System and method for peer-to-peer statistics-based fault detection

Abstract

Embodiments of the present disclosure relate to systems and methods for peer-to-peer statistics based fault detection. Although many network components include diagnostic capabilities, these diagnostics may be unreliable. Thus, when dependent solely on these diagnoses, an error indication of operability or non-operability may result in. To better detect operational issues of a network component, operational parameters from the network component and one or more peer devices are analyzed to determine whether the network component is operational. In some embodiments, data derived from these operational parameters is provided to a supervised machine learning model, and the model provides an output indicative of an operational state of the network component. Some embodiments binarize an operating parameter of a device and calculate a maximum duration of inactivity of the device indicative of the binarized parameter. Some embodiments calculate a moving average of the binarized parameters. In some embodiments, the maximum duration and / or moving average (s) are provided to a machine learning model.

Description

[0001] Divisional Application Instructions

[0002] This application is a divisional application of the Chinese invention patent application with the application date of February 25, 2020, application number 202010117385.5, and name “System and method for fault detection based on peer statistics”. Technical Field

[0003] One exemplary aspect relates to identifying faults in a network device based on unreliable device statistics, and more particularly to a method and / or apparatus for observing the behavior of neighboring (peer) network devices and determining the health of the device based on unreliable status reports of the device and based on statistics collected from its peers. Background Art

[0004] Radio chipsets are often used in wireless access points such as Wi-Fi access points (APs). Although chipsets greatly simplify the design and construction of wireless APs, the internal state of the chipset is often difficult to evaluate because the counters exposed by the chipset are often corrupted by interference from neighboring APs. As such, the information provided by the internal chipset counters provides noisy data that conveys unreliable and sometimes misleading information.

[0005] Therefore, it may be difficult to assess whether a radio transmitter is experiencing operational difficulties (e.g., is stuck or has stopped transmitting). Detecting operational problems or failures may be important for quickly resolving the problem. For example, if an access point's beacon radio (or any other radio) stops transmitting, the access point will not be visible to neighboring mobile wireless terminals (WTs). As a result, neighboring WTs will not be able to associate with or otherwise communicate with the AP. The sooner we detect that a problem has occurred, the sooner a technician can be notified, and / or an automatic recovery mechanism can be invoked to remedy the situation. Therefore, there is a need for improved methods for providing reliable health status of network components, even when the built-in diagnostics of network counters are providing noisy and sometimes misleading information. Summary of the invention

[0006] According to some embodiments of the present disclosure, a method for determining whether a network component is operable is provided, the method comprising: determining, by one or more hardware processors, a first operating parameter value of the network component; determining, by one or more hardware processors, one or more neighboring devices of the network component; determining, by one or more hardware processors, a second operating parameter value of the one or more neighboring devices; determining, by one or more hardware processors, whether the network component is operational based on the first operating parameter value of the network component and the second operating parameter value of the one or more neighboring devices; and conditionally controlling the network component based on whether the network component is determined to be operational.

[0007] According to some other embodiments of the present disclosure, a system for determining whether a network component is operational is provided, the system comprising: a hardware processing circuit; one or more hardware memories storing instructions, the instructions configuring the hardware processing circuit to perform operations when executed, the operations comprising: determining a first operating parameter value of the network component; determining one or more neighboring devices of the network component; determining a second operating parameter value of the one or more neighboring devices; determining whether the network component is operational based on the first operating parameter value of the network component and the second operating parameter value of the one or more neighboring devices; and conditionally controlling the network component based on whether the network component is determined to be operational.

[0008] According to some further embodiments of the present disclosure, a non-transitory computer-readable storage medium storing instructions is provided, which, when executed, configures a hardware processing circuit to determine whether a network component is operational, the operations comprising: determining a first operating parameter value of the network component; determining one or more neighboring devices of the network component; determining a second operating parameter value of one or more neighboring devices; determining whether the network component is operational based on the first operating parameter value of the network component and the second operating parameter value of one or more neighboring devices; and conditionally controlling the network component based on whether the network component is determined to be operational. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The embodiments of the present invention may be better understood by referring to the following description in conjunction with the accompanying drawings, in which like reference numerals indicate identical or functionally similar elements, and in which:

[0010] FIG. 1a is a block diagram illustrating an embodiment of an exemplary network environment;

[0011] FIG1 b is a block diagram illustrating an embodiment of an exemplary Wi-Fi portion of a network environment;

[0012] Figure 2 is a block diagram illustrating an embodiment of an exemplary wireless access point;

[0013] Figure 3 is a block diagram illustrating an embodiment of an exemplary network management system including an automatic fault analyzer;

[0014] Figure 4 is a block diagram illustrating an embodiment of an exemplary network node server;

[0015] Figure 5 is a block diagram illustrating an embodiment of an exemplary device such as a user equipment (UE) or a wireless terminal (WT);

[0016] Fig. 6A is an illustrative example of a data structure used to determine peer neighbors;

[0017] Figure 6B is a diagram illustrating processing of operating parameter values ​​in some disclosed embodiments;

[0018] Figure 7 is a flow chart illustrating an exemplary embodiment of a process 700 by which a behavior model is established and used;

[0019] Figure 8 is a flow chart of a process for determining whether a network component is operational;

[0020] Fig. 9 is a flow chart of a process for determining whether a network component is operational;

[0021] Fig.10 is a flow chart of a process for determining whether a network component is operational;

[0022] Fig.11 is a flow chart of a process 1100 for quantifying operating parameter measurements; and

[0023] Fig.12 Example machine learning modules according to some examples of the present disclosure are shown. DETAILED DESCRIPTION

[0024] Many network devices include diagnostic capabilities. These diagnostic capabilities typically maintain statistics about the performance of the network device. These statistics can convey statistics related to, for example, the amount of network traffic processed by the network device (e.g., counts of received messages or packets, counts of transmitted messages or packets, delays, or throughput). In some cases, these statistics rely on hardware-based analysis of network traffic. For example, a network interface chip of a network device can maintain one or more data values ​​to support the generation of these diagnostic statistics. However, these diagnostic capabilities are sometimes unreliable. For example, some network interface chips are susceptible to interference generated by other wireless devices, which may cause damage to the internal counters that support diagnostic capabilities. In order to reduce uncertainty and increase the reliability of the diagnosis of the network device, the disclosed embodiment incorporates information from adjacent (peer) devices to derive a more accurate determination of the health of a given device.

[0025] According to one non-limiting example, the beacon radio of the AP transmits a beacon message at a specific rate (e.g., 10 beacons per second). When a wireless device receives the beacon message, it can evaluate the signal strength of the beacon and determine whether to associate with the AP based on the strength of the signal. Some embodiments of the access point include a radio chipset of the wireless that maintains one or more counters that characterize the operation of the wireless radio. In some of these embodiments, an internal counter R in the radio chipset x The number of messages received by the AP in response to sending a beacon signal is counted. x The count indicated by the counter may be affected by messages from other neighboring WTs and is therefore unreliable. x The counters provide cumulative counts of various other parameters. This can present challenges when assessing the health of an AP based solely on statistics managed internally by the wireless radio.

[0026] Because internal diagnostics provided by network devices can be unreliable and therefore convey little or sometimes misleading information about the health of the AP, a system implementing one or more disclosed embodiments uses a predetermined threshold to map a receive (Rx) count provided by the internal diagnostics to a binary value, such as 0 or 1. When the number indicated by the Rx counter drops below the predetermined threshold, the system maps the Rx count to a first value, such as zero (0), and when the number is equal to or greater than the threshold, the Rx count is mapped to a second value, such as one (1).

[0027] Implementations that rely on diagnostic data provided by a single AP may experience challenges. For example, an implementation that makes control decisions for a networked system based on data provided by a single AP, which may be from the access point's internal diagnostics (e.g., the R x The raw unprocessed receive count of the counter) or, as described above, the binary value of the receive count. This results in suboptimal control decisions.

[0028] To improve the accuracy of these determinations, at least some disclosed embodiments utilize information from neighboring (peer) APs. Some embodiments place limits on the number of neighbors or peer devices relied upon when making determinations about a particular network device. For example, some embodiments may limit the number of peer devices considered to five (5), six (6), seven (7), eight (8), nine (9), or ten (10) devices.

