DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
METHOD AND SYSTEM FOR IDENTIFYING ANOMALIES IN EVENTS SUBSCRIPTION SERVICE MANAGEMENT
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to migration of customers, more particularly relates to a system and a method of identifying anomalies in events subscription service management.
BACKGROUND OF THE INVENTION
[0002] With increase in number of users, the network service provisions have to be upgraded to incorporate increased users and to enhance the service quality so as to keep pace with such high demand. There are a lot of factors that need to be cared for when considering quality of a network. To maintain health of a network regular monitoring of various parameters has to be done, like monitoring performance of various network elements and network functions etc. Network functions play a vital role in improving the quality of a network by the way of managing traffic, delegating node allocation, managing performance of routing device etc. The network may be riddled with many functional problems due to external and internal factors which may induce anomalies and abnormal behavior of network functions. A Network Data Analytics Function (NWDAF) is configured to identify the abnormalities or exception trends (e.g. location change, being misused) present in a UE (user equipment) or a group of UE’s in a certain area of interest. NWDAF will determine the abnormal behavior only when a consumer request for it for a particular UE or a group of UE. Such detection methodology can cause a bottleneck in the NWDAF. There is a need of a system to identify any anomaly in real time without limiting the capacity of the network and method thereof.
[0003] Presently there is no mechanism in place for the identification of anomaly in event subscription service automatically and it is mostly performed by manual intervention which may involve errors and is time and resource consuming. There is a requirement of a system and a method to identify anomaly for various event subscription service operations.
SUMMARY OF THE INVENTION
[0004] One or more embodiments of the present disclosure provide a method and system for identifying anomalies in events subscription service management.
[0005] In one aspect of the present invention, the system for identifying the anomalies in events subscription service management is disclosed. The system includes a transceiver, data related to one or more User Equipment (UE). The system further includes a data handling unit, configured to, one or more data handling processes such as cleaning, definition, sorting, and normalizing on the received data to ensure consistency and remove extraneous information. The system further includes an execution unit, configured to execute an anomaly detection model on the data for determining anomalous events of the one or more UEs. The system further includes a notification unit, configured to notify a user about the one or more events anomalous events of the one or more UEs, thereby providing insights into network behaviour and performance of the one or more UEs.
[0006] In an embodiment, the data related to the one or more UEs includes network activity, mobility, and usage patterns of the one or more UEs.
[0007] In an embodiment, the anomaly detection model is pre-trained on historical data for identification of patterns and connections between network load, user activity, and external and internal factors.
[0008] In an embodiment, the one or more anomalous events include unusual patterns of network usage and unexpected location changes.
[0009] In an embodiment, the system provides analysis of subscription usage trends, resource allocation, and system policy optimization recommendations.
[0010] In another aspect of the present invention, the method for identifying the anomalies in events subscription service management is disclosed. The method includes the step of receiving data related to one or more User Equipment (UE). The method further includes the step of performing the one or more data handling processes such as cleaning, definition, sorting, and normalizing on the received data to ensure consistency and remove extraneous information. The method further includes the step of executing an anomaly detection model on the data for determining one or more anomalous events of the one or more UEs. The method further includes the step of notifying a user about the one or more anomalous events of the one or more UEs for providing insights into network behaviour and performance of the one or more UEs.
[0011] In another aspect of the invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions is disclosed. The computer-readable instructions are executed by a processor. The processor is configured to collect data related to one or more User Equipment (UE). The processor is configured to clean the data for removing extraneous information, sorting the data, and normalizing the data for ensuring consistency of the data. The processor is configured to execute an anomaly detection model on the data for determining one or more anomalous events of the one or more UEs. The processor is configured to notify a user about the one or more anomalous of the one or more UEs.
[0012] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.
