DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
METHOD AND SYSTEM FOR IDENTIFYING ONE OR MORE ANOMALIES IN A NETWORK
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3. PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to the field of wireless communication systems. More particularly, the invention a method and a system for identifying one or more anomalies in a network.
BACKGROUND OF THE INVENTION
[0002] In modern telecommunications networks, ensuring seamless connectivity for subscribers is a critical requirement. Subscribers frequently move across different geographical areas or "cells," and their network demands fluctuate between various services or "slices," such as video streaming, gaming, or voice communication. Traditional systems often struggle to manage these transitions efficiently, leading to potential disruptions in service quality. Particularly, when a subscriber shifts from one cell to another or from one slice to another, maintaining high-quality service is challenging due to inherent delays and a lack of real-time tracking of network performance.
[0003] Current network management solutions face significant limitations in diagnosing and identifying issues that occur during these transitions. For instance, a common problem occurs when a subscriber moves between cells or switches network slices, such as shifting from video streaming to a gaming session. The delay in switching can impact the overall user experience, and traditional diagnostic tools are often incapable of identifying the precise cause of such disruptions. As a result, telecom operators struggle to pinpoint the root causes of these network issues, especially when the problems span across multiple network slices or geographical regions.
[0004] Furthermore, the complexity of modern telecommunications networks, with the introduction of technologies like 5G, has increased the difficulty of monitoring and troubleshooting network performance. The traditional systems lack advanced capabilities to track subscriber movement and behaviour across diverse network slices, making it difficult for operators to manage the networks proactively. This limitation results in longer downtimes and delayed resolution of network issues, ultimately impacting the quality of service provided to subscribers.
[0005] Hence, there is a need for an advanced solution that can effectively track subscriber movement across different cells and network slices in real-time, providing telecom operators with the ability to identify patterns of network issues promptly.
SUMMARY OF THE INVENTION
[0006] One or more embodiments of the present disclosure provide a method and system for identifying one or more anomalies in a network.
[0007] In one aspect of the present invention, the method for identifying one or more anomalies in a network is disclosed. The method includes the step of receiving, by one or more processors, a first set of data from one or more cell towers via a probing unit. Said first set of data includes information pertaining to at least one of network traffic, signal strength, packet loss, and latency. The received data is pre-processed and converted to a standard format. The method further includes the step of generating, by one or more processors, a second set of data by extracting one or more features from the received data. The one or more features correspond to at least call parameters, geographic coordinates, and load metrics.
[0008] The method further includes the step of training, by the one or more processors, a machine learning model utilizing the second set of data to analyze patterns corresponding to movement of one or more subscribers and one or more network performance metrics. The method further includes the step of tracking the movement of the one or more subscribers between each of the one or more cell towers based on the trained machine learning model. The method further includes the step of correlating the tracked movement of the one or more subscriber with the one or more network performance metrics to identify the one or more anomalies in the network. The one or more anomalies correspond to one of call dropping and slow data speeds during one of the movements of the one or more subscribers between cells and network slice switching. Further, on identification of the one or more anomalies, the method comprises the step of transmitting an alert to an operator of the network.
[0009] In an embodiment of the present invention, the system for identifying one or more anomalies in a network is disclosed. The system includes a receiving unit that is configured to receive a first set of data from one or more cell towers via a probing unit. The system includes a generating unit that is configured to generate a second set of data by extracting one or more features from the received data. The system further includes a training unit that is configured to train a machine learning model utilizing the second set of data to analyze patterns corresponding to movement of one or more subscribers and one or more network performance metrics. The system further includes a tracking unit that is configured to track the movement of the one or more subscribers between each of the one or more cell towers based on the trained machine learning model. The system further includes a correlating unit that is configured to correlate, the tracked movement of the one or more subscribers with the one or more network performance metrics to identify the one or more anomalies in the network.
[0010] Other features and aspects of this invention will be apparent from the following description and the accompanying drawings. The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specifications, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter; resort to the claims being necessary to determine such inventive subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS
[0011] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0012] FIG. 1 is an exemplary block diagram of an environment for identifying one or more anomalies in a network, according to one or more embodiments of the present invention;
[0013] FIG. 2 is an exemplary block diagram of a system for identifying one or more anomalies in a network, according to one or more embodiments of the present invention;
[0014] FIG. 3 is an exemplary architecture of the system of FIG. 2, according to one or more embodiments of the present invention;
[0015] FIG. 4 is an exemplary system?architecture illustrating the flow for identifying one or more anomalies in a network, according to one or more embodiments of the present disclosure;
[0016] FIG. 5 is a flow diagram of a method for identifying one or more anomalies in a network, according to one or more embodiments of the present invention.
[0017] The foregoing shall be more apparent from the following detailed description of the invention.