[0029] Some disclosed embodiments receive signal strength measurements from wireless terminals to determine which APs are within a predefined proximity of each other. In some embodiments, if there is a client WT that satisfies the condition defined by Equation 1 below i , then the two APs, AP1 and AP2, are called peers:

[0030] SS1+SS2>T SS Equation 1

[0031] in:

[0032] T SS - Predetermined signal strength (e.g. RSSI) threshold

[0033] SS1-WT i The strength of the signal received from AP1

[0034] SS2-WT i The strength of the signal received from AP2

[0035] Alternatively, in some embodiments, the APs identify each other's beacon signals and define the AP as a peer neighbor if the signal strength of the signal received from another AP is greater than a predetermined threshold. i and AP j Considered as neighbors:

[0036] SS i-＞j >T2 or SS j-＞i >T2 Equation 2

[0037] in:

[0038] SS i-＞j-From AP i Transmitted and sent by AP j Received signal strength (such as RSSI)

[0039] T2-predetermined threshold

[0040] In other embodiments, peers of the first AP are identified as those candidate peer APs that have a signal strength experienced at the first AP that is above a threshold. Some embodiments rank the candidate peer APs by signal strength and then select the N highest ranked candidate APs as peer APs of the first AP. (For example, N can be any number between one and one hundred).

[0041] In order to consolidate information from peer APs, some disclosed embodiments collect operational statistics from neighboring APs. These operational statistics may include, for example, the number of clients associated with or communicating with a peer AP, or a receive counter for a peer AP. The receive counter may count the number of packets received, the amount of data received, or other metrics that quantify the receive activity on the peer AP. Some embodiments store the collected operational statistics in a memory. Some embodiments organize the collected operational statistics in a table, such as the following example Table 1:

[0042] Table 1

[0043]

[0044] The AP in Table 1 above i APs whose health is being analyzed are indicated. AP1 to AP5 represent APs defined by equation 1 or equation 2 above in some embodiments. i The number of associated wireless devices indicates the time-dependent number of WTs associated with each peer AP and the number of WTs associated with the AP whose health is being evaluated. x The counter indicates the number of received packets (R ) received by each of the peer APs within a predetermined time window (eg, one minute). x ) The number of received messages tracked. In some embodiments, the receive counter is implemented in hardware, software, or firmware of the corresponding network component.

[0045] Using a first predetermined threshold (e.g., ten (10)) associated with the number of wireless devices associated with each AP, and a second predetermined threshold (e.g., fifty (50)) for the receive counter(s), the values ​​in Table 1 are mapped to an active state or an inactive state or to one of two binary values ​​as shown in Table 2 below:

[0046] Table 2

[0047]

[0048]

[0049] In some embodiments, the conversion of the data represented in Table 1 to the data represented in Table 2 is performed as follows: If the AP is active during a specific time period, the method marks the AP state as zero for the above time window. However, if the AP is determined to be inactive during the specific time period, the method maps the state of the AP to a binary value of 1 for the above time window. (For example, in this example, active=>0; inactive=>1).

[0050] In at least some embodiments, the information in Table 1 is collected periodically, for example, every 60 seconds. The periodically collected information is then mapped to binary values ​​as described above. This periodic processing generates a time series of binarized data for each AP being monitored.

[0051] The data in the time series is grouped into time periods, and each time period may include data collected within more than one periodic collection interval. For example, in some embodiments, although data is collected every N seconds, data in a Z second time period is grouped for further processing (where Z>N).

[0052] An illustrative example of a time series of the number of clients observed by an AP whose health is being evaluated and its peers is provided below in Table 3. Since each column represents a single collection event, multiple columns represent multiple collection events within a time period.

[0053] Table 3

[0054] Network equipment Time period 1 Time period 2 Time period 3 <![CDATA[AP i ]]> 1 1 1 1 1 1 0 1 1 0 0 1 1 1 0 1 1 1 1 1 1 0 1 0 1 1 1 0 1 0 <![CDATA[AP1]]> 0 0 0 1 1 0 1 0 0 1 1 0 1 1 0 0 0 1 0 1 1 1 0 0 0 0 1 0 1 0 <![CDATA[AP2]]> 1 0 1 1 0 0 1 0 0 1 1 0 0 0 1 1 1 1 1 1 1 0 1 0 0 1 0 1 1 0 <![CDATA[AP3]]> 1 0 0 1 0 0 0 1 1 1 0 0 1 1 0 0 0 0 0 1 0 0 1 1 1 1 0 0 1 1 <![CDATA[AP4]]> 0 1 1 1 0 0 0 0 1 1 0 0 0 1 0 0 0 1 1 1 0 0 1 1 0 0 0 0 1 0 <![CDATA[AP5]]> 0 0 1 0 0 1 0 0 1 0 0 0 0 0 1 1 0 1 0 0 1 0 0 1 1 0 1 0 0 1

[0055] Similarly, Table 4 below illustrates the monitored network components (AP i ) and its peers' Rx counts over time.

[0056] Table 4

[0057] Network equipment Time period 1 Time period 2 Time period 3 <![CDATA[AP i ]]> 1 1 1 0 1 0 0 0 0 0 1 0 0 1 1 0 0 1 0 1 1 0 1 0 0 1 0 0 1 1 <![CDATA[AP1]]> 0 1 0 0 0 0 0 1 0 0 1 0 1 1 1 0 1 1 0 0 0 1 1 0 0 1 0 1 0 1 <![CDATA[AP2]]> 1 1 0 0 0 1 0 0 0 1 1 1 1 0 1 1 1 0 0 0 1 0 1 1 1 1 1 0 0 0 <![CDATA[AP3]]> 1 0 1 1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 0 0 1 0 0 0 1 0 1 1 0 1 <![CDATA[AP4]]> 0 1 0 1 0 1 0 0 1 1 0 0 1 1 0 0 1 1 1 1 0 0 0 1 0 0 1 0 1 0 <![CDATA[AP5]]> 0 0 0 0 0 0 0 1 1 0 0 0 0 1 1 1 1 1 0 0 1 0 1 1 0 1 0 0 0 0

[0058] To determine whether a subject AP is active within a given time window (time period), the system analyzes the number of activity indications within each time period. For example, the method may be performed for a subject AP (e.g., AP i) uses a first criterion (e.g., a threshold value >0.2 (e.g., >20%). Some embodiments use a window size of W (e.g., 10) minutes to determine the activity state of the subject AP. If the percentage of data values ​​indicating activity within the time window is greater than the first threshold, the subject AP is determined to be active during the time window. A second threshold value (e.g., >0.4 {>40%}) can be used for the peer APs of the subject AP. Specifically, if the percentage of activity indications within a given time period (e.g., zero in this example) is greater than the second threshold, the peer AP is considered active.

[0059] In the example of Table 3 above, during the first time window, AP i was active during two (2) of the ten (10) samples and was therefore determined to be inactive during that time window (0.2 is less than or equal to the first threshold discussed above). During the second time window (also 10 minutes in this example), the AP i is also active in 2 of 10 samples, and therefore it is assumed to be inactive. In a third example time period of ten minutes, AP i It is active in four (4) samples out of ten (10) samples, and therefore it is determined to be active. The above three determinations can be represented in a vector as {1, 1, 0} or (inactive, inactive, active) by using the value one (1) to represent inactivity and the value zero (0) to represent activity.

[0060] For neighboring APs, a second threshold (e.g., 0.4) is used in some embodiments. By using the second threshold, the state of peer AP1 is mapped to {active, active, active} or equivalently mapped to {0,0,0} for the three time periods illustrated. Similarly, AP2 is mapped to {active, inactive, active} or equivalently mapped to {0,1,0}.

[0061] Then, during the consecutive time periods AP i is the maximum duration of inactivity to be determined. For example, if the AP i If there is inactivity for five consecutive one-minute periods (for a total duration of five minutes), the AP is determined to be i is inactive for a duration of five. Referring again to the example of Table 3, a short activity sequence indicates that AP i Inactive for a duration of two (inactive in the first time period and the second time period). The duration is stored for later use.

[0062] Next, the system uses the mapping of active and inactive states (e.g., within a 10-minute window) to calculate AP iThe moving window average of the activity state (e.g., in this example, the activity state is represented as zero). For example, assuming that AP i The active state of is given by the sequence {1, 1, 0, 0, 1, 1, 0, 0, 0}, then using a moving window of size two (2) results in the moving window average being {1, 0.5, 0, 0.5, 1, 0.5, 0, 0}. This moving window average is stored for further use. An average of the peer AP state values ​​is also determined. This average of the peer AP states is then used to generate a moving average of the averaged peer states.

