DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
METHOD AND SYSTEM FOR DETECTING ANOMALY RELATED TO NETWORK QUALITY
2. APPLICANT(S)
Name Nationality Address
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3. PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to the field of network management and maintenance and, more specifically, to a system and a method thereof for detecting anomaly related to network quality.
BACKGROUND OF THE INVENTION
[0002] With the increase in number of users, the network service provisions have to be upgraded to incorporate increased users and to enhance the service quality so as to keep pace with such high demand. There are a lot of factors that need to be cared for when considering the quality of a network. To maintain the health of a network regular monitoring of various parameters has to be done, like monitoring performance of various network elements and network functions etc. The network functions play a vital role in improving the quality of a network by the way of managing traffic, delegating node allocation, managing performance of routing device etc. A network function is associated with micro-services executing several tasks in parallel. The data generated by the network services are vast and analysis of such data is essential for enhancement of user experience and to improve service quality. The network functions in a network generate an immense amount of performance data, including key performance indicators (KPIs) and counters. Over time, there are observable gradual but significant deteriorations in network quality which are clearly reflected by values of KPIs, counters and other parameters. The quality degradation is severely impacting user experience. To sort out anomalies, problem that are causing network degradation and detecting the root causes of quality degradation and taking corrective actions is a painstakingly manual process involving individual analysis of collected data that can be measured in tera-bytes (TB). Analyzing the massive volume of performance data for anomalies and trends consumed valuable time and resources.
[0003] In the contemporary network maintenance and management approach, the steps are taken to resolve issues after the problem occurs which is accompanied by service disruption and downtime. Usual network management is primarily reactive, where the approach is to address network quality issues only after they are reported by users or when they resulted in noticeable service disruptions. This reactive approach negatively impacted user satisfaction and service reliability. This approach also causes inefficient allocation of resources thus adding onto unnecessary operational cost.
[0004] There is a requirement of a system and method thereof to monitor the network parameters regularly, estimate quality by analysis of network data, prompting regular up-gradation of network quality by maintenance and taking proactive approach to resolve problems and anomalies.
SUMMARY OF THE INVENTION
[0005] One or more embodiments of the present disclosure provide a method and system for detecting anomaly related to network quality.
[0006] In one aspect of the present invention, the system for detecting the anomaly related to the network quality is disclosed. The system includes a transceiver configured to receive, network performance data from one or more data sources. The system further includes a training unit, configured to, train, a model with the network performance data. The training unit is further configured to train one of patterns and trends of a normal network behavior from the network performance data. The system further includes a monitoring unit, configured to, monitor, current network performance data. The system further includes a detecting unit, configured to, detect, utilizing the trained model, one or more anomalies pertaining to the network quality with the current network performance data when determined that the current network performance data deviates from the learnt one of patterns and trends of the normal network behaviour.
[0007] In an embodiment, the one or more data sources include at least one of, one or more network functions or performance manager .
[0008] In an embodiment, the network performance data includes at least one of, network performance metrics. The network performance metrics include at least one of latency, throughput, bandwidth usage, packet loss, error rates and network traffic volume during network function operations in the network.
[0009] In an embodiment, on receipt of the current network performance data, a preprocessing unit is configured to preprocess the received network performance data.
[0010] In an embodiment, one of the patterns and the trends of the normal network behaviour include at least one of, learnt values and learnt range of values pertaining to the normal network behaviour.
[0011] In an embodiment, the detecting unit detects, utilizing the trained model, the one or more anomalies pertaining to the network quality with the current network performance data. The detecting involves extracting, one or more current values from the current network performance data and comparing, the one or more current values with one or more learnt values. When the one or more current values deviates from the one or more values pertaining to the learnt one of the patterns and the trends, the detecting unit detects, the one or more anomalies pertaining to the network quality with the current network performance data.
[0012] In an embodiment, the current network performance data is real time data monitored by the one or more processors.
[0013] In an embodiment, the system further includes an analysis engine, configured to perform, a Root Cause Analysis (RCA) on the current network performance data when the one or more anomalies are detected.
[0014] In an embodiment, the analysis engine performs, the RCA on the current network performance data when the one or more anomalies are detected. The RCA involves identifying, one or more network quality parameters which include the one or more anomalies. The RCA further involves determining, one or more potential causes for the one or more anomalies by correlating the identified one or more network quality parameters and the one or more anomalies with a pre-defined list of potential causes stored in a storage unit.
[0015] In an embodiment, the transceiver is further configured to transmit alerts and/or notifications to a user pertaining to the detected one or more anomalies.
[0016] In another aspect of the present invention, the method for detecting the anomaly related to the network quality is disclosed. The method includes the step of receiving by one or more processors, network performance data from one or more data sources. The method further includes the step of training, by the one or more processors, a model with the network performance data. The model is trained to learn one of patterns and trends of a normal network behaviour from the learnt network performance data. The method further includes the step of monitoring, by the one or more processors, current network performance data. The method further includes detecting, by the one or more processors, one or more anomalies pertaining to the network quality with the current network performance data. The method detects anomalies by utilizing the trained model, when determined that the current network performance data deviates from the learnt one of the patterns and the trends of the normal network behaviour.
[0017] In another aspect of invention, User Equipment (UE) is disclosed. The UE includes one or more primary processors communicatively coupled to one or more processors, the one or more primary processors coupled with a memory. The processor causes the UE to receive one or more alerts and/or notifications pertaining to one or more anomalies in the network.