DETAILED DESCRIPTION OF THE INVENTION
[0018] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0019] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0020] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0021] The present invention discloses a system and a method for identifying the one or more anomalies in a network. More particularly, the system described herein offers a robust solution that tracks subscriber movement across different cells and slices in real-time. It not only identifies patterns of network issues but also allows operators to diagnose and rectify problems more efficiently. By utilizing this invention, telecom operators can significantly reduce the time and complexity involved in identifying network problems, leading to enhanced service quality and subscriber satisfaction.
[0022] Referring to FIG. 1, FIG. 1 is an exemplary block diagram of an environment 100 for identifying the one or more anomalies in a network 106, according to one or more embodiments of the present invention. The identification of the anomalies in the network 106 includes spotting unusual patterns, unusual traffic spikes, unauthorized access attempts, data transfer patterns, and behaviors that could indicate issues like security breaches or performance problems. The environment 100 includes a User Equipment (UE) 102, a server 104, a network 106, and a system 108. A user interacts with the system 108 utilizing the UE 102.
[0023] For the purpose of description and explanation, the description will be explained with respect to one or more user equipment’s (UEs) 102, or to be more specific will be explained with respect to a first UE 102a, a second UE 102b, and a third UE 102c, and should nowhere be construed as limiting the scope of the present disclosure. Each of the at least one UE 102 namely the first UE 102a, the second UE 102b, and the third UE 102c is configured to connect to the server 104 via the network 106.
[0024] In an embodiment, each of the first UE 102a, the second UE 102b, and the third UE 102c is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as smartphones, Virtual Reality (VR) devices, Augmented Reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0025] The network 106 includes, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, or some combination thereof. The network 106 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0026] The network 106 may also include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth.
[0027] The environment 100 includes the server 104 accessible via the network 106. The server 104 may include by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, a processor executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0028] The environment 100 further includes the system 108 communicably coupled to the server 104, and the UE 102 via the network 106. The system 108 is adapted to be embedded within the server 104 or is embedded as the individual entity.
[0029] Operational and construction features of the system 108 will be explained in detail with respect to the following figures.
[0030] FIG. 2 is an exemplary block diagram of the system 108 for identifying one or more anomalies in a network 106, according to one or more embodiments of the present invention.
[0031] As per the illustrated and preferred embodiment, the system 108 for identifying one or more anomalies in a network 106, includes one or more processors 202, a memory 204, and a probing unit 206. The one or more processors 202, hereinafter referred to as the processor 202, may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions. However, it is to be noted that the system 108 may include multiple processors as per the requirement and without deviating from the scope of the present disclosure. Among other capabilities, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204.
[0032] As per the illustrated embodiment, the processor 202 is configured to fetch and execute computer-readable instructions stored in the memory 204 as the memory 204 is communicably connected to the processor 202. The memory 204 is configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium, which may be fetched and executed to manage operations in the network 106. The memory 204 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0033] As per the illustrated embodiment, the probing unit 206 is configured to collect raw network data from gNodeB (cell towers), which serves as the training dataset for the machine learning models. This data includes information about traffic, signal strength, packet loss, latency, and other relevant network statistics. The probing unit 206 performs data analytics on the collected raw data and provides insights into network behaviour, including performance during network slice transitions. The probing unit 206 is not limited to a specific device or hardware but can be implemented as a software module integrated into various network components, such as a dedicated server or a cloud-based service. It may also take the form of a physical device installed at key points in the network, such as at the core network or near the radio access network (RAN). The unit may operate passively by monitoring data streams or actively by sending test packets to simulate slice switching scenarios and measure network response.
[0034] The probing unit 206 is one of, but not limited to, Radio Resource Monitoring (RRM) Probes, Deep Packet Inspection (DPI) Devices, Network Performance Monitors (NPM), Synthetic Traffic Generators, and so forth. The foregoing examples of probing unit 206 types are non-limiting and may not be mutually exclusive. In an embodiment, the probing unit 206 is configured as Radio Resource Monitoring (RRM) Probes. The RRM probes track signal strength, handover success rates, and the quality of service (QoS) experienced by users. These probing units are particularly useful during transitions between network slices, as they detect changes in signal quality and identify areas where the switch may introduce latency or packet loss.
[0035] In an embodiment, the probing unit 206 is configured as Deep Packet Inspection (DPI) Devices. DPI are passive probes that analyze the contents of network packets during slice switching, helping identify issues specific to high-priority services such as video calls or real-time gaming. In an embodiment, the probing unit 206 is configured as Network Performance Monitors (NPM), where the NPM tools serve as probing units that track key performance indicators (KPIs), including bandwidth utilization, error rates, and network congestion. These tools can be integrated into both RAN and core network elements to detect performance degradation during slice handovers.
