DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
METHOD AND SYSTEM OF IDENTIFYING ONE OR MORE ABNORMALITIES IN A COMMUNICATION NETWORK
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to abnormalities detection in a communication network, more particularly relates to a method and a system of identifying one or more abnormalities in the communication network.
BACKGROUND OF THE INVENTION
[0002] Generally, telecom networks consist of numerous NFs (Network functions), each NF is responsible for specific tasks, procedures and call flows. The network operations teams or consumers may face various challenges during detection of the abnormal procedures and call flows for any network function.
[0003] Detecting abnormal procedures or call flows in real-time is essential for ensuring the network's reliability and performance. However, due to manual monitoring and identifying these anomalies/abnormalities across multiple NFs can be overwhelming and time-consuming task and often leads to delayed responses and service disruptions. Further, there could also be instances of false positives or false negatives detected during anomaly detection, thereby causing unnecessary alarms or overlooking actual issues. Therefore, the manual based detection of abnormalities significantly impacts network performance and customer experience.
[0004] In view of the above, there is a dire need for an efficient system and method for dynamically detecting abnormalities in the communication network.
SUMMARY OF THE INVENTION
[0005] One or more embodiments of the present disclosure provide a method and system of identifying one or more abnormalities in a communication network.
[0006] In one aspect of the present invention, the system of identifying one or more abnormalities in a communication network is disclosed. The system includes a receiving unit configured to receive data associated with one or more network functions from a probing unit. The system further includes an integrating unit configured to integrate the received data of the one or more network functions into a combined dataset. The system further includes an analyzing unit configured to analyze, the combined dataset utilizing a trained model to determine at least one of, one or more trends and patterns related to each of the one or more network functions. The system further includes a detection unit configured to detect, the one or more abnormalities in the one or more network functions in real time by monitoring at least one of, call flows and procedures corresponding to each of the one or more network functions utilizing the determined at least one of, the one or more trends and the patterns. The system further includes a transmitting unit configured to transmit alerts and notification along with a generated report to a User Equipment (UE) on detection of the one or more abnormalities in the one or more network functions.
[0007] In an embodiment, the data associated with the one or more network functions corresponds to at least call flow information, procedure logs, and network performance metrics.
[0008] In an embodiment, the integrating unit integrates the received data of the one or more network functions into the combined dataset, and further configured to pre-process, the combined dataset and store, the pre-processed combined dataset in a database.
[0009] In an embodiment, the detection unit detects the one or more abnormalities in the one or more network functions in real time, by identifying, a behavior of each of the one or more network functions. The detection unit is further configured to comparing, an identified behavior of each of the one or more network functions with the one or more identified trends and patterns and detecting, one or more deviations in the identified behavior based on the comparison.
[0010] In an embodiment, the alerts and notifications along with the generated report include at least one of information corresponding to the detected one or more abnormalities and resolution for the detected one or more abnormalities in the one or more network functions.
[0011] In an embodiment, a generation unit is configured to generate reports associated with the detected one or more abnormalities in the one or more network functions.
[0012] In another aspect of the present invention, the method of identifying one or more abnormalities in a communication network is disclosed. The method includes the step of receiving data associated with one or more network functions from a probing unit. The method further includes the step of integrating the received data of the one or more network functions into a combined dataset. The method further includes the step of analyzing the combined dataset utilizing a trained model to determine at least one of, one or more trends and patterns related to each of the one or more network functions. The method further includes the step of detecting the one or more abnormalities in the one or more network functions in real time by monitoring at least one of, call flows and procedures corresponding to each of the one or more network functions utilizing the determined at least one of, the one or more trends and the patterns. The method further includes the step of transmitting alerts and notification along with a generated report to a User Equipment (UE) on detection of the one or more abnormalities in the one or more network functions.
[0013] In another aspect of the invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions is disclosed. The computer-readable instructions are executed by a processor. The processor is configured to receive data associated with one or more network functions from a probing unit. The processor is configured to integrate the received data of the one or more network functions into a combined dataset. The processor is configured to analyze the combined dataset utilizing a trained model to determine at least one of, one or more trends and patterns related to each of the one or more network functions. The processor is configured to detect, the one or more abnormalities in the one or more network functions in real time by monitoring at least one of, call flows and procedures corresponding to each of the one or more network functions utilizing the determined at least one of, the one or more trends and the patterns. The processor is configured to transmit alerts and notification along with a generated report to a User Equipment (UE) on detection of the one or more abnormalities in the one or more network functions.