[0018] In another aspect of the invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions is disclosed. The computer-readable instructions are executed by a processor. The processor is configured to receive, network performance data from one or more data sources. The processor is further configured to train a model with network performance data. The processor is configured to train the model to learn one of the patterns and the trends of a normal network behaviour from the network performance data. The processor is further configured to monitor current network performance data. The processor is further configured to detect, utilizing the trained model, one or more anomalies pertaining to the network quality with the current network performance data when determined that the current network performance data deviates from the learnt one of the patterns and the trends of the normal network behaviour.
[0019] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.
BRIEF DESCRIPTION OF THE DRAWINGS
[0020] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0021] FIG. 1 is an exemplary block diagram of an environment for detecting anomaly related to network quality according to one or more embodiments of the present invention;
[0022] FIG. 2 is an exemplary block diagram of a system for detecting the anomaly related to the network quality according to one or more embodiments of the present invention;
[0023] FIG. 3 is a schematic representation of a workflow of the system of FIG. 1, according to the one or more embodiments of the present invention;
[0024] FIG. 4 is an exemplary block diagram of an architecture implemented in the system to the FIG. 2, according to one or more embodiments of the present invention;
[0025] FIG. 5 is a flowchart for detecting the anomaly related to the network quality according to one or more embodiments of the present invention; and
[0026] FIG. 6 is a schematic representation of a method of detecting the anomaly related to the network quality according to one or more embodiments of the present invention.
[0027] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0028] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0029] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0030] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0031] FIG. 1 illustrates an exemplary block diagram of an environment 100 for detecting anomaly related to quality of a network 105, according to one or more embodiments of the present disclosure. In this regard, the environment 100 includes a User Equipment (UE) 110, a server 115, the network 105 and a system 120 communicably coupled to each other for detecting the anomaly related to the network 105 quality. The anomaly refers to any deviation in the network 105 performance from one of predefined patterns and expected trends for a proper functioning of the network 105. The network 105 quality refers to how well the network 105 functions in delivering data and services. The network quality is determined by performance parameters including, but not limited to latency, bandwidth, connection stability, response time and network 105 congestion.
[0032] As per the illustrated embodiment and for the purpose of description and illustration, the UE 110 includes, but not limited to, a first UE 110a, a second UE 110b, and a third UE 110c, and should nowhere be construed as limiting the scope of the present disclosure. In alternate embodiments, the UE 110 may include a plurality of UEs as per the requirement. For ease of reference, each of the first UE 110a, the second UE 110b, and the third UE 110c, will hereinafter be collectively and individually referred to as the “User Equipment (UE) 110”.
[0033] In an embodiment, the UE 110 is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as a smartphone, virtual reality (VR) devices, augmented reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0034] The environment 100 includes the server 115 accessible via the network 105. The server 115 may include, by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, one or more processors executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0035] The network 105 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 105 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0036] The network 105 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth. The network 105 may also include, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, a VOIP or some combination thereof.
[0037] The environment 100 further includes the system 120 communicably coupled to the server 115 and the UE 110 via the network 105. The system 120 is configured for detecting the anomaly related to the network 105 quality. As per one or more embodiments, the system 120 is adapted to be embedded within the server 115 or embedded as an individual entity.
[0038] Operational and construction features of the system 120 will be explained in detail with respect to the following figures.
[0039] FIG. 2 is an exemplary block diagram of the system 120 for detecting the anomaly related to the network 105 quality, according to one or more embodiments of the present invention.
[0040] As per the illustrated embodiment, the system 120 includes one or more processors 205, a memory 210, a user interface 215, and a storage unit 220. For the purpose of description and explanation, the description will be explained with respect to one processor 205 and should nowhere be construed as limiting the scope of the present disclosure. In alternate embodiments, the system 120 may include more than one processor 205 as per the requirement of the network 105. The one or more processors 205, hereinafter referred to as the processor 205 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0041] As per the illustrated embodiment, the processor 205 is configured to fetch and execute computer-readable instructions stored in the memory 210. The memory 210 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to create or share data packets over a network service. The memory 210 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0042] In an embodiment, the user interface 215 includes a variety of interfaces, for example, interfaces for a graphical user interface, a web user interface, a Command Line Interface (CLI), and the like. The user interface 215 facilitates communication of the system 120. In one embodiment, the user interface 215 provides a communication pathway for one or more components of the system 120. The examples of such components include, but are not limited to, the UE 110 and the storage unit 220.
[0043] The storage unit 220 is one of, but not limited to, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of storage unit 220 types are non-limiting and may not be mutually exclusive e.g., a database 220 can be both commercial and cloud-based, or both relational and open-source, etc.
[0044] In order for the system 120 to detect the anomaly related to the network quality, the processor 205 includes one or more modules. In one embodiment, the one or more modules includes, but not limited to, a transceiver 225, a preprocessing unit 230, a training unit 235, a monitoring unit 240, a detecting unit 245 and an analysis engine 250 communicably coupled to each other detecting the anomaly related to the network quality.
[0045] In one embodiment, the one or more modules are used in combination or interchangeably for detecting the anomaly related to the network 105 quality.
