DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
SYSTEM AND METHOD FOR PROCESSING ALARM DATA
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to the field of wireless communication systems, more particularly relates to a method and a system for processing alarm data.
BACKGROUND OF THE INVENTION
[0002] In general, the communication network is monitored by monitoring all the core networking components such as, routers, switches, firewalls, servers, and Virtual Machines (VMs). The intent of monitoring these networking components is to detect faults or anomaly, if any. Anomaly detection is the identification of rare events, items, or observations which are suspicious because they differ significantly from standard behaviors or patterns.
[0003] Generally, consumers may face difficulty in detecting and managing alarms comprehensively across various network components as the anomalies and network issues were often identified manually. Due to which, there may be possibilities of some critical alarms going unnoticed. Further, due to absence of predictive analysis makes it difficult to anticipate and address potential issues in advance.
[0004] In view of the above, there is a dire need for a system and a method for centralized alarm detection and time-based analysis, which ensures enhanced network management by ensuring efficiency, reliability, and security
SUMMARY OF THE INVENTION
[0005] One or more embodiments of the present disclosure provides a method and a system for processing alarm data.
[0006] In one aspect of the present invention, the method for processing alarm data is disclosed. The method includes the step of retrieving, by the one or more processors, historic alarm data from one or more data sources. The method further includes the step of analysing, by the one or more processors, using an Artificial Intelligence/Machine Learning (AI/ML) model at least one of, patterns, trends and behaviour of one or more anomalies based on the retrieved historic alarm data. The method further includes the step of receiving, by the one or more processors, real time alarm data from the one or more data sources. The method further includes the step of categorizing, by the one or more processors, one or more alarms based on the received real time alarm data using at least one of, the AI/ML model. The method further includes the step of predicting, by the one or more processors, using the AI/ML model, one or more future alarms representing the one or more anomalies based on the categorization of the one or more alarms.
[0007] In yet another embodiment, the analysis is at least one of, a time series analysis or a statistical analysis performed by the one or more processors using the AI/ML model to identify at least one of, the patterns, the trends and the behaviour.
[0008] In yet another embodiment, the one or more alarms are categorized into severity levels based on one or more parameters.
[0009] In yet another embodiment, the one or more parameters include at least one of, type of alarms and impact on services.
[0010] In yet another embodiment, the step of, categorizing, one or more alarms further includes the step of transmitting, by the one or more processors, alerts/notifications to a user when the one or more alarms are categorized as critical.
[0011] In yet another embodiment, the method further comprising the step of refining, by the one or more processors, the AI/ML model with newly learnt at least one of, the patterns, trends and behaviour of the one or more anomalies based on recently analysed historic alarm data, wherein the AI/ML model is refined with at least one of, the patterns, trends and behaviour and corresponding actions taken.
[0012] In yet another embodiment, the method further comprising the step of storing, by the one or more processors, the analysed data in a centralized data storage unit.
[0013] In another aspect of the present invention, the system for processing alarm data is disclosed. The system includes a retrieving unit, configured to, retrieve, historic alarm data from one or more data sources. The system further includes an analysis engine, configured to, analyse, using an Artificial Intelligence/Machine Learning (AI/ML) model at least one of, patterns, trends and behaviour of one or more anomalies based on the retrieved historic alarm data. The system further includes a transceiver, configured to, receive, real time alarm data from the one or more data sources. The system further includes a categorizing unit, configured to, categorize, one or more alarms based on the received real time alarm data using at least one of, the AI/ML model. The system further includes a predicting engine, configured to, predict, using the AI/ML model, one or more future alarms representing the one or more anomalies based on the categorization of the one or more alarms.
[0014] In yet another aspect of the present invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by a processor. The processor is configured to retrieve, historic alarm data from one or more data sources. The processor is further configured to analyse, using an Artificial Intelligence/Machine Learning (AI/ML) model at least one of, patterns, trends and behaviour of one or more anomalies based on the retrieved historic alarm data. The processor is further configured to receive, real time alarm data from the one or more data sources. The processor is further configured to categorize, one or more alarms based on the received real time alarm data using at least one of, the AI/ML model. The processor is further configured to predict, using the AI/ML model, one or more future alarms representing the one or more anomalies.
[0015] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.
BRIEF DESCRIPTION OF THE DRAWINGS
[0016] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0017] FIG. 1 is an exemplary block diagram of an environment for processing alarm data, according to one or more embodiments of the present invention;
[0018] FIG. 2 is an exemplary block diagram of a system for processing the alarm data, according to one or more embodiments of the present invention;
[0019] FIG. 3 is an exemplary architecture of the system of FIG. 2, according to one or more embodiments of the present invention;
[0020] FIG. 4 is an exemplary architecture for processing the alarm data, according to one or more embodiments of the present disclosure;
[0021] FIG. 5 is an exemplary signal flow diagram illustrating the flow for processing the alarm data, according to one or more embodiments of the present disclosure; and
[0022] FIG. 6 is a flow diagram of a method for processing the alarm data, according to one or more embodiments of the present invention.
[0023] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0024] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0025] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0026] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0027] Various embodiments of the present invention provide a system and a method for processing alarm data. The disclosed system and method aim at enhancing network management. In other words, the present invention provides a unique approach of providing a centralized platform which integrates the alarm data and Artificial Intelligence/Machine Learning (AI/ML) capabilities. The present invention detects and manage alarms from various network components, performs real-time alarm detection, time-based analysis, historical analysis, predictive analytics to anticipate network trends and potential issues. Advantageously, by including a centralized platform for integrating the alarm data and managing alarms from various network components, the time taken for the same is reduced substantially and also since all the relevant data is observed on a single interface such as a dashboard, enhances the user experience and also provides a centralized control system operated by the user.
