DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
SYSTEM AND METHOD FOR DETECTING ANOMALIES IN A NETWORK
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to the field of wireless communication systems, more particularly relates to a method and a system for detecting anomalies in a network.
BACKGROUND OF THE INVENTION
[0002] In general, the communication network is monitored by monitoring all the core networking components such as, routers, switches, firewalls, servers, and VMs. The intent of monitoring these networking components is to detect faults or anomalies, if any. Anomaly detection is the identification of rare events, items, or observations which are suspicious because they differ significantly from standard behaviors or patterns.
[0003] Generally, consumers may struggle to efficiently detect anomalies in network performance and configurations, often relying on manual processes. Further, the metric data collected from network devices may not be effectively verified for accuracy and consistency that may lead to potential errors in analysis. Furthermore, assessing the physical status of network components, such as servers and switches, may be challenging to consumers and makes it difficult to proactively address hardware issues.
[0004] In view of the above, there is a dire need for system and method for detecting anomalies, verifying metric data, and assessing physical status via NMS interface, which ensures enhanced network management by ensuring reliability, efficiency, and security by bridging the gap between network monitoring and management.
SUMMARY OF THE INVENTION
[0005] One or more embodiments of the present disclosure provides a method and a system for detecting anomalies in a network.
[0006] In one aspect of the present invention, the method for detecting anomalies in a network is disclosed. The method includes the step of collecting, by one or more processor, current data from one or more sources. The method further includes the step of selecting, by the one or more processors, one or more Artificial Intelligence/Machine Learning (AI/ML) models from the plurality of AI/ML models to detect anomalies, the one or more AI/ML models are selected based on a type of data for which anomaly is required to be detected. The method further includes the step of identifying, by the one or more processors, using the selected one or more AI/ML models, a deviation within the current data when at least one of, current trends/patterns deviate from at least one of, the historic trends/patterns. The method further includes the step of detecting, by the one or more processors, using the selected one or more AI/ML models, an anomaly based on the identified deviation.
[0007] In another embodiment, the current data includes at least one of, metrics data, configuration data, physical status data.
[0008] In yet another embodiment, the one or more selected AI/ML models are trained with at least one of, historic trends/patterns.
[0009] In yet another embodiment, the current data pertains to physical status of network components, the step of, detecting, the anomaly, includes the steps of, determining, by the one or more processors, using the AI/ML models if the identified deviation breaches one or more thresholds associated to the physical status data of the network components and in response to determining the breach inferring, by the one or more processors, presence of the anomaly with respect to the current data pertaining to the physical status of the network components.
[0010] In yet another embodiment, the physical status data is received from the one or more sources which includes at least one of, a sensor, the sensor retrieves the physical status data from the network components.
[0011] In yet another embodiment, the anomaly with respect to the physical status data represents issues with the network components.
[0012] In yet another embodiment, the method further comprising the step of predicting, by the one or more processors, at least one of, future anomaly, network component failure or other issues in the network using the AI/ML models.
[0013] In yet another embodiment, the method further comprising the step of refining, by the one or more processors, the AI/ML models by enabling the AI/ML models to learn at least one of, new patterns/trends or new values in real time based on receiving new data from the one or more sources.
[0014] In yet another embodiment, the step of, detecting, using the selected one or more AI/ML models, an anomaly with the current data, further includes the steps of generating, by the one or more processors, at least one of, alerts or notifications, in response to detecting the anomaly, or remediation actions to resolve the anomaly and transmitting, by the one or more processors, at least one of, the alerts or the remediation actions to a user.
[0015] In another aspect of the present invention, the system for detecting anomalies in a network is disclosed. The system includes a collecting unit, configured to, collect, current data from one or more sources. The system further includes a selecting unit, configured to, select, one or more Artificial Intelligence/Machine Learning (AI/ML) models from the plurality of AI/ML models to detect anomalies, the one or more AI/ML models are selected based on a type of data for which anomaly is required to be detected. The system further includes a detecting unit, configured to, identify, using the selected one or more AI/ML models, a deviation within the current data when at least one of, current trends/patterns deviate from at least one of, the historic trends/patterns. The detecting unit, is further configured to, detect, using the selected one or more AI/ML models, an anomaly based on the identified deviation.
[0016] In yet another aspect of the present invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by a processor. The processor is configured to collect, current data from one or more sources. The processor is further configured to select, one or more Artificial Intelligence/Machine Learning (AI/ML) models from the plurality of AI/ML models to detect anomalies wherein the one or more AI/ML models are selected based on a type of data for which anomaly is required to be detected. The processor is further configured to identify, using the selected one or more AI/ML models, a deviation within the current data when at least one of, current trends/patterns deviate from at least one of, the historic trends/patterns. The processor is further configured to detect, using the selected one or more AI/ML models, an anomaly based on the identified deviation.
[0017] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.
BRIEF DESCRIPTION OF THE DRAWINGS
[0018] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0019] FIG. 1 is an exemplary block diagram of an environment for detecting anomalies in a network, according to one or more embodiments of the present invention;
[0020] FIG. 2 is an exemplary block diagram of a system for detecting the anomalies in the network, according to one or more embodiments of the present invention;
[0021] FIG. 3 is an exemplary architecture of the system of FIG. 2, according to one or more embodiments of the present invention;
[0022] FIG. 4 is an exemplary architecture for detecting the anomalies in the network, according to one or more embodiments of the present disclosure;
[0023] FIG. 5 is an exemplary signal flow diagram illustrating the flow for detecting the anomalies in the network, according to one or more embodiments of the present disclosure; and
[0024] FIG. 6 is a flow diagram of a method for detecting the anomalies in the network, according to one or more embodiments of the present invention.
[0025] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0026] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0027] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0028] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0029] Various embodiments of the present invention provide a system and a method for detecting anomalies in a network. The most unique aspect of the invention lies in its ability to combine advanced technologies like machine learning for detecting anomalies, verifying metric data, and assessing physical status via an interface. The disclosed system and method aim at enhancing network monitoring and management. In other words, the present invention provides a unique approach of combining an anomaly detection, data verification, and a hardware status assessment to create a unified framework or platform. Advantageously, this unified platform, driven by Artificial Intelligence/Machine Learning (AI/ML) model, enhances network reliability, efficiency, security by bridging the gap between network monitoring and management, minimizing downtime and operational costs.
