DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
METHOD AND SYSTEM FOR ANOMALY DETECTION
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention discloses a method and system for anomaly detection. More particularly, the system described herein offers a comprehensive approach for retrieving data, training models, analysing performance, and detecting anomalies by facilitating the selection of the most appropriate training model.
BACKGROUND OF THE INVENTION
[0002] In traditional systems, it is essential that the data used for training AI/ML model is clean and free from anomalies. To achieve this, establishing a variety of policies for different parameters is a key step. These policies play a vital role in ensuring that the model is not unintentionally trained on data with anomalies, thus avoiding incorrect predictions and outcomes.
[0003] Anomaly detection is essential for identifying unusual patterns in data. Existing systems often use specific machine learning models that don’t work well with all types of data. This can result in wrong predictions and the potential to overlook significant anomalies.
[0004] Traditional approaches mostly concentrated on either creating machine learning models or basic visualization methods. They do not combine detailed statistical analysis with easy-to-use interfaces. As a result, users struggle to understand how different models perform because the data is presented in a complex way, making it hard for them to make good decisions.
[0005] Hence, there is a need for efficient methods and systems to make it easier to evaluate different machine learning models and show key performance metrics in a simple way.
SUMMARY OF THE INVENTION
[0006] One or more embodiments of the present disclosure provide a method and a system for anomaly detection in incoming raw or analyzed data.

[0007] In one aspect of the present invention, a method for anomaly detection comprises the steps of retrieving data from one or more data sources and training each of a plurality of models with the retrieved data using one or more logics. Further, generating training statistics data and performance data for each of the plurality of trained models and analyzing at least one of the training statistics data and the performance data of each of the plurality of trained models. The method further includes selecting at least one trained model from the plurality of trained models, which includes at least one of the preferred training statistics data and the performance data, and determining, by utilizing the selected at least one trained model, if one or more anomalies are present with the current data.
[0008] In an embodiment, said one or more data sources include at least one of the data sources within a telecommunication network and the data sources outside the telecommunication network. The telecommunication network includes at least one of network performance data, subscriber data, and device data, and the outside of the telecommunication network include at least one of competitor data, social media data, customer feedback, and surveys.
[0009] In an embodiment, the step of training each of a plurality of models with the retrieved data using one or more logics includes the steps of feeding, by the one or more processors, each of the plurality of models with the retrieved data; applying, by the one or more processors, one or more logics for each of the plurality of models; and training, by the one or more processors, each of the plurality of models with the fed data and the applied one or more logics.
[0010] In an embodiment, the training statistics data and the performance data of each of the plurality of trained models are displayed by the one or more processors on a single interface for a user to view.

[0011] In an embodiment, the step of selecting at least one trained model from the plurality of trained models, which includes a preferred training statistics data and a performance data, includes the steps of comparing, by the one or more processors, at least one of the training statistics data and the performance data of each trained model with at least one user-defined threshold, a dynamically set threshold, wherein the threshold includes at least one of data values or a range of data values.
[0012] In an embodiment, the step of determining, utilizing the selected at least one trained model, one or more anomalies with current data includes the steps of checking, by the one or more processors, if the current data deviates from the learnt trends/patterns of the selected at least one trained model, and if deviation is detected, determining, by the one or more processors, that the current data includes the one or more anomalies.
[0013] In an embodiment, a system for anomaly detection is disclosed. The system comprising a retrieving unit configured to retrieve data from one or more data sources; a training unit configured to train, each of a plurality of models with the retrieved data using one or more logics; a generating unit configured to generate training statistics data and performance data for each of the plurality of trained models; an analyzing unit configured to analyze at least one of the training statistics data and the performance data of each of the plurality of trained models; a selecting unit configured to select at least one trained model from the plurality of trained models which includes at least one of, preferred training statistics data and the performance data; and a determining unit configured to determine, utilizing the selected at least one trained model, if one or more anomalies are present with a current data.

[0014] In an aspect of the present invention, a non-transitory computer-readable medium has stored thereon computer-readable instructions. The computer-readable instructions are executed by the processor. The processor is configured to retrieve the data pertaining to the operation of the network from a database, and the processor is configured to train each of a plurality of models with the retrieved data using one or more logics. Thereafter, the processor generates training statistics data and performance data for each of the plurality of trained models. Further, the processor analyses at least one of the training statistics data and the performance data of each of the plurality of trained models and selects at least one trained model from the plurality of trained models, which includes at least one of the preferred training statistics data and the performance data. At the end, the processor determines whether anomalies are present with the current data by utilizing the selected at least one trained model.