[0014] In another aspect of invention, User Equipment (UE) is disclosed. The UE includes one or more primary processors communicatively coupled to one or more processors, the one or more primary processors coupled with a memory. The processor causes the UE to receive alerts and notification along with a generated report on detection of the one or more abnormalities in the one or more network functions.
[0015] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.
BRIEF DESCRIPTION OF THE DRAWINGS
[0016] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0017] FIG. 1 is an exemplary block diagram of an environment of identifying one or more abnormalities in a communication network, according to one or more embodiments of the present invention;
[0018] FIG. 2 is an exemplary block diagram of a system of identifying the one or more abnormalities in the communication network, according to one or more embodiments of the present invention;
[0019] FIG. 3 is a schematic representation of a workflow of the system of FIG. 1, according to the one or more embodiments of the present invention;
[0020] FIG. 4 is an exemplary block diagram of an architecture implemented in the system of the FIG. 2, according to one or more embodiments of the present invention;
[0021] FIG. 5 is a signal flow diagram of identifying the one or more abnormalities in the communication network, according to one or more embodiments of the present invention; and
[0022] FIG. 6 is a schematic representation of a method of identifying the one or more abnormalities in the communication network, according to one or more embodiments of the present invention.
[0023] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0024] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0025] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0026] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0027] The present invention discloses detecting abnormal procedures and call flows. More particularly, the present invention provides a unique approach of dynamically/automatically detecting abnormal procedures and call flows in real-time in all network functions. An Artificial Intelligence/ Machine Learning (AI/ML) model performs abnormalities detection utilizing the historical data and learns patterns of the historical data. The AI/ML model ensures high accuracy in identifying abnormalities in the communication network and enables network operators or consumers to address issues before they impact network quality.
[0028] FIG. 1 illustrates an exemplary block diagram of an environment 100 of identifying one or more abnormalities in a communication network 106, according to one or more embodiments of the present disclosure. In this regard, the environment 100 includes a User Equipment (UE) 102, a server 104, the communication network 106 and a system 108 communicably coupled to each other of identifying the one or more abnormalities in the communication network 106.
[0029] In an embodiment, the abnormalities refer to deviations from expected or normal behavior within the communication network 106 that could impact the network’s performance, security, or functionality. The one or more abnormalities includes, but not limited to, performance degradation, call flow or procedure failures, anomalous traffic patterns, security breaches, configuration or protocol issues, resource overutilization. The one or more abnormalities in the communication network 106 are identified by monitoring network functions and comparing real-time behavior against predefined thresholds, historical data, or expected patterns. The network functions (224) refer to a functionality or task within the communication network 106 that contributes to the overall operation, management, and delivery of network services. The task refers to a unit of work or operation that needs to be executed to achieve a particular objective. The network function is at least one of Physical Network Functions (PNFs), Virtualized Network Functions (VNFs), Cloud-Native Network Functions (CNFs).
[0030] As per the illustrated embodiment and for the purpose of description and illustration, the UE 102 includes, but not limited to, a first UE 102a, a second UE 102b, and a third UE 102c, and should nowhere be construed as limiting the scope of the present disclosure. In alternate embodiments, the UE 102 may include a plurality of UEs as per the requirement. For ease of reference, each of the first UE 102a, the second UE 102b, and the third UE 102c, will hereinafter be collectively and individually referred to as the “User Equipment (UE) 102”.
[0031] In an embodiment, the UE 102 is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as a smartphone, virtual reality (VR) devices, augmented reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0032] The environment 100 includes the server 104 accessible via the communication network 106. The server 104 may include, by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, one or more processors executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0033] The communication network 106 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The communication network 106 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0034] The communication network 106 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth. The communication network 106 may also include, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, a VOIP or some combination thereof.
[0035] The environment 100 further includes the system 108 communicably coupled to the server 104 and the UE 102 via the communication network 106. The system 108 is configured to identify the one or more abnormalities in the communication network 106. As per one or more embodiments, the system 108 is adapted to be embedded within the server 104 or embedded as an individual entity.
[0036] Operational and construction features of the system 108 will be explained in detail with respect to the following figures.
[0037] FIG. 2 is an exemplary block diagram of the system 108 of identifying the one or more abnormalities in the communication network 106, according to one or more embodiments of the present invention.
[0038] As per the illustrated embodiment, the system 108 includes one or more processors 202, a memory 204, a user interface 206, and a database 208. In an embodiment, the system 108 includes a probing unit 222 and a one or more network functions 224 communicably coupled to each other.