BRIEF DESCRIPTION OF THE DRAWINGS
[0013] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0014] FIG. 1 is an exemplary block diagram of an environment for identifying anomalies in events subscription service management, according to one or more embodiments of the present invention;
[0015] FIG. 2 is an exemplary block diagram of a system for identifying the anomalies in events subscription service management, according to one or more embodiments of the present invention;
[0016] FIG. 3 is an exemplary block diagram of an architecture implemented in the system of the FIG. 2, according to one or more embodiments of the present invention;
[0017] FIG. 4 is a signal flow diagram for identifying the anomalies in events subscription service management, according to one or more embodiments of the present invention; and
[0018] FIG. 5 is a schematic representation of a method of identifying the anomalies in events subscription service management, according to one or more embodiments of the present invention.
[0019] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0020] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0021] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0022] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0023] FIG. 1 illustrates an exemplary block diagram of an environment 100 for identifying anomalies in events subscription service management, according to one or more embodiments of the present disclosure. In this regard, the environment 100 includes a User Equipment (UE) 110, a server 115, a network 105 and a system 120 communicably coupled to each other for identifying the anomalies in events subscription service management.
[0024] As per the illustrated embodiment and for the purpose of description and illustration, the UE 110 includes, but not limited to, a first UE 110a, a second UE 110b, and a third UE 110c, and should nowhere be construed as limiting the scope of the present disclosure. In alternate embodiments, the UE 110 may include a plurality of UEs as per the requirement. For ease of reference, each of the first UE 110a, the second UE 110b, and the third UE 110c, will hereinafter be collectively and individually referred to as the “User Equipment (UE) 110”.
[0025] In an embodiment, the UE 110 is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as a smartphone, virtual reality (VR) devices, augmented reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0026] The environment 100 includes the server 115 accessible via the network 105. The server 115 may include, by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, one or more processors executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0027] The network 105 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 105 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0028] The network 105 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth. The network 105 may also include, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, a VOIP or some combination thereof.
[0029] The environment 100 further includes the system 120 communicably coupled to the server 115 and the UE 110 via the network 105. The system 120 is configured for identifying the anomalies in events subscription service management. As per one or more embodiments, the system 120 is adapted to be embedded within the server 115 or embedded as an individual entity.
[0030] Operational and construction features of the system 120 will be explained in detail with respect to the following figures.
[0031] FIG. 2 is an exemplary block diagram of the system 120 for identifying anomalies in events subscription service management, according to one or more embodiments of the present invention.
[0032] As per the illustrated embodiment, the system 120 includes one or more processors 205, a memory 210, a user interface 215, and a database 220. For the purpose of description and explanation, the description will be explained with respect to one processor 205 and should nowhere be construed as limiting the scope of the present disclosure. In alternate embodiments, the system 120 may include more than one processor 205 as per the requirement of the network 105. The one or more processors 205, hereinafter referred to as the processor 205 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0033] As per the illustrated embodiment, the processor 205 is configured to fetch and execute computer-readable instructions stored in the memory 210. The memory 210 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to create or share data packets over a network service. The memory 210 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0034] In an embodiment, the user interface 215 includes a variety of interfaces, for example, interfaces for a graphical user interface, a web user interface, a Command Line Interface (CLI), and the like. The user interface 215 facilitates communication of the system 120. In one embodiment, the user interface 215 provides a communication pathway for one or more components of the system 120. Examples of such components include, but are not limited to, the UE 110 and the database 220.
[0035] The database 220 is one of, but not limited to, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of database 220 types are non-limiting and may not be mutually exclusive e.g., a database can be both commercial and cloud-based, or both relational and open-source, etc.
[0036] In order for the system 120 to identify the anomalies during the events subscription service management, the processor 205 includes one or more modules/units. In one embodiment, the one or more modules/units includes, but not limited to, a transceiver unit 225, a data handling unit 230, an execution unit 235, and a notification unit 240 communicably coupled to each other for identifying anomalies in events subscription service management.
[0037] In one embodiment, the one or more modules/units may be used in combination or interchangeably for identifying the anomalies in events subscription service management.