[0030] Referring to FIG. 1, FIG. 1 illustrates an exemplary block diagram of an environment 100 for detecting anomalies in a network 106 according to one or more embodiments of the present invention. The environment 100 includes a User Equipment (UE) 102, a server 104, the network 106, a system 108, and one or more sources 110. In one embodiment, detecting anomalies is a crucial process which facilitate to identify one or more issues in the network 106 before the one or more issues lead to larger problems such as impacting performance of the network 106. In one embodiment, detecting anomalies pertains to at least one of, but not limited to, one or more issues associated with network components. Herein the one or more issues include at least one of, but not limited to, a network component failure. In one embodiment, the network components are the physical and logical devices and technologies that work together to facilitate communication and data transfer across the network 106. Herein, the network components include, at least one of, but not limited to, routers, switches, load balancers and the server 104.
[0031] For the purpose of description and explanation, the description will be explained with respect to one or more user equipment’s (UEs) 102, or to be more specific will be explained with respect to a first UE 102a, a second UE 102b, and a third UE 102c, and should nowhere be construed as limiting the scope of the present disclosure. Each of the at least one UE 102 namely the first UE 102a, the second UE 102b, and the third UE 102c is configured to connect to the server 104 via the network 106.
[0032] In an embodiment, each of the first UE 102a, the second UE 102b, and the third UE 102c is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as smartphones, Virtual Reality (VR) devices, Augmented Reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0033] The network 106 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 106 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0034] The network 106 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth.
[0035] The environment 100 includes the server 104 accessible via the network 106. The server 104 may include by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, a processor executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0036] The environment 100 further includes the one or more sources 110. In one embodiment, the one or more sources 110 are origins from which the data is collected and utilized for at least one of, but not limited to, analysis, research, and decision-making. In one embodiment, the one or more sources 110 is at least one of, but not limited to, sensors, applications, one or more databases, and network functions. In particular, the one or more sources 110 is associated with the sources included within the network 106 and outside the network 106.
[0037] The environment 100 further includes the system 108 communicably coupled to the server 104, the UE 102, and the one or more sources 110 via the network 106. The system 108 is adapted to be embedded within the server 104 or is embedded as the individual entity.
[0038] Operational and construction features of the system 108 will be explained in detail with respect to the following figures.
[0039] FIG. 2 is an exemplary block diagram of the system 108 for detecting anomalies in the network 106, according to one or more embodiments of the present invention.
[0040] As per the illustrated and preferred embodiment, the system 108 for detecting anomalies in the network 106, includes one or more processors 202, a memory 204, a storage unit 206 and one or more Artificial Intelligence/Machine Learning (AI/ML) models 220. The one or more processors 202, hereinafter referred to as the processor 202, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions. However, it is to be noted that the system 108 may include multiple processors as per the requirement and without deviating from the scope of the present disclosure. Among other capabilities, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204.
[0041] As per the illustrated embodiment, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204 as the memory 204 is communicably connected to the processor 202. The memory 204 is configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed for detecting anomalies in the network 106. The memory 204 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0042] The environment 100 further includes the storage unit 206. As per the illustrated embodiment, the storage unit 206 is configured to store data collected from the one or more sources 110 associated with the network components. The storage unit 206 is one of, but not limited to, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of the storage unit 206 types are non-limiting and may not be mutually exclusive e.g., the database can be both commercial and cloud-based, or both relational and open-source, etc.
[0043] As per the illustrated embodiment, the system 108 includes the one or more AI/ML models 220. The one or more AI/ML models 220 facilitates system 108 in performing tasks such as, detecting anomalies, recognizing patterns, making predictions, solving problems, enhance decision-making, and provide insights across various fields. For example, the one or more AI/ML models 220 facilitates in solving real-world problems without extensive manual intervention.
[0044] As per the illustrated embodiment, the system 108 includes the processor 202 for detecting anomalies in the network 106. The processor 202 includes a collecting unit 208, a selecting unit 210, a training unit 212, a detecting unit 214, a predicting unit 216, and a refining model 218. The processor 202 is communicably coupled to the one or more components of the system 108 such as the memory 204, the storage unit 206 and the one or more AI/ML models 220. In an embodiment, operations and functionalities of includes the collecting unit 208, the selecting unit 210, the training unit 212, the detecting unit 214, the predicting unit 216, the refining model 218 and the one or more components of the system 108 can be used in combination or interchangeably.
[0045] In one embodiment, initially the collecting unit 208 of the processor 202 is configured to collect current data from the one or more sources 110. Herein, the current data associated with the network components includes at least one of, but not limited to metrics data, configuration data, physical status data. In one embodiment, the collecting unit 208 collects the current data from the one or more sources 110 which are present within the network 106 and outside the network 106. In one embodiment, the one or more sources 110 periodically transmits the current data to the system 108. For example, the collecting unit 208 collects the current data related to the network components from a sensor.
[0046] In one embodiment, the current data pertaining to the physical status data is received from the one or more sources 110 which includes at least one of, but not limited to, a sensor. Herein, the sensor retrieves the physical status data associated with the network components from the one or more sources 110. In one embodiment, the sensor is a device that detects and measures physical status of the network components, such as at least one of, but not limited to, a temperature and a pressure, and a humidity. The sensor converts the measurements of the physical status into signals that can be interpreted and processed by the system 108.
[0047] In one embodiment, the collecting unit 208 collects the current data from a Network Management System (NMS). Herein, the NMS acts as the mediator between the one or more sources 110 and the collecting unit 208. Herein, the NMS is a centralized platform that collects the current data from the one or more sources 110. In one embodiment, the NMS collects, monitor, analyze and manage data from the one or more sources 110. Herein, the current data may be in the form of, alarm data and the counter data associated with the network components.
