DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
SYSTEM AND METHOD FOR PREDICTING ONE OR MORE ANOMALIES IN A NETWORK
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to the field of wireless communication systems, more particularly relates to a method and a system for predicting one or more anomalies in a network.
BACKGROUND OF THE INVENTION
[0002] In the communication network, the network monitoring is performed where all networking components like routers, switches, firewalls, servers, and VMs are monitored in order to detect faults or anomaly. Anomaly detection is the identification of rare events, items, or observations which are suspicious because they differ significantly from standard behaviors or patterns.
[0003] Generally, the alarms may be set by the consumers in order to get notification pertaining to anomaly detection. The consumer may get notified about the raised alarms on the dashboards. In practice, the anomalies are detected manually that leads to slower response times and the possibility of critical problems going unnoticed until they cause significant disruptions in the network.
[0004] In some situations, for example, the alarm raised due to some anomalies at particular application 1, the same anomalies may occur at application 2 in the future that may run on the same or may be different server. Therefore, these alarms triggered in a different environment, may also go unnoticed. Even if they are detected, it will be a cumbersome task to detect the same type of anomalies every time.
[0005] In view of the above, there is a dire need for a system and a method for correlating anomalies from multiple alarms, which ensures any future anomalies can be detected and resolved before the issues are caused.
SUMMARY OF THE INVENTION
[0006] One or more embodiments of the present disclosure provides a method and a system for predicting one or more anomalies in a network.
[0007] In one aspect of the present invention, the method for predicting one or more anomalies in the network is disclosed. The method includes the step of retrieving, by one or more processors, at least one of, alarm data and counter data from one or more data sources. The method further includes the step of determining, by the one or more processors, using an Artificial Intelligence/Machine Learning (AI/ML) model, a plurality of anomalies from the retrieved at least one of, the alarm data and the counter data. The method further includes the step of generating, by one or more processors, correlated data based on correlating the plurality of anomalies. The method further includes the step of predicting, by the one or more processors, utilizing the AI/ML model, the one or more anomalies in the network based on at least one of, the alarm data, the counter data and the correlated data.
[0008] In another embodiment, the alarm data and the counter data pertain to at least one of, alarms generated by network devices, information of status of nodes in a network, or details of one or more server connectivity.
[0009] In yet another embodiment, the one or more processors, determines, using the AI/ML model, the plurality of anomalies including at least one of, unusual patterns/trends in network traffic, deviations from expected performance levels or alarms triggered by network devices
[0010] In yet another embodiment, the step of, generating, a correlated data based on correlating the plurality of anomalies, includes the steps of, comparing, by the one or more processors, each of the plurality of anomalies with remaining plurality of anomalies. Further, determining, by the one or more processors, one or more common relationship parameters between the plurality of anomalies based on the comparison, wherein the one or more common relationship parameters include at least one of, one or more common attributes or one or more common underlying issues. Thereafter, generating, by the one or more processors, the correlated data based on the determined one or more common relationship parameters, the correlated data includes data of the determined one or more common relationship parameters.
[0011] In yet another embodiment, the AI/ML model is fed with historic data related to patterns/trends of the alarm data and the counter data.
[0012] In yet another embodiment, the method further comprising the step of, transmitting, by the one or more processors, alerts and/or notifications to a user pertaining to one or more predicted anomalies, the alerts and/or notifications include information of at least one of, the one or more predicted anomalies, nature of the one or more predicted anomalies and recommended action for resolution of the one or more predicted anomalies.
[0013] In yet another embodiment, when predicting the one or more anomalies associated with one or more nodes, the method includes the steps of checking, whether multiple alarms generated are linked to the one or more nodes based on the correlated data and if determined that the multiple alarms generated are linked to the one or more nodes, predicting, one or more anomalies associated with the one or more network nodes.
[0014] In yet another embodiment, when predicting utilizing the AI/ML model the one or more anomalies related to predicting the future alarms, based on at least one of, the patterns/trends of the historic data related to alarms and/or counters, the correlated data and the alarm data and the counter data.
[0015] In another aspect of the present invention, the system for predicting one or more anomalies in a network is disclosed. The system includes a retrieving unit, configured to, retrieve, at least one of, alarm data and counter data from one or more data sources. The system further includes a determining unit, configured to, determine, using an Artificial Intelligence/Machine Learning (AI/ML) model, a plurality of anomalies from the retrieved at least one of, the alarm data and the counter data. The system further includes a generating unit, configured to, generate, a correlated data based on correlating the plurality of anomalies. The system further includes a predicting unit, configured to, predict, utilizing the AI/ML model, the one or more anomalies in the network based on at least one of, the alarm data, the counter data and the correlated data.
[0016] In yet another aspect of the present invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by a processor. The processor is configured to retrieve at least one of, alarm data and counter data from one or more data sources. The processor is further configured to determine, using an Artificial Intelligence/Machine Learning (AI/ML) model, a plurality of anomalies from the retrieved at least one of, the alarm data and the counter data. The processor is further configured to generate correlated data based on correlating the plurality of anomalies. The processor is further configured to predict, utilizing the AI/ML model, the one or more anomalies in the network based on at least one of, the alarm data, the counter data and the correlated data.
[0017] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.
BRIEF DESCRIPTION OF THE DRAWINGS
[0018] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0019] FIG. 1 is an exemplary block diagram of an environment for predicting one or more anomalies in a network, according to one or more embodiments of the present invention;
[0020] FIG. 2 is an exemplary block diagram of a system for predicting the one or more anomalies in the network, according to one or more embodiments of the present invention;
[0021] FIG. 3 is an exemplary architecture of the system of FIG. 2, according to one or more embodiments of the present invention;
[0022] FIG. 4 is an exemplary architecture for predicting the one or more anomalies in the network, according to one or more embodiments of the present disclosure;
[0023] FIG. 5 is an exemplary signal flow diagram illustrating the flow for predicting the one or more anomalies in the network, according to one or more embodiments of the present disclosure; and
[0024] FIG. 6 is a flow diagram of a method for predicting the one or more anomalies in the network, according to one or more embodiments of the present invention.