[0039] For the purpose of description and explanation, the description will be explained with respect to one processor 202 and should nowhere be construed as limiting the scope of the present disclosure. In alternate embodiments, the system 108 may include more than one processor 202 as per the requirement of the communication network 106. The one or more processors 202, hereinafter referred to as the processor 202 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0040] As per the illustrated embodiment, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204. The memory 204 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to create or share data packets over a network service. The memory 204 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0041] In an embodiment, the user interface 206 includes a variety of interfaces, for example, interfaces for a graphical user interface, a web user interface, a Command Line Interface (CLI), and the like. The user interface 206 facilitates communication of the system 108. In one embodiment, the user interface 206 provides a communication pathway for one or more components of the system 108. Examples of such components include, but are not limited to, the UE 102 and the database 208.
[0042] The database 208 is one of, but not limited to, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of database 208 types are non-limiting and may not be mutually exclusive e.g., a database can be both commercial and cloud-based, or both relational and open-source, etc.
[0043] In order for the system 108 to identify the one or more abnormalities in the communication network 106, the processor 202 includes one or more modules. In one embodiment, the one or more modules includes, but not limited to, a receiving unit 210, an integrating unit 212, an analyzing unit 214, a detection unit 216, a generation unit 218, and a transmitting unit 220 communicably coupled to each other for identifying the one or more abnormalities in the communication network 106.
[0044] In one embodiment, each of the one or more modules, the receiving unit 210, the integrating unit 212, the analyzing unit 214, the detection unit 216, the generation unit 218, and the transmitting unit 220 can be used in combination or interchangeably for identifying the one or more abnormalities in the communication network 106.
[0045] The receiving unit 210, the integrating unit 212, the analyzing unit 214, the detection unit 216, the generation unit 218, and the transmitting unit 220 in an embodiment, may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 202. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 202 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 204 may store instructions that, when executed by the processing resource, implement the processor. In such examples, the system 108 may comprise the memory 204 storing the instructions and the processing resource to execute the instructions, or the memory 204 may be separate but accessible to the system 108 and the processing resource. In other examples, the processor 202 may be implemented by electronic circuitry.
[0046] In one embodiment, the receiving unit 210 is configured to receive data associated with one or more network functions 224 from a probing unit 222. The one or more network function 224 refers to roles or operations carried out by components within the communication network 106 that contribute to its overall functioning. The one or more network functions 224 can perform essential tasks such as call processing, mobility management, data routing, session management, and network performance monitoring. The one or more network functions 224 include, but not limited to, Call Session Control Functions (CSCF), Session Management Function (SMF), Access and Mobility Management Function (AMF), User Plane Function (UPF).
[0047] The data refers to raw facts, figures, or information that can be collected, measured, analyzed, and used to make decisions or derive insights. The data associated with the one or more network functions 224 corresponds to at least call flow information, procedure logs, and network performance metrics. The call flow information refers to data that tracks the path of a call, including initiation, connection, and termination. The procedure logs refer to the logs that record the actions and procedures carried out by network devices. The network devices are components that are used to connect, manage, and facilitate communication between devices within the communication network 106. The network device is at least one of, router, switch, modem, firewall, hub. The procedure logs can be used for troubleshooting, monitoring performance, or identifying faults. The network performance metrics refers to quantitative measures that assess the health and performance of the communication network 106, such as latency, packet loss, throughput, and jitter. The network performance metrics help in detecting network issues and ensure quality of service (QoS). The probing unit 222 is a component in the communication network 106 designed to monitor, capture, and collect data from various parts of the communication network 106.
[0048] Upon receiving the data associated with the one or more network functions 224, the integrating unit 212 is configured to integrate the received data of the one or more network functions 224 into a combined dataset. The dataset is a collection of related data organized in a structured format, designed for purposes such as analysis, reporting, or research. The combined dataset refers to a unified collection of data that integrates information from the one or more network functions 224 into a single, coherent dataset. The combined dataset includes data collected from one or more network functions 224. The combined dataset includes, but is not limited to, call flow information, procedure logs, performance metrics, and other relevant data. The combined dataset is structured in a way that aligns data from the one or more network functions 224, making it consistent and suitable for analysis. The combining of the dataset involves standardizing formats, aligning timestamps, and correlating data points. The standardizing formats ensure that data from one or more network functions 224 is in consistent format making it easier to compare and analyze. The aligning timestamps synchronizes data from one or more network functions 224 to ensure that all data points correspond to the same time or time period. The correlating data points links data points from different sources based on common identifiers or attributes, allowing for meaningful integration and analysis. The identifiers are unique values or codes assigned to entities or objects within the dataset. The identifiers include, but are not limited to, session identifiers (ID), user ID, device ID, transaction ID. The attributes include, but are not limited to, timestamp, status, performance metrics, event type. Upon integrating the received data of the one or more network functions 224 into the combined dataset, the integrating unit 212 further configured to pre-process the combined dataset. The pre-processing of the combined dataset includes, but not limited to, data cleaning, normalization, and feature extraction. The data cleaning removes any invalid or inconsistent entries, ensuring data quality. The normalization standardizes the data, making it suitable for analysis and modeling. The feature extraction identifies relevant attributes or features within the data that will be used for analysis. Upon pre-processing the combined dataset, the integrating unit stores the pre-processed combined dataset in the database 208.