[0048] In one embodiment, the collecting unit 208 collects the current data from the one or more sources 110 via an interface. In one embodiment, the interface includes at least one of, but not limited to, one or more Application Programming Interfaces (APIs) which are used for collecting the current data associated with the network components from the one or more sources 110. The one or more APIs are sets of rules and protocols that allow different entities to communicate with each other. The one or more APIs define the methods and data formats that entities can use to request and exchange information, enabling integration and functionality across various platforms. In particular, the APIs are essential for integrating different systems, accessing services, and extending functionality.
[0049] In one embodiment, upon collecting the current data from the one or more sources 110, the collecting unit 208 is further configured integrate the current data collected from the one or more sources 110 within the network 106 and the one or more sources 110 outside the network 106. Herein, integrating the current data involves combining current data collected from the one or more sources 110 to provide a unified view or to enable comprehensive analysis. For example, the system 108 provides an integrated view of network health which includes combined metrics data, configuration data, and physical status assessment.
[0050] Upon integrating the current data, the collecting unit 208 is further configured to preprocess the integrated current data. In particular, the collecting unit 208 is configured to preprocess the current data to ensure the data consistency and quality of the data within the system 108. The collecting unit 208 performs at least one of, but not limited to, data normalization, data definition and data cleaning procedures.
[0051] While preprocessing, the collecting unit 208 performs at least one of, but not limited to, reorganizing the data, removing the redundant data, formatting the data, removing null values from the data, cleaning the data, handling missing values. The main goal of the preprocessing is to achieve a standardized data format across the system 108. In one embodiment, while preprocessing the current data is verified for accuracy, ensuring reliable analysis and decision-making. For example, in order to verify the current data, the collecting unit 208 checks that that numerical data within the current data falls within expected values. Further, the preprocessing eliminates duplicate data and inconsistencies from the current data. The retrieving unit 208 ensures that the preprocessed data is stored appropriately in at least one of, the storage unit 206 for subsequent retrieval and analysis.
[0052] Upon preprocessing the current data, the selecting unit 210 of the processor 202 is configured to select one or more AI/ML models 220 from the plurality of AI/ML models 220 for detecting anomalies. In one embodiment, the selecting unit 210 selects the one or more AI/ML models 220 from the plurality of AI/ML models 220 based on a type of data for which anomaly is required to be detected. Herein, the type of the data pertains to at least one of, but not limited to, the metrics data, and the physical status data. In an alternate embodiment, the type of data pertains to at least one of, but not limited to, tabular data and text data. For example, if the collected current data is in the form of at least one of, but not limited to, a table with rows and columns, then the one or more AI/ML models 220 such as linear regression model and a decision tree model is selected by the selecting unit 210.
[0053] Further, the selecting unit 210 configures one or more hyperparameters of the selected one or more AI/ML models 220 in order to train the selected one or more AI/ML models 220. Herein, the one or more hyperparameters of the selected one or more AI/ML models 220 includes at least one of, but not limited to, a learning rate, a batch size, and a number of epochs. Subsequent to configuring the one or more hyperparameters of the selected one or more AI/ML models 220, the selecting unit 210 infers that the selected one or more AI/ML models 220 are ready for training. Hereinafter, the selected one or more AI/ML models 220 is referred to the AI/ML model 220 without limiting the scope of the invention.
[0054] Upon selecting the AI/ML model 220 among the plurality of AI/ML models 220, the training unit 212 of the processor 202 is configured to train the AI/ML model 220 with at least one of, but not limited to, historic trends/patterns. In an alternate embodiment, the training unit 212 of the processor 202 is configured to train the AI/ML model 220 based on expected values of historic data. Herein, the expected values are the ideal values which are associated with the network components and the historical data is the previous data associated with the network components which is stored in the storage unit 206. In an alternate embodiment, the training unit 212 of the processor 202 is configured to train the AI/ML model 220 with at least one of, but not limited to, the preprocessed current data which is stored in the storage unit 206.
[0055] In one embodiment, for training the AI/ML model 220, the training unit 212 splits the historical data into at least one of, but not limited to, training data and testing data. Further, the training unit 212 feeds the training data to the AI/ML model 220. Subsequent to training, the trained AI/ML model 220 is fed with the testing data in order to evaluate performance of the trained AI/ML model 220.
[0056] In one embodiment, when the trained AI/ML model 220 generates an output based on the testing data, the training unit 212 evaluates the performance of the trained AI/ML model 220. In one embodiment, the output generated by the trained AI/ML model 220 is again fed back to the trained AI/ML model 220 by the training unit 212, so that based on the generated output, the trained AI/ML model 220 is trained again. In particular, after generating the output, the AI/ML model 220 keeps on training and updating itself in order to achieve better output.
[0057] In alternate embodiment, based on the performance evaluation of the trained AI/ML model 220, the training unit 212 may again configure the one or more hyperparameters of the trained AI/ML model 220 to optimize the performance of the trained AI/ML model 220. In one embodiment, when the performance of the trained AI/ML model 220 is optimized, then the trained AI/ML model 220 is inferred as the optimal model 220 which can be used for further analysis.
[0058] In one embodiment, based on training, the AI/ML model 220 learns at least one of, but not limited to, trends/patterns of the historical data associated with the network components by applying one or more logics. The patterns refer to recurring behaviors or structures in the data that appear consistently over time. The trends are general directions in which data points move over a period of time. In one embodiment, the one or more logics may include at least one of, but not limited to, a k-means clustering, a hierarchical clustering, a Principal Component Analysis (PCA), an Independent Component Analysis (ICA), a deep learning logics such as Artificial Neural Networks (ANNs), a Convolutional Neural Networks (CNNs), a Recurrent Neural Networks (RNNs), a Long Short-Term Memory Networks (LSTMs), a Generative Adversarial Networks (GANs), a Q-Learning, a Deep Q-Networks (DQN), a Reinforcement Learning Logics, etc.
[0059] Upon training the AI/ML model 220, the detecting unit 214 of the processor 202 is configured to identify a deviation within current data using the trained AI/ML model 220. Herein the current data pertains to the metrics data, the configuration data, and the physical status data of the network components. In one embodiment, in order to identify the deviation within the current data, the detecting unit 214 utilizes the trained model 220 which continuously or periodically monitors the current data. Based on the historical data associated with the one or more sources 110 and the learnt trends/patterns of the historical data, the detecting unit 214, using the trained AI/ML model 220 identifies the deviation within the current data when at least one of, the current trends/patterns deviate from at least one of, the historic trends/patterns. Herein the current trends/patterns are identified by the trained AI/ML model 220 by applying one or more logics. In one embodiment, when the detecting unit 214 identifies the deviation within the current data, then the detecting unit 214 infers that there is a possibility of presence of an anomaly within the current data.