[0025] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0026] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0027] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0028] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0029] Various embodiments of the present invention provide a system and a method for predicting one or more anomalies in a network. The disclosed system and method aim at correlating a plurality of anomalies from multiple alarms. In other words, the present invention provides a unique approach of predicting future alarms, node failures that may be caused due to potential problems and taking preventive measures before the potential problems lead to significant disruptions based on the correlated data and the historical data. The correlation of the plurality of anomalies allows the system to proactively identify the potential problems and how the potential problems are related to each other. The correlation of anomalies allows the system to take precautionary measures for the problems that may occur in the future due to anomalies.
[0030] Referring to FIG. 1, FIG. 1 illustrates an exemplary block diagram of an environment 100 for predicting one or more anomalies in a network 106 according to one or more embodiments of the present invention. The environment 100 includes a User Equipment (UE) 102, a server 104, the network 106, a system 108, and one or more data sources 110. Herein, predicting one or more anomalies in the network 106pertains to predicting future alarms and one or more issues such at least one of, but not limited to, node failures in the network 106. In particular, one or more anomalies from multiple alarms are correlated by the system 108 and then correlated data is used for predicting one or more anomalies in the network 106.
[0031] For the purpose of description and explanation, the description will be explained with respect to one or more user equipment’s (UEs) 102, or to be more specific will be explained with respect to a first UE 102a, a second UE 102b, and a third UE 102c, and should nowhere be construed as limiting the scope of the present disclosure. Each of the at least one UE 102 namely the first UE 102a, the second UE 102b, and the third UE 102c is configured to connect to the server 104 via the network 106.
[0032] In an embodiment, each of the first UE 102a, the second UE 102b, and the third UE 102c is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as smartphones, Virtual Reality (VR) devices, Augmented Reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0033] The network 106 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 106 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0034] The network 106 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth.
[0035] The environment 100 includes the server 104 accessible via the network 106. The server 104 may include by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, a processor executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0036] The environment 100 further includes the one or more data sources 110. In one embodiment, the one or more data sources 110 are origins from which the data is collected and utilized for at least one of, but not limited to, analysis, research, and decision-making. In one embodiment, the one or more data sources 110 is at least one of, but not limited to, server 104, applications, one or more databases, network functions, network elements. In particular, the one or more data sources 110 is associated with the sources included within the network 106 and outside the network 106.
[0037] The environment 100 further includes the system 108 communicably coupled to the server 104, the UE 102, and the one or more data sources 110 is via the network 106. The system 108 is adapted to be embedded within the server 104 or is embedded as the individual entity.
[0038] Operational and construction features of the system 108 will be explained in detail with respect to the following figures.
[0039] FIG. 2 is an exemplary block diagram of the system 108 for predicting the one or more anomalies in the network 106, according to one or more embodiments of the present invention.
[0040] As per the illustrated and preferred embodiment, the system 108 for predicting the one or more anomalies in the network 106, includes one or more processors 202, a memory 204, a storage unit 206 and an Artificial Intelligence/Machine Learning (AI/ML) 220. The one or more processors 202, hereinafter referred to as the processor 202, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions. However, it is to be noted that the system 108 may include multiple processors as per the requirement and without deviating from the scope of the present disclosure. Among other capabilities, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204.
[0041] As per the illustrated embodiment, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204 as the memory 204 is communicably connected to the processor 202. The memory 204 is configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed for predicting the one or more anomalies in the network 106. The memory 204 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0042] The environment 100 further includes the storage unit 206. As per the illustrated embodiment, the storage unit 206 is configured to store data retrieved from the one or more data sources 110. The storage unit 206 is one of, but not limited to, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of the storage unit 206 types are non-limiting and may not be mutually exclusive e.g., the database can be both commercial and cloud-based, or both relational and open-source, etc.
[0043] As per the illustrated embodiment, the system 108 includes the AI/ML model 220. In an alternate embodiment, the system 108 includes a plurality of AI/ML models 220. The AI/ML model 220 is a machine learning model that performs tasks such as recognizing patterns, detecting anomalies, correlating anomalies, making predictions, and solving problems, enhance decision-making, and provide insights across various fields. For example, the AI/ML model 220 facilitates in solving real-world problems without extensive manual intervention.
[0044] As per the illustrated embodiment, the system 108 includes the processor 202 for predicting the one or more anomalies in the network 106. The processor 202 includes a retrieving unit 208, a training unit 210, a determining unit 212, a generating unit 214, a predicting unit 216, and a transceiver 218. The processor 202 is communicably coupled to the one or more components of the system 108 such as the memory 204, the storage unit 206 and the AI/ML model 220. In an embodiment, operations and functionalities of includes the retrieving unit 208, the training unit 210, the determining unit 212, the generating unit 214, the predicting unit 216, and the transceiver 218 and the one or more components of the system 108 can be used in combination or interchangeably.
[0045] In one embodiment, initially the retrieving unit 208 of the processor 202 is configured to retrieve data from the one or more data sources 110. Herein, the retrieved data pertains to at least one of, but not limited to, alarm data and counter data from one or more data sources 110. In an alternate embodiment, historic data pertaining to the alarm data and the counter data is retrieved from the one or more data sources 110. Herein, the retrieving unit 208 retrieves data from the one or more data sources 110 which are present within the network 106 and outside the network 106. In one embodiment, the one or more data sources 110 transmits data to the system 108 periodically.
[0046] In one embodiment, the alarm data and the counter data pertain to at least one of, but not limited to, alarms generated by network devices, information of status of nodes in the network 106, details of one or more server 104 connectivity. Herein the network devices and the node include at least one of, but not limited to, routers, switches, repeaters, and hubs. In one embodiment, the status of nodes incudes at least one of, but not limited to, online, offline, critical, and healthy. In one embodiment, the details of one or more server 104 connectivity incudes at least one of, but not limited to, active, inactive, connected, disconnected, reachable, and unreachable.
[0047] In one embodiment, the alarms are notifications or signals that indicate a specific condition or event requiring attention. In particular, the alarms serve to alert users about issues such as at least one of, but not limited to, node failures, network traffic, performance degradation, or security breaches. For example, the alarms are visual alarms such as lights on a device, audible sound alerts, or digital (notifications in monitoring systems). In one embodiment, the counters are measurement tools or variables that keep track of quantities or occurrences of specific events. The counters provide insights into traffic, errors, and overall health of the network 106. For example, the counters are traffic counters, error counters, and connection counters.