[0038] The transceiver unit 225, the data handling unit 230, the execution unit 235, and the notification unit 240, in an embodiment, may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 205. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 205 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 210 may store instructions that, when executed by the processing resource, implement the processor. In such examples, the system 120 may comprise the memory 210 storing the instructions and the processing resource to execute the instructions, or the memory 210 may be separate but accessible to the system 120 and the processing resource. In other examples, the processor 205 may be implemented by electronic circuitry.
[0039] In an embodiment, transceiver unit 225 is configured to collect data related to one or more UE 110. The collection of data related to the UE 110 occurs through the transceiver unit 225, which interfaces directly with the UE 110 within the network 105. The transceiver unit 225 gathers various types of information, which includes, but not limited to, network activity, mobility, and usage patterns. The network activity encompasses the monitoring of upload and download activities, capturing metrics such as, but not limited to, data volume, data types, and interaction frequency. The mobility data refers to the physical location and movement patterns of the UE 110, which includes, but not limited to, geographical coordinates and connected cell tower identification. The usage patterns reveal how the UE 110 interacts with the network 105, detailing data consumption habits and service access frequency. Once data is collected, the collected data is transmitted to a Network Data Analytics Function (NWDAF) 305 (as shown in the FIG. 3) for processing, enabling comprehensive monitoring and analysis to identify trends and anomalies. The insights derived from the data analysis, which include anomaly detection, performance trends, user behavior analysis, and actionable information for network optimization, are subsequently made available to data consumers within the network, allowing for proactive management of network resources. The
[0040] Upon receiving the data by the transceiver unit 225, the data handling unit 230 is configured to perform the one or more data handling processes such as cleaning, definition, sorting, and normalizing on the received data to ensure consistency and remove extraneous information. The cleaning refers to the process of identifying and removing any erroneous, incomplete, or irrelevant data from the database 220. The process of cleaning ensures that only high-quality, relevant information is retained for analysis. The definition involves establishing the structure and format of the data, including definition types and characteristics. The definition process is crucial for ensuring that the data may be effectively processed and analyzed later. The sorting refers to arranging the data in the specified order based on certain criteria. The sorting process aids in organizing the data, making the sorting easier to analyze and retrieve specific information. The normalizing involves adjusting the data to ensure consistency across the dataset. The normalizing may include converting data to the standard format or scale, which is essential for accurate comparisons and analyses. The removal of the extraneous information involves identifying and eliminating data which is irrelevant and unnecessary for the analysis. The irrelevant data refers to information that doesn't contribute to meaningful analysis or insight and may interfere with detecting anomalies or trends. The data of objects and variables is required to be deleted when the objects and variables no longer contribute to the system 120 functionality.
[0041] In one embodiment, the data required to be deleted is also termed as irrelevant data. The data include, but is not limited to, outdated, unused, or redundant information that no longer serves a functional purpose. The data can stem from various sources, including outdated logs, unused variables, and previous configuration files that no longer serve a purpose. Redundant backups and unfinished drafts also contribute to storage inefficiencies. Temporary files, duplicate data, and unused database entries further clutter the system 120. Further, the temporary files, the duplicate data, and the unused database entries lead to clutter storage, slow down system performance, and increase compliance risks. Identifying and deleting the data is essential to maintaining efficient operations, that ensures data integrity and optimizes storage capacity within the system 120.
[0042] The extraneous information includes, but not limited to, debug and diagnostic logs, system alerts and notifications, and automated network management traffic. The sorting involves organizing the collected data into a structured format based on a consumer requirement. The sorting includes, but is not limited to, chronological sorting, sorting by data usage volume, and sorting by network event type. The normalization is the process of adjusting the data to ensure uniformity and comparability. The normalization includes, but is not limited to, standardizing data units, consistent data formats, standardizing categorical values, and handling missing or null values.