[0060] Upon identifying the deviation within the current data, the detecting unit 214 of the processor 202 is configured to detect the anomaly within the current data based on the identified deviation using the trained model 220. Herein the current data pertains to the metrics data and the configuration data of the network components. In one embodiment, in order to detect the anomaly within the current data, the detecting unit 214 utilizes the trained AI/ML model 220 which continuously or periodically monitors the current data and the identified deviation. Based on the historical data associated with the one or more sources 110 and the learnt trends/patterns of the historical data, the trained AI/ML model 220 sets one or more thresholds related to the metrics data and the configuration data of the network components.
[0061] In one embodiment, when the detecting unit 214 using the trained AI/ML model 220 determines that the current data breaches the one or more thresholds, then the detecting unit 214 infers the presence of the anomaly within the current data. For example, let us assume that the current data such as the metrics data is deviated and when the metrics data breaches the one or more thresholds, the detecting unit 214 detects anomaly. Let us assume that the metrics data is related to latency of the network components. So, when the time taken by the network components to transmit data packets to the system 108 exceeds the one or more thresholds, then the anomaly is detected by the detecting unit 214.
[0062] In one embodiment, upon identifying the deviation within the current data, the detecting unit 214 of the processor 202 is configured to detect the anomaly within the current data based on the identified deviation using the trained AI/ML model 220. Herein the current data pertains to the physical status data of the network components. In one embodiment, in order to detect the anomaly within the physical status data, the detecting unit 214 utilizes the trained AI/ML model 220 which continuously or periodically monitors the physical status data and the identified deviation. Based on the historical data associated with the one or more sources 110 and the learnt trends/patterns of the historical data, the trained AI/ML model 220 sets one or more thresholds associated to the physical status data of the network components. Further, the detecting unit 214 using the trained AI/ML model 220 determines that the identified deviation of the physical status data breaches the one or more thresholds. . When the physical status data breaches the one or more thresholds, the detecting unit 214 infers presence of the anomaly within the physical status of the network components. In particular, the anomaly with respect to the physical status data represents issues with the network components.
[0063] For example, let us assume for a particular network component with a maximum capacity of handling the heat or temperature is set by trained AI/ML model 220 based on the learnt trends/patterns of the historic data pertaining to the physical status of the network components. Herein the maximum capacity of handling the heat or temperature is the pre-defined or pre-configured one or more thresholds limit/value. Thereafter, in some time interval i.e., after 12hrs if the detecting unit 214 detects the particular network component temperature has reached the pre-defined or pre-configured one or more thresholds limit/value, then detecting unit 214 infers as the anomaly.
[0064] In one embodiment, whenever the anomaly is detected, the detecting unit 214 is further configured to generate one or more alarms. In other words, the one or more alarms are generated in response to the detected anomaly.
[0065] In one embodiment, upon detecting the anomaly, the detecting unit 214 is further configured to generate at least one of, alerts or notifications, in response to the detection. The detecting unit 214 is further configured to provide the remediation actions to resolve anomaly detected by the detecting unit 214. Herein, the detecting unit 214 transmits, at least one of, the alerts or notifications and the remediation actions to the user.
[0066] Upon detecting the anomaly, the predicting unit 216 of the processor 202 is configured to predict, at least one of, future anomaly, a network component failure or other issues in the network 106 using the trained AI/ML model 220. In one embodiment, the predicting unit 216 predicts at least one of, the future anomaly, the network component failure or other issues in the network 106 based on the learnt trends/patterns of the historic data pertaining to the network components. In alternate embodiment, the future anomalies include at least one of, but not limited to, the network component failure or other issues that may occur in the network 106.
[0067] In an embodiment, the predicting unit 216 performs a predictive analysis to predict at least one of, the future anomaly, the network component failure or other issues in the network 106 using the trained AI/ML model 220. In an embodiment, the trained AI/ML model 220 may continuously or periodically monitor the network 106 in real time in order to predict at least one of, the future anomaly, the network component failure or other issues in the network 106. Further, the trained AI/ML model 220 checks the historical data pertaining to the network components against the current data of the network components. In the event, if the predicting unit 216 detects the change or deviation in the current data of the network components against the historical data of the network components, the predicting unit 216 predicts the at least one of, the future anomaly, the network component failure or other issues in the network 106.
[0068] For example, let us assume for a particular network component a maximum capacity of handling the heat or temperature is set by trained AI/ML model 220 based on the learnt trends/patterns of the historic data pertaining to the network components. Thereafter, in some time interval i.e., after 12hrs if the detecting unit 214 detects that the particular network component temperature is reaching near the pre-defined or pre-configured one or more thresholds limit/value, then the predicting unit 216 predicts the anomaly such as in some time interval the temperature of the particular network component will be breaching the pre-defined or pre-configured one or more thresholds limit/value. Thereafter, the predicting unit 216 predicts that if proper action is not taken for the predicted anomaly, then there is a possibility of the network component failure due to the high temperature.
[0069] Upon predicting at least one of, the future anomaly, the network component failure or one or more issues in the network 106, the predicting unit 216 is further configured to generate at least one of, the alerts or notifications, in response to the prediction. Further, the predicting unit 216 is further configured to provide the remediation actions to avoid the one or more issues predicted by the predicting unit 216. Thereafter, the predicting unit 216 is further configured to transmit, at least one of, the alerts or notifications and the remediation actions to a user.
[0070] In one embodiment, the alerts or notifications and the remediation actions are transmitted to the user in a real time. In one embodiment, the user may view the alerts or notifications and the remediation actions on the UI 306 of the UE 102. Based on the at least one of, the alerts or notifications and the remediation actions, the at least one of, the system 108 or the user performs the remediation actions to resolve the one or more issues. In one embodiment, the remediation actions include at least one of, but not limited to, a root cause analysis. For example, if the temperature of the network component is increasing, the system 108 can provide cooling to the network component.