[0048] In one embodiment, the retrieving unit 208 retrieves data from a Network Management System (NMS). Herein, the NMS acts as the mediator between the one or more data sources 110 and the retrieving unit 208. Herein, the NMS collects the alarm data and the counter data from the one or more data sources 110. The alarm data and counter data include information about at least one of, but not limited to, the status of nodes within the network 106, and details about server 104 connectivity. In one embodiment, the NMS identifies, configure, monitor, update and troubleshoot nodes within the network 106.
[0049] In one embodiment, the retrieving unit 208 retrieves the alarm data and the counter data from the one or more data sources 110 via an interface. In one embodiment, the interface includes at least one of, but not limited to, one or more APIs which are used for retrieving the alarm data and the counter data from the one or more data sources 110. The one or more APIs are sets of rules and protocols that allow different entities to communicate with each other. The one or more APIs define the methods and data formats that entities can use to request and exchange information, enabling integration and functionality across various platforms. In particular, the APIs are essential for integrating different systems, accessing services, and extending functionality.
[0050] In one embodiment, upon retrieving the alarm data and the counter data from the one or more data sources 110, the retrieving unit 208 is further configured integrate the alarm data and the counter data retrieved from the one or more data sources 110 within the network 106 and the one or more data sources 110 outside the network 106. Herein, integrating the alarm data and the counter data involves combining data from the one or more data sources 110 to provide a unified view or to enable comprehensive analysis.
[0051] Upon integrating the alarm data and the counter data, the retrieving unit 208 is further configured to preprocess the integrated alarm data and the counter data. In particular, the retrieving unit 208 is configured to preprocess the alarm data and the counter data to ensure the data consistency and quality of the data within the system 108. The retrieving unit 208 performs at least one of, but not limited to, data normalization, data definition and data cleaning procedures.
[0052] While preprocessing, the retrieving unit 208 performs at least one of, but not limited to, reorganizing the data, removing the redundant data, formatting the data, removing null values from the data, cleaning the data, handling missing values. The main goal of the preprocessing is to achieve a standardized data format across the entire system 108. The preprocessing eliminates duplicate data and inconsistencies from the alarm data and the counter data. The retrieving unit 208 ensures that the preprocessed data is stored appropriately in at least one of, the storage unit 206 for subsequent retrieval and analysis.
[0053] Upon preprocessing the alarm data and the counter data, the training unit 210 of the processor 202 is configured to train the AI/ML model 220 with at least one of, but not limited to, the preprocessed alarm data and the counter data. In an alternate embodiment, the AI/ML model 220 is trained on historical data which is stored in the storage unit 206. Herein the historical data pertains to, previous data of the nodes, alarm data and the counter data. In one embodiment, the training unit 210 retrieves the preprocessed alarm data and the counter data and the historical data from the storage unit 206 for training the AI/ML model 220. In one embodiment, the training unit 210 feds the AI/ML model 220 with the historic data related to trends/patterns of the alarm data and the counter data.
[0054] In an alternate embodiment, the system 108 includes a plurality of AI/ML models 220 from which the training unit 210 selects an appropriate AI/ML model 220 for training. Thereafter, the selected AI/ML model 220 is trained using the preprocessed alarm data and the counter data. Further, the training unit 210 configures one or more hyperparameters of the AI/ML model 220 based on historical data related to the alarm data and the counter data in order to train the AI/ML model 220. Herein, the one or more hyperparameters of the AI/ML model 220 include at least one of, but not limited to, a learning rate, a batch size, and a number of epochs. Subsequent to configuring the one or more hyperparameters of the AI/ML model 220, the training unit 210 infers that the AI/ML model 220 is ready for training.
[0055] In one embodiment, for training the AI/ML model 220, the training unit 210 splits the historical data and the preprocessed alarm data and the counter data into at least one of, but not limited to, training data and testing data. Further, the training unit 210 feeds the training data to the AI/ML model 220. Based on the fed training data, the AI/ML model 220 learns one or more trends/patterns in the fed training data. Subsequent to training, the trained AI/ML model 220 is fed with the testing data in order to evaluate performance of the trained AI/ML model 220.
[0056] In one embodiment, when the trained AI/ML model 220 generates an output based on the testing data, the training unit 210 evaluates the performance of the trained AI/ML model 220. In one embodiment, the output generated by the trained AI/ML model 220 is again fed back to the trained AI/ML model 220 by the training unit 210, so that based on the generated output, the trained AI/ML model 220 is trained again. In particular, after generating the output, the AI/ML model 220 keeps on training and updating itself in order to achieve better output.
[0057] In alternate embodiment, based on the performance evaluation of the of the trained AI/ML model 220, the training unit 210 may again configure the one or more hyperparameters of the trained AI/ML model 220 to optimize the performance of the trained AI/ML model 220. In one embodiment, when the performance of the trained AI/ML model 220 is optimized, then the trained AI/ML model 220 is inferred as the optimal AI/ML model 220 which can be used for further analysis.
[0058] In one embodiment, based on training, the trained AI/ML model 220 learns at least one of, but not limited to, trends/patterns associated with the alarm data and the counter data by applying one or more logics. The patterns refer to recurring behaviors or structures in the data that appear consistently over time. The trends are general directions in which data points move over a period of time. In one embodiment, the one or more logics may include at least one of, but not limited to, a k-means clustering, a hierarchical clustering, a Principal Component Analysis (PCA), an Independent Component Analysis (ICA), a deep learning logics such as Artificial Neural Networks (ANNs), a Convolutional Neural Networks (CNNs), a Recurrent Neural Networks (RNNs), a Long Short-Term Memory Networks (LSTMs), a Generative Adversarial Networks (GANs), a Q-Learning, a Deep Q-Networks (DQN), a Reinforcement Learning Logics, etc.
[0059] Based on the learned at least one of, but not limited to, trends/patterns associated with the alarm data and the counter data, the trained AI/ML model 220 sets one or more thresholds related to the alarm data and the counter data. In particular, the trained AI/ML model 220 sets one or more thresholds related to the alarm data and the counter data using the historical data. In an alternate embodiment, the one or more thresholds are set by the user.
[0060] Upon training the AI/ML model 220, the determining unit 212 of the processor 202 is configured to determine a plurality of anomalies from the retrieved at least one of, the alarm data and the counter data using the trained AI/ML model 220. In one embodiment, the trained AI/ML model 220 continuously monitors the alarm data and the counter data to determine the plurality of anomalies.