[0043] Upon cleaning the data by the data handling unit 230, the execution unit 235 is configured to execute the anomaly detection model on the cleaned data for determining one or more anomalous events of the one or more UE 110. The system collects various data essential for effective network management, which includes, but not limited to, network performance, UE mobility, UE communication, user data congestion. The network performance metrics, such as latency and throughput, help identify bottlenecks. The UE mobility tracks UE 110 movement and handover events for better resource allocation. The UE communication monitors interactions with the network 105, aiding in understanding usage trends. The user data congestion assesses network 105 strain during high demand, essential for load balancing. Together, the data provides insights into network dynamics and user behavior, enabling proactive management and improved customer experience.
[0044] The one or more anomalous events refer to unusual or unexpected patterns of activity or usage by each of the UE 110 connected to the network 105 that deviate from typical behavior. The typical behavior defines as the normal or expected patterns of activity and usage by the UE 110 on the network 105. The typical behavior is based on historical data and predefined standards for network performance and user activity. The example of typical behavior includes, but not limited to, normal data usage, consistent location patterns, standard network connectivity, and expected device activity.
[0045] The anomalies are identified using the anomaly detection model based on deviations from the typical behavior, which is established from the historical data and predefined standards for network performance and user activity. The anomalies accurately detail the types of issues anomaly detection model may detect, such as, but not limited to, potential issues, security threats, performance problems, and abnormal user activity. The invention involves identifying correct the machine learning models based on features of data and the request.
[0046] Additionally, the NWDAF 305 addresses potential bottlenecks by enhancing its capabilities and ensuring that it provides timely, accurate, and relevant insights for anomaly detection. The bottlenecks at the NWDAF 305 occur due to, but not limited to, real-time data processing, enhanced analytics, contextual awareness, proactive management, and informed decision-making. The NWDAF 305 is a critical component of the network architecture that enhances network efficiency and user experience through advanced analytics. The NWDAF 305 designed to provide insights and analytics related to various network functions, facilitating informed decision-making for network management and optimization. The insights provided by the NWDAF 305 are invaluable for the anomaly detection models 335 (as shown in FIG.3). By incorporating the NWDAF 305 analytics into the anomaly detection process, the system 120 may enhance the accuracy and relevance of its predictions. Specifically, the NWDAF 305 enhances the contextual awareness, proactive management, and enhanced performance analysis by providing real-time insights and analytics related to network slice instances and load levels.
[0047] In an embodiment, the NWDAF 305 provides the identifier and load level information for the network slice instance and allowing Network Function (NF) consumers to subscribe to or unsubscribe from periodic notifications or alerts when a threshold is exceeded. A Policy Control Function (PCF) supports considering input from the NWDAF 305 for policies related to network resource assignment and traffic steering.
[0048] In an embodiment, the anomaly detection model is pre-trained on historical data for identification of patterns and connections between network load, user activity, and external and internal factors. The historical data refers to the aggregation of data from previous events, activities, and network conditions. The historical data may include details, but not limited to, data usage over time, user behavior patterns on the network 105, and various factors that influenced network performance.
[0049] In an embodiment, the identification of patterns corresponding to network load refers to the amount of data traffic being handled by the network 105 at any given time. The network load includes the data from, but not limited to, streaming services, online gaming, video conferencing, and other high-bandwidth applications. The network load fluctuates based on the number of, but not limited to, active users, the type of services are using, and the time of day. The identification of patterns corresponding to the user activity identifies the number of users streaming video content and uploading high-definition images and videos. The user activity further includes, but not limited to, types of applications used, the duration of the online sessions, the frequency of the data usage, and the mobility patterns. The identification of patterns external and internal factors includes various conditions that can impact network performance. The external factors might include, but not limited to, weather conditions, large public gatherings, and geographical obstacles which affect signal strength. The internal factors refer to the technical aspects within the network 105 itself which include, but not limited to, network configuration, resource allocation, and infrastructure capacity.
[0050] In an embodiment, the anomaly detection model identifies connections between the observed high network load and specific user activities such as, but not limited to, streaming and social media sharing. The anomaly detection model recognizes the activities contribute significantly to strain on resources of the network 105. Additionally, the anomaly detection model correlates the timing of the load spike with the start and end times of the user activity, linking the increased traffic to the external factor of the user activity.