[0028] Referring to FIG. 1, FIG. 1 illustrates an exemplary block diagram of an environment 100 for processing alarm data according to one or more embodiments of the present invention. The environment 100 includes a User Equipment (UE) 102, a server 104, a network 106, a system 108, and one or more data sources 110. Herein, processing alarm data pertains to anlaysing historical alarm data and real time alarm data, categorizing one or more alarms and predicting one or more future alarms representing the one or more anomalies. In one embodiment, system 108 predicts one or more future alarms related to one or more issues that may occur in the future within the network 106.
[0029] For the purpose of description and explanation, the description will be explained with respect to one or more user equipment’s (UEs) 102, or to be more specific will be explained with respect to a first UE 102a, a second UE 102b, and a third UE 102c, and should nowhere be construed as limiting the scope of the present disclosure. Each of the at least one UE 102 namely the first UE 102a, the second UE 102b, and the third UE 102c is configured to connect to the server 104 via the network 106.
[0030] In an embodiment, each of the first UE 102a, the second UE 102b, and the third UE 102c is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as smartphones, Virtual Reality (VR) devices, Augmented Reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0031] The network 106 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 106 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0032] The network 106 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth.
[0033] The environment 100 includes the server 104 accessible via the network 106. The server 104 may include by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, a processor executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0034] The environment 100 further includes the one or more data sources 110. In one embodiment, the one or more data sources 110 are origins from which the data is collected and utilized for at least one of, but not limited to, analysis, research, and decision-making. In one embodiment, the one or more data sources 110 is at least one of, but not limited to, server 104, applications, sensors, one or more databases, network functions, network elements, network devices such as routers and switches. In particular, the one or more data sources 110 is associated with the sources included within the network 106 and outside the network 106.
[0035] The environment 100 further includes the system 108 communicably coupled to the server 104, the UE 102, and the one or more data sources 110 via the network 106. The system 108 is adapted to be embedded within the server 104 or is embedded as the individual entity.
[0036] Operational and construction features of the system 108 will be explained in detail with respect to the following figures.
[0037] FIG. 2 is an exemplary block diagram of the system 108 for processing the alarm data, according to one or more embodiments of the present invention.
[0038] As per the illustrated and preferred embodiment, the system 108 for processing the alarm data, includes one or more processors 202, a memory 204, a centralized data storage unit 206 and an Artificial Intelligence/Machine Learning (AI/ML) model 220. The one or more processors 202, hereinafter referred to as the processor 202, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions. However, it is to be noted that the system 108 may include multiple processors as per the requirement and without deviating from the scope of the present disclosure. Among other capabilities, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204.
[0039] As per the illustrated embodiment, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204 as the memory 204 is communicably connected to the processor 202. The memory 204 is configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed for processing the alarm data. The memory 204 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0040] The system 108 further includes the centralized data storage unit 206. As per the illustrated embodiment, the centralized data storage unit 206 is configured to store data retrieved from the one or more data sources 110. More particularly, the historic alarm data retrieved from the one or more data sources 110 is stored in the centralized data storage unit 206. In another embodiment, the data retrieved from the one or more data sources 110 includes at least one of, but not limited to alarm data and counter data. The centralized data storage unit 206 is one of, but not limited to, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of the centralized data storage unit 206 types are non-limiting and may not be mutually exclusive e.g., the database can be both commercial and cloud-based, or both relational and open-source, etc.
[0041] As per the illustrated embodiment, the system 108 includes the AI/ML model 220. In an alternate embodiment, the system 108 includes a plurality of AI/ML models 220. The AI/ML model 220 is a machine learning model that performs tasks such as analysing and recognizing patterns and trends, making predictions, , enhance decision-making, and provide insights across various fields. For example, the AI/ML model 220 facilitates in solving real-world problems without extensive manual intervention.
[0042] As per the illustrated embodiment, the system 108 includes the processor 202 for processing the alarm data. The processor 202 includes a retrieving unit 208, an analysis engine 210, a transceiver 212, a categorizing unit 214, a training unit 216, a predicting engine 218, a model refining unit 222. The processor 202 is communicably coupled to the one or more components of the system 108 such as the memory 204, the centralized data storage unit 206 and the AI/ML model 220. In an embodiment, operations and functionalities of includes the retrieving unit 208, the analysis engine 210, the transceiver 212, the categorizing unit 214, the training unit 216, the predicting engine 218, the model refining unit 222 and the one or more components of the system 108 can be used in combination or interchangeably.
[0043] In one embodiment, initially the retrieving unit 208 of the processor 202 is configured to retrieve historic alarm data from the one or more data sources 110. In an alternate embodiment, historic counter data is retrieved from the one or more data sources 110. Herein the historic alarm data includes at least one of, but not limited to, alarms generated by the one or more data sources 110. For example, the retrieving unit 208 retrieves the alarm generated by the sensors.
[0044] In one embodiment, the alarms are notifications or signals that indicates a specific condition or event that requires attention. In particular, the alarms serve to alert users about one or more issues such as at least one of, but not limited to, node failures, network traffic, performance degradation, or security breaches. For example, the alarms are visual alarms such as lights on a device, audible sound alerts, or digital (notifications in monitoring systems). In one embodiment, the counters are measurement tools or variables that keep track of quantities or occurrences of specific events. The counters provide insights into traffic, errors, and overall health of the network 106. For example, the counters are traffic counters, error counters, and connection counters.
[0045] In an alternate embodiment, historic alarm data is retrieved from the one or more data sources 110. Herein, the retrieving unit 208 retrieves historic alarm data from the one or more data sources 110 which are present within the network 106 and outside the network 106. In one embodiment, the one or more data sources 110 periodically transmits the historic alarm data to the system 108.
[0046] In one embodiment, the retrieving unit 208 retrieves the historic alarm data from a Network Management System (NMS). Herein, the NMS acts as the mediator between the one or more data sources 110 and the retrieving unit 208. Herein, the NMS collects the historic alarm data from the one or more data sources 110. In one embodiment, the NMS identifies, configure, monitor, update and troubleshoot one or more data sources 110 within the network 106.