[0063] The average peer status value is given by Equation 2 below:

[0064]

[0065] in:

[0066] averagepeerstate[k] – the kth element of the average peer state vector

[0067] Number of peers - the number of peer AP activity vectors to be averaged

[0068] Peers p [k]-Peer AP p The kth element of the activity state vector.

[0069] As an example, if used for AP i For example, two peer APs j and AP k The time series of the state of is given by:

[0070] AP j State = {0,0,0,1,1,0,0,0,0,1,1,1}

[0071] AP k State = {0,1,1,1,1,0,1,0,0,1,0,1}

[0072] Among them, AP j and AP k It is AP i Neighbors.

[0073] Using equation 2 above, the average of the peer AP values ​​is:

[0074] AP i Average of peer status values ​​= {0, 0.5, 0.5, 1, 1, 0, 0.5, 0, 0, 1, 0.5, 1}

[0075] Using a moving window of length two (2), the moving average of the above series is given by:

[0076] AP i Moving average of peer status values ​​=

[0077] {0.25,0.5,0.75,1,0.5,0.25,0.25,0,0.5,0.75,0.75}

[0078] A similar calculation is performed on the data in Table 4 to obtain the R x The moving average of the percentage of inactivity determined by the counter.

[0079] Based on the above discussion, AP is derived using a combination of one or more of the following statistics: i Indication of operability:

[0080] a. From AP i The maximum duration of the inactivity indication is derived from the number of associated devices.

[0081] b. From the AP in a given time window i The percentage of activity indication derived from the number of associated devices

[0082] c. From AP in a given time window i The percentage of activity indications derived from the received count of

[0083] d. A moving average of activity indications derived from the receive counter(s) of one or more peer APs.

[0084] e. A moving average of an activity indication derived from the number of devices associated with one or more peer APs.

[0085] Some disclosed embodiments utilize machine learning models to evaluate AP i Is it running / operating or down / not operating. Used to determine the AP i The one or more criteria for operation may vary according to the embodiment. In some embodiments, the following example criteria are used:

[0086] Duration>100R1

[0087] From AP i The percentage of inactivity among the number of clients > 0.8R2

[0088] From AP i The percentage of inactivity in the Rx counts is > 0.8R3

[0089] Peer-to-peer moving average of inactivity indications based on Rx counter(s) < 0.3

[0090] R4

[0091] Peer moving average of inactivity indicators derived from the number of associated clients < 0.2R5

[0092] Usually, R1-R3 above indicates AP i is inactive and therefore may be experiencing an operational failure. R4 and R5 check that AP i Some embodiments only detect if the peer AP is active. i The AP is determined only when it is inactive and its neighbors are active. i There is a fault.

[0093] The five rules (R1 to R5) set forth above define a five-dimensional "cubic" volume. Rather than a simple cube, more complex volumes can be defined in five-dimensional space, and the AP is determined based on whether the combined activity vector is within the more complex volume. i Is experiencing operational failures? The combined activity vector is defined as

[0094] Combined activity vector = [S1, S2, S3, S4, S5] Equation 5

[0095] in:

[0096] S1 is the maximum duration of inactivity within a time period,

[0097] S2 is the percentage of time that the number of clients associated during the time period indicated inactivity,

[0098] S3 is the percentage of time during this period that the receive counter indicates inactivity,

[0099] S4 is a moving average of the peer AP's inactivity indications based on the reception counter, and

[0100] S5 is a moving average of the activity indications of the peer APs based on the number of associated clients.

[0101] Although the above description includes reference to four specific activity measurements in assessing the health of an AP, some embodiments may rely on one or more additional parameters not discussed above.

[0102] FIG. 1a illustrates an exemplary system 100a implemented in accordance with an exemplary embodiment. The exemplary system 100a includes a plurality of access points (AP1 142, ..., AP X 144, AP 1' 150, ..., AP X' 152), a plurality of authentication, authorization, and accounting (AAA) servers (only one AA server 110 is shown), a plurality of dynamic host configuration protocol (DHCP) servers (only one DHCP server 116 is shown), a plurality of domain name system (DNS) servers (only one DNS server 122 is shown), a plurality of web servers (only one web server 128 is shown), and a network management system (NMS) 136, such as an access point management system, which are coupled together via a network 134 such as the Internet and / or an intranet. Network communication links (143, 145, 151, 153, 161, 163, 171, 173) couple the access points (AP1 142, AP X 144, AP 1' 150, AP X' 152) to the network 134, respectively. 140, 146, and 148) are wireless devices that can move throughout the system 100.

[0103] In the exemplary system 100, the access point groups are located at different (multiple) customer locations. Customer location 1 102, such as a shopping mall, includes access points (AP 1 142, ..., AP X 144). Customer location 2 104, such as a stadium, includes access points (AP 1'150, ..., AP X'152). As shown in FIG. 1, UEs (UE 1 138, ..., UE Z 140) are currently located at customer location 1 102; UEs (UE 1'146, ..., UE Z'148) are currently located at customer location 2 104.

[0104] The Network Management System (NMS) 136 continuously collects SLE statistics related to the performance experienced by some or all of the above clients or UEs. Whenever SLE degradation is experienced, the Network Management System 136 and in particular the Automatic Fault Analyzer module triggers injection actions into the system, such as restarting the device or alerting an IT technician.

[0105] Figure 1b illustrates an exemplary system 100b implemented in accordance with an exemplary embodiment. The exemplary system 100b includes a plurality of access points (AP1 161, AP2 162 ..., AP8 168) and wireless links between the APs.

[0106] The link represents the N strongest RSSI signals to the neighboring APs. In the example of Figure 1b, the number N=5. Based on RSSI, the peer neighbors of AP1 are AP2, AP3, AP7, and AP6. The peer neighbors of AP2 are AP1, AP3, AP4, AP7, and AP2. The peer neighbors of AP3 are AP1, AP2, AP8, AP4, and AP5. Similarly, other peer neighbors can be determined for other APs. It should be noted that although the number of peers of the above-mentioned APs is limited by the predetermined parameter N=5. In contrast, since the strength of the RSSI from other APs is lower than the RSSI threshold, for example -75dBm, AP8 has only two neighboring peers, AP3 and AP4.

[0107] Figure 2 An exemplary access point 200 (e.g., access points AP 1142, ..., AP X 144, AP 1'150, ..., AP X'152 of FIG. 1a) is illustrated according to an exemplary embodiment. The access point 200 includes a wired interface 230, a wireless interface 236, 242, a processor 206 such as a CPU, a memory 212, and an assembly of modules 208, such as an assembly of hardware modules, such as an assembly of circuits, which are coupled together via a bus 209, and the various elements can exchange data and information through the bus 209. The wired interface 230 includes a receiver 232 and a transmitter 234. The wired interface couples the access point 200 to the network and / or the Internet 134 of FIG. 1. The first wireless interface 236 can support a Wi-Fi interface, such as an IEEE 802.11 interface, including: a receiver 238 coupled to a receiving antenna 239, and the access point can receive a wireless signal from a communication device such as a wireless terminal via the receiver 238; and a transmitter 240 coupled to a transmitting antenna 241, and the access point can transmit a wireless signal to a communication device such as a wireless terminal via the transmitter 240. The second wireless interface 242 can support The access point 240 includes a receiver 244 coupled to a receiving antenna 245, through which the access point can receive wireless signals from a communication device such as a wireless terminal; and a transmitter 246 coupled to a transmitting antenna 247, through which the access point can transmit wireless signals to a communication device such as a wireless terminal.

[0108] Memory 212 includes routines 214 and data / information 216. Routine 214 includes an assembly of modules 218, such as an assembly of software modules, and an application programming interface (API) 220. Data / information 216 includes a collection of configuration information 222, message event flow capture 224, and remedial actions 226 to be taken if an abnormal message flow is found.

[0109] Figure 3 An exemplary network management and fault detection system 300, such as a wireless system monitoring and fault detection server, is illustrated according to an exemplary embodiment. Figure 3 The network monitoring and fault detection system 300 of FIG. 1 is the network management system (NMS) 136 of FIG. 1. The network management system 300 includes a communication interface 330 (e.g., an Ethernet interface), a processor 306, an output device 308 (e.g., a display, a printer, etc.), an input device 310 (e.g., a keyboard, a keypad, a touch screen, a mouse, etc.), a memory 312, and an assembly of modules 340 (e.g., an assembly of hardware modules, such as an assembly of circuits), which are coupled together via a bus 309, and the various elements can exchange data and information through the bus 309. The communication interface 330 couples the network monitoring and fault detection system 300 to a network and / or the Internet. The communication interface 330 includes: a receiver 332, via which the network monitoring system can receive data and information, such as RSSI from various APs, the number of WTs associated with each AP, counts from the internal counters of the APs, etc.; and a transmitter 334, via which the network monitoring system 300 can send data and information, such as configuration information, and confirm the receipt of information from other devices of the network.