[0046] The transceiver 225, the preprocessing unit 230, training unit 235, the monitoring unit 240, the detecting unit 245 and the analysis engine 250 in an embodiment, may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 205. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 205 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 210 may store instructions that, when executed by the processing resource, implement the processor 205. In such examples, the system 120 may comprise the memory 210 storing the instructions and the processing resource to execute the instructions, or the memory 210 may be separate but accessible to the system 120 and the processing resource. In other examples, the processor 205 may be implemented by electronic circuitry.
[0047] In one embodiment, the transceiver 225, is configured to receive network performance data from one or more data sources. The network 105 in the present embodiment is the structured system of interconnected devices and components that facilitate the exchange of data and communication between users, applications and services. The network 105 includes but is not limited to routers, switches, firewalls, performance managers, load balancers, wireless access points, network functions virtualization components and end user devices. The network performance data includes at least one of network performance metrics. The network performance metrics refer to specific parameters that describe the performance of the network 105. The parameters considered to identify the performance metrics include but are not limited to latency, throughput, bandwidth usage, packet loss, error rates and network traffic volume during network function operations in the network 105.
[0048] In an embodiment, the one or more data sources refer to the origins from which the network performance data is collected. The one or more data sources include at least one of, one or more network functions or an performance manager . The network functions are functional components within the network 105.
[0049] In an embodiment, the one or more network functions include at least one of, but not limited to, routers, switches, gateways and servers. The functions undertaken by the one or more network functions involve both physical as well as virtual or software defined functions. In an embodiment, the performance manager is a dedicated system which is configured to collect, aggregate and monitor network performance metrics. The functioning of each network functions or performance manager generates performance metrics associated with the network 105.
[0050] In an embodiment, once the real time network performance data is received, the data is pre-processed by the preprocessing unit 230. In an embodiment, the data received from the data sources is raw data. The raw data is heterogenous with diverse formats and range. The raw data is not suitable for training models. The model refers to complex algorithms or statistical models that learn from training on a given data. The raw data is transformed into standardized data through data pre-processing. In this regard, the preprocessing unit 230 is configured to perform at least one of, but not limited to, data cleaning, data normalization or scaling, aggregation and summarization, conversion of formats, filtering unnecessary data, time synchronization and data labeling. By doing so, the received data is made ready for the model training.
[0051] Upon receiving data on the performance metrics from different data sources and converting the network performance data (or simply referred to as the data) into standardized data, the training unit 235, trains the model with the standardized data. The training of the model includes feeding the standardized data into the model. The model processes the data utilizing the computational or statistical framework with which the model is formulated. The diverse learning models include supervised learning models, unsupervised learning models, semi-supervised learning models, reinforcement learning models and deep learning models. The insights from the training include identifying one of the patterns and the trends and understanding threshold values essential for optimized performance of the network 105. The one of the patterns and the trends of a normal network behaviour include at least one of, learnt values and learnt range of values pertaining to the normal network behaviour. In an exemplary embodiment, one or more components of the network 105 is configured to one of process and execute a request received form the UE 110 within a predefined time period. The predefined time period is defined by an operator considering factors such as, but not limited to, network traffic and resources allocated. If the one or more network components one of processes and executes the request within the predefined time period, the network 105 is deemed to showcase normal network behaviour. Further, if the one or more network components fails to one of processes and executes the request within the predefined time period, the network 105 is deemed to showcase abnormal network behaviour.
[0052] In an embodiment, the model is trained by reinforcement learning. The reinforcement learning is a machine learning method where a model learns to make decisions by interacting with an environment. The model finds out which decision leads to the optimal outcome so that the decision-making ability of the model is refined gradually. The optimal outcome refers to accurate data transmission with reduced latency and data packet loss in the network 105. In the present invention, the model is trained with real time performance metrics and actions taken for any deterioration of performance metrics in the network 105. For example, the model explores decisions of at least one of adjusting bandwidth or rerouting traffic when the there is network congestion within the network 105 to find out which decision delivered the optimized outcome to avoid congestion and retain seamless data transmission in the network 105. The reinforcement learning of the model allows the model to take decisions which delivers optimized outcome, whenever the network congestion occur in future in the network 105.
[0053] Based on the insights gained during the learning, the model is configured to identify patterns on a new data. The new data is the real time data that is not familiarized by the model previously during learning but is new to the model.
[0054] Upon training the model, the monitoring unit 240 monitors the current network performance data. The current network performance data is real time performance data that is immediate, updated at every given moment of time and is new to the model. The performance data of the current network is the data pertaining to the quality of performance of the network 105 in real time, based on parameters, including but not limited to latency, throughput, bandwidth usage, packet loss, error rates and network traffic volume.
[0055] Upon monitoring the performance of the current network, the detecting unit 245 detects one or more anomalies associated with the network quality in the current network performance data. The detecting unit 245is able to do the detection by extracting the current values from the current network performance data and comparing the one or more current values from the current network performance data with one or more learnt values. The values of the performance parameters of the network in real time is received as the current network performance data. The learnt values of the network performance parameters include at least one of thresholds or range of values pertaining to the normal network behaviour as learnt by the model during the training.