[0047] In one embodiment, the retrieving unit 208 retrieves the historic alarm data from the one or more data sources 110 via an interface. In one embodiment, the interface includes at least one of, but not limited to, one or more Application Programming Interfaces (APIs) which are used for retrieving the historic alarm data from the one or more data sources 110. The one or more APIs are sets of rules and protocols that allow different entities to communicate with each other. The one or more APIs define the methods and data formats that entities can use to request and exchange information, enabling integration and functionality across various platforms. In particular, the APIs are essential for integrating different systems, accessing services, and extending functionality.
[0048] In one embodiment, upon retrieving the historic alarm data from the one or more data sources 110, the retrieving unit 208 is further configured to integrate the historic alarm data retrieved from the one or more data sources 110 within the network 106 and the one or more data sources 110 outside the network 106. Herein, integrating the network performance data involves combining data from the one or more data sources 110 to provide a unified view or to enable comprehensive analysis. Advantageously, the unified view is provided on a centralized platform to manage alarm data retrieved from the one or more data sources 110. The integration of data ensures that alarm data is shared and analysed comprehensively.
[0049] Upon integrating the historic alarm data, the retrieving unit 208 is further configured to preprocess the integrated historic alarm data. In particular, the retrieving unit 208 is configured to preprocess the historic alarm data to ensure the data consistency and quality of the data within the system 108. The retrieving unit 208 performs at least one of, but not limited to, data normalization, data definition and data cleaning procedures.
[0050] While preprocessing, the retrieving unit 208 performs at least one of, but not limited to, reorganizing the data, removing the redundant data, formatting the data, removing null values from the data, cleaning the data, and handling missing values. The main goal of the preprocessing is to achieve a standardized data format across the entire system 108. The preprocessing eliminates duplicate data and inconsistencies from the historic alarm data. The retrieving unit 208 ensures that the preprocessed data is stored appropriately in at least one of, the centralized data storage unit 206 for subsequent retrieval and analysis.
[0051] Upon preprocessing the historic alarm data, the analysis engine 210 of the processor 202 is configured to analyse at least one of, patterns, trends and behaviour of one or more anomalies based on the retrieved historic alarm data using the AI/ML model 220. In one embodiment, the analysis is at least one of, a time series analysis or a statistical analysis performed by the analysis engine 210 using the AI/ML model 220 to identify at least one of, the patterns, the trends and the behaviour of the one or more anomalies. Herein, the patterns refer to recurring behaviors or structures in the data that appear consistently over time. The trends are general directions in which data points move over a period of time. The behaviour refers to the unusual patterns or deviations from normal operations that indicate a potential issue, such as a security breach or network failure. In one embodiment, the analysed data is stored in the centralized data storage unit 206 by the analysis engine 210. In one embodiment, the one or more anomalies are the previous one or more anomalies which are detected by the analysis engine 210 using the AI/ML model 220 based on the retrieved historic alarm data. Further, the AI/ML model 220 learns the at least one of, the patterns, the trends and the behaviour of one or more anomalies.
[0052] Upon analysing at least one of, the patterns, the trends and the behaviour of one or more anomalies, the transceiver 212 of the processor 202 is configured to receive real time alarm data from the one or more data sources 110 via the NMS. Herein, the real time alarm data includes at least one of, but not limited to one or more alarms generated by the one or more data sources 110. For example, let us consider the network functions are the one or more data sources 110. When the network functions are operating abnormally as compared to the normal operations, then the one or more alarms are generated by the one or more data sources 110. Further, the real time alarm data received by the transceiver 212 is integrated and preprocessed by the retrieving unit 208. Advantageously, the system offers both real time alarm detection and historical analysis, enabling users to understand network behaviour over time and identify recurring issues.
[0053] Upon receiving the real time alarm including the one or more alarms, the categorizing unit 214 of the processor 202 is configured to categorize the one or more alarms using at least one of, the AI/ML model 220. The categorizing unit 214 categorizes the one or more alarms into severity levels based on one or more parameters. Herein, the one or more parameters include at least one of, type of alarms and impact on services. In one embodiment, the type of alarms includes at least one of, but not limited to, a performance alarm which is generated when the Central Processing Unit (CPU) utilization exceeds a predefined threshold, an operational alarm which is generated when the services are down, and a user behavior alarm which is generated when patterns of the user behavior deviate from normal user behaviors. In one embodiment, the service includes at least one of, but not limited to, communication services, and database services.
[0054] In one embodiment, the generated one or more alarms are categorized into severity levels based on the one or more parameters. In an alternate embodiment, the categorizing unit 214 considers the one or more parameters such as at least one of, but not limited to, the network traffic, error rates, and the historical data for categorizing the generated one or more alarms into the severity levels.
[0055] In one embodiment, the categorizing unit 214 categories the generated one or more alarms into the severity levels which includes at least one of, but not limited to, critical alarms, major alarms, and minor alarms. In one embodiment, the categorizing unit 214 utilizes the AI/ML model 220 to assign a severity score or level to each alarm among the generated one or more alarms. For example, the categorizing unit 214 utilizes the AI/ML model 220 to assign severity score or level to each alarm depending on severity of impact of the one or more alarms on the services. The alarm with the highest score is considered as critical alarm, the alarm with the second highest score is considered as the major alarm and so on.
[0056] In one embodiment, when the one or more alarms are categorized as critical, then the categorizing unit 214 is further configured to transmit, alerts/notifications to the user. Herein, the alerts/notifications include at least one of, but not limited to, a warning associated with critical alarm such as the critical alarm may include an anomaly. In an alternate embodiment, the critical alarms indicate the anomaly that requires immediate attention, and other alarms indicate less severe anomaly as compared to the anomaly indicated by the critical alarm.
[0057] Upon categorizing the generated one or more alarms, the analysis engine 210 is configured to detect the anomaly among the generated one or more alarms utilizing the AI/ML model 220. In an embodiment, the AI/ML model 220 continuously or periodically monitors the categorized one or more alarms in order to detect the anomaly. Based on historic alarm data and the learnt at least one of, the patterns, the trends and the behaviour of one or more anomalies which were previously detected in the past, the AI/ML model 220 sets the one or more thresholds. Further, the analysis engine 210 utilizing the AI/ML model 220 determines whether the real time alarm data associated with the categorized one or more alarms breaches the one or more thresholds. When the real time alarm data associated with the categorized one or more alarms breaches the one or more thresholds, then the anomaly is detected by the analysis engine 210. Advantageously, by detecting the anomaly, the system 108 contributes to improved network security by identifying potential threats.