[0110] Memory 312 includes routines 314 and data / information 317. Routines 314 include an assembly 318 of modules, for example, an assembly of software modules.

[0111] The memory 312 includes routines 314 and data / information 317. The routines 314 include an assembly of modules 318, such as an assembly of software modules, and an application programming interface (API) 320. The data / information 317 includes configuration information 322, peer neighbors of each AP 323, a count of WTs associated with each AP 324, a count of an internal counter Rx of each AP, and other activity indicators, such as the number of bytes sent by each AP 319.

[0112] The memory module 312 also includes an activity statistics module 350. The module 350 also includes a plurality of activity time series 351, ..., 353 of activity measurements of the history. For example, the activity measurements may include, but are not limited to: the number of clients associated with each AP, the counts from the Rx counters of each AP, the number of bytes received by each AP from the associated WTs, etc. The configuration model 322 also includes parameters used to map the time series (e.g., 351a, ..., 353a) to activity indication sequences (e.g., 351b, ..., 353b), etc.

[0113] Routine 314 uses the activity time series and time series associated with each AP and its peers to determine whether AP inactivity is indicative of a faulty AP or simply an indicator of low network activity (eg, wireless activity) in the vicinity of the AP whose health is being evaluated.

[0114] Figure 4 An exemplary node server 400 is illustrated, for example, an AA server, a DHCP server, a DNS server, a Web server, etc. In some embodiments, Figure 4 The node server 400 is the server 110, 116, 122, 128 of FIG. 1. The node server 400 includes a communication interface 402 (e.g., an Ethernet interface), a processor 406, an output device 408 (e.g., a display, a printer, etc.), an input device 410 (e.g., a keyboard, a keypad, a touch screen, a mouse, etc.), a memory 412, and an assembly of modules 416 (e.g., an assembly of hardware modules, such as an assembly of circuits), which are coupled together via a bus 409, and various components can exchange data and information through the bus 409. The communication interface 402 couples the network monitoring system 400 to a network and / or the Internet. The communication interface 402 includes: a receiver 420, through which the node server can receive data and information, such as information related to operations, such as registration requests, AA services, DHCP requests, simple notification service (SNS) searches, and web page requests; and a transmitter 422, through which the node server 400 can send data and information, such as configuration information, authentication information, web page data, etc.

[0115] The memory 412 includes routines 428 and data / information 430. The routines 428 include an assembly 432 of modules (eg, an assembly of software modules) and data information 430.

[0116] Figure 5 An exemplary client, such as UE 500 (eg, user equipment UE 1 138, ..., UE Z 140, UE 1 146, ..., UE Z' 148) is illustrated in accordance with an exemplary embodiment.

[0117] UE 500 includes a wired interface 502, a wireless interface 504, a processor 506 (e.g., a CPU), a memory 512, and an assembly of modules 516 (e.g., an assembly of hardware modules, such as an assembly of circuits), which are coupled together via a bus 509, and various components can exchange data and information through the bus 509. The wired interface 502 includes a receiver 520 and a transmitter 522. The wired interface couples UE 500 to the network and / or the Internet 134 of FIG.

[0118] Exemplary wireless interfaces 504 may include a cellular interface 524, a first wireless interface 526 (eg, an IEEE 802.11 WiFi interface), and a second wireless interface 528 (eg, The cellular interface 524 includes: a receiver 532 coupled to a receiver antenna 533, and the access point can receive wireless signals from access points such as AP 1 142, ..., AP X 144, AP 1'150, ..., AP X'152 via the receiver 532; and a transmitter 534 coupled to a transmit antenna 535, and the access point can transmit wireless signals to APs such as AP 1 142, ..., AP X 144, AP 1'150, ..., AP X'152 via the transmitter 534. The first wireless interface 526 can support a Wi-Fi interface, such as an IEEE 802.11 interface, including: a receiver 536 coupled to a receive antenna 537, and the UE can receive wireless signals from a communication device such as an AP via the receiver 536; and a transmitter 538 coupled to a transmit antenna 539, and the UE can transmit wireless signals to a communication device such as an AP via the transmitter 538. The second wireless interface 528 can support It includes: a receiver 540 coupled to a receiving antenna 541, and the UE can receive wireless signals from a communication device such as an AP via the receiver 540; and a transmitter 542 coupled to a transmitting antenna 543, and the UE can transmit wireless signals to a communication device such as an AP via the transmitter 542.

[0119] The memory 512 includes routines 528 and data / information 517. The routines 528 include an assembly of modules 515, such as an assembly of software modules. The data / information 517 may include configuration information and any additional information required for the normal operation of the UE 500.

[0120] Fig. 6A is an illustrative example of a data structure used to determine peer neighbors.

[0121] Data 605 is a data structure storing RSSI observations of APs. Field 606 stores the identifier of the AP from which the signal was received by the other AP. Field 607 stores the number of RSSI measurements stored in data structure 605. Field 608 stores the identifier of the AP that generated the signal received by the receiving AP (e.g., 606). Field 609 stores the RSSI value of the signal received from the AP identified by 608. Fields 608 and 609 are repeated within data structure 605 for each AP from which a signal is received.

[0122] Data structure 615 provides a list of peer neighbors for each AP. Data 616 indicates the AP whose peer is being evaluated. Data 617 provides the number of peers associated with AP1. In some cases, this number is limited by the number of APs whose RSSI is greater than a predetermined threshold (e.g., -75dBm). In other cases, for the sake of reducing the amount of computation, the number is limited to a predetermined threshold, such as 5. In this case, the system determines the peer AP as the AP from which the RSSI is the strongest. Data 618 provides a list of the "Count 2" APs (e.g., indicated by 617) with the strongest RSSI.

[0123] Figure 6B is a diagram illustrating processing of operating parameter values ​​in some disclosed embodiments. Figure 6B A time sequence 654 of operational parameter measurements or values ​​V1-V24 of a network device over a series of corresponding time periods 652 identified as times T1-T24 is shown. The operational parameter may indicate the number of wireless devices associated with or otherwise communicating with the network device, or a count of packets or messages received and / or transmitted by the network device. In some embodiments, multiple types of operational parameter values ​​(e.g., counts of associated devices and counts of received devices, and / or additional operational network parameters) are repeated. Figure 6B The processing of network parameter values ​​is shown in FIG.

[0124] Some disclosed embodiments determine an activity indication of a network device. As discussed in more detail below, the determination of the activity indication is based on criteria. In some embodiments, if a value (e.g., any of V1-V24) is below a threshold, then the activity indication indicates a first state of the network device (e.g., “active”), otherwise the activity indication is set to indicate a second state of the network device (e.g., “inactive”). These activity indications are set in Figure 6B1-124. Each numbered activity indication is derived from a corresponding equally numbered operational parameter measurement (e.g., I24 is derived from V24, etc.). Some disclosed embodiments then quantize the multiple activity indications to generate a single quantized activity indication. The quantized activity indications are shown as a time series 658, including QI1-QI4. Each quantized activity indication represents the activity of the network device during a time period, which is within Figure 6B Note that each quantization period QT1-QT4 includes multiple operating parameter values. Therefore, at least in some embodiments, Figure 6B The diagram illustrates that the sampling frequency of the operating parameter value exceeds the quantization time period. Figure 6B Quantization of activity indications from time series 656 to sequence 658 is shown, but some embodiments do not quantize multiple activity indications into a single indication. In these embodiments, the characterization of the operating parameter value is based on time series 656.

[0125] As discussed above, some embodiments characterize operating parameters of the device based on activity indication 656 or quantized activity indication 658. For example, some embodiments generate a moving average of activity indication 656 or 658. Figure 6B In FIG. 1 , example moving averages are illustrated by MA1-MA3. MA1 is based on QI1 and QI2. MA2 is based on QI2 and QI3. MA3 is based on QI3 and QI4. In some embodiments, Figure 6B The moving average illustrated in is provided to the machine learning model. Some embodiments determine that the activity indication indicates a maximum continuous duration of inactivity. In some embodiments, the maximum continuous duration is determined based on indication 656. In other embodiments, the maximum continuous duration is determined based on indication 658. Some embodiments provide the maximum continuous duration to the machine learning model.