[0056] In an embodiment, upon comparison of one or more current values in the current network performance data with one or more values learnt by the model, one or more deviations in the current network performance data are detected. When the one or more current values deviate from the one or more learnt values, it is a deviation from the normal network behaviour. This is because the learnt values pertain to performance parameters of normal network behaviour. For example, during training, the model learns that average latency in the network 105 under normal operation is between 50 ms to 80 ms. The latency is the time taken for a data packet to be transmitted from one point to another in the network 105.The trained model learns that the latency of 50 ms to 80 ms is the value or range of values pertaining to the normal network behaviour. If the model observes that the latency in the current or real time network data exceeds 50 ms to 80 ms, say, 100 ms, then the detecting unit 245 detects the existence of a deviation in the latency of the current network performance. The deviation from the normal network behaviour is detected as one or more anomalies in the current network performance data by the detecting unit 245.
[0057] Upon detecting the anomalies, analysis engine 250 is configured to perform, Root Cause Analysis (RCA) on the current network performance data. The RCA is conducted on the current network performance data when the one or more anomalies are detected. The RCA is conducted by identifying, one or more network quality parameters which include the one or more anomalies. The RCA is conducted by determining, one or more potential causes for the one or more anomalies by correlating the identified one or more network quality parameters and the one or more anomalies with a pre-defined list of potential causes stored in a storage unit 220. The list of potential causes for the anomalies include hardware failure, network congestion, misconfiguration of Quality of Service (QoS) policy, external interferences and software bugs. For example, if there is a packet loss in a specific area of the network 105, the root cause for the anomaly may be a damaged fiber optic cable which is a hardware failure.
[0058] Upon detecting the one or more anomalies by the detecting unit 245, the transceiver 225 is further configured to transmit alerts and notifications to the users, via the user interfaces 215 to the UE 110. The alerts are warnings on the one or more anomalies in the current network performance data. The notifications include at least one of warnings of one or more anomalies and recommendations for correcting the one or more anomalies in the network performance data. For example, the detecting unit detects a spike in latency deviating from the normal network behaviour affecting several customers using the network 105. The alerts are sent via at least one of e-mail, SMS, dashboard or other tools. Upon the transmission of alerts and notifications to the user, the user is able to take appropriate actions to correct the one or more anomalies.
[0059] The data on the performance parameters, one or more detected anomalies and root causes of the one or more anomalies are stored in the storage unit 220. The stored data in the storage unit 220 enables the system 120 to detect one or more anomalies related to network quality whenever the one or more anomalies occur later. The stored data is further used to train the model to learn detecting one or more anomalies, the root causes of the each of the one or more anomalies and explore decision making in transmitting appropriate alerts and notifications. The automated real time training of the model enables the system to detect similar anomalies and take actions easier and quicker.
[0060] In an embodiment, once the one or more anomaly in the current network performance is detected, auto optimization or self-tuning of the network happens using reinforcement learning of the trained model. The self-tuning in the present invention refers to adopting the most apt value to resolve the identified anomaly in the current network performance data. The apt value in self-tuning in the present invention refers to the apt value for a detected anomaly is the possible resolution that can eliminate the detected anomaly and bring back the normal network behaviour without increase in one or more network quality parameters. The increase in network parameters including but not limited to latency, data packet loss, error rate, and network traffic. The trained model learns the one or more anomalies in the network performance data, the alerts and notifications transmitted pertaining to the detected one or more anomalies in the network performance data. The trained model utilizing the learning explores the optimally suitable action to be taken when the one or more anomalies are detected in the current network performance data. For example, when one anomaly is detected, and action of self-tune action has been done. For the action, one value is provided, suppose A. Further, if the problem has not been resolved with the action, another action is to be performed. For the second action another value is provided, say B. Further if the action for A and B does not resolve the anomaly, a third action is to be performed corresponding to which value C is provided. The action and value continue until most apt quality of network is retained eliminating the detected anomaly, Further the action and values are treated as training data for the model. The training refines the model facilitating the system 120 to adopt apt actions for similar anomaly in future. The system 120 auto recovers or self-tunes the current network performance to the most apt value of performance avoiding the degradation of the network quality. The proactive issue resolution enhances customer satisfaction and retention.
[0061] FIG. 3 describes a preferred embodiment of the system 120 of FIG. 2, according to various embodiments of the present invention. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the first UE 110a and the system 120 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0062] As mentioned earlier in FIG. 1, each of the first UE 102a, the second UE 110b, and the third UE 110c may include an external storage device, a bus, a main memory, a read-only memory, a mass storage device, communication port(s), and a processor. The exemplary embodiment as illustrated in FIG. 3 will be explained with respect to the first UE 110a without deviating from the scope of the present disclosure and the limiting the scope of the present disclosure. The first UE 110a includes one or more primary processors 305 communicably coupled to the one or more processors 205 of the system 120.
[0063] The one or more primary processors 305 are coupled with a memory 210 storing instructions which are executed by the one or more primary processors 305. Execution of the stored instructions by the one or more primary processors 305 enables the first UE 110a to receive one or more alerts and notifications pertaining to one or more anomalies.
[0064] As mentioned earlier in FIG. 2, the one or more processors 202 of the system 120 is configured to detect anomaly related to network quality. As per the illustrated embodiment, the system 120 includes the one or more processors 205, the memory 210, the user interface 215, and the database 220. The operations and functions of the one or more processors 205, the memory 210, the user interface 215, and the database 220 are already explained in FIG. 2. For the sake of brevity, a similar description related to the working and operation of the system 120 as illustrated in FIG. 2 has been omitted to avoid repetition.