[0051] Furthermore, the anomaly detection model assesses internal factors which include, but not limited to, the current network configuration, and identifies that network 105 is optimally set up to handle the sudden surge in traffic. If not, the model suggests potential areas for the improvement to enhance network performance during the peak usage times. The anomalous behavior is identified by the anomaly detection model through data collection from the UE 110 and network metrics. The anomalous behavior establishes the standard of typical behavior from historical data and monitors for significant deviations, such as, but not limited to, sudden spikes in usage or unexpected location changes. The model considers internal factors like network configuration and external factors like events causing increased traffic. When deviations are detected, the anomalous behavior are classified as anomalies, prompting alerts for network operators and suggestions for improvement to enhance performance and security.
[0052] In an embodiment, the system 120 provides analysis of subscription usage trends, resource allocation, and system policy optimization recommendations. The system 120 analyzes subscription usage trends to identify patterns in data consumption and peak usage times. The subscription usage trends include, but not limited to daily data consumption patterns, event-driven spikes, and seasonal usage changes. The system 120 assesses the allocation of network resources to pinpoint inefficiencies and determine areas where resources might be over- or under-utilized. The resource allocation includes, but is not limited to, bandwidth utilization in high-traffic areas, server load balancing, and resource allocation during events. Based on the analysis, the system 120 provides recommendations for optimizing system policies, including resource reallocation and subscription adjustments, to enhance overall network performance and user experience. The system 120 policy optimization recommendations include, but are not limited to, dynamic bandwidth allocation, subscription plan adjustments, and prioritization of critical applications.
[0053] Upon analysis performed by the execution unit 235, the notification unit 240 is configured to notify the consumer about the one or more anomalous events of the one or more UEs 110.
[0054] In an embodiment, the consumer is a node that uses one or more services of the NWDAF 305. The consumer using the NWDAF 305 service request, and the NWDAF 305 communicating relevant data from the service request to inventive system 120. In one embodiment, the consumers of the NWDAF 305 are Policy Control Function (PCF), Access and Mobility Management Function (AMF), Session Management Function (SMF), Network Exposure Function (NEF), and Location Management Function (LMF). In another embodiment, the consumers may be a client device operated by a network admin.
[0055] Further, the one or more anomalous events include unusual patterns of network usage and unexpected location changes. The unusual patterns of network usage refer to deviations from typical data consumption or network activity patterns. For example, unexpected data surge, unusual network traffic, and frequent and large data transfers. The unexpected location changes involve detecting deviations in the typical geographic locations where the UE 110 is used. The unexpected location changes include, but not limited to, sudden global movement, rapid location shifts, and unusual traffic patterns.

[0056] In an embodiment, the notification unit 240 provides insights into behaviour of the network 105 and performance of the one or more UEs 110. The notification unit 240 continuously analyzes key metrics, such as traffic patterns, latency, and bandwidth utilization, enabling proactive optimization of network performance. The notification unit 240 also monitors UEs performance, assessing data consumption and connection quality to identify potential issues that may affect user experience. When anomalies like sudden data surges or abnormal location tracking are detected, the notification unit 240 proactive communication fosters a better understanding between the network 105 and the users, facilitating data-driven decision-making. Ultimately, the notification unit 240 provides valuable insights that enhance overall network performance and user satisfaction.
[0057] FIG. 3 is an exemplary block diagram of an architecture 300 of the system 120 for identifying anomalies in events subscription service management, according to one or more embodiments of the present invention.
[0058] The architecture 300 includes a Network Data Analytics Function (NWDAF) 305, a Core NF (Network Function) 310, a Data Consumer 315, a Processing hub 320, a data preprocessing 325, a model training model 330, an anomaly detection model 335, an alerting and response 340, Graphical User Interface (GUI) 345, and the database 220.