[0049] Upon integrating the received dataset into the combined dataset, the analyzing unit 214 is configured to analyze the combined dataset. The combined dataset is analyzed by utilizing a trained model to determine at least one of, one or more trends and patterns related to each of the one or more network functions 224. The trained model is at least one of Artificial Intelligence /Machine Learning (AI/ML) model. The AI/ML model is trained using historical data to identify the trends and patterns related to each of the one or more network functions 224. The historical data related to each of the network functions 224 refers to previously collected and stored information about the operations, performance, and behaviors of each of the network functions 224 over a period of time. The historical data includes, but is not limited to network performance metrics, resources utilization, faults and failures, traffic patterns. The network performance metrics include, but are not limited to, data about latency, throughput, jitter, bandwidth usage, and packet loss for each network function over time. The resource utilization includes, but not limited to, historical record of Central Processing Unit (CPU), memory, storage usage for virtual or physical network functions. The faults and failures include, but are not limited to, logs of outages, crashes, errors, or malfunctions related to the one or more network functions 224. The traffic patterns include information about data flows, traffic volumes, and routing decisions made by each network function 224 at different times or under varying conditions. The trends refer to long-term changes or developments observed in the data over time (e.g., increasing latency trends). The patterns are regular, repeated occurrences observed in the performance of the one or more network functions 224 (e.g., peak usage times or common failure patterns).
[0050] Upon analyzing the combined dataset, the detection unit 216 is configured to detect the one or more abnormalities in the one or more network functions 224 in real-time. The one or more abnormalities are detected in the one or more network functions 224 in real-time by monitoring at least one of, call flows and procedures corresponding to each of the one or more network functions 224. The call flows are sequences of messages or communications between the one or more network functions 224 involved in setting up, maintaining, and terminating calls or data sessions. The procedures are standardized operations or steps that the one or more network functions 224 follow to execute tasks, such as handovers, resource allocation, or session management. The at least one of call flows and procedures are monitored by utilizing the determined at least one of, the one or more trends and the patterns. The one or more trends and patterns are determined by analyzing the historical data to understand the normal behavior of the one or more network functions 224. The trends and patterns define what is considered normal or expected behavior for the network functions, such as typical call setup sequences, timing characteristics, or the number of signaling messages. The trends and patterns derived from analysis serve as baselines that describe expected behaviors. The baselines include statistical parameters like average values, ranges, typical call flow sequences, or other metrics that characterize the performance of network functions under normal conditions. The detection unit 216 uses the established baselined to monitor call flows and procedures of the one or more network functions 224 in real time.
[0051] The detection unit 216 detects the one or more abnormalities in the one or more network functions 224 in real time by identifying the behavior of each of the one or more network functions 224. The behavior refers to the operational characteristics or the manner in which each network function 224 performs its tasks or handles its processes during normal and abnormal conditions. The normal conditions represent the expected and typical state of operations where the network functions behave as designed. The normal condition includes, but not limited to, expected traffic levels, standard resources utilization, proper procedure execution, minimal error rates, stable performance metrics. The abnormal conditions occur when the one or more network functions 224 deviate from expected behavior either due to internal issues, external factors or unexpected changes in the environment. The abnormal conditions include, but are not limited to, traffic spikes or congestion, resources over-utilization, failure to execute procedures correctly, high error rates or packet loss, security breaches or attacks. Upon identifying the behavior, the detection unit 216 is configured to compare an identified behavior of each of the one or more network functions 224 with one or more identified trends and patterns. Upon comparing the identified behavior, the detection unit 216 is configured to detect one or more deviations in the identified behavior based on the comparison. The one or more deviations refers to the abnormalities or issues in the network 106. The one or more deviations includes, but are not limited to, call flow deviations, performance metric deviations, procedure log deviations, load and traffic deviations, behavioral anomalies, failure patterns.