[0065] Further, the processor 202 includes the transceiver 225, the preprocessing unit 230, the training unit 235, the training unit 235, the monitoring unit 240, the detecting unit 245 and the analysis engine 250. The operations and functions of the transceiver 225, the preprocessing unit 230, training unit 235, monitoring unit 240, the detecting unit 245 and the analysis engine 250 are already explained in FIG. 2. Hence, for the sake of brevity, a similar description related to the working and operation of the system 120 as illustrated in FIG. 2 has been omitted to avoid repetition. The limited description provided for the system 120 in FIG. 3, should be read with the description as provided for the system 120 in the FIG. 2 above, and should not be construed as limiting the scope of the present disclosure.
[0066] FIG. 4 is an exemplary block diagram of an architecture 300 implemented in the system of the FIG. 2, according to one or more embodiments of the present invention;
[0067] The architecture 400 includes a processing and analytics hub 405, a data lake 420, and the user interface 215. The processing and analytics hub 405 includes a data integrator 410, a data preprocessing unit 415, a model training unit 425 and a degradation detection unit 430.
[0068] In an embodiment, the network performance data from one or more data sources are accessed to the processing and analytics hub 405 by the data integrator 410.The data sources in the present inventions include one or more network functions or performance manager. The network performance data pertains to atleast network performance metrics. The network performance metrics refers to parameters that determines the quality of network performance. The parameters to determine the network performance in the present invention include but are not limited to latency, throughput, bandwidth usage, error rates, packet loss and network traffic volume. The parameters are considered during the network function operations in the network 105 to determine the network performance.
[0069] Upon integrating the network performance data by the data integrator 410, the data preprocessing unit 415 processes the received data. The received data is raw data. The raw data is heterogenous with diverse formats. The raw data is not appropriate to train the model. The raw data is not suitable for analysing by the model. The raw data is standardized by pre-processing. The pre-processing includes but not limited to, data cleaning, data normalization, conversion of formats, time synchronization and data labeling.
[0070] Upon pre-processing of data by the data preprocessing unit 415, the standardized data is provided to the model training unit 425. The model training unit 425 applies the given dataset onto the model. The model learns the one of the patterns and the trends of a normal network behaviour from the network performance data. The learnt one of the patterns and the trends of the normal network behaviour include atleast one of, values and range of values pertaining to the normal network behaviour. The normal network behaviour refers to the typical performance of the network 105 under usual operating conditions.
[0071] In an embodiment, the learnt values and learnt range of values pertaining to the normal network behaviour is stored in the data lake 420. The data lake 420 is further configured to store the insights of one of the patterns and the trends learnt by the model.
[0072] Upon training of model and detecting the one of the patterns and the trends of the normal network behaviour in the model training unit 425, the degradation detection unit 430 detects one or more anomalies pertaining to the network quality of the current network performance. The one or more anomalies in the current network performance data is detected by extracting one or more current values from the current network performance data and comparing the one or more current values with one or more learnt values. The degradation detection unit 430 continuously monitors the incoming data. If one or more values of current network performance metrics deviates from the one or more learnt values, the degradation detection unit 430 detects one or more anomalies. The one or more deviations in the incoming real time or current performance data are detected by the degradation detection unit 430 as one or more anomalies.
[0073] In an embodiment, the degradation detection unit 430 detects the root cause of quality deterioration in the network 105. The Root Cause Analysis (RCA) is performed on the current network performance data when the one or more anomalies are detected. The RCA involves identifying one or more network quality parameters and determining, one or more potential causes for the one or more detected anomalies. The network quality parameters include but not limited to, latency, throughput, bandwidth usage, packet loss, error rates and network traffic volume during network function operations in the network 105. The RCA further involves determining root cause for the one or more anomalies. The root cause is done by correlating the identified one or more network quality parameters and the one or more anomalies with a list of potential causes stored in the data lake 420. The list of causes enables the system 120 to find the root cause of one or more anomalies associated with one or more network quality parameters. The network quality parameters, the detected anomaly and the corresponding root cause is further stored in the data lake 420. The RCA enables the system 120 to detect one or more similar anomalies occurring in the course of time.
[0074] Upon detecting the anomalies and the root causes of the anomalies, the system 120 transmits alerts and/or notifications to a user. The alerts and/or notifications pertain to the detected one or more anomalies. Each of the alerts and/or notifications are unique to each of the parameters and the corresponding anomalies. The alerts are warnings on the detected anomalies. The notifications include at least warnings or recommendations on the action to be taken on the detected anomalies. The alerts and/or notifications enable the user to take up corrective action on the detected anomalies, reducing the manual determination of anomalies and location where anomalies occur in future.
[0075] FIG. 5 is a flow diagram for detecting the anomaly related to the network quality, according to one or more embodiments of the present invention.
[0076] At step 505, the system 120 receives data pertaining to the network performance data from one or more data sources at the performance manager -system interface. The network performance data refers to the network performance metrics. The network performance metrics includes parameters including but not limited to latency, throughput, bandwidth usage, packet loss, error rates and network traffic volume during network function operations in the network 105. The data sources from where the network performance data is received, include, but not limiting to the network performance metrics and performance manager. The received network performance data is raw data which is not suitable for model training. Therefore, the received data is transformed to standardized data.
[0077] At step 510, the standardized data is analysed to understand one of the patterns and the trends. The one of the patterns and the trends are related to learnt values and learnt range of values pertaining to normal network behaviour. These values pertain to performance metrics of the network 105 which are essential for an optimized functioning of the network 105.
[0078] At step 510, the system 120 monitors the network continuously. The real time incoming data regarding the performance of the network are monitored by the system 120.
[0079] At step 515, upon monitoring the incoming data, the system 120 detects one or more anomalies. The one or more anomalies are events when the performance metrics of the incoming data deviates from the learnt one of the patterns and the trends. The incoming data pertains to the current network performance metrics. The learnt one of the patterns and the trends pertains to the values or range of values of the normal network behaviour as learnt by the model during training. At step 520, the model is trained to detect one or more anomalies whenever incoming data is received by the system 120 from different sources.