[0058] Upon detecting the anomaly in the categorized one or more alarms, the training unit 216 of the processor 202 is configured to train the AI/ML model 220 with at least one of, but not limited to, the preprocessed real time alarm data, and the categorized one or more alarms. In an alternate embodiment, the training unit 216 is configured to train the AI/ML model 220 with at least one of, but not limited to, the data related to the detected anomaly. Further, the training unit 216 configures one or more hyperparameters of the AI/ML model 220 in order to train the AI/ML model 220. Herein, the one or more hyperparameters of the AI/ML model 220 includes at least one of, but not limited to, a learning rate, a batch size, and a number of epochs. Subsequent to configuring the one or more hyperparameters of the AI/ML model 220, the training unit 216 infers that the AI/ML model 220 is ready for training.
[0059] In one embodiment, for training the AI/ML model 220, the training unit 216 splits the preprocessed real time alarm data, the categorized one or more alarms and the data related to the detected anomaly into at least one of, but not limited to, training data and testing data. Further, the training unit 214 feeds the training data to the AI/ML model 220. Subsequent to training, the trained AI/ML model 220 is fed with the testing data in order to evaluate performance of the trained AI/ML model 220.
[0060] In one embodiment, when the trained AI/ML model 220 generates an output based on the testing data, the training unit 216 evaluates the performance of the trained AI/ML model 220. In one embodiment, the output generated by the trained AI/ML model 220 is again fed back to the trained AI/ML model 220 by the training unit 216, so that based on the generated output, the trained AI/ML model 220 is trained again. In particular, after generating the output, the model 220 keeps on training and updating itself in order to achieve better output. In one embodiment, based on training, the trained AI/ML model 220 learns at least one of, but not limited to, the patterns, the trends and the behaviour of the detected anomaly and the categorized one or more alarms by applying one or more logics.
[0061] In one embodiment, the one or more logics may include at least one of, but not limited to, a k-means clustering, a hierarchical clustering, a Principal Component Analysis (PCA), an Independent Component Analysis (ICA), a deep learning logics such as Artificial Neural Networks (ANNs), a Convolutional Neural Networks (CNNs), a Recurrent Neural Networks (RNNs), a Long Short-Term Memory Networks (LSTMs), a Generative Adversarial Networks (GANs), a Q-Learning, a Deep Q-Networks (DQN), a Reinforcement Learning Logics, etc.
[0062] Upon training the AI/ML model 220, the predicting engine 218 of the processor 202 is configured to predict, the one or more future alarms utilizing the trained AI/ML model 220. In one embodiment, the predicting engine 218 predicts the one or more future alarms based on learnt at least one of, but not limited to, the patterns, the trends and the behaviour of the detected anomaly and the categorized one or more alarms. Herein, the one or more future alarms pertain to one or more potential issues that may occur in the network 106.
[0063] In an embodiment, the predicting engine 218 performs predictive analytics using the trained AI/ML model 220 to predict the one or more future alarms based on learnt at least one of, but not limited to, the patterns, the trends and the behaviour of the detected anomaly and the categorized one or more alarms. For example, let us assume that the categorized one or more alarms includes the multiple anomalies which are detected by the system 108. Further the predicting unit 216 utilizes the trained AI/ML model 220 to check similarities between the categorized one or more alarms and one or more alarms which are not yet generated by the one or more data sources 110. Herein, the similarities include at least one of, but not limited to, a common anomaly or a common issue. Based on the similarities between the categorized one or more alarms and the one or more alarms which are not yet generated, the predicting unit 216 predicts the one or more future alarms.
[0064] For example, let us assume that a first alarm is raised due to the anomaly such as high traffic. Herein the first alarm is categorized into the critical alarm. So based on at least one of, but not limited to, the patterns, the trends and the behaviour of the detected anomaly such as high traffic and the categorized one or more alarms such as the first alarm, the similarities between the first alarm and the one or more alarms which are not yet generated are checked by the predicting unit 216 using the trained AI/ML model 220. Based on checking the similarities, the predicting unit 216 predicts that the one or more future alarms will be generated predicting unit 216. More particularly, the predicting unit 216 predicts that due to the high traffic a second alarm will be raised pertaining to delay in serving the request which represents the one or more anomalies. Advantageously, due to the predictive analytics the potential issues such as delay in serving the request are prevented.
[0065] Upon predicting the one or more future alarms, details pertaining to the predicted one or more future alarms are stored in the centralized data storage unit 206. Herein, the details include at least one of, but of limited to, information of which one or more future alarms will be raised in the future. For example, the details such as due to the high traffic the alarm associated with the delay in serving the request by the network function will be raised in the future.
[0066] Furthermore, the details pertaining to the predicted one or more future alarms are transmitted as at least one of, but not limited to, alerts and notifications to the user in real time by the transceiver 212. More particularly, the details pertaining to the predicted one or more future alarms are provided to the user on the UI 306 of the UE 102 so that user can view the alerts and notifications and take one or more actions user to resolve the predicted future alarms. Herein the one or more actions includes at least one of, but not limited to, performing the root cause analysis. Advantageous the system 108 enables users to proactively identify and address the one or more future alarms associated with the anomaly before they escalate into critical problems.
[0067] Upon transmitting the details pertaining to the predicted one or more future alarms to the user, the model refining unit 222 of the processor 202 is configured to refine the AI/ML model 220 with newly learnt at least one of, the patterns, trends and behaviour of the one or more anomalies based on recently analysed historic alarm data. For example, the AI/ML model 220 keeps on training based on real time alarm data and recently analysed alarm data. In another embodiment, the model refining unit 222 refines the AI/ML model 220 with at least one of, the patterns, trends and behaviour and corresponding one or more actions taken by the user to resolve the predicted one or more future alarms. For example, if a particular action successfully resolves the predicted one or more future alarms, the model refining unit 222 enables the AI/ML model 220 to adapt and refines the one or more logics for future incidents similar to the current incidents that have occurred.
[0068] The retrieving unit 208, the analysis engine 210, the transceiver 212, the categorizing unit 214, the training unit 216, the predicting engine 218, the model refining unit 222 in an exemplary embodiment, are implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 202. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 202 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 204 may store instructions that, when executed by the processing resource, implement the processor 202. In such examples, the system 108 may comprise the memory 204 storing the instructions and the processing resource to execute the instructions, or the memory 204 may be separate but accessible to the system 108 and the processing resource. In other examples, the processor 202 may be implemented by electronic circuitry.