[0052] Upon detecting the one or more abnormalities, the generation unit 218 is configured to generate reports associated with the detected one or more abnormalities in the one or more network functions. The report includes, but is not limited to, a description of the abnormality, timestamp, affected network functions, severity level, trends and patterns comparison. The description of the abnormality includes detailed information about what was detected, such as the type of issue (e.g., traffic spike, performance degradation) and which network function was affected. The timestamp refers to the exact time when the abnormality was detected, which is important for correlating events and understanding when the problem occurred. The affected network functions refer to the identification of the one or more network functions 224 that experienced the abnormality, such as the radio resource management function, packet core function, etc. The severity level refers to an indication of how critical the abnormality is ranging from minor performance deviations to severe issues affecting network reliability. The trends and patterns comparison refers to the comparison of the real-time behavior with the expected trends and patterns, showing how the current behavior deviated from normal.
[0053] Upon generating the report associated with the detected one or more abnormalities in the one or more network functions, the transmitting unit 220 is configured to transmit alerts and notification along with a generated report to the UE 102. The alert is a high-priority message intended to prompt immediate action. The alert indicates a critical problem that requires urgent attention, such as a significant deviation from expected network behavior or an impending failure. For example, if the system 108 detects a sudden drop in call success rates that indicates a malfunction in a core network element, the alert is generated and sent to the network operations team. The alert might say: "Critical Alert: Call success rate dropped by 50% on Network Function A. Immediate action required”. The notification is a message that provides information about network events but may not require immediate action. The notifications are typically less urgent compared to alerts and are used to keep operators informed of system status or changes. For example, if the system 108 completes a scheduled maintenance process on a network function without any issues, a notification might be sent to the operators. The notification might say: “Notification: Scheduled maintenance on Network Function B completed successfully at 2:00 AM”. The alerts and notification can be delivered in various formats, such as emails, SMS, push messages to a mobile app, or a web dashboard, depending on the network management system's configuration. The alerts and notifications along with the generated report include at least one of information corresponding to the detected one or more abnormalities and resolution for the detected one or more abnormalities in the one or more network functions 224.
[0054] Therefore, the system 108 enables the proactive detection of abnormal procedures and call flows, allowing service providers to resolve issues before they impact network quality. The system 108 is capable of detecting abnormalities in real-time by continuously monitoring network function data such as call flows, procedures, and performance metrics. The system 108 reduces the time to detect, diagnose, and resolve network issues, leading to improved service reliability, reduced downtime, and optimized resource allocation.
[0055] FIG. 3 describes a preferred embodiment of the system 108 of FIG. 2, according to various embodiments of the present invention. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the first UE 102a and the system 108 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0056] As mentioned earlier in FIG. 1, each of the first UE 102a, the second UE 102b, and the third UE 102c may include an external storage device, a bus, a main memory, a read-only memory, a mass storage device, communication port(s), and a processor. The exemplary embodiment as illustrated in FIG. 3 will be explained with respect to the first UE 102a without deviating from the scope of the present disclosure and the limiting the scope of the present disclosure. The first UE 102a includes one or more primary processors 302 communicably coupled to the one or more processors 202 of the system 108.
[0057] The one or more primary processors 302 are coupled with a memory 304 storing instructions which are executed by the one or more primary processors 302. Execution of the stored instructions by the one or more primary processors 302 enables the first UE 102a to receive, the alerts and the notification along with the generated report on detection of the one or more abnormalities in the one or more network functions.
[0058] As mentioned earlier in FIG. 2, the one or more processors 202 of the system 108 is configured to identify the one or more abnormalities in the communication network 106. As per the illustrated embodiment, the system 108 includes the one or more processors 202, the memory 204, the user interface 206, and the database 208. In an embodiment, the system 108 includes the probing unit 222 and the one or more network functions 224 communicably coupled to each other. The operations and functions of the one or more processors 202, the memory 204, the user interface 206, the database 208, the probing unit 222 and the one or more network functions 224 are already explained in FIG. 2. For the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition.
[0059] Further, the processor 202 includes the receiving unit 210, the integrating unit 212, the analyzing unit 214, the detection unit 216, the generation unit 218, and the transmitting unit 220. The operations and functions of the receiving unit 210, the integrating unit 212, the analyzing unit 214, the detection unit 216, the generation unit 218, and the transmitting unit 220 are already explained in FIG. 2. Hence, for the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition. The limited description provided for the system 108 in FIG. 3, should be read with the description as provided for the system 108 in the FIG. 2 above, and should not be construed as limiting the scope of the present disclosure.
[0060] FIG. 4 is an exemplary block diagram of an architecture 400 of the system 108 for identifying the one or more abnormalities in the communication network 106, according to one or more embodiments of the present invention.