[0059] The NWDAF 305 analyzes data across the network to derive insights and support decision-making. The NWDAF 305 provides real-time or near real-time data to enhance the performance and reliability of network services, focusing on the anomaly detection model 335 and performance optimization. The NWDAF 305 collects data from the core NF 310 and various data sources. The NWDAF 305 analyzes the data to derive analytics and insights. The NWDAF 305 transmits the insights to the processing hub 320 for further use in anomaly detection and other analytics tasks.
[0060] The core NF 310 acts as the central network function that interacts with all other components in the network 105. The core NF 310 serves as the primary interface for managing network resources and ensures seamless communication among various network elements. The core NF 310 receives data and requests from the NWDAF 305 and data consumers 315, processes the information, and transmits the relevant insights and commands to the processing hub 320.
[0061] The data consumer 315 represents entities or applications that utilize the data and insights generated by the network 105. The data consumer 315 may include applications, user interfaces 215, or other network functions that require access to analytics for operational purposes. The data consumer 315 receives insights from the processing hub 320. The data consumer 315 uses the data for decision-making, operational management, or enhancing user experience.
[0062] The processing hub 320 centralizes processing activities related to the data pre-processing 325, the model training 330, the anomaly detection model 335, and the alerting and response 340. The processing hub 320 integrates various modules to manage data flows and processes efficiently. The processing hub 320 receives real-time data from the NWDAF 305.
[0063] The data pre-processing 325 serves as a critical initial stage in the data analysis pipeline. The data preprocessing 325 ensures that the raw data collected from various sources is transformed into the format that may be effectively analyzed by subsequent components, particularly the model training 330 and the anomaly detection module 335. The data preprocessing 325 component enhances the quality of the data, minimizes noise, and prepares for the meaningful analysis.
[0064] The model training 330 is pivotal in developing and refining machine learning models that facilitate anomaly detection within the network. The model training 330 ensures that the models not only effectively identify anomalies but also adapt to new data patterns, thereby improving overall accuracy over time. The model training 330 receives preprocessed data from the data preprocessing 325 and trains the selected models on the pre-processed data 325. The model training 330 uses training techniques and optimizes hyperparameters to improve performance and also incorporates feedback from the anomaly detection 335 regarding detection outcomes.
[0065] The anomaly detection model 335 responsible for applying the trained machine learning models to real-time or near-real-time incoming data from the network. The anomaly detection model 335 primary goal is to identify any unusual patterns or behaviors that deviate from established norms, thereby detecting potential anomalies that may indicate issues within the network 105. The anomaly detection model 335 continuously receives streaming data from the network 105, which includes various metrics and parameters relevant to the UE 110 and network performance. The anomaly detection model 335 identifies anomalies by comparing real-time data against expected patterns and generates alerts based on the detected anomalies. Further transmits the alerts to the alerting and response 340 for further action
[0066] The alerting and response model 340 is responsible for handling alerts generated by the anomaly detection model 335. The alerting and response model 340 primary role is to initiate appropriate responses to the identified anomalies and communicate with relevant stakeholders or systems to ensure timely action is taken. The alerting and response model 340 receives alerts from the anomaly detection 335, ensuring that all detected anomalies are logged and processed. The alerting and response model 340 provides feedback to the anomaly detection 335 regarding the effectiveness of responses, which may inform future model training and detection processes.
[0067] The processing hub GUI 345 provides the graphical user interface for monitoring and interacting with the processing hub. The processing hub GUI 345 allows users to visualize data analytics, model performance, and detect anomalies. The processing hub GUI 345 displays real-time data and insights derived from the processing hub 320. Further, the processing hub GUI 345 enables user interaction for operational decision-making, such as, but not limited to, adjusting parameters, monitoring system performance, and responding to alerts.