[0015] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specifications, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter; resort to the claims being necessary to determine such inventive subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS
[0016] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0017] FIG. 1 is an exemplary block diagram of an environment for anomaly detection, according to one or more embodiments of the present invention;
[0018] FIG. 2 is an exemplary block diagram of a system for anomaly detection, according to one or more embodiments of the present invention;
[0019] FIG. 3 is an exemplary architecture of the system of FIG. 2, according to one or more embodiments of the present invention;
[0020] FIG. 4 is an exemplary architecture illustrating the flow for anomaly detection, according to one or more embodiments of the present disclosure;
[0021] FIG. 5 is a flow diagram of a method for anomaly detection, according to one or more embodiments of the present invention.
[0022] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0023] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0024] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0025] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0026] The present invention discloses a method and system for anomaly detection. More particularly, the system described herein offers a comprehensive approach for retrieving data, training models, analysing performance, and detecting anomalies by facilitating the selection of the most appropriate model. The anomaly detection and forecasting are based on identifying/analyzing trends of current operations performed by the anomaly interface unit. The system uses an Artificial Intelligence/Machine Learning (AI/ML) model to capture current trends, perform analysis, and predict or forecast requirements and/or potential issues in the data anomaly.
[0027] Referring to FIG. 1, FIG. 1 illustrates an exemplary block diagram of an environment 100 for anomaly detection in a network, according to one or more embodiments of the present invention. The environment 100 includes a User Equipment (UE) 102, a server 104, a network 106, and a system 108. A user interacts with the system 108 utilizing the UE 102.
[0028] For the purpose of description and explanation, the description will be explained with respect to one or more user equipment’s (UEs) 102, or, to be more specific, will be explained with respect to a first UE 102a, a second UE 102b, and a third UE 102c, and should nowhere be construed as limiting the scope of the present disclosure. Each of the at least one UE 102, namely the first UE 102a, the second UE 102b, and the third UE 102c, is configured to connect to the server 104 via the network 106.
[0029] In an embodiment, each of the first UE 102a, the second UE 102b, and the third UE 102c is one of, but not limited to, any electrical, electronic, electro-mechanical, or an equipment and a combination of one or more of the above devices, such as smartphones, Virtual Reality (VR) devices, Augmented Reality (AR) devices, laptops, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0030] The network 106 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 106 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0031] The network 106 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc., one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth.
[0032] The environment 100 includes the server 104, accessible via the network 106. The server 104 may include, by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, a processor executing code to function as a server, one or more machines performing server-side functionality as described herein, or at least a portion of any of the above, or some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defence facility side, or any other facility that provides service.
[0033] The environment 100 further includes the system 108, communicably coupled to the server 104, and the UE 102 via the network 106. The system 108 is adapted to be embedded within the server 104 or is embedded as the individual entity.
[0034] Operational and construction features of the system 108 will be explained in detail with respect to the following figures.
[0035] FIG. 2 is an exemplary block diagram of the system 108 for anomaly detection in the network 106, according to one or more embodiments of the present invention.
[0036] As per the illustrated and preferred embodiment, the system 108 for anomaly detection in the network 106 includes one or more processors 202, a memory 204, and a storage unit 206. The one or more processors 202, hereinafter referred to as the processor 202, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single-board computers, and/or any devices that manipulate signals based on operational instructions. However, it is to be noted that the system 108 may include multiple processors as per the requirement and without deviating from the scope of the present disclosure. Among other capabilities, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204.
[0037] As per the illustrated embodiment, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204, as the memory 204 is communicably connected to the processor 202. The memory 204 is configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to manage operations in the network 106. The memory 204 may include any non-transitory storage device, including, for example, volatile memory such as RAM or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0038] As per the illustrated embodiment, the storage unit 206 is specifically configured to store data associated with the operation performed in the system 108. The storage unit 206 is one of, but not limited to, the Unified Inventory Management (UIM) unit, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of storage unit 206 types are non-limiting and may not be mutually exclusive e.g., the database can be both commercial and cloud-based, or both relational and open-source, etc.
[0039] In an exemplary embodiment, the storage unit 206 serves as a central hub for all the data associated with the system 108, providing unified and accessible data for analysis. The storage unit 206 is configured to accommodate various data types, including structured data such as databases, semi-structured data such as JSON or XML files, and unstructured data such as text documents, images, and videos. This capability is crucial for telecommunications systems, which generate a wide array of data from different sources.
[0040] As per the illustrated embodiment, the system 108 includes the processor 202 to manage operations in the network 106 for anomaly detection. The processor 202 includes a retrieving unit 208, a transceiver 210, a training unit 212, a generating unit 214, an analyzing unit 216, a selecting unit 218, a determining unit 220 and an interaction unit 224. The processor 202 is communicably coupled to one or more components of the system 108, such as the database 206 and the memory 204. In an embodiment, operations and functionalities of the retrieving unit 208, a transceiver 210, training unit 212, generating unit 214, analyzing unit 216, selecting unit 218, determining unit 220, interaction unit 224, and the one or more components of the system 108 can be used in combination or interchangeably.
[0041] The storage unit 204 may be at least one of, a data lake. It is important to note that the data lake is a centralized repository designed to hold vast volumes of data in its native, raw format. Data lakes may be designed to handle increasing volumes of data without significant changes to the underlying architecture. This scalability is essential for telecommunications networks, which continuously generate large amounts of data. This centralization simplifies data management and ensures that all relevant data is readily available for analysis.
[0042] In one embodiment, initially the operations are performed by the processor 202. The retrieving unit 208 of the processor 202 is responsible for gathering data from various sources, such as databases, live data streams, or external APIs. It ensures that the data collected is relevant and up-to-date, forming the foundation for the training process. The retrieving unit 208 filters and preprocesses the data to remove any noise or irrelevant information, preparing it for subsequent analysis and training of AI/ML model. Once the data is prepared, the model is trained using a variety of machine learning algorithms, on the cleaned dataset. The training results, including key performance metrics, are stored in a centralized data lake, making them readily available for future analysis.
[0043] In one embodiment, the data sources include at least one of the data sources within a telecommunication network and the data sources outside the telecommunication network. The telecommunication network includes at least one of network performance data, subscriber data, and device data. The network performance data provides historical data that includes metrics such as latency, bandwidth usage, packet loss, and error rates to provide the operational status of the telecommunications network. The subscriber data includes data about users of the telecommunications services, such as account details, usage patterns, billing information, and service preferences. The device data refers to data collected from various devices connected to the network, such as mobile phones, routers, and internet of things (IoT) devices. The device data includes information on device performance, connectivity status, and usage statistics, which are essential for managing network resources effectively. These internal data are vital for the telecommunications provider to maintain service quality, optimize network performance, and enhance user experience.