[0061] For example, let us assume the alarm data and the counter data are associated with one or more parameters of the server 104 where the multiple requests arrive. The one or more parameters are at least one of, but not limited to, capacity of handling the multiple requests, time required for responding to the multiple requests. Herein, the server 104 is handling traffic of 1 lakh requests in a day that may be the threshold set by the trained AI/ML model 220. Subsequently, let us say on any other day, the load of the traffic increases to 10 lakh requests. Herein, using the trained AI/ML model 220, the determining unit 212 determines unusual patterns in traffic. During this situation, since the number of requests exceeds the set one or more thresholds, an alarm is triggered, and the unusual pattern in traffic is inferred as an anomaly. Similarly, the determining unit 212 determines the plurality of anomalies which includes at least one of, but not limited to, unusual trends/ patterns in network traffic, deviations from expected performance levels or alarms triggered by the network devices.
[0062] Upon determining the plurality of anomalies, the generating unit 214 of the processor 202 is configured to correlate the plurality of anomalies. The correlations refer to relationships between two or more metrics, showing how changes in one metric are linked to changes in another. An example of correlating the plurality of anomalies from multiple alarms is provided. Let us consider that the system 108 may have a computation engine A configured to compute datasets. This computation engine A may be configured with pre-defined set of resources. In the event, the computation engine A receives traffic/load from multiple applications such as application 1 and application 2, for which the resources required may be more compared to the pre-defined set resources of computation engine A, then the computation engine A will not be able to cater to the increase in demand of resources for applications 1 and 2. In this regard, the system 108 infers that there is an anomaly and hence alarms may be raised in this regard.
[0063] Further let us consider that the system 108 identifies that a similar application, let us say application 3 may be utilizing the same computation engine A. In this regard, the system 108 may predict that an alarm may be raised in the future for a similar type of anomaly for application 3 as well, in the event the number of resources required for application 3 is more compared to the pre-defined set of resources for computation engine A. The system 108 predicts that an alarm may be raised in the future for a similar type of anomaly for application 3 by correlating plurality of anomalies from multiple alarms raised for applications 1 and 2. Therefore, according to this example, the plurality of anomalies may be correlated from multiple alarms based on the determined one or more common relationship parameters among the plurality of anomalies. In particular, multiple alarms may together signify a perceived or a known or a predicted anomaly. The AI/ML model 220 is configured to learn this correlation with the help of user feedback utilizing a centralized platform. Hence the AI/ML model 220 will be in a better position to then predict future anomalies and network issues.
[0064] Upon correlating the plurality of anomalies, the generating unit 214 generates the correlated data based on correlating the plurality of anomalies. In particular, the generating unit 214 compares each of the plurality of anomalies with the remaining plurality of anomalies. Further based on the comparison, the generating unit 214 determines one or more common relationship parameters between the plurality of anomalies. Herein, the one or more common relationship parameters includes at least one of, but not limited to, one or more common attributes or one or more common underlying issues.
[0065] For example, the one or more common attributes or one or more common underlying issues related to the plurality of anomalies include at least one of, but not limited to, significant divergence from normal behavior such as high traffic, specific time at which the one or more anomalies occur, increased error rates, and receiving traffic from unexpected IP addresses.
[0066] In one embodiment, instead of dealing with isolated alarms, the system 108 connects the dots between the one or more common relationship parameters, which provides a more comprehensive understanding of the network's health. For example, if the network 106 experiences a sudden increase in traffic, the alarm 1 is raised which might indicate high bandwidth usage. Simultaneously, alarm 2 is raised which indicates an increase in error rates on a specific router. Further, the generating unit 214 determines that both alarms are raised simultaneously or one after the other. So, the generating unit 214 connects dots such as due to the increase in the traffic, the router is overloaded and causes the errors. By linking the alarm 1 and the alarm 2, the generating unit 214 generates the correlated data.
[0067] Upon correlating the plurality of anomalies and generating the correlated data, the predicting unit 216 of the processor 202 is configured to predict, the one or more anomalies in the network 106utilizing the AI/ML model 220 based on at least one of, the alarm data, the counter data and the correlated data. Herein, predicting the one or more anomalies in the network 106includes at least one of, predicting the future alarms and predicting one or more anomalies associated with the one or more nodes such as the one or more issues.
[0068] In one embodiment, for predicting the one or more anomalies in the network 106associated with the one or more nodes, the predicting unit 216 checks whether multiple alarms generated are linked to the one or more nodes based on the correlated data. If the predicting unit 216 determines that the multiple alarms generated are linked to the one or more network nodes, the predicting unit 216 predicts one or more anomalies associated with the one or more network nodes.
[0069] For example, by correlating the plurality of anomalies, the predicting unit 216 predicts when one or more nodes such as routers will be experiencing failures or performance degradation using the AI/ML model 220. For example, the AI/ML model 220 experiences that the specific node among the one or more nodes is continuously raising multiple alarms which may be more compared to a pre-set alarm frequency in a particular time interval, then the predicting unit 216 detects the specific node failure using the AI/ML model 220. In other situation, the one or more nodes may experience high traffic compared to pre-set or dynamically set traffic capacity, then the AI/ML model 220 notify that the one or more nodes has failed due to failure to handle high traffic.
[0070] In an embodiment, the predicting unit 216 preforms a predictive analysis using the AI/ML model 220 to predict future alarms based on the alarm data, counter data, correlated data and the historical data. Herein, the alarm data, counter data, correlated data and the historical data are fed to the AI/ML model 220. The AI/ML model 220 learns the trends/ patterns related to the fed data. Based on the learnt trends/ patterns, the alarm data, the counter data, and the correlated data, the predicting unit 216 predicts future alarms. For example, let us assume application 1 and application 2 are running utilizing the same server 104. The plurality of anomalies from the multiple alarms are correlated by the system 108 by identifying the one or more common relationship parameters between the plurality of anomalies such as, the one or more common underlying issues. Herein due to the common underlying issues in the server 104, the AI/ML model 220 detects the anomaly in application 1 for which the alarm is raised. Further, the AI/ML model 220 uses the correlated data to check similar alarms in application 2 as the application 2 is running on the same server 104 which is causing common underlying issues. In the AI/ML model 220 determines that the similar alarms are present in application 2, then the predicting unit 216 predicts the next alarm will be raised by the application 2.
[0071] Upon predicting the one or more anomalies in the network 106, the transceiver 218 of the processor 202 is configured to transmit alerts and/or notifications to the user pertaining to one or more predicted anomalies in a real time. In particular, the transceiver 218 transmits the alerts and/or notifications pertaining to one or more predicted anomalies and the predicted future alarms. Herein, the alerts and/or notifications include information of at least one of, the one or more predicted anomalies, nature of the one or more predicted anomalies and recommended action for resolution of the one or more predicted anomalies. In one embodiment, the user is notified on the UI 306 of the UE 102. Further, based on the alerts and/or notifications the user performs one or more actions to resolve the one or more predicted anomalies in the network 106. Herein, the one or more actions is at least one of, but not limited to, troubleshooting techniques and Root Cause Analysis (RCA) to resolve the one or more predicted anomalies in the network 106without impacting the performance of the system 108 in the network 106. Advantageously, the predictive analysis capabilities of the system 108 enables proactive maintenance, allowing the network operators to anticipate and prevent one or more predicted anomalies before they impact network operations.