[0071] In one embodiment, upon transmitting at least one of, the alerts or notifications and the remediation actions to the user, the refining model 218 of the processor 202 is configured to refine the AI/ML model 220 by enabling the AI/ML model 220 to learn at least one of, new patterns/trends or new values in real time based on receiving new data from the one or more sources 110. In another embodiment, the refining model 218 also continuously refines the AI/ML model 220 through learning from historical data to enhance accuracy. In yet another embodiment, the refining model 218 refines the AI/ML model 220 based on at least one of, but not limited to, the detected anomaly, the predicted anomaly and the remediation actions. Advantageously, due to a proactive maintenance, the risk hardware failure in the network is reduced.
[0072] The collecting unit 208, the selecting unit 210, the training unit 212, the detecting unit 214, the predicting unit 216, and the refining model 218 in an exemplary embodiment, are implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 202. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 202 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 204 may store instructions that, when executed by the processing resource, implement the processor 202. In such examples, the system 108 may comprise the memory 204 storing the instructions and the processing resource to execute the instructions, or the memory 204 may be separate but accessible to the system 108 and the processing resource. In other examples, the processor 202 may be implemented by electronic circuitry.
[0073] FIG. 3 illustrates an exemplary architecture for the system 108, according to one or more embodiments of the present invention. More specifically, FIG. 3 illustrates the system 108 for detecting anomalies in the network 106. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the UE 102 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0074] FIG. 3 shows communication between the UE 102, the system 108, and the one or more sources 110. For the purpose of description of the exemplary embodiment as illustrated in FIG. 3, the UE 102, uses network protocol connection to communicate with the system 108, and the one or more sources 110. In an embodiment, the network protocol connection is the establishment and management of communication between the UE 102, the system 108, and the one or more sources 110 over the network 106 (as shown in FIG. 1) using a specific protocol or set of protocols. The network protocol connection includes, but not limited to, Session Initiation Protocol (SIP), System Information Block (SIB) protocol, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Simple Network Management Protocol (SNMP), Internet Control Message Protocol (ICMP), Hypertext Transfer Protocol Secure (HTTPS) and Terminal Network (TELNET).
[0075] In an embodiment, the UE 102 includes a primary processor 302, and a memory 304 and a User Interface (UI) 306. In alternate embodiments, the UE 102 may include more than one primary processor 302 as per the requirement of the network 106. The primary processor 302, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0076] In an embodiment, the primary processor 302 is configured to fetch and execute computer-readable instructions stored in the memory 304. The memory 304 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed for detecting anomalies in the network 106. The memory 304 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0077] In an embodiment, the User Interface (UI) 306 includes a variety of interfaces, for example, a graphical user interface, a web user interface, a Command Line Interface (CLI), and the like. The UI 306 of the UE 102 allows the user to view the detected anomalies as well as the predicted anomalies in the network 106. In one embodiment, the user may be at least one of, but not limited to, a network operator.
[0078] As mentioned earlier in FIG.2, the system 108 includes the processors 202, the memory 204 and the storage unit 206, for detecting anomalies in the network 106, which are already explained in FIG. 2. For the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition.
[0079] Further, as mentioned earlier the processor 202 includes the collecting unit 208, the selecting unit 210, the training unit 212, the detecting unit 214, the predicting unit 216, and the refining model 218 which are already explained in FIG. 2. Hence, for the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition. The limited description provided for the system 108 in FIG. 3, should be read with the description provided for the system 108 in the FIG. 2 above, and should not be construed as limiting the scope of the present disclosure.
[0080] FIG. 4 is an exemplary the system 108 architecture 400 for detecting anomalies in the network 106, according to one or more embodiments of the present disclosure.
[0081] The architecture 400 includes an Alarm source 1, an Alarm source 2 and an Alarm source 3 which acts as the one or more sources 110. Herein, the one or more sources 110 are in communication with the network components. The architecture 400 further includes the NMS 402, a pre-processing unit 404, an execution unit 406, a Machine Learning (ML) service 408, the storage unit 206, workflow 410 and the UI 306 communicably coupled to each other via the network 106.
[0082] In one embodiment, the NMS 402 periodically collects the current data associated with the network components from at least one of, the Alarm source 1, the Alarm source 2 and the Alarm source 3. The current data is crucial for monitoring performance of the network components, identifying anomaly, and ensures that system 108 operate smoothly.
[0083] In one embodiment, the pre-processing unit 404 receives the collected current data from the NMS 402 and preprocesses the current data. For example, the network performance data undergoes preprocessing to ensure data consistency within the system 108. In particular, the preprocessing involves tasks like data cleaning, normalization, removing unwanted data like outliers, duplicate records and handling missing values. In yet another example, the raw data is pre-processed to clean, normalize, and convert the raw data into a structured format suitable for analysis. The preprocessing includes verifying the accuracy of current data and ensuring data consistency.
[0084] In one embodiment, the execution unit 406 is designed to analyze and detect anomalies in the network 106 in real time. Based on the learnt historic trends/patterns of historic data by the AI/ML model 220, the execution unit 406 identifies the deviation in the current trends/patterns and detects the anomaly within the current data. Further, the execution unit 406 predicts, at least one of, the future anomaly, the network component failure or other issues in the network 106 using the AI/ML model 220.
[0085] In one embodiment, the ML service 408 refer to platform and tool that provide resources for building, deploying, and managing AI/ML model 220. The ML service 408 preforms the AI/ML model 220 selection and the AI/ML model 220 training. Herein, the AI/ML model 220 learns the historic trends/patterns of historic data and facilitate the execution unit 406 to detect and predict the anomalies.
[0086] In one embodiment, the storage unit 206 includes a structured collection of the preprocessed data, the detected anomaly, the predicted anomaly which are managed and organized in a way that allows system 108 for easy access, retrieval, and manipulation. The storage unit 206 are used to store, manage, and retrieve large amounts of information efficiently.
[0087] In one embodiment, the workflow 410 is a defined sequence of processes or tasks that are carried out to complete a specific goal or project. The workflow 410 involves the coordination of components in the architecture, resources, and tools to ensure that work is completed efficiently and effectively. In particular, the workflow 410 retrieves the information pertaining to the predicted anomaly from the storage unit 206 and provides the visual representation on the UI 306.
[0088] FIG. 5 is a signal flow diagram illustrating the flow for detecting anomalies in the network 106, according to one or more embodiments of the present disclosure.