[0061] The architecture 400 includes the probing unit 222, a processing hub 402 and the user interface 206. The processing hub 402 includes a data collection unit 404, a data integration unit 406, a data pre-processing unit 408, a model training unit 410, and a real-time monitoring unit 412 communicably coupled to each other. The processing hub 402 includes a data lake 414 communicably coupled to model training unit 410.
[0062] The probing unit 222 collects real-time data from the one or more network functions 224 such as call flows, procedure logs and performance metrics. Thereafter the probing unit 222 transmits the collected data from the one or more network functions 224 to the data collection unit 404. The probing unit 222 transmits the collected data to the data collection unit 404 via a processing hub- probing unit interface.
[0063] Upon receiving the data associated with the one or more network functions 224 from the probing unit 222, the data collection unit 404 transmits the received data to the data integration unit 406. Upon receiving the data from the data collection unit 404, the data integration unit 406 integrates the received data of the one or more network functions 224 into the combined dataset.
[0064] Upon integrating the pre-processed data, the data is transmitted to the data preprocessing unit 408. The data pre-processing unit 408 pre-processes the received data. The pre-processing of the received data includes, but not limited to, data cleaning, data normalization and transformation. The data cleaning removes any inconsistencies, errors, or irrelevant data. The data normalization scales the data to a common range or format. The transformation is performed on the data if required. The data preprocessing unit 408 prepares the data for model training, which helps in detecting patterns and trends in the one or more network functions 224.
[0065] Subsequently, the pre-processed data is transmitted to the model training unit 410. The model training unit 410 is responsible for training AI/ML models using the preprocessed data. The AI/ML model is trained utilizing historical data corresponding to the one or more network functions 224 to determine at least one of, one or more trends and patterns related to each of the one or more network functions 224. Further, the model training unit 410 monitors training status, evaluates model output, generates inferences, and handles model retraining if required. In an embodiment, the pre-processed data and the model output are stored in the data lake 414.
[0066] Upon analyzing the data, the prediction made by the AI/ML model is transmitted to the real-time monitoring unit 412. Upon receiving the predictions made by the AI/ML model the real-time monitoring unit 412 detects the one or more abnormalities in the one or more network functions 224. The real-time monitoring unit 412 monitors the at least one of the call flows and procedures corresponding to each of the one or more network functions 224. If any abnormalities are present in the one or more network functions, the real-time monitoring unit 412 generates the report and transmits the alerts and notification to the user interface 206. The alerts and notifications along with the generated report include at least one of information corresponding to the detected one or more abnormalities and resolution for the detected one or more abnormalities in the one or more network functions 224. Upon receiving the alerts notifications along with the generated reports, the user interface can take proactive measures in order to prevent any service disruptions.
[0067] FIG. 5 is a signal flow diagram for identifying the one or more abnormalities in the communication network 106, according to one or more embodiments of the present invention.
[0068] At step 502, the data collection unit 404 collects the data from the one or more network functions 224 via the processing hub- probing unit interface. The data associated with the one or more network functions 224 corresponds to at least the call flow information, the procedure logs, and the network performance metrics. The data collection is continuous and captures real-time activities and transactions across the communication network 106.
[0069] At step 504, upon collecting the data, the data integrating unit 406 integrates the received data into the combined dataset. The integration of the received data ensures that the data from one or more network functions 224, which consist of varying formats and structures can be analyzed together.
[0070] At step 506, upon integrating the received data, the data pre-processing unit 408 pre-processes the received data. The pre-processing of the received data includes data cleaning, normalization and feature extraction. For instance, the data preprocessing unit 408 removes the null value, duplicate data or irrelevant data from the received data from the one or more network functions 224.
[0071] At step 508, upon preprocessing the received data, the model training unit 410 trains the AI/ML model by utilizing the historical data related to the one or more network functions 224 to determine the trends and patterns related to each of the one or more network functions 224.
[0072] At step 510, based on determining the trends and patterns related to each of the one or more network functions 224 by the model training unit 410, the real time monitoring unit 412, monitors the call flows and procedures in the one or more network functions 224 in real- time to detect the one or more abnormalities.
[0073] At step 512, if the one or more abnormalities are detected, the real-time monitoring unit 412 generates the report and transmits the alert and notification to the user interface 206. The alerts and notifications along with the generated report include at least one of information corresponding to the detected one or more abnormalities and resolution for the detected one or more abnormalities in the one or more network functions 224. The user interface 206 can take proactive measures in order to prevent any service disruptions. Alternatively, if the one or more abnormalities are not detected, the AI/ML model will be transmitted to the model training unit 410 for retraining the model.