The database serves as a vital repository for storing the data from the core NF 310 and the NWDAF 305 enabling effective data retrieval for the model training 330 in the processing hub 320. The database 220 facilitates anomaly detection by providing patterns of normal and abnormal behaviors for comparison with current data. Additionally, the database 220 enhances the alerting and response capabilities by supplying relevant context for generated alerts. The database 220 seamless integration with other components ensures efficient data flow and supports data-driven decision-making within the architecture 300. Overall, the database 220 plays the crucial role in improving the accuracy and responsiveness of the processing hub 320.
[0068] FIG. 4 is a signal flow diagram for identifying anomalies in events subscription service management, according to one or more embodiments of the present invention.
[0069] At step 405, the process initiates with the start node, marking the beginning of the anomaly detection workflow. The step prepare for the data collection.
[0070] At step 410, the first active step involves collecting data from the UE 110, which may include various metrics and usage patterns that are essential for analyzing network performance. The data collection is critical for understanding the behavior of users and identifying potential performance issues. Techniques for the collection of data may include, but not limited to, real-time monitoring and logging, ensuring that data is accurate and representative of current network conditions.
[0071] At step 415, the collected data is transmitted to the NWDAF 305. Here, the advanced algorithms may be applied to process the data, extracting meaningful insights and patterns. The phase involves identifying trends over time, detecting deviations from normal operation, and preparing the data for further analysis. The NWDAF 305 plays the crucial role in determining the overall health of the network 105 and predicting potential anomalies based on the historical and real-time data.
[0072] At step 420, furthermore, the processed data is then transmitted to the processing hub GUI 345, which serves as the graphical user interface for monitoring and managing the anomaly detection process. The processing hub GUI 345 enables users to monitor key performance indicators, view alerts, and access detailed reports on network performance. Users may interact with the processing hub GUI 345 to filter data, run queries, and analyze specific time frames or incidents, allowing for informed decision-making based on the visualized data.
[0073] At step 425, the final step, any anomalies identified during the analysis are communicated to the consumer. The notification process may take various forms, such as, but not limited to, alerts, dashboards, or reports, depending on user preferences. Providing timely and relevant information about detected anomalies allows users to take corrective actions, investigate underlying causes, and improve overall network performance and reliability.

[0074] FIG. 5 is a flow diagram of a method 500 identifying the anomalies in the events subscription service management, according to one or more embodiments of the present invention. For the purpose of description, the method 500 is described with the embodiments as illustrated in FIG. 2 and should nowhere be construed as limiting the scope of the present disclosure.
[0075] At step 505, the method 500 includes the step of receiving the data related to one or more UE 110. The data related to the one or more UEs 110 include network activity, mobility, and usage patterns of the one or more UEs 110.
[0076] At step 510, the method 500 includes the step of performing the one or more data handling processes such as cleaning, definition, sorting, and normalizing on the received data to ensure consistency and remove extraneous information. The providing analysis of subscription usage trends, resource allocation, and system policy optimization recommendations.
[0077] At step 515, the method 500 includes the step of executing the anomaly detection model on the data for determining the one or more anomalous events of the one or more UEs 110. The one or more anomalous events include unusual patterns of network usage and unexpected location changes.
[0078] At step 520, the method 500 includes the step of notifying the consumer about the one or more anomalous events of the one or more UEs 110 for providing insights into network behaviour and performance of the one or more UEs 110. The anomaly detection model is pre-trained on historical data for identification of patterns and connections between network load, user activity, and external and internal factors.
[0079] The present invention further discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by the processor 205. The processor 205 is configured to collect data related to one or more UE 110. The processor 205 is further configured to clean the data for removing extraneous information, sorting the data, and normalizing the data for ensuring consistency of the data. The processor 205 is further configured to execute the anomaly detection model on the data for determining one or more anomalous events of the one or more UEs 110. The processor 205 is further configured to notify the consumer about the one or more anomalous events of the one or more UEs 110. A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-5) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0080] The present disclosure includes technical advancements in network performance monitoring and anomaly detection. Enhanced algorithms within the NWDAF enable accurate identification of abnormal behaviors using historical and real-time data. Real-time monitoring techniques facilitate continuous data collection from user equipment, ensuring current information for accurate analysis. The user-friendly processing hub graphical user interface allows for effective visualization and interaction with network data, while an automated alerting mechanism ensures timely notifications of detected anomalies for prompt intervention. Additionally, the scalable architecture accommodates increasing data volumes and user equipment, maintaining robust performance as network demands grow.