[0080] At step 525, the detection of one or more anomalies as the output of the model is being checked.
[0081] At step 530, if the model output of detection of one or more anomalies is not optimal, the model is retrained to make the output optimal. The model output is said to be not optimal if the detection of one or more anomalies is distorted and does not deliver sufficient accuracy and precision. The insufficient accuracy and precision pertain to at least, but not limited to locating the right place at where one or more anomalies occurred and also the right time of occurrence.
[0082] At step 535, the model output of detection of one or more anomalies is found optimal and the root cause of the one or more anomalies is also detected. The Root Cause Analysis (RCA) is conducted to find the real cause of the one or more anomalies in the network 105 as detected by the system 120. The user is notified about the root cause of one or more anomalies. The notifying of the user interface on the root cause of one or more anomalies is performed by transmitting alerts and notifications. The alerts and/or the notifications include at least one of recommendations or warnings to correct the one or more anomalies.
[0083] FIG. 6 is a schematic representation of a method 600 for detecting anomaly related to network quality, according to one or more embodiments of the present invention. For the purpose of description, the method 600 is described with the embodiments as illustrated in FIG. 2 and should nowhere be construed as limiting the scope of the present disclosure.
[0084] At step 605, the method 600 includes the step of receiving the network performance data from one or more data sources. The data sources include at least one of one or more network functions or performance manager . The network performance data includes at least one of network performance metrics. The performance metrics are associated with values of each of the parameters that determine the quality of performance of a network. The parameters include, but not limited to latency, throughput, bandwidth usage, packet loss, error rates and network traffic volume during network function operations in the network 105. In an embodiment the step 605, the method 600 further includes processing of the network performance data. The processing is done to transform the received raw data into standardized format. The standardized data, and not the raw data, is appropriate for model training.
[0085] At step 610, the method 600 includes training a model with the standardized network performance data. The model is trained to learn patterns or trends of a normal network. The one of the patterns and the trends of a normal network include at least one of learnt values and learnt range of values which are essential for the normal performance of the network.
[0086] At step 615, the method 600 includes monitoring the current network performance data. The current network performance data is the data pertaining to the network performance metrics received by the system 120 in real time.
[0087] At step 620, the method 600 includes detecting one or more anomalies pertaining to the network quality of the current network performance data. The detection is performed utilizing the trained model. The model correlates the current network performance data from the one of the patterns and the trends learnt by the model from the training. The automated detection relieves the network engineers from manual tasks related to anomaly detection and trend analysis, improving operational efficiency. The root cause of the one or more anomalies is also detected by the system by the system 120. In an embodiment, as the one or more anomalies are detected, the alerts and notifications pertaining to the detected one or more anomalies are transmitted to the users. The real time response of the system 120 through alerts and notifications ensure real time issue resolution, minimizing network downtime and enhancing service reliability.
[0088] The present invention further discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by the processor 205. The processor 205 is configured to receive, network performance data from one or more data sources. The processor 205 is further configured to train, a model with the network performance data, The processor 205 the model is trained to learn one of the patterns and the trends of a normal network behaviour from the network performance data. The processor 205 is further configured to monitor current network performance data. The processor 205 is further configured to detect, utilizing the trained model, one or more anomalies pertaining to the network quality with the current network performance data when determined that the current network performance data deviates from the learnt one of the patterns and the trends of the normal network behaviour.
[0089] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-6) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0090] The present disclosure incorporates technical advancement of detecting quality deterioration in a network at the right time during data transmission. Further, the present invention takes up a proactive approach by detecting the degradation in the network quality utilizing a trained model. The automated detection of degradation of network quality and automated transmitting of alerts and notifications to the users relieve manual detection. The time consumed in reactive approach causing technical disruption is overcome through the present invention by utilizing models. The application of models in detecting the anomalies whenever the performance parameters deteriorate and transmitting alerts to the users enhances reliability. The application of automation further reduces operational cost and facilitates seamless data transmission. The current disclosure provides sufficient technical and economic advancement by adequately assisting the telecommunication industry to improve anomaly detection and retaining proper functioning of the network.
[0091] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS
[0092] Environment- 100
[0093] Network- 105
[0094] User Equipment (UE)- 110
[0095] Server- 115
[0096] System -120
[0097] Processor- 205
[0098] Memory- 210
[0099] User Interface- 215
[00100] Storage unit- 220
[00101] Transceiver- 225
[00102] Training unit- 230
[00103] Monitoring unit- 235
[00104] Detecting unit- 240
[00105] Processing and Analytics Hub- 405
[00106] Data Integrator- 410
[00107] Data Pre-Processing Unit- 415
[00108] Data Lake- 420
[00109] Model Training Unit-425
[00110] Degradation Detection Unit- 430
,CLAIMS:CLAIMS
We Claim:
1. A method (600) for detecting anomaly related to network quality, the method comprising the steps of:
receiving (605), by one or more processors (205), network performance data from one or more data sources;
training (610), by the one or more processors (205), a model with the network performance data; wherein the model is trained to learn one of the patterns and the trends of a normal network behaviour from the network performance data;
monitoring (615), by the one or more processors (205), current network performance data; and
detecting (620), by the one or more processors (205), utilizing the trained model, one or more anomalies pertaining to the network quality with the current network performance data when determined that the current network performance data deviates from the learnt one of the patterns and the trends of the normal network behaviour.