[0072] The retrieving unit 208, the training unit 210, the determining unit 212, the generating unit 214, the predicting unit 216, and the transceiver 218 in an exemplary embodiment, are implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 202. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 202 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 204 may store instructions that, when executed by the processing resource, implement the processor 202. In such examples, the system 108 may comprise the memory 204 storing the instructions and the processing resource to execute the instructions, or the memory 204 may be separate but accessible to the system 108 and the processing resource. In other examples, the processor 202 may be implemented by electronic circuitry.
[0073] FIG. 3 illustrates an exemplary architecture for the system 108, according to one or more embodiments of the present invention. More specifically, FIG. 3 illustrates the system 108 for predicting the one or more anomalies in the network 106. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the UE 102 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0074] FIG. 3 shows communication between the UE 102, the system 108, and the one or more data sources 110. For the purpose of description of the exemplary embodiment as illustrated in FIG. 3, the UE 102, uses network protocol connection to communicate with the system 108, and the one or more data sources 110. In an embodiment, the network protocol connection is the establishment and management of communication between the UE 102, the system 108, and the one or more data sources 110 over the network 106 (as shown in FIG. 1) using a specific protocol or set of protocols. The network protocol connection includes, but not limited to, Session Initiation Protocol (SIP), System Information Block (SIB) protocol, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Simple Network Management Protocol (SNMP), Internet Control Message Protocol (ICMP), Hypertext Transfer Protocol Secure (HTTPS) and Terminal Network (TELNET).
[0075] In an embodiment, the UE 102 includes a primary processor 302, and a memory 304 and a User Interface (UI) 306. In alternate embodiments, the UE 102 may include more than one primary processor 302 as per the requirement of the network 106. The primary processor 302, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0076] In an embodiment, the primary processor 302 is configured to fetch and execute computer-readable instructions stored in the memory 304. The memory 304 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed for predicting the one or more anomalies in the network 106. The memory 304 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0077] In an embodiment, the User Interface (UI) 306 includes a variety of interfaces, for example, a graphical user interface, a web user interface, a Command Line Interface (CLI), and the like. The UI 306 of the UE 102 allows the user to transmit data to the system 108 for training the AI/ML model 220. Herein, the UE 102 act as at least one data source 110. In one embodiment, the user receives at least one of, but not limited to, the alerts and/or notifications pertaining to one or more predicted anomalies from the system 108 to the UI 306. In one embodiment, the user may be at least one of, but not limited to, a network operator.
[0078] As mentioned earlier in FIG.2, the system 108 includes the processors 202, the memory 204 and the storage unit 206, for predicting the one or more anomalies in the network 106, which are already explained in FIG. 2. For the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition.
[0079] Further, as mentioned earlier the processor 202 includes the retrieving unit 208, the training unit 210, the determining unit 212, the generating unit 214, the predicting unit 216, and the transceiver 218 which are already explained in FIG. 2. Hence, for the sake of brevity, a similar description related to the working and operation of the system 108 as illustrated in FIG. 2 has been omitted to avoid repetition. The limited description provided for the system 108 in FIG. 3, should be read with the description provided for the system 108 in the FIG. 2 above, and should not be construed as limiting the scope of the present disclosure.
[0080] FIG. 4 is an exemplary the system 108 architecture 400 for predicting the one or more anomalies in the network 106, according to one or more embodiments of the present disclosure.
[0081] The architecture 400 includes the one or more data sources 110 such as Alarm source 1, Alarm source 2 and Alarm source 3 from which multiple alarms maybe triggered. For example, the one or more data sources 110 are one or more network functions linked with the multiple alarms. When the performance of the one or more data sources 110 are degraded or the one or more issues are faced by the one or more data sources 110, then the multiple alarms are triggered by the one or more data sources 110.
[0082] The architecture 400 further includes the NMS 402, a pre-processor 404, an Intelligent alarm correlation and anomaly detection engine 406, a Machine Learning (ML) service 408, the storage unit 206, workflow 410 and the UI 306 communicably coupled to each other via the network 106.
[0083] In one embodiment, the NMS 402 periodically collects the alarm data and the counter data from the at least one of, the Alarm source 1, the Alarm source 2 and the Alarm source 3. The collected alarm data and the counter data is crucial for monitoring network performance, identifying issues, and ensures that system 108 operate smoothly.
[0084] In one embodiment, the pre-processor 404 receives the collected alarm data and the counter data from the NMS 402 and preprocesses the collected alarm data and the counter data. For example, the collected alarm data and the counter data undergoes preprocessing to ensure data consistency within the system 108. In particular, the preprocessing involves tasks like data cleaning, normalization, removing unwanted data like outliers, duplicate records and handling missing values.
[0085] In one embodiment, the Intelligent alarm correlation and anomaly detection engine 406 is designed to analyze and manage multiple alarms and alerts in real time. In particular, the Intelligent alarm correlation and anomaly detection engine 406 analyzes one or more common relationships between multiple alarms to identify trends/patterns of the multiple alarms. Based on the identified trends/patterns, the Intelligent alarm correlation and anomaly detection engine 406 utilizes the AI/ML model 220 to correlate alarm.
[0086] In one embodiment, the ML service 408 refer to platform and tool that provide resources for building, deploying, and managing AI/ML model 220. The ML service 408 preforms the AI/ML model 220 selection and the AI/ML model 220 training. Herein, the AI/ML model 220 learns the trends/patterns of the multiple alarms. Based on the correlated alarms and the learned trends/patterns, AI/ML model 220 facilities the Intelligent alarm correlation and anomaly detection engine 406 to identify deviations from normal behavior or unusual patterns and predict the one or more anomalies or the future alarms.
[0087] In one embodiment, the storage unit 206 includes a structured collection of the preprocessed data, the correlated data, the predicted one or more anomalies and the future alarms that are managed and organized in a way that allows system 108 for easy access, retrieval, and manipulation. The storage unit 206 are used to store, manage, and retrieve large amounts of information efficiently.
[0088] In one embodiment, the workflow 410 is a defined sequence of processes or tasks that are carried out to complete a specific goal or project. The workflow 410 involves the coordination of components in the architecture, resources, and tools to ensure that work is completed efficiently and effectively. In particular, the workflow 410 retrieves the information pertaining to the correlated data, and the predicted one or more anomalies from the storage unit 206 and provides the visual representation on the UI 306.