[0036] In one embodiment, the probing unit 206 is configured as Synthetic Traffic Generators. The synthetic traffic generators are active probes that simulate user traffic under different network slice scenarios, used to assess the impact of slice switching on key performance metrics such as latency and throughput. The probing unit 206 operates in an active mode by injecting synthetic traffic into the network to simulate slice switching events. The unit generates test packets to emulate transitions between network slices, measuring network response such as delays, packet handling, or congestion during the switch. This method is especially useful for controlled testing under specific conditions. For example, an active probe can be implemented as a traffic generator that simulates real-world scenarios where user equipment (UE) shifts between slices providing distinct quality-of-service (QoS) guarantees, such as a switch from a high-throughput slice to a low-latency slice. Said probing unit 206 is designed to analyze network performance and issues that arise during network slice switching. Network slice switching involves transitions between different logical network slices, which may be tailored to distinct service requirements such as enhanced mobile broadband, ultra-reliable low-latency communications, or massive machine-type communications. The probing unit 206 provides real-time insights and diagnostics on these transitions, helping maintain network efficiency and service quality.
[0037] In an embodiment, the probing unit 206 operates as a hybrid system, combining both passive and active monitoring techniques. The hybrid probing unit collects live network data while simultaneously generating test traffic to evaluate network performance under different slice-switching scenarios. This approach offers a comprehensive view of network behavior, helping identify both real-time and potential future issues. For instance, the hybrid probe could be used to monitor ongoing user traffic while also running simulated slice-switching tests, helping telecommunications providers identify weak points in the network’s response to high-demand situations like a sudden switch between slices serving different service types (e.g., from low-bandwidth IoT communications to high-bandwidth video streaming).
[0038] In an embodiment, the probing unit 206 is implemented as a virtualized software function deployed in a cloud-based network environment. This software-based probing unit is scalable and adaptable, enabling flexible monitoring in large-scale 5G networks with multiple slices. The unit gathers and analyzes network data from gNodeBs, core networks, and cloud servers, adjusting dynamically as network conditions evolve. For example, a cloud-native probing unit can analyze traffic distribution across network slices in a mobile broadband scenario where users are transitioning between ultra-dense urban areas and rural areas, each requiring different slice characteristics.
[0039] In an embodiment, the probing unit 206 is a dedicated hardware device installed at critical points in the network, such as at the core or edge nodes, or near the radio access network (RAN). These hardware-based probing units are capable of high-speed, low-latency data collection and analysis, making them ideal for real-time monitoring of network slice transitions. For instance, a dedicated hardware probe could be installed at the gNodeB level, continuously tracking signal quality, handover success rates, and other metrics as users transition between slices optimized for different applications like augmented reality (AR) or voice-over-IP (VoIP) communications.
[0040] In an embodiment, the probing unit 206 is part of a broader service assurance system that monitors the end-to-end performance of network slices. The unit collects data from various components, including the user equipment (UE), gNodeB, and core network, analyzing how well each slice adheres to predefined service-level agreements (SLAs). For example, in a scenario where a network slice is dedicated to ultra-reliable low-latency communication (URLLC), the probing unit monitors latency, packet delivery success, and jitter to ensure compliance with the required SLAs during and after slice switching.
[0041] Referring to Fig. 2, as per the illustrated embodiment, the system 108 includes the processor 202 to identify the one or more anomalies in the network 106. The processor 202 includes a receiving unit 208, a generating unit 210, a training unit 212, a tracking unit 214 and a correlating unit 216. Each unit performs specific tasks within the overall network analysis and optimization process, particularly during network slice switching. The processor 202 is communicably coupled to the one or more components of the system 108 such as the probing unit 206, and the memory 204. In an embodiment, operations and functionalities of the receiving unit 208, the generating unit 210, the training unit 212, the tracking unit 214, the correlating unit 216, and the one or more components of the system 108 can be used in combination or interchangeably to optimize network performance during network slice transitions.
[0042] In one embodiment, the receiving unit 208 is configured to receive a first set of data from one or more cell towers (gNodeB) via the probing unit 206. Said first set of data may include metrics such as information pertaining to at least one of network traffic, signal strength, packet loss, and latency. The received data is pre-processed and converted to a standard format. Said standard format for pre-processed data may include CSV (Comma-Separated Values), JSON (JavaScript Object Notation), XML (eXtensible Markup Language), Parquet, TFRecord, HDF5 (Hierarchical Data Format), SQL databases, Protocol Buffers and like.
[0043] The receiving unit 208 plays a key role in gathering raw network data from the probing unit 206, which monitors network behavior during slice switching. The probing unit 206, as detailed in previous paragraphs, acts as an intermediary, ensuring that real-time network information is transmitted to the processor 202 for subsequent analysis. The raw data received by the receiving unit 208 forms the foundation for the extraction and processing performed by the other functional units within the processor 202.