The method (600) as claimed in claim 1, wherein the one or more data sources include at least one of, one or more network functions or performance manager.

2. The method (600) as claimed in claim 1, wherein the network performance data include at least one of, network performance metrics; wherein the network performance metrics include at least one of latency, throughput, bandwidth usage, packet loss, error rates and network traffic volume during network function operations in the network (105).

3. The method (600) as claimed in claim 1, wherein the step of, receiving, real time network performance data from one or more data sources, further includes the step of:
preprocessing, by the one or more processors, the received network performance data.

4. The method (600) as claimed in claim 1, wherein the one of the patterns and the trends of the normal network behaviour include at least one of, learnt values and learnt range of values pertaining to the normal network behaviour.

5. The method (600) as claimed in claim 1, wherein the step of, detecting, utilizing the trained model, one or more anomalies pertaining to the network quality with the current network performance data, includes the steps of:
extracting, by the one or more processors, one or more current values from the current network performance data;
comparing, by the one or more processors, the one or more current values with one or more learnt values;
when the one or more current values deviates from the one or more values pertaining to the learnt one of the patterns and the trends, detecting, by the one or more processors, the one or more anomalies pertaining to the network quality with the current network performance data.

6. The method (600) as claimed in claim 1, wherein the current network performance data is real time data monitored by the one or more processors.