[0074] FIG. 6 is a flow diagram of a method 600 for identifying the one or more abnormalities in the communication network 106, according to one or more embodiments of the present invention. For the purpose of description, the method 600 is described with the embodiments as illustrated in FIG. 2 and should nowhere be construed as limiting the scope of the present disclosure.
[0075] At step 602, the method 600 includes the step of receiving the data associated with the one or more network functions 224 from the probing unit 222 by the receiving unit 210. The data associated with the one or more network functions 224 corresponds to at least call flow information, procedure logs, and network performance metrics.
[0076] At step 604, the method 600 includes the step of integrating the received data of the one or more network functions 224 into the combined dataset by the integrating unit 212. The integrating unit 212 integrates the received data of the one or more network functions 224 into combined dataset by pre-processing the combined dataset and storing the preprocessed combined dataset in the database 208.
[0077] At step 606, the method 600 includes the step of analyzing, the combined dataset utilizing the trained model to determine at least one of, one or more trends and patterns related to each of the one or more network functions 224 by the analyzing unit 214.
[0078] At step 608, the method 600 includes the step of detecting the one or more abnormalities in the one or more network functions 224 in real time by the detection unit 216. The one or more abnormalities is detected in the one or more network functions 224 by monitoring at least one of, call flows and procedures corresponding to each of the one or more network functions 224 utilizing the determined at least one of, the one or more trends and the patterns. The one or more abnormalities in the one or more network functions 224 in real-time is detected by identifying the behavior of each of the one or more network functions 224. Upon identifying the behavior of each of the one or more network functions 224, the identified behavior of each of the one or more network functions 224 is compared with the one or more identified trends and patterns. Thereafter, the one or more deviations in the identified behavior are detected based on the comparison. Upon detecting the one or more abnormalities in the one or more network functions 224 in real time, the generation unit 218 is configured to generate reports associated with the detected one or more abnormalities in the one or more network functions 224.
[0079] At step 610, the method 600 includes the step of transmitting the alerts and notification along with a generated report to the UE 102 on detection of the one or more abnormalities in the one or more network functions 224 by the transmitting unit 220. The alerts and notifications along with the generated report include at least one of information corresponding to the detected one or more abnormalities and resolution for the detected one or more abnormalities in the one or more network functions 224.
[0080] The present invention further discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by the processor 202. The processor 202 is configured to receive the data associated with the one or more network functions 224 from the probing unit 222. The processor 202 is further configured to integrate the received data of the one or more network functions 224 into the combined dataset. The processor 202 is further configured to analyze the combined dataset utilizing the trained model to determine at least one of, the one or more trends and patterns related to each of the one or more network functions 224. The processor 202 is further configured to detect, the one or more abnormalities in the one or more network functions 224 in real time by monitoring the at least one of, call flows and procedures corresponding to each of the one or more network functions 224 utilizing the determined at least one of, the one or more trends and the patterns. The processor 202 is further configured to transmit the alerts and notification along with the generated report to the UE 102 on detection of the one or more abnormalities in the one or more network functions 224.
[0081] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-6) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0082] The present disclosure incorporates technical advancement of enabling network operators to proactively perform issues resolution before they impact network quality. The rapid response to anomalies by the present invention reduces network down time and improves customer satisfaction. The present invention can scale to accommodate the complexity and size of modern telecom networks. The present invention provides improvement in network reliability and performance through the early detection of network abnormalities. Further, the present invention provides better integration of network data, and more informed decision-making facilitated by the generated reports and alerts.
[0083] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.
REFERENCE NUMERALS

[0084] Environment- 100
[0085] User Equipment (UE)- 102
[0086] Server- 104
[0087] Network- 106
[0088] System -108
[0089] Processor- 202
[0090] Memory- 204
[0091] User Interface- 206
[0092] Database- 208
[0093] Receiving Unit- 210
[0094] Integrating Unit- 212
[0095] Analysing unit- 214
[0096] Detection Unit- 216
[0097] Generation Unit- 218
[0098] Transmitting Unit- 220
[0099] Probing unit- 222
[00100] One or more network functions -224
[00101] One or more primary processor- 302
[00102] Memory- 304
[00103] Processing hub - 402
[00104] Data collection unit- 404
[00105] Data integration unit- 406
[00106] Data pre-processing unit- 408
[00107] Model training unit - 410
[00108] Real-time monitoring unit- 412
[00109] Data lake- 414
,CLAIMS:CLAIMS:
We Claim:
1. A method (600) of identifying one or more abnormalities in a communication network (106), the method (600) comprising the steps of:
receiving, by one or more processors (202), data associated with one or more network functions (224) from a probing unit (222);
integrating, by the one or more processors (202), the received data of the one or more network functions (224) into a combined dataset;
analysing, by the one or more processors (202), the combined dataset utilizing a trained model to determine at least one of, one or more trends and patterns related to each of the one or more network functions (224);
detecting, by the one or more processors (202), the one or more abnormalities in the one or more network functions (224) in real time by monitoring at least one of, call flows and procedures corresponding to each of the one or more network functions (224) utilizing the determined at least one of, the one or more trends and the patterns; and
transmitting, by the one or more processors (202), alerts and notification along with a generated report to a User Equipment (UE) (102) on detection of the one or more abnormalities in the one or more network functions (224).