[0044] In one embodiment, the receiving unit 208 may utilize one of techniques such as, but not limited to, Database Extraction, ETL (Extract, Transform, Load) Tools, Application Programming Interface (API) Integration, Web Scraping, Real-Time Data Streaming, and Query Languages to retrieve the data from the one or more data sources.
[0045] In the database extraction technique, the receiving unit 208 is in communication with the probing unit 206 using a database client or programming language to execute queries and retrieve data. For instance, the receiving unit 208 pulls data on customer call records, including call duration, time of day, and destination numbers. This data is crucial for analyzing customer behavior and identifying usage patterns. The ETL tools are utilized to extract data from multiple data sources, handling various data formats and making them ideal for analyzing the consolidated data. For example, the ETL tool connects to network management systems via APIs to pull real-time performance metrics, extract billing data from SQL databases, and scrape social media platforms for customer feedback.
[0046] The API integration allows the receiving unit 208 to access data from data services by making HTTP requests to API endpoints, enabling real-time data retrieval. For instance, the receiving unit 208 pulls data that may include metrics such as information pertaining to at least one of network traffic, signal strength, packet loss, and latency via their APIs.
[0047] In one embodiment, the generating unit 210 is configured to generate a second set of data by extracting one or more features from the first set of data received by the receiving unit 208. This second set of data may include metrics such as information pertaining to at least one of network traffic, signal strength, packet loss, and latency. The data may also include, but is not limited to, critical network performance metrics such as signal quality patterns, latency spikes, and user movement trends between cell towers during slice switching. The received data is pre-processed and converted to a standard format. The one or more features correspond to at least call parameters, geographic coordinates, and load metrics. By isolating these relevant features, the generating unit 210 ensures that only the most pertinent information is forwarded for further analysis, thereby optimizing the system's efficiency and reducing the computational load. In one embodiment, the generating unit 210 may specifically focus on subscriber handover patterns between network slices to identify performance bottlenecks or inefficiencies during the transitions.
[0048] In one embodiment, the training unit 212 is configured to train a machine learning model using the second set of data generated by the generating unit 210. The machine learning model is trained to analyze subscriber movement patterns and network performance metrics, enabling it to learn how the network behaves during slice switching. By leveraging both historical and real-time data, the training unit 212 allows the system to predict potential issues, such as network congestion or handover delays, before they impact the overall network performance. For example, the training unit 212 can help the system predict traffic congestion during peak hours when multiple subscribers transition between high-bandwidth and low-latency slices.
[0049] In an embodiment, the training unit 212 is configured to train the machine learning model utilizing the training dataset to identify trends and patterns within that dataset. The training data is essential for training the selected model. During this training process, the model learns the underlying patterns and relationships between the input features that may include threshold values for different parameters and the target variable such as anomaly detection based on current policy.
[0050] The training unit 212 is responsible for core function of training the machine learning model, enabling it to learn and adapt by identifying trends and patterns within the data. The model is selected based on a characteristic of the training dataset, desired output, and a task. This process involves several key activities, such as feature extraction and learning relationships. In feature extraction, the model identifies important features or attributes in the data that contribute to making predictions. In learning relationships, the model learns how different features relate to each other and how they correlate with the output labels. This understanding is crucial for various tasks, such as regression, where the model predicts continuous values, or classification, where it predicts discrete categories.
[0051] In one embodiment, the tracking unit 214 is configured to track, the movement of the one or more subscribers between each of the one or more cell towers (gNodeBs) based on the insights derived from the machine learning model trained by the training unit 212. It tracks how each subscriber transitions between network slices and assesses the impact of these movements on overall network performance. For instance, when a subscriber moves from a high-throughput slice to a low-latency slice, the tracking unit 214 monitors the speed and efficiency of the slice handover, identifying any disruptions in service quality, such as packet loss or increased latency, that occur during the transition.
[0052] In an embodiment, the tracking unit 214 may use a GPS (Global Positioning System) Coordinates for accurate tracking of the subscriber movement between each of the one or more cell towers (gNodeBs). However, the tracking unit 214 may be selected based on Cell ID (Cell Identifier), Location Area Code (LAC), GSM networks, International Mobile Subscriber Identity (IMSI), Timing Advance (TA), Signal Strength, Neighboring Cell Information, and like.