[0126] Figure 7 is a flow chart illustrating an exemplary embodiment of a process 700 by which a behavior model is established and used. Figure 7 One or more functions discussed are performed by a hardware processing circuit (e.g., 406). In some embodiments, instructions (e.g., 428) stored in a memory (e.g., 412) when executed configure the hardware processing circuit (e.g., 406) to perform one or more functions discussed below.

[0127] The process begins at step 705 and proceeds to step 710, where the system identifies the device, such as an AP, whose health is in question. For example, the system attempts to identify whether the AP's transmitter is operational, determine whether activity within the network is properly distributed between neighboring devices / APs, etc. The method continues to step 715, where measurements are collected by the device whose health is being evaluated; the measurements are then sent to a network management system, such as server 136 of FIG. 1, for storage and further evaluation.

[0128] The process proceeds to step 720, where the network management system identifies peer devices of the AP whose health is being evaluated, such as peer APs. Peer devices are devices whose signals are received by the AP under evaluation with an RSSI greater than a predetermined RSSI. Once the peer devices are identified, the system collects measurements of indicators related to the activity of these peer devices in step 725.

[0129] The process proceeds to step 730, where the activity-related measurements collected in step 715 are compared to a predetermined threshold, thereby obtaining statistics indicating an estimated activity level of the AP whose health is being evaluated. Similarly, in step 735, the activity-related measurements collected in step 725 are compared to a predetermined threshold, thereby obtaining statistics indicating an estimated activity level of peers of the AP whose health is being evaluated.

[0130] The process proceeds to step 740 where the system analyzes the time series associated with the activity of the AP whose health is being assessed and the time series of its peers to derive additional estimators of the level activity of these devices.

[0131] The process proceeds to step 745, where a set of rules are used to process activity-related statistics of the AP whose health is being estimated and activity-related statistics of the AP's peers. According to a first embodiment, each of the different activity indicators is compared to an associated threshold value, resulting in an activity indicator for the AP whose health is being evaluated and an activity indicator for its peers (e.g., see Rules 1 to 5). According to a second embodiment, the rules are centrally checked for specific thresholds. According to a third embodiment, an estimated level of the activity level of the device whose health is being measured is compared to the activity level of its peers. If the level of a particular device is very different from the activity level of its peers, the system marks this as a problem with a balancing algorithm (e.g., a roaming algorithm) and changes the roaming criteria between the device whose health is being evaluated and its peers.

[0132] The process proceeds to step 750, where the system determines whether the conditions checked in step 745 are satisfied. If the method determines in step 750 that rules R1 to R5 have been satisfied, or in other words, the AP whose health is being checked is inactive while its peers show activity, the system considers the AP to be faulty in step 760. Otherwise, the process moves to step 765, where the AP is considered to be functional. Similarly, according to the second embodiment, step 750 determines whether the combined vector of the activity statistics of the AP whose health is being evaluated and the activity statistics of its peers are within a predetermined volume. If the system determines that the combined activity vector is within the predefined volume, the AP is declared to be faulty in step 760. Otherwise, the AP is declared to be operational in step 765.

[0133] Returning to step 760, in addition to marking the AP as faulty, the method proceeds to step 770, where the fault detection server and / or network management server (e.g., 136 of FIG. 1) invokes corrective action, such as restarting the faulty AP to attempt to mitigate the problem, notifying a technician, etc.

[0134] Figure 8 is a flow chart of a process for determining whether a network component is operational. Figure 8 One or more operations discussed are performed by a hardware processing circuit (e.g., 506). For example, instructions (e.g., 528) stored in a memory (e.g., 512) configure the hardware processing circuit to perform the following instructions: Figure 8 and one or more operations discussed in process 800. In some embodiments, process 800 is performed by the network management system 136. In operation 805, a first indication of activity is determined for the subject device. In some embodiments, operation 805 includes obtaining an operating parameter value of the subject device. For example, the operating parameter value can be received via a network connection between the operating device and the network management device. As discussed above, the operating parameter can include one or more of the following: a count of packets or messages received by the subject device during a predetermined time period, or the number of wireless devices that communicate with or associate with the subject device (e.g., an association between a site and an access point) during a predetermined time period.

[0135] Characterize the operation parameter value in various embodiments. In some embodiments, the operation parameter value is binarized to indicate whether the subject device is active (or operational) or inactive (or inactive) during a time period. Binarization is based on a threshold value specific to the operation parameter (e.g., the number of reception counts or associated devices). Since the operation parameter value is regularly collected over time, operation 805 generates a time series of binary indications of activity or inactivity. In some aspects, the time series is further quantized to reduce the number of activity indications included in the time series. For example, in some embodiments, process 1100 is applied to the generated time series of operation 805.

[0136] In some embodiments, a moving average of these activity indications is determined.In some embodiments, a maximum continuous period or duration of inactivity indications within the collection period is also determined.

[0137] In operation 810, a second indication of activity is determined for one or more neighboring devices of the subject device. In some embodiments, operation 810 includes obtaining an operational parameter value for each neighboring device. For example, in some embodiments, the operational parameter value is received via a network connection between each neighboring device and a network management device. As discussed above, in some embodiments, the operational parameter value represents one or more of the following: a count of packets or messages received by each of (multiple) neighbor (peer) devices during a predetermined time period, or the number of wireless devices communicating with or associating with the corresponding neighboring device (e.g., an association between a station (e.g., WT or UE) and an access point) during a predetermined time period.

[0138] Similar to the first operating parameter value, characterize the second operating parameter in various embodiments. In some embodiments, the second operating parameter is used to determine whether the corresponding adjacent device is active (or operational) or inactive (or inactive) indication. Determination is based on a criterion specific to the operating parameter (e.g., the number of receiving counts or associated devices). In some embodiments, due to regularly collecting the second operating parameter value over time. In these embodiments, operation 810 generates a time series of activity or inactivity indications of each adjacent device. In some embodiments, each of these generated time series is quantized to reduce the number of each activity determination based on a single operating parameter value or to summarize each activity determination. For example, in some embodiments, operation 810 utilizes process 1100 as described below to quantize each time series of activity indications for adjacent devices, thereby reducing the number of activity indications representing adjacent devices in a time period.

[0139] In some embodiments, when there are multiple time series of activity indications for corresponding multiple peer / neighboring devices, in some embodiments, the multiple time series are averaged or otherwise aggregated into a single time series of neighboring devices that collectively represent the subject device. In some embodiments, a moving average of these aggregated binarized time series is determined. This results in another time series of moving averages.

[0140] Operation 815 determines whether the subject device is operational. The determination is made based on the first indication and the second indication. In some embodiments, the determination is based on one or more characterizations of the first operating parameter discussed above and one or more characterizations of the second operating parameter. In some embodiments, these characterizations are provided to a machine learning model, and the determination is based on the output of the machine learning model, as described above.

[0141] In operation 820, the main device is conditionally controlled based on the determination of operation 815. In some embodiments, if the main device is operational, no control input is provided to the main device. In some embodiments, if the main device is determined to be inoperable, the main device can be restarted, powered off or reset. In some embodiments, the main device is conditionally controlled by installing different versions of firmware, bios or software (for example, different from the previous version installed on the main device when the operating parameters are determined) to the main device. In some embodiments, if the main device is determined to be inoperable, one or more alarms are generated. Alarms can be generated via any means known in the art, including email, text, pager or other messaging technologies. In some embodiments, the alarm generated by operation 820 is used to notify human IT technicians, who can provide manual intervention to return the device to an operable state.

[0142] Fig. 9 is a flow chart of a process 805 for determining whether a network component is operational. Fig. 9 One or more operations discussed are performed by a hardware processing circuit (e.g., 506). For example, instructions (e.g., 528) stored in a memory (e.g., 512) configure the hardware processing circuit to perform the following instructions: Fig. 9 One or more operations are discussed. The following discussion is about the parameters of a single operation Fig. 9 However, the skilled person will appreciate that in some embodiments, process 805 may be repeated for a variety of different types of operating parameters. For example, some embodiments provide at least one counter for received packets or messages and a counter for packets received from a subject device (e.g., an AP as discussed above). i ) is associated with or communicates with the wireless device to perform process 805. Process 805 can be further repeated for additional operating parameters considered by the disclosed embodiments.