[0044] The data sources outside of the telecommunication network includes at least one of competitor data, social media data, customer feedback, and surveys. The competitor data includes information regarding competitors' performance, pricing strategies, and market positioning. This data is crucial for benchmarking and developing competitive strategies. The social media data includes data gathered from social media platforms that can reveal customer sentiment, trends, and public perception of the telecommunications services. The customer feedback and surveys include direct feedback from customers, collected through surveys, reviews, and other channels.
[0045] In one embodiment, the retrieving unit 208 may utilize one of techniques such as, but not limited to, Database Extraction, ETL (Extract, Transform, Load) Tools, Application Programming Interface (API) Integration, Web Scraping, Real-Time Data Streaming, and Query Languages to retrieve the data from the one or more data sources.
[0046] In the database extraction technique, the retrieving unit 208 connects to a database using a database client or programming language to execute queries and retrieve data. For instance, the retrieving unit 208 pulls data on customer call records, including call duration, time of day, and destination numbers. This data is crucial for analyzing customer behavior and identifying usage patterns. The ETL tools are utilized to extract data from multiple data sources, handling various data formats and making them ideal for analyzing the consolidated data. For example, the ETL tool connects to network management systems via APIs to pull real-time performance metrics, extract billing data from SQL databases, and scrape social media platforms for customer feedback.
[0047] The API integration allows the retrieving unit 208 to access data from data services by making HTTP requests to API endpoints, enabling real-time data retrieval. For instance, the retrieving unit 208 pulls logs from cloud services or third-party monitoring tools via their APIs. The Web scraping involves writing scripts to extract data from web pages. For example, extracting data such as pricing of data plan, data limits, contract terms, and promotional offers from web pages. The real-time data streaming techniques facilitate continuous data retrieval from sources that provide live feeds, such as IoT devices or social media platforms. Technologies like Apache Kafka or AWS Kinesis may be employed to manage these streams, allowing applications to process and analyze data as it arrives.
[0048] The transceiver 210 is configured to receive an input from a user pertaining to one or more desired parameters, wherein the one or more desired parameters includes at least one of, user defined threshold, dynamically set threshold or user defined features, wherein the threshold includes at least one of, data values or range of data values. For example, a smart environmental monitoring system is used to track air quality levels, where the transceiver is integrated into the environmental monitoring device and designed to receive inputs from users regarding the parameters they want to monitor. The user specifies desired parameters. For instance, the user defined a threshold, where the user sets a specific threshold for PM2.5 (particulate matter) levels at 35 µg/m³. The defined threshold can include data values where the user-defined threshold is set to trigger an alert when PM2.5 levels exceed 35 µg/m³. Further, the transceiver receives these parameters and processes incoming data from various sensors. If the PM2.5 level exceeds the user-defined threshold of 35 µg/m³, the system automatically triggers an alert.
[0049] The training unit 212 is configured to trains each of a plurality of models with the retrieved data using one or more logics. For instance, the training unit 212 trains each of a plurality of models by feeding each of the plurality of models with the retrieved data. Thereafter, one or more logics are applied for each of the plurality of models. The training statistics data and the performance data of each of the plurality of trained models is displayed by the generating unit 214 on a single interface for a user to view.
[0050] In one embodiment, the plurality of models refers to multiple distinct machine learning models that are trained on the same dataset or a set of datasets. Each model may use different algorithms or architectures to learn patterns in the data. For instance, said model may be a linear regression model, a random forest model, and the like. A linear regression model is a statistical method used to model the relationship between a dependent variable (target) and one or more independent variables (features) by fitting a linear equation to observed data. For instance, in a housing price prediction system, a linear regression model could be used to predict house prices based on features like square footage, number of bedrooms, and location. The model will learn to establish a linear relationship between these features and the target price. Similarly for the random forest model, an ensemble learning method that constructs multiple decision trees during training and outputs the mode (classification) or mean (regression) of the individual trees' predictions. For instance, in the same housing price prediction scenario as mentioned above, a random forest model could be used. This model will analyze the same features (square footage, number of bedrooms, etc.) but will create multiple decision trees to make more robust predictions by averaging the results, thereby increasing prediction accuracy.
[0051] In one embodiment, the one or more logics may include at least one of, but not limited to, a k-means clustering, a hierarchical clustering, a Principal Component Analysis (PCA), an Independent Component Analysis (ICA), a deep learning logics such as Artificial Neural Networks (ANNs), a Convolutional Neural Networks (CNNs), a Recurrent Neural Networks (RNNs), a Long Short-Term Memory Networks (LSTMs), a Generative Adversarial Networks (GANs), a Q-Learning, a Deep Q-Networks (DQN), a Reinforcement Learning Logics, etc.
[0052] The generating unit 214 of the processor 202 is configured to generate training statistics data and performance data for each of the plurality of trained models, where said performance data pertains to performance of each trained model. The training statistics data refer to metrics and data that help evaluate the performance and effectiveness of a model during the training process; and the performance data in machine learning refers to the metrics and statistics used to evaluate how well a model performs on its tasks.
[0053] For instance, the generating unit 214 is configured to receive the training statistics data and the performance data of each of the plurality of trained models from the training unit 212. Further, the training statistics data and the performance data of each of the plurality of trained models is displayed by the generating unit 214 on a single interface for a user to view. Said generating unit 214 is provided for creating various output formats from the trained models, and generates reports, visualizations, or dashboards that present the performance metrics and insights derived from the training process. Further, the generating unit 214 ensures that the results are communicated clearly, enabling users to understand model performance at a glance.
[0054] In one embodiment, the generating unit 214 creates various output formats that convey insights derived from the training and analysis of machine learning models. For instance, the generating unit 214 produces detailed performance reports, visualizations, and dashboards that summarize key metrics such as accuracy, Mean Squared Error (MSE), and confusion matrices. This enables stakeholders to easily interpret the results and understand the effectiveness of different machine learning algorithms. Additionally, the generating unit 214 may facilitate the generation of comparative analyses between algorithms, highlighting trends and patterns that inform decision-making. By providing these outputs, the generating unit 214 empowers network operators and other users to take informed actions, such as optimizing model selection or adjusting operational strategies based on the insights gathered from the training process.
[0055] The analyzing unit 216 is configured to analyze at least one of the training statistics data and the performance data of each of the plurality of trained models. The analyzing unit 216 evaluates the performance of each trained model. It examines the logged statistics, comparing metrics such as accuracy, Mean Squared Error (MSE), Mean Absolute Error (MAE), and Confusion Matrices. This unit helps identify which trained model performed best under various conditions, providing insights into the strengths and weaknesses of each approach.
[0056] In an embodiment, the selecting unit 218 of the processor 202 makes decisions regarding which trained model to use for anomaly detection. The selecting unit 218 is configured to select at least one trained model from the plurality of trained models which includes at least one of preferred training statistics data and the performance data. For instance, the selecting unit 218 selects the at least one trained model from the plurality of trained models which includes the preferred training statistics data and the performance data. The most appropriate trained model is determined by comparing at least one of the training statistics data and the performance data of each trained model with the one or more desired parameters, wherein the one or more desired parameters includes at least one of, user defined threshold, dynamically set threshold or user defined features, wherein the threshold includes at least one of, data values or range of data values.
[0057] Subsequently, the selecting unit 218 selects most appropriate trained model for detecting presence of anomaly in the data. These criteria may encompass performance metrics such as accuracy, precision, and recall of the trained model based on historical data; computational efficiency, which considers the resource requirements of the trained model and is crucial for real-time applications; and scalability, the ability of the trained model to handle increasing amounts of data without significant performance degradation.