[0089] At step 502, the system 108 collects current data associated with the network components from the one or more sources 110. In one embodiment, the system 108 transmits at least one of, but not limited to, a Hyper Text Transfer Protocol (HTTP) request to the one or more sources 110 to collect the current data. In one embodiment, a connection is established between the system 108 and the one or more sources 110 before collecting the current data. Further, the current data is integrated and preprocessed by the system 108.
[0090] At step 504, the system 108 selects at least one AI/ML model 220 from the plurality of AI/ML models 220 to detect anomalies related to the current data collected from the one or more sources 110.
[0091] At step 506, the system 108 trains the selected AI/ML model 220 with at least one of, historic trends/patterns associated with the network components.
[0092] At step 508, the system 108 utilizes the collected current data to detect the anomaly associated with the collected current data by using the selected AI/ML model 220. Herein, the system 108 identifies the deviation within the current data when at least one of, the current trends/patterns deviate from at least one of, the historic trends/patterns associated with the network components. When the identified deviation breached the one or more thresholds, then the system 108 detects the anomaly.
[0093] At step 510, the system 108 transmits at least one of, the alerts or the remediation actions to the user regarding the detected anomaly. Herein, the system 108 transmits at least one of, the alerts or the remediation actions to the user by at least one of, but not limited to, the HTTP request. The user can view the alerts or the remediation actions on the UI 306 of the UE 102.
[0094] FIG. 6 is a flow diagram of a method 600 for detecting anomalies in the network 106, according to one or more embodiments of the present invention. For the purpose of description, the method 600 is described with the embodiments as illustrated in FIG. 2 and should nowhere be construed as limiting the scope of the present disclosure.
[0095] At step 602, the method 600 includes the step of collecting the current data from one or more sources 110. In one embodiment, the collecting unit 208 retrieves the current data from the one or more sources 110. In particular, the collecting unit 208 utilizes the one or more APIs for retrieving the current data from the one or more sources 110. Further, the current data retrieved from the one or more sources 110 is integrated by the collecting unit 208. Thereafter, the integrated data is preprocessed by the the collecting unit 208 to ensure the data consistency and quality within the system 108.
[0096] At step 604, the method 600 includes the step of selecting the one or more AI/ML models 220 from the plurality of AI/ML models 220 to detect anomalies. In one embodiment, the selecting unit 210 selects the AI/ML model 220 based on the type of the collected current data. For example, if the collected current data is in the form of, at least one of, but not limited to, text and images, then the AI/ML model 220 such as a Natural Language Processing (NLP) model is selected by the selecting unit 210. Further, the selected AI/ML model 220 is trained with at least one of, but not limited to, historic trends/patterns associated with the network components in the network 106.
[0097] At step 606, the method 600 includes the step of identifying using the selected AI/ML model 220, the deviation within the current data when at least one of, the current trends/patterns deviate from at least one of, the historic trends/patterns. In one embodiment, the detecting unit 214 identifies the deviation within the current data. For example, let us assume, that the network traffic handling capacity of the network component is in a range of 8000-10000 requests in a day. When the network traffic deviates from the range of 8000-10000 requests, then the deviation is identified and the detecting unit 214 infers that there is the possibility of the presence of the anomaly.
[0098] At step 608, the method 600 includes the step of detecting, using the selected AI/ML model 220, the anomaly based on the identified deviation. In one embodiment, the detecting unit 214 detects the anomaly. For example, the trained AI/ML model 220 sets the one or more thresholds based on the learnt trends/patterns of historic data. Further, based on the identified deviation of the current trends/patterns the detecting unit 214 detects the anomaly.
[0099] For example, let us assume that the current data includes the data metric data related to the network traffic handling capacity of the network component. Let us assume that the network traffic handling capacity of the network component is 10000 requests in a day which acts as the one or more thresholds. Subsequently, let us say on next day, the load of the network traffic increases to 25000 requests. Herein, using the trained model 220, the detecting unit 214 determines unusual patterns in the network traffic. During this situation, since the network traffic (25000 requests) breaches the one or more thresholds (10000 requests), the unusual pattern in network traffic is inferred as the anomaly.
[00100] Upon detecting the anomaly, the alerts or notifications are provided to the user along with the remediation actions to resolve the detected anomaly. In one embodiment, upon detecting the anomaly, the predicting unit 216 is configured to predict, at least one of, the future anomaly, the network component failure or other issues in the network 106 using the trained AI/ML model 220. For example, let us assume that, for the network component the ideal temperature ranges the handling the heat or temperature is 40°C to 50°C. In one scenario, if the temperature of the network component is breaching the ideal range, then the predicting unit 216 predicts that in some time interval there is the possibility of the network component failure due to the high temperature.
[00101] Furthermore, based on the prediction, at least one of, the alerts or notifications along with the remediation actions is provided to the user in order to avoid the network component failure. Advantageously, due to the predictive analytics and proactive maintenance of the network component the risk of hardware failure is avoided.
[00102] In yet another aspect of the present invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by a processor 202. The processor 202 is configured to collect current data from one or more sources 110. The processor 202 is further configured to select one or more AI/ML models 220 from the plurality of AI/ML models 220 to detect anomalies, the one or more AI/ML models 220 are selected based on a type of data for which anomaly is required to be detected. The processor 202 is further configured to identify, using the selected one or more AI/ML models 220, a deviation within the current data when at least one of, current trends/patterns deviate from at least one of, the historic trends/patterns. The processor 202 is further configured to detect using the selected one or more AI/ML models 220 an anomaly based on the identified deviation.
[00103] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-6) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[00104] The present disclosure provides technical advancements where the system offers real-time anomaly detection for network performance, configuration, and physical status, allowing for timely issue resolution. Metric data collected from network devices are verified for accuracy, ensuring reliable analysis and decision-making. By assessing the physical status of network components, the system enables proactive maintenance and reduces the risk of hardware failures. Utilizing historical data, the system employs predictive analytics to forecast potential anomalies and hardware issues, allowing for preventive measures. The system provides an integrated view of network health, combining performance metrics, configuration data, and physical status assessment for a holistic perspective. Reduced downtime, improved resource allocation, and proactive maintenance leads to cost savings for network operations.
[00105] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS

[00106] Environment - 100;
[00107] User Equipment (UE) - 102;
[00108] Server - 104;
[00109] Network- 106;
[00110] System -108;
[00111] One or more sources – 110;
[00112] Processor - 202;
[00113] Memory - 204;
[00114] Storage unit – 206;
[00115] Collecting unit – 208;
[00116] Selecting unit – 210;
[00117] Training unit – 212;
[00118] Detecting unit – 214;
[00119] Predicting unit – 216;
[00120] Refining model– 218;
[00121] AI/ML Model – 220;
[00122] Primary Processor – 302;
[00123] Memory – 304;
[00124] User Interface (UI) – 306;
[00125] NMS– 402;
[00126] Pre-processing unit - 404;
[00127] Execution unit – 406;
[00128] ML service – 408;
[00129] Workflow – 410.

,CLAIMS:CLAIMS
We Claim:
1. A method (600) for detecting anomalies in a network (106), the method (600) comprising the steps of:
collecting, by one or more processors (202), current data from one or more sources (110);
selecting, by the one or more processors (202), one or more Artificial Intelligence/Machine Learning (AI/ML) models (220) from the plurality of AI/ML models (220) to detect anomalies, wherein the one or more AI/ML models (220) are selected based on a type of data for which anomaly is required to be detected;
identifying, by the one or more processors (202), using the selected one or more AI/ML models (220), a deviation within the current data when at least one of, current trends/patterns deviate from at least one of, the historic trends/patterns; and
detecting, by the one or more processors (202), using the selected one or more AI/ML models (220), an anomaly based on the identified deviation.