[0069] FIG. 3 illustrates an exemplary architecture for the system 108, according to one or more embodiments of the present invention. More specifically, FIG. 3 illustrates the system 108 for processing the alarm data. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the UE 102 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0070] FIG. 3 shows communication between the UE 102, the system 108, and the one or more data sources 110. For the purpose of description of the exemplary embodiment as illustrated in FIG. 3, the UE 102, uses network protocol connection to communicate with the system 108, and the one or more data sources 110. In an embodiment, the network protocol connection is the establishment and management of communication between the UE 102, the system 108, and the one or more data sources 110 over the network 106 (as shown in FIG. 1) using a specific protocol or set of protocols. The network protocol connection includes, but not limited to, Session Initiation Protocol (SIP), System Information Block (SIB) protocol, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Simple Network Management Protocol (SNMP), Internet Control Message Protocol (ICMP), Hypertext Transfer Protocol Secure (HTTPS) and Terminal Network (TELNET).
[0071] In an embodiment, the UE 102 includes a primary processor 302, and a memory 304 and a User Interface (UI) 306. In alternate embodiments, the UE 102 may include more than one primary processor 302 as per the requirement of the network 106. The primary processor 302, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0072] In an embodiment, the primary processor 302 is configured to fetch and execute computer-readable instructions stored in the memory 304. The memory 304 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed for processing the alarm data. The memory 304 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0073] In an embodiment, the User Interface (UI) 306 includes a variety of interfaces, for example, a graphical user interface, a web user interface, a Command Line Interface (CLI), and the like. The UI 306 of the UE 102 allows the user to view the at least one of, the alerts and the notifications transmitted by the system 108 to the user regarding the predicted one or more future alarms. In one embodiment, the user may be at least one of, but not limited to, a network operator. Advantageously, the user can identify and address issues more efficiently, leading to reduced downtime and enhanced network reliability.
[0074] As mentioned earlier in FIG.2, the system 108 includes the processors 202, the memory 204, the centralized data storage unit 206, and the AI/ML model 220 for processing the alarm data, which are already explained in FIG. 2. For the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition.
[0075] Further, as mentioned earlier the processor 202 includes the retrieving unit 208, the analysis engine 210, the transceiver 212, the categorizing unit 214, the training unit 216, the predicting engine 218, the model refining unit 222 which are already explained in FIG. 2. Hence, for the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition. The limited description provided for the system 108 in FIG. 3, should be read with the description provided for the system 108 in the FIG. 2 above, and should not be construed as limiting the scope of the present disclosure.
[0076] FIG. 4 is an exemplary the system 108 architecture 400 for processing the alarm data, according to one or more embodiments of the present disclosure.
[0077] The architecture 400 includes the one or more data sources 110 such as Alarm source 1, Alarm source 2 and Alarm source 3 from which one alarm data is received at the system 108. The alarm data includes, at least one of, multiple alarms that are triggered by the one or more data sources 110. For example, the one or more data sources 110 are one or more network functions. When the performance of the one or more data sources 110 are degraded or the one or more issues are faced by the one or more data sources 110, then the alarms data is generated by the one or more data sources 110.
[0078] The architecture 400 further includes the NMS 402, a pre-processor 404, an execution unit 406, a Machine Learning (ML) service 408, the centralized data storage unit 206, workflow 410 and the UI 306 communicably coupled to each other via the network 106.
[0079] In one embodiment, the NMS 402 periodically collects the alarm data from at least one of, the Alarm source 1, the Alarm source 2 and the Alarm source 3. The alarm data is crucial for monitoring network performance, identifying anomaly, and ensures that system 108 operate smoothly. The alarm data collected by the NMS 402 is considered as the historic alarm data when retrieved for analysing.
[0080] In one embodiment, the pre-processor 404 receives the collected historic alarm data from the NMS 402 and preprocesses the historic alarm data. For example, the historic alarm data undergoes preprocessing to ensure data consistency within the system 108. In particular, the preprocessing involves tasks like data cleaning, normalization, removing unwanted data like outliers, duplicate records and handling missing values.
[0081] In one embodiment, the execution unit 406 is designed to analyze and manage multiple alarms in real time. In particular, the execution unit 406 categorizes one or more alarms based on one or more parameters. In one embodiment, the execution unit 406 detects the anomalies associated with the one or more alarms. Based on the categorization of the one or more alarms, the execution unit 406 performs predictive analytics to predict the one or more future alarms.
[0082] In one embodiment, the ML service 408 refer to platform and tool that provide resources for building, deploying, and managing AI/ML model 220. The ML service 408 preforms the AI/ML model 220 selection and the AI/ML model 220 training. Herein, the AI/ML model 220 learns the patterns, the trends and the behaviour of the one or more anomalies. Based on the learnt patterns, the trends and the behaviour of the one or more anomalies, the AI/ML model 220 facilities the execution unit 406 to categorize the one or more alarms and performs the predictive analytics.
[0083] In one embodiment, the centralized data storage unit 206 includes a structured collection of the preprocessed data, the categorized one or more alarms, the predicted one or more future alarms which are managed and organized in a way that allows system 108 for easy access, retrieval, and manipulation. The centralized data storage unit 206 are used to store, manage, and retrieve large amounts of information efficiently.
[0084] In one embodiment, the workflow 410 is a defined sequence of processes or tasks that are carried out to complete a specific goal or project. The workflow 410 involves the coordination of components in the architecture, resources, and tools to ensure that work is completed efficiently and effectively. In particular, the workflow 410 retrieves the one or more categorized alarms and the predicted one or more future alarms from the centralized data storage unit 206 and provides the visual representation on the UI 306.
[0085] FIG. 5 is a signal flow diagram illustrating the flow for processing the alarm data, according to one or more embodiments of the present disclosure.
[0086] At step 502, the system 108 retrieves historic alarm data from the one or more data sources 110. In one embodiment, the system 108 transmits at least one of, but not limited to, a Hyper Text Transfer Protocol (HTTP) request to the one or more data sources 110 to retrieve at least one of, the historic alarm data. In one embodiment, a connection is established between the system 108 and the one or more data sources 110 before retrieving the historic alarm data. Further, the historic alarm data is integrated and preprocessed.
[0087] At step 504, the system 108 analyses using the AI/ML model 220, at least one of, the patterns, the trends and the behaviour of the one or more anomalies based on the retrieved historic alarm data. Herein, the system 108 performs at least one of, but not limited to, the time series analysis or a statistical analysis for identifying the at least one of, the patterns, the trends and the behaviour of the one or more anomalies.