7. The method (500) as claimed in claim 1, wherein the method further comprises the step of:
performing, by the one or more processors, a Root Cause Analysis (RCA) on the current network performance data when the one or more anomalies are detected.

8. The method (600) as claimed in claim 8, wherein the step of, performing, a Root Cause Analysis (RCA) on the current network performance data when the one or more anomalies are detected, includes the steps of:
identifying, by the one or more processors, one or more network quality parameters which include the one or more anomalies;
determining, by the one or more processors, one or more potential causes for the one or more anomalies by correlating the identified one or more network quality parameters and the one or more anomalies with a pre-defined list of potential causes stored in a storage unit.

9. The method (600) as claimed in claim 1, wherein the method further comprises the step of:
transmitting, by the one or more processors, alerts and/or notifications to a user pertaining to the detected one or more anomalies.

10. A system (120) for detecting anomaly related to network quality, the system comprising:
a transceiver (225), configured to, receive, network performance data from one or more data sources;
a training unit (235), configured to, train, a model with the network performance data; wherein the model is trained to learn one of the patterns and the trends of a normal network behaviour from the network performance data;
a monitoring unit (240), configured to, monitor, current network performance data; and
a detecting unit (245), configured to, detect, utilizing the trained model, one or more anomalies pertaining to the network quality with the current network performance data when determined that the current network performance data deviates from the learnt one of the patterns and the trends of the normal network behaviour.

11. The system (120) as claimed in claim 11, wherein the one or more data sources include at least one of, one or more network functions or performance manager. .

12. The system (120) as claimed in claim 11, wherein the network performance data include at least one of, network performance metrics; wherein the network performance metrics include at least one of latency, throughput, bandwidth usage, packet loss, error rates and network traffic volume during network function operations in the network (105).
13. The system (120) as claimed in claim 11, wherein once the current network performance data is received, a preprocessing unit (230) is configured to preprocess the received network performance data.

14. The system (120) as claimed in claim 11, wherein the one of the patterns and the trends of the normal network behaviour include at least one of, learnt values and learnt range of values pertaining to the normal network behaviour.

15. The system (120) as claimed in claim 11, wherein the detecting unit (245) detects, utilizing the trained model, the one or more anomalies pertaining to the network quality with the current network performance data, by:
extracting, one or more current values from the current network performance data;
comparing, the one or more current values with one or more learnt values;
when the one or more current values deviates from the one or more values pertaining to the learnt one of the patterns and the trends, detecting, the one or more anomalies pertaining to the network quality with the current network performance data.

16. The system (120) as claimed in claim 11, wherein the current network performance data is real time data monitored by the one or more processors.

17. The system (120) as claimed in claim 11, wherein the system (120) further comprising an analysis engine (250), configured to perform, a Root Cause Analysis (RCA) on the current network performance data when the one or more anomalies are detected.

18. The system (120) as claimed in claim 18, wherein the analysis engine performs, the RCA on the current network performance data when the one or more anomalies are detected, by:
identifying, one or more network quality parameters which include the one or more anomalies;
determining, one or more potential causes for the one or more anomalies by correlating the identified one or more network quality parameters and the one or more anomalies with a pre-defined list of potential causes stored in a storage unit.

19. The system (120) as claimed in claim 11, wherein the transceiver (225) is further configured to transmit alerts and/or notifications to a user pertaining to the detected one or more anomalies.

20. A User Equipment (UE) (110), comprising:
one or more primary processors communicatively coupled to one or more processors (205), the one or more primary processors coupled with a memory (210), wherein said memory stores instructions which when executed by the one or more primary processors causes the UE (110) to:
receiving, one or more alerts and notifications pertaining to one or more anomalies in the network (105).
wherein the one or more processors (205) is configured to perform the steps as claimed in claim 1.