[0143] After start operation 905, process 805 moves to operation 910. In operation 910, a first time series of values ​​of operating parameters of the device is determined. For example, as discussed above, the network device may include diagnostic capabilities that provide for the collection of various statistics, including, for example, counts of the number of packets or messages received and / or transmitted, the number of devices communicating with or associated with the network device, memory usage, CPU utilization, or other operating parameters. In some embodiments, the operating parameters are collected from the network device multiple times on a regular basis to create a time series of values ​​of the operating parameters.

[0144] In operation 920, a second time series of activity indications is generated. The second time series is generated based on the first time series and based on a criterion. For example, in some embodiments, the criterion compares each value in the first time series with a threshold value. Based on the comparison, in some embodiments, each value in the first time series is binarized into one of two possible values. One value indicates the activity of the device, while the second binary value indicates the lack of activity of the device. As an example, in some embodiments, a lower number of received packets may indicate that the device is not active. In some embodiments, a very high number of received packets may also indicate an inactive or faulty device. The values ​​of the second time series generated in operation 920 indicate the inactivity or activity of the device during the time period when the corresponding operating parameter values ​​in the first time series were collected.

[0145] Operation 930 determines a maximum duration of consecutive inactivity indications in the values ​​of the second time series. The maximum duration may be expressed in terms of a number of indications or an elapsed time of consecutive inactivity.

[0146] Operation 935 determines the percentage of activity indications in the second time series that are indicative of activity.An alternative embodiment determines the percentage of activity indications in the second time series that are indicative of inactivity.

[0147] Operation 940 determines a moving average of a second time series of activity indications. The moving average depends on the window of indications used to calculate the moving average, which can be, for example, any number of indications between two (2) and one hundred (100) measurements, or any number. The moving average also depends on the number of overlapping measurements between sequential moving average calculations. The number of overlapping measurements (or non-overlapping measurements) may also vary depending on the embodiment. For example, in some embodiments, there may be one non-overlapping measurement between sequential moving average measurements, but other numbers are contemplated.

[0148] In operation 950, a determination is made as to whether the device is operational or inoperable. The determination is based on one or more of a duration, a percentage of activity indications (a percentage of inactivity indications), or a moving average. As discussed above, in some embodiments, one or more of these representations of operating parameters are provided to a machine learning model, and the determination of the operational state of the device is based on the output of the machine learning model. After operation 950, process 805 moves to an end state 960.

[0149] Fig.10 is a flow chart of a process 810 for determining whether a network component is operational. Fig.10 One or more operations discussed are performed by a hardware processing circuit (e.g., 506). For example, instructions (e.g., 528) stored in a memory (e.g., 512) configure the hardware processing circuit to perform the following instructions: Fig.10 The operation or operations being discussed.

[0150] After start operation 1005, process 810 moves to operation 1010. In operation 1010, a first plurality of time series of operational parameter values ​​for a corresponding plurality of peer devices of the subject device are determined. For example, as discussed above, the device (e.g., AP) subject to operability determination may be a first plurality of time series of operational parameter values ​​for a corresponding plurality of peer devices of the subject device. i ) can be within the proximity of other devices (peer or adjacent devices). In various aspects, such proximity is determined based on the visibility of signals emitted by (multiple) adjacent devices and received at the subject device (or vice versa). In operation 1010, operating parameters are collected from those peer devices. The operating parameters may include (multiple) counters of the number of wireless devices associated with each peer device and / or the number of packets received and / or sent by each of the corresponding peer devices. Other operating parameters are also expected, such as the number of packet errors, network jitter measurements, delays, throughput or other statistics. In at least some embodiments, this statistical information about each peer device can be obtained from the diagnostic capabilities built into each peer device. In some cases, the peer device includes hardware that maintains such statistical information. In other embodiments, the information is maintained via a firmware-based or software-based implementation. In some embodiments, the operating parameters of each peer device are collected from the peer device multiple times on a regular basis to create a time series of operating parameter values ​​(e.g., a single time series in the first multiple time series).

[0151] In operation 1020, a second plurality of time series corresponding to each peer device or neighboring device discussed above with respect to operation 1010 is generated. Each time series in the second plurality of time series consists of values ​​indicating the activity of the corresponding neighboring device. Each time series in the second plurality is based on a corresponding time series in the first plurality. (For example, a first time series of operating parameter values ​​of a first peer device is used to generate a corresponding second time series in a second plurality). In some embodiments, an indication of activity is determined by applying one or more criteria to the values ​​of the corresponding first time series of operation 1010. For example, operation 1020 may compare each value in the first plurality of time series with a predetermined threshold value, and based on the result of the comparison, set a corresponding value in a time series in the second plurality of time series. In some embodiments, operation 1020 binarizes the values ​​in the first plurality of time series based on one or more criteria to generate a second plurality of time series.

[0152] In operation 1030, corresponding values ​​in the second plurality of time series are aggregated to generate a third time series. In some embodiments, the aggregation averages the corresponding values. Alternatively, the median of the corresponding values ​​can be used for the aggregation.

[0153] In operation 1040, a moving average of the third time series of activity information is determined. The moving average window size and / or overlap size (within the window) may vary depending on the embodiment. Some embodiments use a window size of two activity indications. In other words, in these embodiments, two activity indications are used to define each moving average. Some embodiments use an overlap size of (window size - 1).

[0154] Operation 1050 determines whether the subject device is operational based on the moving average. As discussed above, in some embodiments, one or more representations of peer AP operating parameters may be used to make the determination. In some embodiments, these representations are provided to a machine learning model, and the output of the machine learning model is used to make an operational determination.

[0155] Fig.11 is a flow chart of a process 1100 for quantifying operating parameter measurements. Fig.11 One or more operations discussed are performed by a hardware processing circuit (e.g., 506). For example, instructions (e.g., 528) stored in a memory (e.g., 512) configure the hardware processing circuit to perform the following instructions: Fig.11 In some embodiments, Fig.11 The process 1100 is used to reduce a first number of operating parameter measurements to a smaller number of activity indications.

[0156] After start operation 1105, process 1100 moves to operation 1110, which obtains a plurality of activity indications of the device over a first time period. For example, as discussed above with respect to operations 920 and 1020, some embodiments determine a plurality of activity determinations based on corresponding plurality of operating parameter values. In at least some embodiments, each of these plurality may represent a time series, as each operating parameter measurement and / or activity determination represents a state of the network device over a discrete time period, and in at least some embodiments the plurality is organized in time. Thus, in some embodiments, operation 1110 obtains a plurality of activity indications from operations 920 or 1020.

[0157] In operation 1120, multiple activity indications include multiple parts. Each part represents an equal amount of elapsed time (e.g., ten minutes). Therefore, the multiple activity indications of operation 1110 collectively represent a time period that is an aggregation of the elapsed time represented by each part. Each part is quantized into a single indicator of activity. The quantization is based on a criterion. In some aspects, the criterion compares the number of activity indications that indicate a specific activity value (e.g., active or inactive) in the part, and sets a single indicator based on the number. In some embodiments, if the number meets the criterion (e.g., is greater than a quantization threshold), the single indicator is set to a first value, otherwise it is set to a second value.

[0158] In operation 1130, a second plurality of quantized activity indicators is generated based on the plurality of portions. The second plurality includes a single activity indicator for each portion included in the first plurality of activity indicators. In some embodiments, the second plurality of quantized activity indicators is composed of Figure 8 The process of 800 Fig. 9 Process 805 and / or Fig.10 The process 810 is used.

[0159] Fig.12 An example machine learning module 1200 is shown according to some examples of the present disclosure. The machine learning module 1200 utilizes a training module 1210 and a prediction module 1220. The training module 1210 inputs historical information 1230 into a feature determination module 1250a. The historical information includes information derived from one or more network devices. In various embodiments, the historical information includes one or more operating parameter values ​​as discussed above. The historical information 1230 can be labeled. The label can indicate whether the subject network device was operational during the period when the operating parameter value or its representation associated with the label was measured or otherwise recorded.

[0160] In some embodiments, the following Fig.12 The machine learning module 1200 described above is as Figure 8In some embodiments, the prediction module 1220 is executed as part of the process 800 and the training module 1210 is executed prior to the execution of the process 800. In some embodiments, one or more functions discussed below with respect to the machine learning module 1200 are performed by the network management system 136.

[0161] The feature determination module 1250a determines one or more features 1260 from the historical information 1230. In general, a feature 1260 is a set of information input and is information determined to predict a specific result. For example, in various embodiments, a feature may include one or more representations of the operating parameter values ​​included in the historical information. This may include, for example, an activity indication, a quantified activity indication, a moving average of an activity indication, and / or a maximum continuous duration of an inactivity indication. The machine learning algorithm 1270 generates a model 1218 based on the features 1260 and the associated labels.