[0058] Said selecting unit 218 may allow users to manually choose a model or provide automated recommendations based on the performance metrics. Its goal is to streamline the selection process, ensuring the most effective trained model is used for the task at hand.
[0059] The selecting unit 218 performs tailored selection. The selecting unit 218 enhances efficiency in trained model selection; its ability to quickly identify and select suitable trained model from a well-organized repository unit streamlines the anomaly detection process, allowing for faster implementation and response times in monitoring systems.
[0060] Thereafter, the determining unit 220 is configured to determine, utilizing the selected at least one trained model, if one or more anomalies are present with a current data. For example, the determining unit 220 with the selected trained model checking, if the current data deviates from learnt trends/patterns of the selected at least one trained model; and if deviation is detected, determining, that the current data includes the one or more anomalies.

[0061] The determining unit 220 takes the selection process a step further by assessing user preferences and contextual factors. If a user does not manually select the trained model, this determining unit 220 employs AI-driven logic to automatically determine the appropriate trained model based on the analysis. It considers factors like historical performance, data characteristics, and specific user requirements, ensuring that the selected trained model is optimal for the current scenario.

[0062] The retrieving unit 208, transceiver 210, training unit 212, generating unit 214, analyzing unit 216, selecting unit 218, determining unit 220 and interaction unit 224, in an exemplary embodiment, are implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 202. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. In the present examples, the memory 204 may store instructions that, when executed by the processing resource, implement the processor 202. In such examples, the system 108 may comprise the memory 204 storing the instructions and the processing resource to execute the instructions, or the memory 204 may be separate but accessible to the system 108 and the processing resource. In other examples, the processor 202 may be implemented by electronic circuitry.
[0063] The interaction unit 224 is uniquely designed to exhibit detailed training statistics related to various AI/ML models, and is configured to enable the user to manipulate the one or more desired parameters in real time via a Graphical User Interface (GUI) running on a User Equipment (UE). Said interaction unit 224 allow the user to interact with the GUI to compare the at least one of, the training statistics data and the performance data of each trained model with the manipulated one or more desired parameters. In one embodiment, the interaction unit 224 allows the user to interact with the GUI to select at least one trained model from the plurality of trained models which includes at least one of, the preferred training statistics data and the performance data based on the manipulated one or more desired parameters, wherein the user is allowed to interact with the GUI using one or more tools. For example, a machine learning platform used to develop and evaluate different models for predicting house prices based on various features (like square footage, number of bedrooms, and location), where the interaction unit 224 provides a GUI so the users can visualize and manipulate data related to trained models. The interaction unit 224 enables users to effectively compare training statistics and performance data for multiple models while manipulating desired parameters through an intuitive GUI.
[0064] In an embodiment, said interaction unit 224 is configured to present the data in both tabular and graphical formats, showcasing key metrics such as accuracy, Mean Squared Error (MSE), Mean Absolute Error (MAE), and a confusion matrix. The confusion matrix is a table that illustrates the performance of a classification algorithm. This visualization is crucial for helping users identify the most suitable algorithm for model training, ultimately improving the accuracy of anomaly detection in incoming raw or analyzed data. The user-friendly interface facilitates informed decision-making and streamlines the anomaly detection process. Additionally, if a user opts not to select a specific AI/ML model after reviewing the statistical data, the processor can automatically choose an appropriate model.
[0065] In an embodiment, said UE is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as smartphones, Virtual Reality (VR) devices, Augmented Reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0066] FIG. 3 illustrates an exemplary architecture for the system 108, according to one or more embodiments of the present invention. More specifically, FIG. 3 illustrates the system 108 for anomaly detection in the data. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to UE 102 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0067] FIG. 3 shows communication between the UE 102, and the system 108. For the purpose of description of the exemplary embodiment as illustrated in FIG. 3, the UE 102, uses network protocol connection to communicate with the system 108. In an embodiment, the network protocol connection is the establishment and management of communication between the UE 102, and the system 108 over the network 106 (as shown in FIG. 1) using a specific protocol or set of protocols. The network protocol connection includes, but not limited to, Session Initiation Protocol (SIP), System Information Block (SIB) protocol, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Simple Network Management Protocol (SNMP), Internet Control Message Protocol (ICMP), Hypertext Transfer Protocol Secure (HTTPS) and Terminal Network (TELNET).
[0068] In an embodiment, the UE 102 includes a primary processor 302, and a memory 304 and a Graphical User Interface (GUI) 306. In alternate embodiments, the UE 102 may include more than one primary processor 302 as per the requirement of the network 106. The primary processor 302, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0069] In an embodiment, the primary processor 302 is configured to fetch and execute computer-readable instructions stored in the memory 304. The memory 304 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to anomaly detection in the network 106. The memory 304 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0070] In an embodiment, the Graphical User Interface (GUI) 306 includes a variety of interfaces, for example, a graphical user interface, a web user interface, a Command Line Interface (CLI), and the like. The GUI 306 allows the user to transmit the request to the system 108 for performing the operation. In one embodiment, the user may include at least one of, but not limited to, a network operator.