[0088] At step 506, the system 108 retrieves real time alarm data from the one or more data sources 110. In one embodiment, the system 108 transmits at least one of, but not limited to, the HTTP request to the one or more data sources 110 to retrieve at least one of, the real time alarm data. Further, the real time alarm data is integrated and preprocessed.
[0089] At step 508, the system 108 categorizes the one or more alarms into severity levels based on based on the one or more parameters using the AI/ML model 220. For example, the severity levels are critical alarms, major alarms and minor alarms.
[0090] At step 510, the system 108 predicts the one or more future alarms based on the patterns, the trends and the behaviour of the one or more anomalies which are learnt by the system 108 using the historic alarm data and the categorized one or more alarms. Herein, the system 108 predicts the one or more future alarms by performing the predictive analytics.
[0091] At step 512, the system 108 transmits alerts or notifications to the UE 102 to resolve the predicted one or more future alarms by the system 108. Herein, the system 108 transmits the alerts or notifications to the user by at least one of, but not limited to, the HTTP request. Further, the user can view the alerts or notifications on the UI 306 of the UE 102.
[0092] FIG. 6 is a flow diagram of a method 600 for processing the alarm data, according to one or more embodiments of the present invention. For the purpose of description, the method 600 is described with the embodiments as illustrated in FIG. 2 and should nowhere be construed as limiting the scope of the present disclosure.
[0093] At step 602, the method 600 includes the step of retrieving, at least one of, historic alarm data from the one or more data sources 110. In one embodiment, the retrieving unit 208 retrieves the historic alarm data from the one or more data sources 110. In particular, the retrieving unit 208 utilizes the one or more APIs for retrieving the historic alarm data from the one or more data sources 110 via the NMS. Further, the historic alarm data retrieved from the one or more data sources 110 is integrated by the retrieving unit 208. Thereafter, the integrated data is preprocessed by the the retrieving unit 208 to ensure the data consistency and quality within the system 108.
[0094] At step 604, the method 600 includes the step of analysing, at least one of, patterns, trends and behaviour of one or more anomalies based on the retrieved historic alarm data using the AI/ML model 220. In one embodiment, the analysis engine 210 analyses, at least one of, the patterns, the trends and the behaviour of one or more anomalies. In one embodiment, the analysis engine 210 performs the time series analysis or the statistical analysis using the AI/ML model 220 to identify at least one of, the patterns, the trends and the behaviour of the one or more anomalies.
[0095] At step 606, the method 600 includes the step of receiving the real time alarm data from the one or more data sources 110. In one embodiment, the transceiver 212 receives the real time alarm data from the one or more data sources 110. Herein, the real time alarm data includes at least one of, but not limited to, the one or more alarms.
[0096] At step 608, the method 600 includes the step of categorizing, the one or more alarms generated based on the received real time alarm data using at least one of, the AI/ML model 220. In one embodiment, the categorizing unit 214 categorizes the one or more alarms into severity levels based on one or more parameters. For example, let us consider 3 alarms are generated by the network functions in the network 106. Herein the alarm 1 is associated with a high network traffic handling by the network functions, the alarm 2 pertains to excess CPU utilization by the network functions and the alarm 3 pertains to excess latency by the network functions. Further, the categorizing unit 214 checks for the impact of the alarm 1, alarm 2 and the alarm 3 on services based on which the one or more alarms are categorized. The alarm with highest impact on the services is considered as the critical alarm, The alarm with lowest impact on the services is considered as the minor alarm.
[0097] Further, the AI/ML model 220 is trained by the training unit 216 with at least one of, the historic alarm data, real historic alarm data and the categorized one or more alarms. While training, the AI/ML model 220 learns at least one of, but not limited to, patterns, trends and behaviour of the one or more anomalies.
[0098] At step 610, the method 600 includes the step of predicting the one or more future alarms utilizing the trained AI/ML model 220. In one embodiment, the predicting engine 218 predicts the one or more future alarms. For example, let us assume that first alarm is the critical alarm which is raised due to anomaly such as 85% of the resources been utilized by the network functions among the allotted resources to the network functions. Then the predicting engine 218 utilizes the trained AI/ML model 220 to check similarities between the first alarm raised and one or more alarms that are not been generated yet. Based on the historical data, the predicting engine 218 checks that which alarm will be raised when each of the allotted resources is utilized by the network functions. Based on checking, the predicting engine 218 predicts that second alarm will be raised when the 100% of the allotted resources is utilized by the network functions. Herein, the second alarm represents one or more anomalies such as degradation in the performance of the network functions as no resources are available.
[0099] In one embodiment, the predicted one or more future alarms are notified to the user on the UI 306 so that the user can take one or more actions to resolve the predicted one or more future alarms. In one embodiment, the alerts and notifications regarding the predicted one or more future alarms is provided to the user via the transceiver 212 and the user can view the alerts and notifications on the UI 306.
[00100] In yet another aspect of the present invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by a processor 202. The processor 202 is configured retrieve historic alarm data from one or more data sources 110. The processor 202 is further configured to analyse, using an Artificial Intelligence/Machine Learning (AI/ML) model 220 at least one of, patterns, trends and behaviour of one or more anomalies based on the retrieved historic alarm data. The processor 202 is further configured to receive, real time alarm data from the one or more data sources. The processor 202 is further configured to categorize, one or more alarms based on the received real time alarm data using at least one of, the AI/ML model 220. The processor 202 is further configured to predict, using the AI/ML model 220, one or more future alarms representing the one or more anomalies based on the categorization of the one or more alarms.
[00101] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-6) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[00102] The present disclosure provides technical advancements in comprehensive alarm detection using the centralized platform to detect and manage alarms from various network components, improving visibility and control. The present invention offers both real-time alarm detection and historical analysis, enabling network operators to understand network behaviour over time and identify recurring issues. The present invention incorporates predictive analytics to anticipate network trends and potential issues, allowing proactive measures to prevent disruptions. The users can identify and address issues more efficiently, leading to reduced downtime and enhanced network reliability. The integration of data from different network monitoring tools ensures that critical information is shared and analysed comprehensively. By detecting anomalies and trends, the system contributes to improved network security by identifying potential threats.
[00103] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS

[00104] Environment - 100;
[00105] User Equipment (UE) - 102;
[00106] Server - 104;
[00107] Network- 106;
[00108] System -108;
[00109] One or more data sources – 110;
[00110] Processor - 202;
[00111] Memory - 204;
[00112] Centralized data storage unit – 206;
[00113] Retrieving unit – 208;
[00114] Analysis engine – 210;
[00115] Transceiver – 212;
[00116] Categorizing unit – 214;
[00117] Training unit – 216;
[00118] Predicting engine – 218;
[00119] Model refining unit - 222;
[00120] AI/ML Model – 220;
[00121] Primary Processor – 302;
[00122] Memory – 304;
[00123] User Interface (UI) – 306;
[00124] NMS – 402;
[00125] Pre-processor - 404;
[00126] Execution unit – 406;
[00127] ML service – 408;
[00128] Workflow – 410.

,CLAIMS:CLAIMS
We Claim:
1. A method (600) for processing alarm data, the method (600) comprising the steps of:
retrieving, by the one or more processors (202), historic alarm data from one or more data sources (110);
analysing, by the one or more processors (202), using an Artificial Intelligence/Machine Learning (AI/ML) model (220) at least one of, patterns, trends and behaviour of one or more anomalies based on the retrieved historic alarm data;
receiving, by the one or more processors (202), real time alarm data from the one or more data sources (110);
categorizing, by the one or more processors (202), one or more alarms based on the received real time alarm data using at least one of, the AI/ML model (220); and
predicting, by the one or more processors (202), using the AI/ML model (220), one or more future alarms representing the one or more anomalies based on the categorization of the one or more alarms.