[0089] FIG. 5 is a signal flow diagram illustrating the flow for predicting the one or more anomalies in the network 106, according to one or more embodiments of the present disclosure.
[0090] At step 502, the system 108 retrieves at least one of, the alarm data and the counter data from the one or more data sources 110. In one embodiment, the system 108 transmits at least one of, but not limited to, a Hyper Text Transfer Protocol (HTTP) request to the one or more data sources 110 to retrieve at least one of, the alarm data and the counter data. In one embodiment, a connection is established between the system 108 and the one or more data sources 110 before retrieving the data. Further, the alarm data and the counter data are integrated and preprocessed. Herein, the system 108 makes the preprocessed alarm data and the counter data ready for training the AI/ML model 220.
[0091] At step 504, the system 108 utilizes the retrieved at least one of, the alarm data and the counter data to determine the plurality of anomalies by using the AI/ML model 220. Herein, the system 108 detects the plurality of anomalies when the alarm data and the counter data had breached the one or more thresholds.
[0092] At step 506, the system 108 generates correlated data based on correlating the plurality of anomalies. Herein, the system 108 correlates the plurality of anomalies based on comparing the each of the plurality of anomalies and determining one or more common relationship parameters between the plurality of anomalies. Thereafter, the correlated data is generated based on the determined one or more common relationship parameters.
[0093] At step 508, the system 108 predicts the one or more anomalies in the network 106the system 108 based on the correlated data. Herein, the system 108 predicts the one or more anomalies in the network 106such as predicting future alarms and predicting one or more issues. The system 108 performs the predictive analysis to predict the one or more anomalies in the network 106.
[0094] At step 510, the system 108 transmits the notification regarding the predicted one or more anomalies in the network 106to the user on the UI 306 by transmitting at least one of, but not limited to, the HTTP request and a POST request.
[0095] FIG. 6 is a flow diagram of a method 600 for predicting the one or more anomalies in the network 106, according to one or more embodiments of the present invention. For the purpose of description, the method 600 is described with the embodiments as illustrated in FIG. 2 and should nowhere be construed as limiting the scope of the present disclosure.
[0096] At step 602, the method 600 includes the step of retrieving, at least one of, alarm data and counter data from one or more data sources 110. In one embodiment, the retrieving unit 208 the at least one of, the alarm data and the counter data from the one or more data sources 110. In particular, the retrieving unit 208 utilizes the one or more APIs for retrieving the data from the one or more data sources 110. Further, the the alarm data and the counter data retrieved from the one or more data sources 110 is integrated by the retrieving unit 208. Thereafter, the integrated data is preprocessed by the the retrieving unit 208 to ensure the data consistency and quality within the system 108.
[0097] At step 604, the method 600 includes the step of determining, using the AI/ML model 220, the plurality of anomalies from the retrieved at least one of, the alarm data and the counter data. In one embodiment, the determining unit 212 determines the plurality of anomalies using the AI/ML model 220. For example, let us assume that the alarm data and the counter data include the details of one or more server 104 connectivity and the let us assume there are multiple connections such as 10 connections between the system 108 and the server 104. Herein, a specific number of the connections such as 6 connections may be the threshold set by the AI/ML model 220 based on the learnt trends/patterns for maintaining the communication between the system 108 and the server 104. When the number of the connections between the system 108 and the server 104 are failed and reaches the threshold such as 6 or below threshold such as less than 6, then the anomaly is detected.
[0098] At step 606, the method 600 includes the step of generating the correlated data based on correlating the plurality of anomalies. In one embodiment, the generating unit 214 generates the correlated data. For example, let us assume alarm 1 is raised due to anomaly such as high traffic and alarm 2 is raised due to anomaly such as delay in serving the request. So, the generating unit 214 compares the anomalies to determine the one or more common relationship parameters therebetween and to correlate the plurality of anomalies. Herein, the generating unit 214 determines that the one or more common relationship parameters is one or more common underlying issue such as due to the high traffic there is delay in serving the request. Based on the determined one or more common relationship among the plurality of anomalies of the alarm 1 and alarm 2, the generating unit 214 correlates the plurality of anomalies and generates correlated data. Advantageously by correlating the plurality of anomalies from multiple alarms troubleshooting becomes more straightforward and less time-consuming.
[0099] At step 608, the method 600 includes the step of predicting, utilizing the AI/ML model 220, the one or more anomalies in the network 106based on at least one of, the alarm data, the counter data and the correlated data. For example, let us assume alarm 1 is raised due to anomaly such as high traffic and alarm 2 is raised due to anomaly such as delay in serving the request and the one or more anomalies of the alarm 1 and alarm 2 are correlated such that due to the high traffic there is delay in serving the request. Based on the correlated data and learnt trends/patterns the system 108 predicts that alarm 3 may be raised in the future that may cause one or more issues such as impacting overall system performance. Further the user is notified on the UI 306 regarding the predicted one or more anomalies in the network 106. Advantageously, the network operators can identify and resolve one or more anomalies in the network 106more rapidly due to automated anomaly correlation which leads to improved network performance and customer satisfaction.
[00100] In yet another aspect of the present invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by a processor 202. The processor 202 is configured to retrieve at least one of, alarm data and counter data from one or more data sources 110. The processor 202 is further configured to determine using an Aritificial Intelligence/Machine Learning (AI/ML) model 220, a plurality of anomalies from the retrieved at least one of, the alarm data and the counter data. The processor 202 is further configured to generate a correlated data based on correlating the plurality of anomalies. The processor 202 is further configured to predict utilizing the AI/ML model 220, the one or more anomalies in the network 106based on at least one of, the alarm data, the counter data and the correlated data.
[00101] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-6) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[00102] The present disclosure provides technical advancements of enhanced network reliability. The system improves network reliability by quickly detecting and addressing anomalies and node failures, reducing downtime and service disruptions. Network operators can identify and resolve problems more rapidly due to automated anomaly correlation, leading to improved network performance and customer satisfaction. The present invention offers proactive maintenance by allowing network operators perform predictive analytics to anticipate and prevent issues before they impact network operations. The present invention provides efficient resource allocation which leads to cost savings and better network utilization, ensuring that resources are used where they are most needed. The present invention preforms real-time anomaly detection which enhances network security by identifying and mitigating security threats promptly, reducing the risk of cyberattacks and data breaches. By correlating anomalies from multiple alarms and providing a centralized platform, troubleshooting becomes more straightforward and less time-consuming.
[00103] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS

[00104] Environment - 100;
[00105] User Equipment (UE) - 102;
[00106] Server - 104;
[00107] Network- 106;
[00108] System -108;
[00109] One or more data sources – 110;
[00110] Processor - 202;
[00111] Memory - 204;
[00112] Storage unit – 206;
[00113] Retrieving unit – 208;
[00114] Training unit – 210;
[00115] Determining unit – 212;
[00116] Generating unit – 214;
[00117] Predicting unit – 216;
[00118] Transceiver - 218;
[00119] AI/ML Model – 220;
[00120] Primary Processor – 302;
[00121] Memory – 304;
[00122] User Interface (UI) – 306;
[00123] NMS– 402;
[00124] Pre-processor - 404;
[00125] Intelligent Alarm correlation and Anomaly Detection Engine – 406;
[00126] ML service – 408;
[00127] Workflow – 410.

,CLAIMS:CLAIMS
We Claim:
1. A method (600) for predicting one or more anomalies in a network (106), the method (600) comprising the steps of:
retrieving, by one or more processors (202), at least one of, alarm data and counter data from one or more data sources (110);
determining, by the one or more processors (202), using an Artificial Intelligence/Machine Learning (AI/ML) model (220), a plurality of anomalies from the retrieved at least one of, the alarm data and the counter data;
generating, by the one or more processors (202), a correlated data based on correlating the plurality of anomalies; and
predicting, by the one or more processors (202), utilizing the AI/ML model (220), the one or more anomalies in the network (106) based on at least one of, the alarm data, the counter data and the correlated data.