[0071] The processor 202 is a critical component in the system 108 designed to interact with various data sources, referred to as one or more data sources, analyze data, and detect anomaly by utilizing the selected at least one trained model with respect to training statistics data and performance data for each of the plurality of trained models. Further, the processor 202, enables a trained model to learn the historic performance of the one or more anomaly detection with respect to the similar data. The result of this learnt historic performance data are stored in the storage unit 206.
[0072] In an embodiment, the connection of the processor 202 with the one or more data sources is facilitated through the use of Application Programming Interfaces (APIs). The APIs used can vary in type, including RESTful APIs, SOAP APIs, or other custom APIs designed for specific data sources. Each type has its own set of rules and protocols for communication, which the processor 202 must adhere to when establishing connections. By using APIs, the processor 202 is configured to connect with a wide range of data sources, regardless of their underlying technology or architecture. This interoperability is essential for modern systems that rely on diverse data inputs. The ability to establish multiple connections through the APIs allows the system to scale efficiently. As the demand for data increases, the processor 202 can connect to additional data sources without significant changes to the underlying architecture. The APIs enable real-time access to data, allowing the processor 202 to retrieve the most current information from the data sources. This is particularly important for applications that require up-to-date data for decision-making or analysis. The APIs often include authentication and authorization mechanisms, ensuring that only authorized users or systems can access the data sources. This adds a layer of security to the data exchange process.
[0073] The one or more data sources includes, by way of example but not limited to, telecommunication network and outside of the telecommunication network. The telecommunication network includes at least one of network performance data, subscriber data, and device data. The outside of the telecommunication network include at least one of competitor data, social media data, customer feedback, and surveys.
[0074] As mentioned earlier in FIG.2, the system 108 includes the processors 202, the memory 204, and the storage unit 206, for anomaly detection, which are already explained in FIG. 2. For the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition.
[0075] Further, as mentioned earlier, the processor 202 includes retrieving unit 208, transceiver 210, training unit 212, generating unit 214, analyzing unit 216, selecting unit 218, determining unit 220 and interaction unit 224, which are already explained in FIG. 2. Hence, for the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition. The limited description provided for the system 108 in FIG. 3 should be read with the description provided for the system 108 in FIG. 2 above and should not be construed as limiting the scope of the present disclosure.
[0076] FIG. 4 is an exemplary architecture illustrating the flow of operations performed for anomaly detection, according to one or more embodiments of the present disclosure.
[0077] In an embodiment, the architecture 400 includes NFs
data 402, data lake 412, data
integration 404, data processing 406, model training unit 408, prediction unit 410, and user interface 414. Said NFs data 402 is a Network Functions which analyzes different type of network performance data.
[0078] Initially, the NFs data 402 establishes connections with various data sources and analyzes different type of network performance data. These diverse data sources are essential for comprehensive analysis and decision-making, as they provide critical insights into network efficiency, user behavior, and operational performance. In an embodiment, the NFs data 402 establishes connections with data sources within a telecommunication network and the data sources outside the telecommunication network. The telecommunication network includes at least one of network performance data, subscriber data, and device data; and the outside of the telecommunication network include at least one of competitor data, social media data, customer feedback, and surveys.
[0079] The NFs data 402 data is then aggregated and stored in a data lake 412. The data lake 412 serves as the central hub for all incoming data, providing a unified and accessible source for analysis. Said data lake 412 is a distributed data base used to store the processed data and trained model outputs.
[0080] The data integration unit 404 is a module that is responsible for consolidating data from various sources into a unified format. This unit plays a crucial role in data management, especially in environments where data comes from multiple data source. Further, the data integration unit is in communication with the data processing 406 via a suitable mean.
[0081] The data processing unit 406 is used for data definition, data normalization or data cleaning (remove redundant data, remove NaN values). Said data processing perform normalization to adjust the data values to a common scale without distorting differences in the ranges of values, encode to convert categorical data into numerical formats that can be easily processed by machine learning algorithms, and structuring to organize the data into a predefined schema or structure, such as tables or arrays, which is essential for efficient querying and analysis. Further, the normalized data from the data processing unit 406 is sent to the model training unit 408.
[0082] The model training unit 408 configured to apply machine learning algorithms to the pre-processed data, which has been effectively integrated through data integration processes 406. Said AI/ML model is designed to execute a variety of algorithms, predictive tasks, anomaly detection, and generate AI-driven outputs using Large Language Models (LLM). Its function revolves around analyzing network data and operational data, leveraging machine learning techniques for in-depth analysis. This integration ensures that various data sources are harmonized, enabling comprehensive analysis.