[0081] The present invention offers multiple advantages that system enhances network stability by detecting and mitigating anomalies, leading to reduced downtime and fewer service disruptions. It optimizes resource allocation to lower operational costs and improve overall efficiency. With real-time monitoring and anomaly detection, the system bolsters network security by swiftly addressing potential threats. Users benefit from a consistent and reliable network experience with faster access to services, while the system's scalable and flexible architecture ensures it can adapt to evolving network demands and emerging technologies.
[0082] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS

[0083] Environment- 100
[0084] User Equipment (UE) - 110
[0085] Server - 115
[0086] Network - 105
[0087] System -120
[0088] Processor - 205
[0089] Memory - 210
[0090] User interface - 215
[0091] Database - 220
[0092] Transceiver unit - 225
[0093] Data Handling unit - 230
[0094] Execution unit - 235
[0095] Notification unit – 240
[0096] NWDAG - 305
[0097] Core Network Function (NF) - 310
[0098] Data Consumer 315
[0099] Processing hub 320
[00100] Data Preprocessing 325
[00101] Model training - 330
[00102] Anomaly detection model - 335
[00103] Alerting and response - 340
[00104] Processing hub Graphical User Interface (GUI) - 345

,CLAIMS:CLAIMS:
We Claim:

1. A method (500) of identifying anomalies in events subscription service management, the method (500) comprising:
receiving, by one or more processors (205), data related to one or more User Equipment (UE) (110);
performing, by one or more processor (205), one or more data handling processes such as cleaning, definition, sorting, and normalizing on the received data to ensure consistency and remove extraneous information;
executing, by the one or more processors (205), an anomaly detection model on the data for determining one or more anomalous events of the one or more UEs (110); and
notifying, by the one or more processor (205), a consumer about the one or more anomalous events of the one or more UEs (110) for providing insights into network behaviour and performance of the one or more UEs (110).

2. The method (500) as claimed in claim 1, wherein the data related to the one or more UEs (110) include network activity, mobility, and usage patterns of the one or more UEs (110).

3. The method (500) as claimed in claim 1, wherein the anomaly detection model is pre-trained on historical data to identify patterns and connections between network load, user activity, and both external and internal factors.

4. The method (500) as claimed in claim 1, wherein the one or more anomalous events include unusual patterns of network usage and unexpected location changes, and further comprise providing analysis of subscription usage trends, resource allocation, and system policy optimization recommendations.

5. A system (120) for identifying anomalies in events subscription service management, the system (120) comprising:
a transceiver unit (225), configured to, collect data related to one or more User Equipment (UE) (110);
a data handling unit (230), configure to perform, one or more data handling processes such as cleaning, definition, sorting, and normalizing on the received data to ensure consistency and remove extraneous information; an execution unit (235), configured to, execute an anomaly detection model on the data for determining one or more anomalous events of the one or more UEs (110); and
a notification unit (240), configured to, notify a consumer about the one or more anomalous events of the one or more UEs (110), thereby providing insights into network behaviour and performance of the one or more UEs (110).

6. The system (120) as claimed in claim 5, wherein the data related to the one or more UEs (110) includes network activity, mobility, and usage patterns of the one or more UEs (110).

7. The system (120) as claimed in claim 5, wherein the anomaly detection model is pre-trained on historical data for identification of patterns and connections between network load, user activity, and external and internal factors.

8. The system (120) as claimed in claim 5, wherein the one or more anomalous events include unusual patterns of network usage and unexpected location changes.

9. The system (120) as claimed in claim 5, wherein the system provides analysis of subscription usage trends, resource allocation, and system policy optimization recommendations.