2. The method (600) as claimed in claim 1, wherein the alarm data and the counter data pertain to at least one of, alarms generated by network devices, information of status of nodes in a network, or details of one or more server connectivity.

3. The method (600) as claimed in claim 1, wherein the one or more processors (202), determine, using the AI/ML model (220), the plurality of anomalies including at least one of, unusual patterns/trends in network traffic, deviations from expected performance levels or alarms triggered by network devices.

4. The method (600) as claimed in claim 1, wherein the step of, generating, a correlated data based on correlating the plurality of anomalies, includes the steps of:
comparing, by the one or more processors (202), each of the plurality of anomalies with remaining plurality of anomalies;
determining, by the one or more processors (202), one or more common relationship parameters between the plurality of anomalies based on the comparison, wherein the one or more common relationship parameters include at least one of, one or more common attributes or one or more common underlying issues; and
generating, by the one or more processors (202), the correlated data based on the determined one or more common relationship parameters, wherein the correlated data includes data of the determined one or more common relationship parameters.

5. The method (600) as claimed in claim 1, wherein the AI/ML model (220) is fed with historic data related to patterns/trends of the alarm data and the counter data.

6. The method (600) as claimed in claim 1, wherein the method (600) further comprising the step of:
transmitting, by the one or more processors (202), alerts and/or notifications to a user pertaining to one or more predicted anomalies, wherein the alerts and/or notifications include information of at least one of, the one or more predicted anomalies, nature of the one or more predicted anomalies and recommended action for resolution of the one or more predicted anomalies.

7. The method (600) as claimed in claim 1, wherein when predicting the one or more anomalies associated with one or more nodes, the method (600) includes the steps of:
checking, whether multiple alarms generated are linked to the one or more nodes based on the correlated data; and
if determined that the multiple alarms generated are linked to the one or more network nodes, predicting, one or more anomalies associated with the one or more nodes.

8. The method (600) as claimed in claim 1, wherein when predicting, by the one or more processors, utilizing the AI/ML model (220), the one or more anomalies related to predicting the future alarms, based on at least one of, the patterns/trends of the historic data related to alarms and/or counters, the correlated data and the alarm data and the counter data.

9. A system (108) for predicting one or more anomalies in a network (106), the system (108) comprising the steps of:
a retrieving unit (208), configured to, retrieve, at least one of, alarm data and counter data from one or more data sources (110);
a determining unit (212), configured to, determine, using an Artificial Intelligence/Machine Learning (AI/ML) model (220), a plurality of anomalies from the retrieved at least one of, the alarm data and the counter data;
a generating unit (214), configured to, generate, a correlated data based on correlating the plurality of anomalies; and
a predicting unit (216), configured to, predict, utilizing the AI/ML model (220), the one or more anomalies in the network (106) based on at least one of, the alarm data, the counter data and the correlated data.

10. The system (108) as claimed in claim 9, wherein the alarm data and the counter data pertain to at least one of, alarms generated by network devices, information of status of nodes in a network, or details of one or more server connectivity.

11. The system (108) as claimed in claim 9, wherein the determining unit (212), determines, using the AI/ML model (220), the plurality of anomalies including at least one of, unusual patterns/trends in network traffic, deviations from expected performance levels or alarms triggered by network devices.

12. The system (108) as claimed in claim 9, wherein the generating unit (214), generates, the correlated data by:
comparing, each of the plurality of anomalies with remaining plurality of anomalies;
determining, one or more common relationship parameters between the plurality of anomalies based on the comparison, wherein the one or more common relationship parameters include at least one of, one or more common attributes or one or more common underlying issues; and
generating, the correlated data based on the determined one or more common relationship parameters, wherein the correlated data includes data of the determined one or more common relationship parameters.

13. The system (108) as claimed in claim 9, wherein the AI/ML model (220) is fed with historic data related to patterns/trends of the alarm data and the counter data.

14. The system (108) as claimed in claim 9, wherein the system (108) further comprising a transceiver (218), configured to:
transmit, alerts and/or notifications to a user pertaining to one or more predicted anomalies, wherein the alerts and/or notifications include information of at least one of, the one or more predicted anomalies, nature of the one or more predicted anomalies and recommended action for resolution of the one or more predicted anomalies.

15. The system (108) as claimed in claim 9, wherein when predicting the one or more anomalies associated with one or more nodes, the predicting unit (216), utilizing the AI/ML model (220) is configured to:
check, whether multiple alarms generated are linked to the one or more nodes based on the correlated data; and
if determined that the multiple alarms generated are linked to the one or more network nodes, predict, one or more anomalies associated with the one or more nodes.

16. The system (108) as claimed in claim 9, wherein when predicting the one or more anomalies related to predicting the future alarms, the predicting unit (216), utilizing the AI/ML model (220) is configured to:
predict the future alarms based on at least one of, the patterns/trends of the historic data related to alarms and/or counters, the correlated data and the alarm data and the counter data.