[0083] The prediction unit 410 is configured to forecast the results on the basis of learned patterns using the selected trained model. Based on the detected pattern, the prediction unit 410 predicts the future trends of the anomaly in the data.
[0084] It is important to note that the user interface 414 provides an interactive feature to enable interaction between the user and the system. It encompasses all the elements that allow users to engage with the system 102, including buttons, menus, icons, and other visual components. The primary goal of the user interface 414 is to facilitate effective and efficient operation, ensuring that users can navigate and utilize the system 108 with ease. This user-centric approach enhances the flexibility and usability of the anomaly detection.
[0085] In an embodiment, the data integration 404, data processing 406, model training unit 408, and prediction unit 410 may collectively be referred to as the "system", which functions as an artificial intelligence (AI) tool designed to perform multiple operations, including data analysis, anomaly detection, and the generation of notifications. This may take up network data and operation data to perform analysis using machine learning models.
[0086] FIG. 5 is a flow diagram of a method 500 for anomaly detection, according to one or more embodiments of the present invention. For the purpose of description, the method 500 is described with the embodiments as illustrated in FIG. 3 and should nowhere be construed as limiting the scope of the present disclosure.
[0087] At step 502, the method 500 includes the step of retrieving the data from one or more data sources based on establishing one or more connections with the one or more data sources. In an embodiment, the retrieving unit 208 retrieves at least one of network performance data, subscriber data, and device data from the telecommunication network. For example, the retrieving unit 208 establishes connections with a network performance database to pull metrics like latency, which is the time it takes for data to travel from one point to another, packet loss, which is the percentage of packets that do not reach their destination, and error rates, which is frequency of errors in data transmission. In another example, the retrieving unit 208 establishes connections and collects data in at least one of competitor data, social media data, customer feedback, and surveys. The vital information such as signal strength which is the quality of the signal received by devices, handover events when a mobile device switches from one cell tower to another, and network congestion which discloses the level of traffic on the network.
[0088] At step 504, the method 500 includes the step of receiving, by the one or more processors, an input from a user pertaining to one or more desired parameters, wherein the one or more desired parameters includes at least one of, user defined threshold, dynamically set threshold or user defined features, wherein the threshold includes at least one of, data values or range of data values. For example, a smart environmental monitoring system is used to track air quality levels, where the transceiver is integrated into the environmental monitoring device and designed to receive inputs from users regarding the parameters they want to monitor. The user specifies desired parameters. For instance, the user defined a threshold, where the user sets a specific threshold for PM2.5 (particulate matter) levels at 35 µg/m³. The defined threshold can include data values where the user-defined threshold is set to trigger an alert when PM2.5 levels exceed 35 µg/m³. Further, the transceiver receives these parameters and processes incoming data from various sensors. If the PM2.5 level exceeds the user-defined threshold of 35 µg/m³, the system automatically triggers an alert.
[0089] At step 506, the method 500 includes the step of training of each of a plurality of models with the retrieved data using one or more logics. For instance, the training unit 210 trains each of a plurality of models by feeding each of the plurality of models with the retrieved data. Thereafter, one or more logics are applied for each of the plurality of models. The training statistics data and the performance data of each of the plurality of trained models is displayed by the generating unit 212 on a single interface for a user to view.

[0090] At step 508, the method 500 includes the step of generating training statistics data and performance data for each of the plurality of trained models. The training statistics data refer to metrics and data that help evaluate the performance and effectiveness of a model during the training process; and the performance data in machine learning refers to the metrics and statistics used to evaluate how well a model performs on its tasks. The training statistics data and the performance data of each of the plurality of trained models is displayed by the one or more processors on a single interface for a user to view.