[0053] In one embodiment, the correlating unit 216 is configured to correlate the tracked movement of the one or more subscribers with network performance metrics to identify the one or more potential anomalies or issues within the network. The one or more anomalies correspond to one of call dropping and slow data speeds during one of the movements of the one or more subscribers between cells and network slice switching. On identification of the one or more anomalies, the method comprises the step of transmitting, by the one or more processors, an alert to an operator of the network. By cross-referencing data about subscriber transitions between network slices with metrics such as latency, packet loss, and signal strength, the correlating unit 216 can pinpoint the root causes of network issues. For example, if a significant increase in packet loss is observed when a subscriber transitions between two slices, the correlating unit 216 may identify the issue as being related to poor handover coordination or inadequate network resource allocation. The correlating unit 216 plays a critical role in diagnosing and addressing network performance issues, enabling more efficient and reliable network slice switching.
[0054] The receiving unit 208, the generating unit 210, the training unit 212, the tracking unit 214 and the correlating unit 216, in an exemplary embodiment, are implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 202. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 202 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the processor may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 204 may store instructions that, when executed by the processing resource, implement the processor 202. In such examples, the system 108 may comprise the memory 204 storing the instructions and the processing resource to execute the instructions, or the memory 204 may be separate but accessible to the system 108 and the processing resource. In other examples, the processor 202 may be implemented by electronic circuitry.
[0055] FIG. 3 illustrates an exemplary architecture for the system 108, according to one or more embodiments of the present invention. More specifically, FIG. 3 illustrates the system 108 for identifying one or more anomalies in a network 106. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the gNodeB (cell tower) 402 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0056] FIG. 3 shows communication between the gNodeB (cell tower) 402, and the system 108. For the purpose of description of the exemplary embodiment as illustrated in FIG. 3, the gNodeB (cell tower) 402, uses network protocol connection to communicate with the system 108. The gNodeB (cell tower) 402 functions as the primary data source in the network. These cell towers continuously collect vital information regarding signal strength, device location, network traffic data, and other relevant metrics from connected mobile devices. This raw data is transmitted to the probing unit 206 for further analysis.
[0057] Further, said network protocol connection includes, but not limited to, Session Initiation Protocol (SIP), System Information Block (SIB) protocol, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Simple Network Management Protocol (SNMP), Internet Control Message Protocol (ICMP), Hypertext Transfer Protocol Secure (HTTPS) and Terminal Network (TELNET).
[0058] According to the exemplary embodiment, the probing unit 206 is hosted on the server 104, which plays a key role in receiving data from gnodeB (cell tower) 402. The probing unit 206 is configured to handle multiple operations, including storing customer details and processing network-related information. For example, when the UE 102 sends a request for network performance metrics, the probing unit 206 retrieves the relevant information from the server 104 and responds accordingly. This interaction ensures that the UE 102 has access to real-time network metrics, which is essential for effective network slice switching and ensuring seamless service delivery.
[0059] As previously described in FIG. 2, the system 108 includes key components such as the processor 202, the memory 204, and the probing unit 206, all of which manage the operations of the network 106. The interaction between these components has been thoroughly explained in relation to FIG. 2. For the sake of brevity, a similar description of their functions is omitted here. However, it is important to note that these components continue to function similarly in the context of FIG. 3 and should be read in conjunction with the description provided for FIG. 2.
[0060] Furthermore, as explained earlier in FIG. 2, the processor 202 comprises several units, including the receiving unit 208, the generating unit 210, the training unit 212, the tracking unit 214, and the correlating unit 216, all of which are crucial for network management. The description of these units and their respective functions has already been covered in FIG. 2 and is not repeated here for brevity. However, the limited description provided for the system 108 in FIG. 3 should be read in conjunction with FIG. 2 to fully understand how the system manages communication and network performance. This should not be construed as limiting the scope of the present invention, as these elements play a critical role in network slice switching and optimization.
[0061] FIG. 4 is an exemplary system?architecture 400 illustrating the flow for identifying one or more anomalies in a network 106, according to one or more embodiments of the present disclosure.
[0062] In one embodiment, the system architecture 400 illustrated in FIG. 4 operates as follows to analyze network issues during network slice switching, ensuring efficient management of resources and enhanced user experience. The process begins with the gNodeB (cell tower) 402, which functions as the primary data source in the network. These cell towers continuously collect vital information regarding signal strength, device location, network traffic data, and other relevant metrics from connected mobile devices. This raw data is transmitted to the probing unit 206 for further analysis.
[0063] The probing unit 206 receives the raw network data collected from the gNodeB 402. This unit is responsible for performing initial data analytics, providing insights into network behavior and performance. It serves as the central hub that aggregates data from multiple gNodeBs 402, ensuring a comprehensive view of network conditions.
[0064] Once the raw data reaches the probing unit 206, it is forwarded to the Data Pre-processing 412 stage. Here, the data undergoes cleaning and preparation, where unwanted or irrelevant data, such as missing values, outliers, and duplicate records, are removed. The pre-processing involves several key functions, including combining data from various sources as needed and splitting the data into training and testing sets. Further, this preprocessing is crucial for maintaining the integrity and quality of the dataset, ensuring that only relevant and accurate information is utilized in subsequent analysis.