2. The method (600) as claimed in claim 1, wherein the current data includes at least one of, metrics data, configuration data, physical status data.

3. The method (600) as claimed in claim 1, wherein the one or more selected AI/ML models (220) are trained with at least one of, historic trends/patterns.

4. The method (600) as claimed in claim 1, wherein when the current data pertains to physical status of network components, the step of, detecting, the anomaly, includes the steps of:
determining, by the one or more processors (202), using the AI/ML models (220) if the identified deviation breaches one or more thresholds associated to the physical status data of the network components; and
in response to determining the breach, inferring, by the one or more processors (202), presence of the anomaly with respect to the current data pertaining to the physical status of the network components.

5. The method (600) as claimed in claim 4, wherein the physical status data is received from the one or more sources (110) which includes at least one of, a sensor, the sensor retrieves the physical status data from the network components.

6. The method (600) as claimed in claim 4, wherein the anomaly with respect to the physical status data represents issues with the network components.

7. The method (600) as claimed in claim 1, wherein the method (600) further comprising the step of:
predicting, by the one or more processors (202), at least one of, future anomaly, network component failure or other issues in the network (106) using the AI/ML models (220).

8. The method (600) as claimed in claim 1, wherein the method (660) further comprising the step of:
refining, by the one or more processors (202), the AI/ML models (220) by enabling the AI/ML models (220) to learn at least one of, new patterns/trends or new values in real time based on receiving new data from the one or more sources (110).

9. The method (600) as claimed in claim 1, wherein the step of, detecting, using the selected one or more AI/ML models (220), an anomaly with the current data, further includes the steps of:
generating, by the one or more processors (202), at least one of:
alerts or notifications, in response to detecting the anomaly; or
remediation actions to resolve the anomaly; and
transmitting, by the one or more processors (202), at least one of, the alerts or the remediation actions to a user.

10. A system (108) for detecting anomalies in a network (106), the system (108) comprising:
a collecting unit (208), configured to, collect, current data from one or more sources (110);
a selecting unit (210), configured to, select, one or more Artificial Intelligence/Machine Learning (AI/ML) models (220) from the plurality of AI/ML models (220) to detect anomalies, wherein the one or more AI/ML models (220) are selected based on a type of data for which anomaly is required to be detected; a detecting unit (214), configured to, identify, using the selected one or more AI/ML models (220), a deviation within the current data when at least one of, current trends/patterns deviates from at least one of, the historic trends/patterns; and
the detecting unit (214), configured to, detect, using the selected one or more AI/ML models (220), an anomaly based on the identified deviation.

11. The system (108) as claimed in claim 10, wherein the current data includes at least one of, metrics data, configuration data, physical status data.

12. The system (108) as claimed in claim 10, wherein the one or more selected AI/ML models (220) are trained with at least one of, historic trends/patterns.

13. The system (108) as claimed in claim 10, wherein when the current data pertains to physical status of network components, the detecting unit (214) detects, the anomaly, by:
determining, using the AI/ML models (220) if the identified deviation breaches one or more thresholds associated to the physical status data of the network components; and
in response to determining the breach, inferring, presence of the anomaly with respect to the current data pertaining to physical status of network components.

14. The system (108) as claimed in claim 13, wherein the physical status data is received from the one or more sources (110) which includes at least one of, a sensor, the sensor retrieves the physical status data from the network components.

15. The system (108) as claimed in claim 13, wherein the anomaly with respect to the physical status data represents issues with the network components.

16. The system (108) as claimed in claim 10, wherein the system (108) further comprising a predicting unit (216), configured to predict at least one of, future anomaly, network component failure or other issues in the network (106) using the AI/ML models (220).

17. The system (108) as claimed in claim 10, wherein the system (108) further comprising:
a refining model (218), configured to, refine, the AI/ML models (220) by enabling the AI/ML models (220) to learn at least one of, new patterns/trends or new values in real time based on receiving new data from the one or more sources (110).

18. The system (108) as claimed in claim 10, wherein the detecting unit (214) is further configured to:
generate, at least one of:
alerts or notifications, in response to detecting the anomaly; or
remediation actions to resolve the anomaly; and
transmit, at least one of, the alerts or the remediation actions to a user.