[0091] At step 510, the method 500 includes the step of analyzing, the training statistics data and the performance data of each of the plurality of trained models. The step of analyzing evaluates the performance of each trained model. It examines the logged statistics, comparing metrics such as accuracy, Mean Squared Error (MSE), Mean Absolute Error (MAE), and Confusion Matrices. This unit helps identify which trained model performed best under various conditions, providing insights into the strengths and weaknesses of each approach.
[0092] At step 512, the method 500 includes the step of selecting one trained model from the plurality of trained models which includes at least one of preferred training statistics data and the performance data. The step of selecting trained model includes the steps of comparing by at least one of the training statistics data and the performance data of each trained model with at least one of user defined threshold, dynamically set threshold, wherein the threshold includes at least one of, data values or range of data values. Subsequently, the selecting step selects the most appropriate trained model for detecting presence of anomaly in the data.
[0093] At step 514, the method 500 includes the step of determining, utilizing the selected at least one trained model, if one or more anomalies are present with a current data. The determining step includes the steps of checking, by the one or more processors, if the current data deviates from learnt trends/patterns of the selected at least one trained model; and if deviation is detected, determining, by the one or more processors, that the current data includes the one or more anomalies.
[0094] Further, the method 500 is configured to enable, by the one or more processors, the user to manipulate the one or more desired parameters in real time via the GUI running on a user equipment (UE). The method 500 allowing, by the one or more processors, the user to interact with the GUI to compare the at least one of, the training statistics data and the performance data of each trained model with the manipulated one or more desired parameters. Further, the method 500 allowing, by the one or more processors, the user to interact with the GUI to select at least one trained model from the plurality of trained models which includes at least one of, the preferred training statistics data and the performance data based on the manipulated one or more desired parameters, wherein the user is allowed to interact with the GUI using one or more tools. For example, a machine learning platform used to develop and evaluate different models for predicting house prices based on various features (like square footage, number of bedrooms, and location), where the interaction unit provides a GUI so the users can visualize and manipulate data related to trained models. The interaction unit enables users to effectively compare training statistics and performance data for multiple models while manipulating desired parameters through an intuitive GUI.
[0095] In one embodiment, the method 500 includes the step to store data pertaining to at least one of the analyses of each of the trained models, the selection of at least one trained model, and the determined one or more anomalies in the storage unit. For example, a financial institution has developed a machine learning system to detect fraudulent transactions using various trained models, where the method 500 stores crucial data related to the analysis of trained models, the selection of the best-performing model, and the identification of anomalies in a financial fraud detection system.
[0096] The present invention further discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by the processor 202. The processor 202 is configured to retrieve the data pertaining to the operation of the network 106 from a database 206, and the processor 202 is configured to train each of a plurality of models with the retrieved data using one or more logics. Thereafter, the processor 202 generates training statistics data and performance data for each of the plurality of trained models. Further, the processor 202 analyses at least one of the training statistics data and the performance data of each of the plurality of trained models and selects at least one trained model from the plurality of trained models, which includes at least one of the preferred training statistics data and the performance data. At the end, the processor 202 determines whether anomalies are present with the current data by utilizing the selected at least one trained model.
[0097] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-5) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0098] The present disclosure provides technical advancement, where the accurate selection of the trained model based on comprehensive training and performance statistics results in precise and accurate detection of the anomalies. The precise and accurate detection of the anomalies helps in improving security through the identification of unusual patterns that may indicate intrusions or attacks, enhanced performance monitoring by revealing unexpected behaviors in network traffic, and proactive management by helping to identify potential system failures or bottlenecks before they escalate. Further, the optimized model training results in robust and efficient models for anomaly detection. By presenting diverse training statistics in an easily understandable format, the user interface simplifies the evaluation of machine learning models. Its user-friendly design allows even those without deep technical knowledge to interpret complex data and make informed decisions about model selection. Furthermore, effective visualization and comparison of training metrics save time and computational resources, enabling users to quickly identify the best AI/ML algorithm, reducing unnecessary iterations and speeding up the deployment of strong models. Accurate model selection based on comprehensive statistics minimizes false alarms and unnecessary alerts, improving overall anomaly detection efficiency. Additionally, if a user chooses not to manually select an AI/ML model, the system can automatically select one by analyzing the statistical outputs. The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS

[0099] Environment - 100;
[00100] User Equipment (UE) - 102;
[00101] Server - 104;
[00102] Network- 106;
[00103] System -108;
[00104] Processor - 202;
[00105] Memory - 204;
[00106] Storage Unit – 206;
[00107] Retrieving unit – 208;
[00108] Transceiver – 210;
[00109] Training unit – 212;
[00110] Generating unit– 214;
[00111] Analysing unit – 216;
[00112] Selecting unit – 218;
[00113] Determining unit 220;
[00114] Interaction unit 224;
[00115] Primary Processor – 302;
[00116] Memory – 304;
[00117] Graphical User Interface (GUI) – 306;
[00118] NFs data – 402;
[00119] Data Integration – 404;
[00120] Data Processing – 406;
[00121] Model training unit – 408;
[00122] Prediction unit – 410;
[00123] Data Lake – 412;
[00124] User Interface – 414;
,CLAIMS:CLAIMS
We Claim:
1. A method (500) for anomaly detection, the method comprising the steps of:
retrieving, by the one or more processors (202), data from one or more data sources (302);
receiving, by the one or more processors, an input from a user pertaining to one or more desired parameters;
training, by the one or more processors (202), each of a plurality of models with the retrieved data using one or more logics;
generating, by the one or more processors (202), training statistics data and performance data for each of the plurality of trained models;
analysing, by the one or more processors (202), at least one of, the training statistics data and the performance data of each of the plurality of trained models;
selecting, by the one or more processors (202), at least one trained model from the plurality of trained models which includes at least one of, preferred training statistics data and the performance data;
determining, by the one or more processors (202), utilizing the selected at least one trained model, if one or more anomalies are present with a current data.

2. The method (500) as claimed in claim 1, wherein the one or more data sources (302) include at least one of, the data sources within a telecommunication network (302a) and the data sources outside the telecommunication network (302b).

3. The method (500) as claimed in claim 2, wherein the one or more data sources (302) within the telecommunication network (302a) include at least one of, network performance data, subscriber data and device data, wherein the one or more data sources outside the telecommunication network (302b) include at least one of, competitor data, social media data, customer feedback and surveys.

4. The method as claimed in claim 1, wherein the step of, retrieving, data from one or more data sources, further includes the step of:
preprocessing, by the one or more processors, the retrieved data.

5. The method (500) as claimed in claim 1, wherein the step of, training, each of a plurality of models with the retrieved data using one or more logics, includes the steps of:
feeding, by the one or more processors (202), each of the plurality of models with the retrieved data;
applying, by the one or more processors (202), the one or more logics for each of the plurality of models; and
training, by the one or more processors (202), each of the plurality of models with the fed data and the applied one or more logics.