[0162] In the prediction module 1220, the current information 1290 can be input to the feature determination module 1250. For example, the operating parameter values ​​and / or the characterizations thereof of the subject network device and / or the neighbors or peer devices of the subject network device are included in the current information. The feature determination module 1250b can determine from the current information 1290 the same feature group or a different feature group (e.g., characterizations of the operating parameter values) as the feature determination module 1250a determined from the historical information 1230. In some examples, the feature determination modules 1250a and 1250b are the same module. The feature determination module 1250b generates a feature vector 1215, which is input into the model 1218 to generate an indication of the operating state of the subject network device 1295. The training module 1210 can operate in an offline manner to train the model 1218. However, the prediction module 1220 can be designed to operate in an online manner. It should be noted that the model 1218 can be regularly updated via additional training and / or user feedback.

[0163] The machine learning algorithm 1270 may be selected from a number of different potential supervised or unsupervised machine learning algorithms. Examples of supervised learning algorithms include artificial neural networks, Bayesian networks, instance-based learning, support vector machines, decision trees (e.g., iterative bisection 3, C4.5, classification and regression trees (CART), chi-squared automatic interaction detector (CHAID, etc.), random forests, linear classifiers, quadratic classifiers, k-nearest neighbors, linear regression, logistic regression, hidden Markov models, models based on artificial life, simulated annealing, and / or virology. Examples of unsupervised learning algorithms include expectation maximization algorithms, vector quantization, and information bottleneck methods. An unsupervised model may not have a training module 1210. In an example embodiment, a regression model is used, and the model 1280 is a vector of coefficients corresponding to the learning importance of each feature in the vector of features 1260, 1215. To calculate the score, in some embodiments, the dot product of the coefficient vector of the model 306 and the feature vector 1215 is taken.

[0164] Although the above flow chart has been discussed with respect to a particular sequence of events, it should be understood that changes to this sequence may occur without materially affecting the operation of the embodiment(s). In addition, the exemplary techniques shown herein are not limited to the specifically shown embodiments, but may also be utilized with other exemplary embodiments, and each described feature is individually and separately claimed.

[0165] The above system may be implemented on (multiple) wireless telecommunication devices / systems such as IEEE 802.11 transceivers, etc. Examples of wireless protocols that may be used with the technology include IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, IEEE 802.11ac, IEEE 802.11ad, IEEE 802.11af, IEEE 802.11ah, IEEE 802.11ai, IEEE 802.11aj, IEEE 802.11aq, IEEE 802.11ax, Wi-Fi, LTE, 4G, Wireless HD, WiGig, WiGi, 3GPP, Wireless LAN, WiMAX, DensiFi SIG, Unifi SIG, 3GPP LAA (Licensed Assisted Access), etc.

[0166] Additionally, the systems, methods, and protocols may be implemented to improve one or more of: a special purpose computer, a programmed microprocessor or microcontroller and peripheral integrated circuit component(s), an ASIC or other integrated circuit, a digital signal processor, a hardwired electronic or logic circuit such as a discrete component circuit, a programmable logic device such as a PLD, PLA, FPGA, PAL, a modem, a transmitter / receiver, any comparable device, etc. In general, any device capable of implementing a state machine, and thus the methods shown herein, may benefit from the various communication methods, protocols, and techniques according to the disclosure provided herein.

[0167] Examples of the processors described herein may include, but are not limited to, at least one of the following: 800 and 801, with 4G LTE integration and 64-bit computing 610 and 615, with 64-bit architecture A7 processor, M7 motion coprocessor, series, Core TM Series processors, Series processors, Atom TM Series processors, Intel Itanium Series processors, i5-4670K and i7-4770K 22nm Haswell, i5-3570K 22nmIvy bridge, FX TM Series processors, FX-4300, FX-6300 and FX-8350 32nmVishera, Kaveri processors, Jacinto C6000 TM Automotive infotainment processors, OMAP TM Automotive-grade mobile processors, Cortex TM -M processor, Cortex-A and ARM926EJ-S TM processor, AirForce BCM4704 / BCM4703 wireless networking processors, AR7100 wireless network processing units, other industry equivalent processors, and may use any known or future developed standards, instruction sets, libraries and / or architectures to perform computing functions.

[0168] In addition, the disclosed method can be easily implemented with software using an object or object-oriented software development environment, which provides a portable source code that can be used on various computer or workstation platforms. Alternatively, the disclosed system can be implemented in part or in whole with hardware using standard logic circuits or VLSI designs. Whether software or hardware is used to implement the system according to the embodiment depends on the speed and / or efficiency requirements of the system, the specific functions, and the specific software or hardware system or microprocessor or microcomputer system utilized. Using the general basic knowledge of the computer and telecommunications fields and according to the functional description provided herein, a person of ordinary skill in the applicable technical field can use any known or later developed system or structure, device and / or software to easily implement the communication system, method and protocol shown herein with hardware and / or software.

[0169] Furthermore, the disclosed methods may be readily implemented in software and / or firmware that may be stored on a storage medium to improve the performance of a general purpose computer, a special purpose computer, a microprocessor, etc., with programming of a controller and memory cooperating. In these instances, the systems and methods may be implemented as programs embedded on a personal computer such as an applet, JAVA.RTM, or CGI script, as a resource resident on a server or computer workstation, as a routine embedded in a special purpose communication system or system component, etc. The system may also be implemented by physically incorporating the system and / or method into a software and / or hardware system, such as the hardware and software system of a communication transceiver.

[0170] Therefore, it is apparent that at least systems and methods for enhancing and improving communication reliability are provided. Although embodiments have been described in conjunction with a number of embodiments, it is apparent that many alternatives, modifications, and variations will be or will be apparent to those of ordinary skill in the applicable technical field. Therefore, the present disclosure is intended to encompass all such alternatives, modifications, equivalents, and variations within the spirit and scope of the present disclosure.

[0171] Example 1 is a method for determining whether a network component is operational, comprising: determining a first operating parameter value of the network component; determining one or more neighboring devices of the network component; determining a second operating parameter value of the one or more neighboring devices; determining whether the network component is operational based on the first operating parameter value of the network component and the second operating parameter value of the one or more neighboring devices; and conditionally controlling the network component based on whether the network component is determined to be operational.

[0172] In Example 2, the subject matter of Example 1 optionally includes: wherein determining one or more neighboring devices of a network component includes: obtaining a list of devices from which signals have been received by the network component via a wireless medium; and determining the neighboring devices by comparing the strength of the signal received from each device in the device list with a signal strength threshold.

[0173] In Example 3, the subject matter of any one or more of Examples 1-2 optionally includes: wherein a first operating parameter value of the network component indicates a number of messages received or a number of wireless terminals associated with the network component, and the method further includes determining a maximum continuous duration in which the operating parameter value indicates that the network component is inactive, wherein a determination of whether the network component is operational is based on the maximum continuous duration.

[0174] In Example 4, the subject matter of Example 3 optionally includes: providing a maximum continuous duration to a machine learning model, wherein the determination of whether the network component is operational is based on an output of the machine learning model.

[0175] In Example 5, the subject matter of any one or more of Examples 1-4 may optionally include: wherein the second operating parameter value of the neighboring device indicates a count of messages received at the corresponding neighboring device or a number of wireless terminals associated with the corresponding neighboring device.

[0176] In Example 6, the subject matter of Example 5 optionally includes: wherein determining whether a network component is operational includes one or more of: generating an activity indication of a network device based on a first operating parameter value; and determining a moving average of the activity indication, wherein the determination of whether the network component is operational is based on the moving average.

[0177] In Example 7, the subject matter of Example 6 optionally includes providing the moving average to a machine learning model, wherein the determination of whether the network component is operational is based on an output of the machine learning model.

[0178] In Example 8, the subject matter of any one or more of Examples 6-7 optionally includes: wherein the determination of whether the network component is operational includes: generating a first indication of activity of the first neighboring device based on a second operating parameter value of the first neighboring device; generating a second indication of activity of the second neighboring device based on the second operating parameter value of the second neighboring device; aggregating the corresponding first indication and second indication of activity; generating a third activity indication based on the aggregation; and generating a moving average of the third activity indication, wherein the determination of whether the network component is operational is based on the moving average.

[0179] In Example 9, the subject matter of Example 8 optionally includes providing the moving average to a machine learning model, wherein the determination of whether the network component is operational is based on an output of the machine learning model.