[0065] In one of the embodiments, following preprocessing, the cleaned data is subjected to feature extraction, where specific variables are identified and transformed into formats suitable for analysis. The extracted features may include call parameters, geographic coordinates, and network load metrics. This step is essential as it determines the input that will be used for training machine learning models.
[0066] Additionally, the data preprocessing unit 412 performs data cleaning, which includes removing redundant data and addressing missing values such as NaN values. This process is crucial for enhancing the quality of the dataset, as it helps to identify and correct errors, eliminate inconsistencies, and ensure that the data is suitable for further analysis. By effectively preparing the data, the data preprocessing unit 412 enables more accurate and reliable outcomes in subsequent analytical processes.
[0067] The processed and feature-extracted data is then sent to the Model Training Unit 414. In this unit, selected machine learning models are employed to analyze the data and identify patterns and correlations between subscriber movement, network performance metrics, and other critical variables. Through iterative training, the model learns to recognize potential issues related to network slice switching, equipping the system with predictive capabilities. During the training phase, the selected model utilizes various models to analyze the training data, learning from the information provided through an iterative process. Each iteration involves adjusting the model’s internal parameters to minimize prediction errors and enhance accuracy, thereby allowing the model to identify significant correlations and dependencies among the variables. This capability is essential for the model to generalize well, to make accurate predictions on new, unseen data based on the patterns learned during training. Furthermore, the model training unit 414 continually evaluates its performance using validation techniques, ensuring that the model not only fits the training data but also maintains robustness and effectiveness in real-world applications.
[0068] Simultaneously, the tracking unit 214 monitors the real-time movements of subscribers across different cells and network slices. This tracking utilizes signals received from the mobile devices as they connect to various gNodeBs, allowing the system to gain insights into user behavior and the dynamics of network slice transitions.
[0069] The tracking unit 214 may use a GPS (Global Positioning System) Coordinates for accurate tracking of the subscriber movement between each of the one or more cell towers (gNodeBs). However, the tracking unit 214 may selected base on Cell ID (Cell Identifier), Location Area Code (LAC), GSM networks, International Mobile Subscriber Identity (IMSI), Timing Advance (TA), Signal Strength, Neighboring Cell Information, and like.
[0070] The collected data of the subscriber movement data is fed into the pattern identification unit 418. The pattern identification unit 418 correlates the movement data with network performance metrics to identify recurring patterns of issues that arise during network slice switching. For instance, the system can detect if subscribers consistently experience latency spikes or dropped calls when moving between specific cells or slices, thus pinpointing areas that require attention.
[0071] Upon identifying significant anomalies or patterns indicating potential network issues, the system triggers real-time alerts to notify network operators immediately. These alerts can be communicated through various channels, such as email or SMS, or integrated into network management systems. The timely alerts enable operators to take prompt action to address any identified issues, minimizing service disruption and ensuring a high-quality user experience.
[0072] The data lake 430 functions as a distributed database where all processed data, insights, and model outputs are stored. It serves as a long-term repository for historical and real-time data, enabling network operators to access previous data for further analysis, model training, or reporting purposes. All processed data, along with the outputs generated from various stages of analysis, are stored in the data lake 430. The data lake 430 is connected to all major processing units in the system, including the probing unit 206, model training unit 414, and pattern identification unit 418. After data is collected and processed by these components, it is stored in the data lake 430 for future reference. This ensures that telecom operators have access to a wealth of information that can be used to improve network performance over time, train more advanced machine learning models, or conduct in-depth studies of network issues. This centralized repository allows for the retention of historical data and model outputs, enabling further analysis and model refinement. The stored data can be leveraged for generating reports, conducting in-depth analyses, and continuously improving network performance.
[0073] The User Interface (UI) 410 serves as the primary point of interaction between network operators and the system. It is designed to provide real-time visibility into the network performance, including tracking subscriber movements, monitoring slice switching events, and identifying potential network issues. The UI is user-friendly and may include dashboards, graphical reports, and alerts to ensure operators can easily access and interpret the data. The UI 410 is connected to various components of the system, such as the probing unit 206, Pattern Identification Unit 418, and the data lake 430. It displays the data collected, processed, and analyzed by these components, providing network operators with actionable insights. Operators can interact with the UI to view real-time alerts, monitor network traffic, and respond to network anomalies detected by the system.
[0074] The data consumers 408 represents the entities or operators who utilize the processed data generated by the system. These consumers are typically telecom operators responsible for monitoring and managing network performance. They rely on insights provided by the system to optimize network resources, ensure seamless user experiences, and address performance issues in real time. The Data Consumers 408 receives data analyzed from the probing unit 206 and other components, such as the pattern identification unit 418 and Tracking Unit 214. This data is presented to them via the User Interface (UI) 410, allowing them to monitor key metrics such as signal strength, subscriber location, and traffic patterns. Based on the information provided, they can make informed decisions about network adjustments and resource allocation to resolve issues during network slice switching.