6. The method as claimed in claim 1, wherein the performance data pertains to performance of each trained model.

7. The method (500) as claimed in claim 1, wherein the training statistics data and the performance data of each of the plurality of trained models is displayed by the one or more processors (202) on an interface for a user to view.

8. The method (500) as claimed in claim 1, wherein the step of, selecting, at least one trained model from the plurality of trained models which includes a preferred training statistics data and a performance data, includes the steps of:
comparing, by the one or more processors (202), at least one of, the training statistics data and the performance data of each trained model with the one or more desired parameters, wherein the one or more desired parameters includes at least one of, user defined threshold, dynamically set threshold or user defined features, wherein the threshold includes at least one of, data values or range of data values; and
selecting, at least one trained model from the plurality of trained models based on comparison.

9. The method as claimed in claim 1, wherein the method further comprising the steps of:
enabling, by the one or more processors, the user to manipulate the one or more desired parameters in real time via a Graphical User Interface (GUI) running on a User Equipment (UE);
allowing, by the one or more processors, the user to interact with the GUI to compare the at least one of, the training statistics data and the performance data of each trained model with the manipulated one or more desired parameters;
allowing, by the one or more processors, the user to interact with the GUI to select at least one trained model from the plurality of trained models which includes at least one of, the preferred training statistics data and the performance data based on the manipulated one or more desired parameters, wherein the user is allowed to interact with the GUI using one or more tools.

10. The method (500) as claimed in claim 1, wherein the step of, determining, utilizing the selected at least one trained model, one or more anomalies with a current data, includes the steps of:
checking, by the one or more processors (202), if the current data deviates from learnt trends/patterns of the selected at least one trained model; and
if deviation is detected, determining, by the one or more processors (202), that the current data includes the one or more anomalies.

11. The method as claimed in claim 1, wherein the one or more processors, stores data pertaining to at least one of, the analysis of each of the trained models, selected at least one trained model and the determined one or more anomalies in a storage unit.

12. A system (108) for anomaly detection, the system (108) comprising:
a retrieving unit (208), configured to, retrieve, data from one or more data sources (302);
a transceiver (210), configured to, receive, an input from a user pertaining to one or more desired parameters;
a training unit (212), configured to, train, each of a plurality of models with the retrieved data using one or more logics;
a generating unit (214), configured to, generate, training statistics data and performance data for each of the plurality of trained models;
an analysing unit (216), configured to, analyse, at least one of, the training statistics data and the performance data of each of the plurality of trained models;
a selecting unit (218), configured to, select, at least one trained model from the plurality of trained models which includes at least one of, preferred training statistics data and the performance data;
a determining unit (220), configured to, determine, utilizing the selected at least one trained model, if one or more anomalies are present with a current data.

13. The system (108) as claimed in claim 12, wherein the one or more data sources (302) include at least one of, the data sources within a telecommunication network (302a) and the data sources outside the telecommunication network (302b).

14. The system (108) as claimed in claim 12, wherein the one or more data sources (302) within the telecommunication network (302a) include at least one of, network (106) performance data, subscriber data and device data, wherein the one or more data sources outside the telecommunication network (302b) include at least one of, competitor data, social media data, customer feedback and surveys.

15. The system as claimed in claim 12, wherein the retrieving unit (208) is further configured to:
preprocess, the retrieved data.

16. The system (108) as claimed in claim 12, wherein the training unit (212), trains, each of a plurality of models by:
feeding, each of the plurality of models with the retrieved data;
applying, the one or more logics for each of the plurality of models; and
training, each of the plurality of models with the fed data and the applied one or more logics.

17. The system as claimed in claim 12, wherein the performance data pertains to performance of each trained model.

18. The system (108) as claimed in claim 12, wherein the training statistics data and the performance data of each of the plurality of trained models is displayed by the generating unit (214) on an interface for a user to view.

19. The system (108) as claimed in claim 12, wherein the selecting unit (218) selects the at least one trained model from the plurality of trained models which includes the preferred training statistics data and the performance data, by:
comparing, at least one of, the training statistics data and the performance data of each trained model with the one or more desired parameters, wherein the one or more desired parameters includes at least one of, user defined threshold, dynamically set threshold or user defined features, wherein the threshold includes at least one of, data values or range of data values; and.
selecting, at least one trained model from the plurality of trained models based on comparison.

20. The system as claimed in claim 12, wherein an interaction unit (224) is configured to:
enable, the user to manipulate the one or more desired parameters in real time via a Graphical User Interface (GUI) 306 running on a User Equipment (UE) 102;
allow, the user to interact with the GUI 306 to compare the at least one of, the training statistics data and the performance data of each trained model with the manipulated one or more desired parameters; and
allow, the user to interact with the GUI 306 to select at least one trained model from the plurality of trained models which includes at least one of, the preferred training statistics data and the performance data based on the manipulated one or more desired parameters, wherein the user is allowed to interact with the GUI 306 using one or more tools.

21. The system (108) as claimed in claim 12, wherein the determining unit (220), determines, utilizing the selected at least one trained model, one or more anomalies with the current data, by:
checking, if the current data deviates from learnt trends/patterns of the selected at least one trained model; and
if deviation is detected, determining, that the current data includes the one or more anomalies.

22. The system as claimed in claim 12, wherein the selecting unit (218) is configured to, store data pertaining to at least one of, the analysis of each of the trained models, selected at least one trained model and the determined one or more anomalies in a storage unit 206.