[0180] In Example 10, the subject matter of any one or more of Examples 5-9 optionally includes: wherein determining whether a network component is operational includes: generating an activity indication of the network device based on a first operating parameter value; and determining a percentage of the activity indication indicating activity, wherein the determination of whether the network component is operational is based on a binarized value.

[0181] In Example 11, the subject matter of one or more of Examples 1-10 may optionally include: wherein conditionally controlling the network component includes powering off or resetting the network component.

[0182] In Example 12, the subject matter of one or more of Examples 1-11 may optionally include generating an alarm in response to determining that the network component is non-operational.

[0183] Example 13 is a system for determining whether a network component is operational, the system comprising: a hardware processing circuit; one or more hardware memories storing instructions, which when executed configure the hardware processing circuit to perform operations, the operations comprising: determining a first operating parameter value of the network component; determining one or more neighboring devices of the network component; determining a second operating parameter value of one or more neighboring devices; determining whether the network component is operational based on the first operating parameter value of the network component and the second operating parameter value of one or more neighboring devices; and conditionally controlling the network component based on whether the network component is determined to be operational.

[0184] In Example 14, the subject matter of Example 13 optionally includes: wherein determining one or more neighboring devices of a network component includes: obtaining a list of devices from which signals have been received by the network component via a wireless medium; and determining the neighboring devices by comparing the strength of the signal received from each device in the device list with a signal strength threshold.

[0185] In Example 15, the subject matter of any one or more of Examples 13-14 optionally includes: wherein a first operating parameter value of the network component indicates a number of messages received or a number of wireless terminals associated with the network component, the method further comprising determining a maximum continuous duration, during which the operating parameter value indicates that the network component is inactive, wherein a determination of whether the network component is operational is based on the maximum continuous duration.

[0186] In Example 16, the subject matter of Example 15 optionally also includes the following operation: providing the maximum continuous duration to a machine learning model, wherein the determination of whether the network component is operational is based on the output of the machine learning model.

[0187] In Example 17, the subject matter of any one or more of Examples 13-16 may optionally include: wherein the second operating parameter value of the neighboring device indicates a count of messages received at the corresponding neighboring device or a number of wireless terminals associated with the corresponding neighboring device.

[0188] In Example 18, the subject matter of Example 17 optionally includes: wherein determining whether a network component is operational includes one or more of: generating an indication of activity of a network device based on a first operating parameter value; and determining a moving average of the activity indication, wherein the determination of whether the network component is operational is based on the moving average.

[0189] In Example 19, the subject matter of Example 18 optionally also includes the following operation: providing the moving average to a machine learning model, wherein the determination of whether the network component is operational is based on the output of the machine learning model.

[0190] In Example 20, the subject matter of any one or more of Examples 18-19 optionally includes: wherein the determination of whether the network component is operational includes: generating a first indication of activity of the first neighboring device based on a second operating parameter value of the first neighboring device; generating a second indication of activity of the second neighboring device based on the second operating parameter value of the second neighboring device; aggregating the corresponding first indication and second indication of activity; generating a third activity indication based on the aggregation; and generating a moving average of the third activity indication, wherein the determination of whether the network component is operational is based on the moving average.

[0191] In Example 21, the subject matter of Example 20 optionally also includes the following operation: providing the moving average to a machine learning model, wherein the determination of whether the network component is operational is based on the output of the machine learning model.

[0192] In Example 22, the subject matter of any one or more of Examples 17-21 optionally includes: wherein determining whether a network component is operational includes: generating an activity indication of the network device based on a first operating parameter value; determining a percentage of the activity indication indicating activity, wherein the determination of whether the network component is operational is based on a binarized value.

[0193] In Example 23, the subject matter of any one or more of Examples 13-22 may optionally include: wherein conditionally controlling the network component includes powering off or resetting the network component.

[0194] In Example 24, the subject matter of any one or more of Examples 13-23 may optionally further include an operation of generating an alarm in response to determining that the network component is non-operational.

[0195] Example 25 is a non-transitory computer-readable storage medium storing instructions that, when executed, configure a hardware processing circuit to determine whether a network component is operational, the operations comprising: determining a first operating parameter value of the network component; determining one or more neighboring devices of the network component; determining a second operating parameter value of the one or more neighboring devices; determining whether the network component is operational based on the first operating parameter value of the network component and the second operating parameter value of the one or more neighboring devices; and conditionally controlling the network component based on whether the network component is determined to be operational.

[0196] In Example 26, the subject matter of Example 25 optionally includes: wherein determining one or more neighboring devices of the network component includes: obtaining a device list, signals from which the network component has received via a wireless medium; and determining the neighboring devices by comparing the strength of the signal received from each device in the device list with a signal strength threshold.

[0197] In Example 27, the subject matter of any one or more of Examples 25-26 optionally includes: wherein a first operating parameter value of the network component indicates a number of messages received or a number of wireless terminals associated with the network component, the method further comprising determining a maximum continuous duration, during which the operating parameter value indicates that the network component is inactive, wherein a determination of whether the network component is operational is based on the maximum continuous duration.

[0198] In Example 28, the subject matter of Example 27 optionally includes: providing a maximum continuous duration to a machine learning model, wherein a determination of whether a network component is operational is based on an output of the machine learning model.

[0199] In Example 29, the subject matter of any one or more of Examples 25-28 may optionally include: wherein the second operating parameter value of the neighboring device indicates a count of messages received at the corresponding neighboring device or a number of wireless terminals associated with the corresponding neighboring device.

[0200] In Example 30, the subject matter of Example 29 optionally includes: wherein determining whether a network component is operational includes one or more of: generating an indication of activity of a network device based on a first operating parameter value; and determining a moving average of the activity indication, wherein the determination of whether the network component is operational is based on the moving average.

[0201] In Example 31, the subject matter of Example 30 optionally includes providing the moving average to a machine learning model, wherein the determination of whether the network component is operational is based on an output of the machine learning model.

[0202] In Example 32, the subject matter of any one or more of Examples 30-31 optionally includes: wherein the determination of whether the network component is operational includes: generating a first indication of activity of the first neighboring device based on a second operating parameter value of the first neighboring device; generating a second indication of activity of the second neighboring device based on the second operating parameter value of the second neighboring device; aggregating the corresponding first indication and second indication of activity; generating a third activity indication based on the aggregation; and generating a moving average of the third activity indication, wherein the determination of whether the network component is operational is based on the moving average.

[0203] In Example 33, the subject matter of Example 32 optionally includes providing the moving average to a machine learning model, wherein the determination of whether the network component is operational is based on an output of the machine learning model.

[0204] In Example 34, the subject matter of any one or more of Examples 30-33 optionally includes: wherein determining whether a network component is operational includes: generating an activity indication of a network device based on a first operating parameter value; determining a percentage of the activity indication indicating activity, wherein the determination of whether the network component is operational is based on a binarized value.

[0205] In Example 35, the subject matter of any one or more of Examples 25-34 optionally includes: wherein conditionally controlling the network component includes powering off or resetting the network component. In Example 36, the subject matter of any one or more of Examples 25-35 optionally also includes the following operations: in response to determining that the network component is not operational, generating an alarm.

Claims

1. A network management system, comprising: A processing circuit in communication with the storage medium, the processing circuit being configured to: determining a first plurality of time series of one or more operating parameter values ​​for corresponding one or more network devices within a proximity of the network device; generating a second plurality of time series of the one or more operating parameter values ​​based at least in part on the criteria applied to the first plurality of time series; aggregating the second plurality of time series of the one or more operational parameter values ​​to obtain a third time series; A determination is made whether the network device is operational based at least in part on a change in the third time series.

2. A method comprising: determining a first plurality of time series of one or more operating parameter values ​​for corresponding one or more network devices within a proximity of the network device; generating a second plurality of time series of the one or more operating parameter values ​​based at least in part on the criteria applied to the first plurality of time series; aggregating the second plurality of time series of the one or more operational parameter values ​​to obtain a third time series; A determination is made whether the network device is operational based at least in part on a change in the third time series.

3. A non-transitory computer readable medium comprising an executable instruction set, which when executed by a processor of a device causes the device to perform the following steps: determining a first plurality of time series of one or more operating parameter values ​​for corresponding one or more network devices within a proximity of the network device; generating a second plurality of time series of the one or more operating parameter values ​​based at least in part on the criteria applied to the first plurality of time series; aggregating the second plurality of time series of the one or more operational parameter values ​​to obtain a third time series; A determination is made whether the network device is operational based at least in part on a change in the third time series.

Images