[0075] In one embodiment, the user interface 410, the data consumers 408, and the data lake 430 work simultaneously to provide a complete ecosystem for monitoring, analyzing, and improving network performance during slice switching. Data flows from gNodeB to the probing unit 206, which performs initial analysis, and the results are further processed and stored in the data lake 430. These results are then presented via the UI 410 to the data consumers 408, enabling them to take necessary actions based on the insights provided.
[0076] FIG. 5 illustrates a flow diagram of a method 500 for identifying one or more anomalies in a network 106, in accordance with one or more embodiments of the present invention. The method 500 provides a structured process for addressing and mitigating potential network anomalies during transitions between network slices, specifically focusing on subscriber movement and performance metrics. For the purposes of clarity and reference, the method is described in conjunction with the embodiments presented in FIG. 2, where the components such as the probing unit, processor, and machine learning models are already detailed. However, it should be understood that the description provided herein for FIG. 5 should not be seen as limiting the scope of the invention. The method, as depicted, outlines the steps performed by one or more processors and their interaction with network components such as cell towers and the probing unit for effective network analysis.
[0077] The method 500 initiates at step 502, where one or more processors receive a first set of data from one or more cell towers via a probing unit 206. The data includes relevant network performance metrics such as traffic patterns, signal strength, packet loss, latency, and subscriber location. The received data is pre-processed and converted to a standard format. This raw data serves as the foundational input for further analysis, and the probing unit 206 plays a critical role in gathering and transmitting this data for processing.
[0078] At step 504, the method includes generating a second set of data by extracting one or more features from the received raw data. The one or more features correspond to at least call parameters, geographic coordinates, and load metrics. These features, which may include patterns in subscriber movements, variations in signal quality, or shifts in network load, are extracted by the one or more processors to create a more refined dataset. This step allows the system to focus on the most relevant data points for subsequent analysis, ensuring efficient machine learning training and model accuracy.
[0079] In step 506, the extracted features are used to train a machine learning model. The machine learning model is trained to analyze patterns such as subscriber movement across different cell towers and key network performance metrics. By leveraging the second set of data, the system enhances its predictive capabilities in identifying potential network issues, particularly during network slice switching. This training process enables the model to anticipate potential anomalies based on historical data and real-time network behaviors.
[0080] At step 508, the trained machine learning model is used to track the movement of subscribers between different cell towers. The system continuously monitors the subscriber movement, correlating the changes in location with network performance metrics such as latency and signal strength. This step provides real-time insights into how the user’s movements across network slices may impact the quality of the connection, thus enabling dynamic adjustments to optimize performance.
[0081] Finally, at step 510, the method includes correlating the tracked movement of the one or more subscribers with the one or more network performance metrics. By comparing these two datasets, the system identifies patterns of network issues, such as call drops, latency spikes, or reduced signal strength when a subscriber switches from one network slice to another. On identification of the one or more anomalies, the method comprises the step of transmitting, by the one or more processors, an alert to an operator of the network. By cross-referencing data about subscriber transitions between network slices with metrics such as latency, packet loss, and signal strength, the correlating unit 216 can pinpoint the root causes of network issues. For example, if a significant increase in packet loss is observed when a subscriber transitions between two slices, the correlating unit 216 may identify the issue as being related to poor handover coordination or inadequate network resource allocation. The correlating unit 216 plays a critical role in diagnosing and addressing network performance issues, enabling more efficient and reliable network slice switching. This correlation step allows the system to detect the one or more anomalies in the network, facilitating proactive issue resolution and ensuring a smoother user experience during network slice transitions.
[0082] The present invention further discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by the processor 202. The processor 202 is configured to receive a first set of data from one or more cell towers via a probing unit 206. The processor 202 is further configured to train the training unit 212 utilizing the second set of data to analyze patterns corresponding to movement of one or more subscribers and one or more network performance metrics. The processor 202 is further configured to track the movement of the one or more subscribers, via the tracking unit 214, between each of the one or more cell towers based on the trained machine learning model. The processor 202 is further configured to correlate the tracked movement of the one or more subscribers’ movement data with the one or more network performance metrics to identify the one or more anomalies in the network.
[0083] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-5) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0084] The present disclosure provides a significant technical advancement. The inventive step resides in the system’s capability to track subscriber movement across different cells and network slices while simultaneously identifying patterns of network issues through the use of advanced machine learning models. The novelty of this invention lies in the seamless integration of subscriber movement tracking, real-time data analysis, pattern recognition of network anomalies, and proactive network management. This holistic approach equips network operators with a powerful tool to optimize network performance, enhance service quality, and ensure a more stable and efficient network experience for end users.
