230
[00119] Execution unit - 235
[00120] Correlation unit - 240
[00121] Analyser unit - 245
[00122] Generating unit - 250
[00123] Determination unit - 255
[00124] One or more primary processor - 305
[00125] Primary memory - 310
[00126] Load Balancer (LB) - 405
[00127] Analysis module - 410
[00128] AI/ML Layer - 415
[00129] Computation engine - 420
[00130] Correlation engine - 425
[00131] Distributed file system - 430
[00132] Caching layer - 435

,CLAIMS:CLAIMS:
We Claim:
1. A method (600) of determining a cause of an anomaly in a network (105), the method (600) comprising the steps of:
receiving, by one or more processors (205), one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes from a user interface (215);
defining, by the one or more processors (205), a workflow and a correlation model, the workflow is defined based on the relationship rules and the one or more correlation nodes as received from the user interface (215);
executing, by the one or more processors (205), the workflow upon receipt of at least one alert, the at least one alert is received in response to identification of the anomaly in a data pertaining to at least one of the an alarm data, a counter data, a Call Data Record (CDR) data, and a probing data;
analysing, by the one or more processors (205), the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing unit of the one or more correlation nodes utilizing the correlation model; and
determining, by the one or more processors (205), the cause of the anomaly based on the analysis of the data.

2. The method (600) as claimed in claim 1, wherein the relationship rules is at least one of, start provision, success, failure, and retry.

3. The method (600) as claimed in claim 1, wherein the correlation model is configured to analyse and prioritize data relationships from correlation nodes based on predefined rule.

4. The method (600) as claimed in claim 1, wherein the one or more correlation nodes is at least one of an alarm node, a counter node, a probing node, an infra-metric node, and a Call Data Record (CDR) node.

5. The method (600) as claimed in claim 1, wherein the one or more correlation nodes are defined as per data required to determine a correlation between the one or more correlation nodes.

6. The method (600) as claimed in claim 1, wherein the method includes the step of generating, by the one or more processors (205) a report including the determined cause of the anomaly based on analysis of the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data.

7. The method (600) as claimed in claim 1, wherein in response to determining the cause of the anomaly, the method (600) further comprises at least one of the steps of:
initiating, by the one or more processors, auto trouble shooting in response to determining cause of the anomaly based on analysis of the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data; and
transmitting, by the one or more processors, a service request to the user interface.

8. The method (600) as claimed in claim 1, wherein upon execution of the workflow, a JavaScript Object Notation (JSON) request is transmitted to a correlation unit (240).

9. The method (600) as claimed in claim 1, wherein the one or more processors, is configured to execute a plurality of workflows upon receipt of a plurality of alerts.

10. A User Equipment (UE) (110) comprising:
one or more primary processors (305) communicatively coupled to one or more processors (205), the one or more primary processors (305) coupled with a memory (310), wherein said memory (310) stores instructions which when executed by the one or more primary processors (305) causes the UE (110) to:
transmit, one or more inputs pertaining to one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes via a user interface (215),
wherein the one or more processors (205) are configured to perform the steps as claimed in claim 1.

11. A system (120) of determining a cause of an anomaly in a network (105), the system (120) comprising:
a receiving unit (225), configured to, receive, one or more inputs pertaining to one or more correlation nodes and one or more relationship rules between the one or more correlation nodes from a user interface (215);
a definition unit (230), configured to define, a workflow and a correlation model, the workflow is defined based on the relationship rules and the one or more correlation nodes as received from the user interface (215);
an execution unit (235), configured execute, the workflow upon receipt of at least one alert, the at least one alert is received in response to presence of the anomaly in a data pertaining to at least one of an alarm data, an counter data, a Call Data Record (CDR) data, and a probing data;
an analyser unit (245), configured to analyse, the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data of the one or more correlation nodes utilizing the correlation model; and
a determination unit (255), configured to determine the cause of the anomaly based on the analysis of the data.

12. The system (120) as claimed in claim 10, wherein the one or more correlation nodes is at least one of an alarm node, a counter node, a probing data, an infra-metric node, and a Call Data Record (CDR) node.

13. The system (120) as claimed in claim 10, wherein the one or more correlation nodes are defined as per data required to determine a correlation between the one or more correlation nodes.

14. The system (120) as claimed in claim 10, wherein the system further includes a generation unit (250), configured, to generate a report including the determined cause of the anomaly based on the analysis of the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data.

15. The system (120) as claimed in claim 10, wherein in response to determining the cause of the anomaly, the determination unit (255) is further configured to:
initiate, an auto trouble shooting in response to determining of cause of the anomaly based the analysis of the data pertaining to at least one of the alarm data, the counter data, the CDR data, and the probing data; and
transmit, a service request to the user interface.

16. The system (120) as claimed in claim 10, wherein upon execution of the workflow, a JavaScript Object Notation (JSON) request is transmitted to a correlation unit (240).

17. The system (120) as claimed in claim 10, wherein the execution unit (235), is configured to execute a plurality of workflows upon receipt of a plurality of alerts.