2. The method (600) as claimed in claim 1, wherein the analysis is at least one of, a time series analysis or a statistical analysis performed by the one or more processors using the AI/ML model to identify at least one of, the patterns, the trends and the behaviour.

3. The method (600) as claimed in claim 1, wherein the one or more alarms are categorized into severity levels based on one or more parameters.

4. The method (600) as claimed in claim 3 wherein the one or more parameters include at least one of, type of alarms and impact on network services.

5. The method (600) as claimed in claim 1, wherein the step of, categorizing, one or more alarms further includes the step of:
transmitting, by the one or more processors (202), alerts/notifications to a user when the one or more alarms are categorized as critical.

6. The method (600) as claimed in claim 1, wherein the method (600) further comprising the step of:
refining, by the one or more processors (202), the AI/ML model (220) with newly learnt at least one of, the patterns, trends and behaviour of the one or more anomalies based on recently analysed historic alarm data, wherein the AI/ML model (220) is refined with at least one of, the patterns, trends and behaviour and corresponding actions taken.

7. The method (600) as claimed in claim 1, wherein the method (600) further comprising the step of:
storing, by the one or more processors (202), the analysed data in a centralized data storage unit (206).

8. A system (108) for processing alarm data, the system (108) comprising:
a retrieving unit (208), configured to, retrieve, historic alarm data from one or more data sources (110);
an analysis engine (210), configured to, analyse, using an Artificial Intelligence/Machine Learning (AI/ML) model (220) at least one of, patterns, trends and behaviour of one or more anomalies based on the retrieved historic alarm data;
a transceiver (212), configured to, receive, real time alarm data from the one or more data sources (110);
a categorizing unit (214), configured to, categorize, one or more alarms based on the received real time alarm data using at least one of, the AI/ML model (220); and
a predicting engine (218), configured to, predict, using the AI/ML model (220), one or more future alarms representing the one or more anomalies based on the categorization of the one or more alarms.

9. The system (108) as claimed in claim 8, wherein the analyses is at least one of, a time series analysis or a statistical analysis performed by the one or more processors using the AI/ML model (220) to identify at least one of, the patterns, the trends and the behaviour.

10. The system (108) as claimed in claim 8, wherein the one or more alarms are categorized into severity levels based on one or more parameters.

11. The system (108) as claimed in claim 10, wherein the one or more parameters include at least one of, type of alarms and impact on services.

12. The system (108) as claimed in claim 8, wherein the categorizing unit (214) is further configured to:
transmit, alerts/notifications to a user when the one or more alarms are categorized as critical.

13. The system (108) as claimed in claim 8, wherein a model refining unit (222) is configured to:
refine, the AI/ML model (220) with recently learnt at least one of, the patterns, trends and behaviour of the one or more anomalies based on recently analysed historic alarm data, wherein the AI/ML model (220) is refined with at least one of, the patterns, trends and behaviour and corresponding actions taken.

14. The system (108) as claimed in claim 8, wherein the analysis engine (210) is further configured to:
store, the analysed data in a centralized data storage unit (206).