[0085] The present disclosure offers a comprehensive solution to enhance network performance and subscriber experience through multiple innovative features. Firstly, it enables the tracking of subscriber movement, allowing operators to monitor and record the locations and mobility patterns of subscribers as they transition between different cells and network slices. This provides valuable insights into subscriber behavior and network dynamics. Secondly, the invention excels in network issue identification. By correlating the tracked movement of the one or more subscribers with the one or more network performance metrics, it allows operators to detect recurring network issues or problem areas where subscribers frequently face connectivity challenges. This facilitates faster and more efficient resolution of network problems.
[0086] Moreover, the system contributes significantly to Quality of Service (QoS) optimization. Through the integration of the user interface with the probe unit, the invention dynamically adapts network resources and configurations based on how subscriber movements affect network performance. This ensures high-quality service delivery even amidst subscriber mobility across different network slices. Finally, the invention promotes proactive issue resolution. With the capability to track subscriber movement and recognize patterns of network anomalies, operators can anticipate potential problems and address them preemptively, improving overall service quality and customer satisfaction.
[0087] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS

[0089] Environment - 100;
[0090] User Equipment (UE) - 102;
[0091] Server - 104;
[0092] Network- 106;
[0093] System -108;
[0094] Processor - 202;
[0095] Memory - 204;
[0096] Probing unit – 206;
[0097] Receiving unit – 208;
[0098] Generating unit – 210;
[0099] Training unit – 212;
[00100] Tracking unit – 214;
[00101] Correlating unit – 216;
[00102] System Architecture – 400;
[00103] gNodeB – 402;
[00104] Data Consumers – 408;
[00105] User Interface – 410;
[00106] Data preprocessing – 412;
[00107] Model training unit - 414;
[00108] Pattern Identification unit – 418;
[00109] Alerting and Response – 420;
[00110] Data lake - 430

,CLAIMS:CLAIMS:
We Claim
1. A method 500 of identifying one or more anomalies in a network 106, the method 500 comprising the steps of:
receiving, by one or more processors 202, a first set of data from one or more cell towers 402 via a probing unit 206;
generating, by the one or more processors 202, a second set of data by extracting one or more features from the received data;
training, by the one or more processors 202, a machine learning model utilizing the second set of data to analyse patterns corresponding to movement of one or more subscribers and one or more network performance metrics;
tracking, by the one or more processors 202, the movement of the one or more subscribers between each of the one or more cell towers 402 based on the trained machine learning model; and
correlating, by the one or more processors 202, the tracked movement of the one or more subscribers with the one or more network performance metrics to identify the one or more anomalies in the network 106.

2. The method 500 as claimed in claim 1, wherein the first set of data includes information pertaining to at least one of network traffic, signal strength, packet loss, and latency.

3. The method 500 as claimed in claim 1, wherein the one or more features correspond to at least call parameters, geographic coordinates, and load metrics.

4. The method 500 as claimed in claim 1, wherein the one or more anomalies correspond to one of call dropping and slow data speeds during one of the movements of the one or more subscribers between cells and network slice switching.

5. The method 500 as claimed in claim 1, wherein on identification of the one or more anomalies, the method 500 comprises the step of transmitting, by the one or more processors 202, an alert to an operator of the network 106.

6. A system 108 for identifying one or more anomalies in a network 106, the system 108 comprising:
a receiving unit 208 configured to receive, a first set of data from one or more cell towers 402 via a probing unit 206;
a generating unit 210 configured to generate, a second set of data by extracting one or more features from the received data;
a training unit 212 configured to train, a machine learning model utilizing the second set of data to analyse patterns corresponding to movement of one or more subscribers and one or more network performance metrics;
a tracking unit 214 configured to track, the movement of the one or more subscribers between each of the one or more cell towers 402 based on the trained machine learning model; and
a corelating unit 216 configured to corelate, the tracked movement of the one or more subscribers with the one or more network performance metrics to identify the one or more anomalies in the network 106.

7. The system 108 as claimed in claim 6, wherein the first set of data includes information pertaining to at least one of network traffic, signal strength, packet loss, and latency.

8. The system 108 as claimed in claim 6, wherein the one or more features correspond to at least call parameters, geographic coordinates, and load metrics.

9. The system 108 as claimed in claim 6, wherein the one or more anomalies correspond to one of call dropping and slow data speeds during one of the movements of the one or more subscribers between cells and network slice switching.

10. The system 108 as claimed in claim 6, comprising a transmitting unit configured to transmit, an alert to an operator of the network 106 on identification of the one or more anomalies.