2. The method (600) as claimed in claim 1, wherein the data associated with the one or more network functions (224) corresponds to at least call flow information, procedure logs, and network performance metrics.

3. The method (600) as claimed in claim 1, wherein the step of integrating the received data of the one or more network functions (224) into the combined dataset, further comprises the steps of:
pre-processing, by the one or more processors (202), the combined dataset; and
storing, by the one or more processors (202), the pre-processed combined dataset in a database (208).

4. The method (600) as claimed in claim 1, wherein the step of detecting, the one or more abnormalities in the one or more network functions (224) in real time, comprises the steps of:
identifying, by the one or more processors (202), a behaviour of each of the one or more network functions (224);
comparing, by the one or more processors (202), an identified behaviour of each of the one or more network functions (224) with the one or more identified trends and patterns; and
detecting, by the one or more processors (202), one or more deviations in the identified behaviour based on the comparison,

5. The method (600) as claimed in claim 1, wherein the alerts and notifications along with the generated report include at least one of information corresponding to the detected one or more abnormalities and resolution for the detected one or more abnormalities in the one or more network functions (224).

6. The method (600) as claimed in claim 1, wherein the one or more processors (202) generates report associated with the detected one or more abnormalities in the one or more network functions (224).

7. A system (108) of identifying one or more abnormalities in a communication network (106), the system (108) comprising:
a receiving unit (210) configured to receive, data associated with one or more network functions (224) from a probing unit (222);
an integrating unit (212) configured to integrate, the received data of the one or more network functions (224) into a combined dataset;
an analysing unit (214) configured to analyse, the combined dataset utilizing a trained model to determine at least one of, one or more trends and patterns related to each of the one or more network functions (224);
a detection unit (216) configured to detect, the one or more abnormalities in the one or more network functions (224) in real time by monitoring at least one of, call flows and procedures corresponding to each of the one or more network functions (224) utilizing the determined at least one of, the one or more trends and the patterns; and
a transmitting unit (220) configured to transmit, alerts and notification along with a generated report to a User Equipment (UE) (102) on detection of the one or more abnormalities in the one or more network functions (224).

8. The system (108) as claimed in claim 7, wherein the data associated with the one or more network functions (224) corresponds to at least call flow information, procedure logs, and network performance metrics.

9. The system (108) as claimed in claim 7, wherein the integrating unit (212) integrates the received data of the one or more network functions (224) into the combined dataset, and further configured to:
pre-process, the combined dataset; and
store, the pre-processed combined dataset in a database.

10. The system (108) as claimed in claim 7, wherein the detection unit (216) detects the one or more abnormalities in the one or more network functions (224) in real time, by:
identifying, a behaviour of each of the one or more network functions (224);
comparing, an identified behaviour of each of the one or more network functions (224) with the one or more identified trends and patterns; and
detecting, one or more deviations in the identified behaviour based on the comparison.

11. The system (108) as claimed in claim 7, wherein the alerts and notifications along with the generated report include at least one of information corresponding to the detected one or more abnormalities and resolution for the detected one or more abnormalities in the one or more network functions (224).

12. The system (108) as claimed in claim 7, wherein a generation unit (218) is configured to generate report associated with the detected one or more abnormalities in the one or more network functions (224).

13. A User Equipment (UE) (102), comprising:
one or more primary processors (302) communicatively coupled to one or more processors (202), the one or more primary processors (302) coupled with a memory (304), wherein said memory (304) stores instructions which when executed by the one or more primary processors causes the UE (102) to:
receive, alerts and notification along with a generated report on detection of the one or more abnormalities in the one or more network functions (224);
wherein the one or more processors (202) is configured to perform the steps as claimed in claim 1.